v0.6.0 — Pre-Execution Governance Engine, SLO Certification CLI & Hardening

What's New in v0.6.0

Added

• In-Tree Pre-Execution Governance Engine & Approval Obligation Bridge (uns.governance, #49):
  • Completed src/uns/governance/context_schema.py (ContextSchema, parse_field_path(), validate_policy_against_schema(), validate_context_capsule(), resolve_field_path(), and canonical JSON SHA-256 compute_context_hash()).
  • Completed src/uns/governance/decision_engine.py with pure, deterministic decide() (DENY > REQUIRE_APPROVAL > ALLOW precedence, full rule evaluation without short-circuiting, and default-DENY fallback) and impure DecisionEngine supporting hot-reload last-known-good quarantine, bounded audit ledger (max_audit_entries), and per-intent fail-mode semantics (SAFETY / GOVERNANCE / OPERATIONAL fail-closed DENY; INFORMATIONAL fail-open ALLOW with operational alert emission).
  • Added src/uns/governance/approval_workflow.py (GovernanceApprovalBridge, ApprovalRequestRecord, ApprovalStatus, sign_approval_callback(), verify_approval_callback()) wiring REQUIRE_APPROVAL decisions to durable uns.Runtime notification obligations (idempotency_key="gov-approval:{decision_id}"), stateless cross-restart recovery (_recover_from_runtime()), and HMAC-SHA256 signed resume callbacks (X-UNS-Signature, X-UNS-Timestamp with ±300s replay guard).
• SLO Telemetry & Certification CLI Harness (uns-slo-certify / src/uns/slo.py, #48):
  • Added compute_slo_report(), format_slo_markdown(), and the uns-slo-certify console script entry point to compute SHA-256 hash-verifiable operational SLO receipts (receipt_sha256 / receipt_hash), human response latency percentiles (p50, p95, max), persistent external provider error rates, recording_only vs. live external provider classification (observed_live_span_days), and 6-gate v1.0 certification checks.

Fixed

• MPDD v2.5 Post-Milestone 4 Hardening:
  • Enforced upfront Content-Length check and streaming MAX_WEBHOOK_BODY_BYTES (262,144) cap in src/uns/api/routes_webhooks.py:_read_bounded_body().
  • Added SQLAlchemyPolicyStore.retire_candidate_revisions() and wired ShadowPolicyEvaluator.reject_delta() to retire PREVIEW/DRAFT revisions on rejection so rejected proposals cannot resurrect on subsequent intakes.
  • Replaced deprecated HTTP_422_UNPROCESSABLE_ENTITY status constant with HTTP_422_UNPROCESSABLE_CONTENT in src/notification/routes.py.