release(0.5.0): the assessment axis ships, and every version surface moves with it

0.5.0 is the axis separation `de09711` built: `Risk` (assessment) alongside
`Disposition` (action), `Policy.action_map` as the supported override, and the
fail-closed path pinned to both axes. Additive and measured to be so — 717
passing with no test changed, matrix 128/128 with 6/6 documented gaps, the
`PRESET_USER_UPLOAD` grading table unchanged row by row. Plus the field FP
measurement (`d1bff60`) and the 0.3.3 behaviour-change correction (`d3d0928`).

WHY THIS COMMIT TOUCHES EIGHT FILES AND 0.4.0's TOUCHED THREE

0.4.0's release commit updated CHANGELOG, pyproject.toml and __init__.py, and
deferred README deliberately: the install block should not name a tag before a
clean-venv install had proven it resolved. Sound reasoning, and the proof step
never ran — so tag v0.4.0 permanently advertises v0.3.4. The tag is not moved.
The ordering is.

Sweeping every tracked file for a version claim, instead of ticking the four
surfaces the checklist named, found five more that no release had ever touched:

  SECURITY.md          "pre-1.0 (0.2.x)" — the one with a consequence for an
                       outsider: it named a support window two minor lines
                       behind the code.
  README.md            "**Status:** v0.3" — the front page, stale since 0.4.0.
  docs/BRIEF.md        "v0.2 (alpha)" — stale since 0.3.0.
  CLAUDE.md            "v0.2 (alpha)" and "12 moduler" where src/ has 15.
  docs/ADOPTION-BRIEF  "703 passing" where the suite is at 717.

Measurement provenance is deliberately left alone: "New in v0.4.0", "verified
identical on 0.2.0 and 0.3.1", "measured against the v0.3.1 tag", every
"post-0.4.0 tree" in LIMITATIONS. Bumping those falsifies the record instead of
updating it, which is why this cannot be a sed sweep — the surfaces have to be
sorted into current-state and provenance before a single edit.

Found because llm-ingestion-okf took our report of this defect class as a
hypothesis about their own repo, measured it, found a worse instance on their
public front page, and sent back the generalization: writing down a trap is not
the same as applying it.

VERIFIED BEFORE COMMITTING, NOT AFTER

  717 passed; coverage 128/128 recall, 6/6 documented gaps hold
  docs/LIMITATIONS.md: 33 items, README says 33
  fp-sweep reproduced all three published numbers exactly on the bumped tree —
    vendor-harvest 98/185 (53.0%), generated-notes 88/547 (16.1%),
    reference-corpus 133/389 (34.2%) — and self-docs runs clean, so the
    untested script survived the bump it imports names from
  forge description: 178 codepoints, under the 180 cap
  no tracked file carries a stale current-state version claim

Still to prove before the tag: a clean-venv install from this commit's sha, and
`git show <sha>` over the README. The install proves the package builds; only
the grep proves the text the tag will carry is right. That second check is the
one the old ordering could not perform, because by then the tag existed.

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Nothing yet.
+
+
+## [0.5.0] — 2026-08-11
+
 ### Added — the axis separation: assessment (`Risk`) vs action (`Disposition`)
 
 > **Additive, and measured to be so.** Every disposition 0.4.0 rendered is
@@ -117,6 +122,37 @@ none, and it took a field sweep to find it.
   the comment was not. Corrected, with the retraction written into the comment so
   it cannot read as a second, disagreeing measurement.
 
+- **Five current-state version claims had never been updated by any release.**
+  The 0.4.0 release commit touched three files — `CHANGELOG.md`,
+  `pyproject.toml`, `src/llm_ingestion_guard/__init__.py` — and deferred the
+  README deliberately, so that the install block would not point at a tag before
+  a clean-venv install had proven it resolved. That proof step never ran, so tag
+  `v0.4.0` permanently carries a README advertising `v0.3.4`. The tag is not
+  moved; the ordering is.
+
+  Sweeping *every* tracked file for a version claim, rather than the four
+  surfaces the release checklist named, found four more that no release had ever
+  touched — plus a stale test count:
+
+  - `SECURITY.md` — "The project is pre-1.0 (`0.2.x`, alpha). Only the latest
+    published version receives fixes." The only one with a consequence for an
+    outsider: it named a support window two minor lines behind the code.
+  - `README.md` — `**Status:** v0.3`, stale since 0.4.0.
+  - `docs/BRIEF.md` and `CLAUDE.md` — "v0.2 (alpha)", stale since 0.3.0. The
+    latter also claimed 12 modules where `src/` has 15.
+  - `docs/ADOPTION-BRIEF.md` — "**703 passing**", where the suite is at 717.
+
+  Every one of them is a *current-state* claim. Measurement provenance — "New in
+  `v0.4.0`", "verified identical on 0.2.0 and 0.3.1", "measured against the
+  v0.3.1 tag" — is left exactly as written, because bumping those would falsify
+  the record rather than update it. From here all current-state surfaces move in
+  the release commit itself and are verified by `git show <sha>` *before* the tag
+  exists, since that is the only check the previous ordering could not perform.
+
+  Found because `llm-ingestion-okf` took our report of this defect class as a
+  hypothesis about their own repo, measured it, found a worse instance, and sent
+  back the generalization: writing down a trap is not the same as applying it.
+
 
 ## [0.4.0] — 2026-08-10
 

CLAUDE.md

@@ -11,7 +11,7 @@ framework-agnostisk kode.
 Referanse-implementasjon: `claude-code-llm-wiki` Stage B (`tools/wiki_ingest/`).
 Lexikon-seed: `injection-patterns.mjs` fra `llm-security`-pluginen.
 
-Repoet er på **v0.2 (alpha)**: stdlib-kjernen er bygget og testet (12 moduler +
+Repoet er på **v0.5 (alpha)**: stdlib-kjernen er bygget og testet (15 moduler +
 topp-nivå wiring, showcase + korpus), inkl. OKF-adapter og aktivt-innhold-
 detektor (EchoLeak-klassen) i output-gaten. Mode-b `import_bundle` skanner
 reserverte strukturfiler (`index.md`/`log.md`) i mottatte bundles i stedet for å

README.md

@@ -2,7 +2,7 @@
 
 Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure.
 
-![Version](https://img.shields.io/badge/version-0.4.0-blue)
+![Version](https://img.shields.io/badge/version-0.5.0-blue)
 ![Status](https://img.shields.io/badge/status-alpha-orange)
 ![Python](https://img.shields.io/badge/python-3.10%2B-purple)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
@@ -33,7 +33,7 @@ at write time, never assumed from the format. Any pipeline ingesting external da
 into an agent-read store has this shape; an OKF wiki is its canonical form — which
 is why the guard ships a first-class OKF adapter (below).
 
-**Status:** `v0.3`, alpha. The stdlib-only core — its detector, contract, and
+**Status:** `v0.5`, alpha. The stdlib-only core — its detector, contract, and
 OKF-adapter modules plus the top-level wiring — is built and tested, exercised by
 an end-to-end showcase and adversarial + false-positive corpora. The public API
 may still change. There are real limitations, stated plainly below; read them.
@@ -43,7 +43,7 @@ may still change. There are real limitations, stated plainly below; read them.
 Not on PyPI. The guard is distributed from its Forgejo origin — pin a release tag:
 
 ```bash
-pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v0.4.0"
+pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v0.5.0"
 ```
 
 The `open/` mirror is anonymously readable, so CI needs no deploy key, token, or

SECURITY.md

@@ -6,7 +6,7 @@ downstream corpus. Reports are welcome.
 
 ## Supported versions
 
-The project is pre-1.0 (`0.2.x`, alpha). Only the latest published version receives
+The project is pre-1.0 (`0.5.x`, alpha). Only the latest published version receives
 fixes; there are no back-ported security branches yet. Pin a version and watch the
 `CHANGELOG.md` `### Security` entries.
 

docs/ADOPTION-BRIEF.md

@@ -4,7 +4,7 @@
 especially one converging on Google's Open Knowledge Format (OKF v0.1) — and needs
 to decide **when** and **where** to add a write-time ingestion guard.
 
-**Status of the guard:** `v0.4.0` (alpha). Stdlib-only core, framework-agnostic.
+**Status of the guard:** `v0.5.0` (alpha). Stdlib-only core, framework-agnostic.
 Public API may still change. Read the known-limitations section before you rely
 on it.
 
@@ -140,9 +140,9 @@ live payload:
 python -m llm_ingestion_guard.coverage    # exit 0 = all as documented
 ```
 
-As of `v0.4.0`: **128 / 128 defended classes demonstrated (recall 100%)** and **6 /
+As of `v0.5.0`: **128 / 128 defended classes demonstrated (recall 100%)** and **6 /
 6 documented gaps still hold** (a *closed* gap fails the test, forcing a doc
-update). The matrix is the single source of truth for the test suite (**703
+update). The matrix is the single source of truth for the test suite (**717
 passing**), which also asserts total recall, that every lexicon pattern has a
 case (so the matrix cannot fall behind the lexicon), the full LLM02 secret-egress
 set, and the container-layer front-end (CSV formula-injection, zip-slip/bomb,

docs/BRIEF.md

@@ -3,7 +3,7 @@
 **A reusable, minimal, dependency-light defensive layer for LLM *ingestion*
 pipelines — the write-time siblings of query-time chatbot guardrails.**
 
-Status: implemented — v0.2 (alpha). This document defines what the repo contains
+Status: implemented — v0.5 (alpha). This document defines what the repo contains
 and why; the stdlib-only core is built and tested (see `README.md` for usage and
 `docs/PLAN.md` for the build order).
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "llm-ingestion-guard"
-version = "0.4.0"
+version = "0.5.0"
 description = "Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure."
 readme = "README.md"
 requires-python = ">=3.10"

src/llm_ingestion_guard/__init__.py

@@ -63,7 +63,7 @@ from .grounding import (
 )
 from . import okf
 
-__version__ = "0.4.0"
+__version__ = "0.5.0"
 
 
 # --- §6 bookends: the two library-side halves around the transform ---------