chore(release-hygiene): CI matrix, CHANGELOG, README security model

- GitHub Actions: ruff + mypy + bandit(-lll) + full pytest on Python
  3.10-3.14 (Ubuntu) plus a macOS 3.14 job — the audit's biggest gap was
  that every gate ran by hand on one machine
- CHANGELOG.md: 0.7.0 retrospective entry + Unreleased section for the
  post-release fixes; earlier versions summarized
- README: Security Model section stating plainly what the guardrails do
  (blocklist, ownership, .trust5 protection, process hygiene, SSRF
  defense, encrypted tokens) and what they do NOT do (no adversarial
  sandbox — use a container/VM for untrusted specs)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ourway

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+
+jobs:
+  test:
+    name: py${{ matrix.python-version }} / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        include:
+          - os: macos-latest
+            python-version: "3.14"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Ruff
+        run: ruff check .
+
+      - name: Mypy
+        run: mypy .
+
+      - name: Bandit (high severity)
+        run: bandit -r trust5 -q -lll -x trust5/assets
+
+      - name: Tests
+        run: pytest -q

CHANGELOG.md

@@ -0,0 +1,81 @@
+# Changelog
+
+All notable changes to Trust5 are documented here. Versions before 0.7.0
+predate this changelog.
+
+## [Unreleased]
+
+### Fixed
+- **Test discovery no longer hands package markers to pytest** — passing
+  `tests/__init__.py` as a CLI argument made pytest collect the whole package
+  on top of explicitly listed files, double-counting every test (a 106-test
+  suite reported as 121). `conftest.py` is likewise excluded from runnable
+  test lists; the write-protection layer still covers both.
+- **Venv safety net fires once Python files actually exist** — it previously
+  ran only in the Setup stage, which sees an empty directory when the planner
+  emits no setup commands; suites then ran on whatever `pytest` the ambient
+  environment provided. Validate now re-runs the idempotent net at its
+  runtime language-detection point, and the net installs the project's
+  `requirements.txt` into the venv.
+- **Planner non-compliance is loud** — a plan missing the mandatory
+  `SETUP_COMMANDS` / `QUALITY_CONFIG` / EARS-criteria blocks now emits
+  explicit warnings, and the quality gate announces when SPEC compliance is
+  skipped for lack of criteria instead of passing vacuously.
+- **`trust5 loop` test runs are hardened** — the LSP loop executed the test
+  command via raw `subprocess.run(shell=True, timeout=120)`; it now uses the
+  same process-group/tree-kill primitive and configured timeout as the rest
+  of the pipeline (closes the audit's one high-severity bandit finding).
+
+### Changed
+- The documented `mypy .` gate passes as written: production code stays
+  strict; test modules are parsed and import-resolved but not type-scored.
+- `cryptography` cap widened (`<44` → `<46`).
+- CI (GitHub Actions): ruff, mypy, bandit, and the full test suite on
+  Python 3.10–3.14 (Ubuntu) plus a macOS job.
+- README gained a Security Model section describing what the guardrails do
+  and do not guarantee.
+
+## [0.7.0] - 2026-07-23
+
+### Added
+- **Interface contracts** — the planner emits per-module public signatures in
+  the MODULES block; every test-writer and implementer prompt is held to
+  them, keeping parallel modules compatible.
+- **One-shot test arbitration** — after two identical failing-test cycles
+  with no pass progress, the repairer may fix the module's own tests under
+  audit rules (justify against acceptance criteria; no deletion, no
+  tautologies, no renaming).
+- **Watchdog live per-module jump accounting** — worst-module rules,
+  module-scoped rebuild signals, and re-driven watchdogs on auto-retry.
+
+### Fixed
+- **The "Raft wall"** — the defect stack that made hard multi-module tasks
+  bail deterministically: double jump counting (30 budget was really 15),
+  progress measured in tests *executed* instead of *passed*, a dead 120s
+  test timeout overriding configuration, head-only output truncation hiding
+  pytest failures, the final repair's work never being tested, bailed
+  modules being unhealable, and futile auto-retries after designed
+  exhaustion (now non-retryable walls + integration-validate healing).
+- Planner-declared module `deps` drive parallel stage sequencing.
+- Repeated-failure detection keys on failing-test identity, not raw output.
+- Flat-layout Python packages are importable by the test runner
+  (project root on `PYTHONPATH`).
+- Entry/demo scripts must belong to a module — unowned planned files were
+  never created and failed their acceptance criteria unconditionally.
+- Serial `trust5 loop` retry storm stopped; loop actually runs.
+
+### Changed
+- Requires `stabilize >= 0.19.1, < 0.20` — atomic jumps, restart-proof
+  message dedup, zombie-stage re-claim, queue lock heartbeat (prevents
+  double execution of long agent tasks), and duplicate-`StartTask`-proof
+  recovery sweeps.
+- `trust5.__version__` reports the real version (was stuck at 0.1.0).
+
+## [0.6.4] and earlier
+
+Context engine (token-accounted compaction), capability tools
+(whitespace-tolerant Edit, MultiEdit, TodoWrite, read-only SubAgent,
+parallel read tools, Anthropic prompt caching), streaming stall fallback,
+disk-persisted tool results, file-freshness guard, TUI status bar and live
+todo panel, process-explosion watchdog, WebFetch SSRF defense, encrypted
+token store. Not individually changelogged.

README.md

@@ -28,6 +28,7 @@ and event sourcing.
 14. [File Layout](#file-layout)
 15. [Timeouts and Limits](#timeouts-and-limits)
 16. [Troubleshooting](#troubleshooting)
+17. [Security Model](#security-model)
 
 ---
 
@@ -544,6 +545,40 @@ Ollama requires no login. Ensure the Ollama server is running at
 
 ---
 
+## Security Model
+
+Trust5 executes LLM-generated shell commands and code **on your machine**.
+Its guardrails are accident containment for a fallible-but-trusted model —
+they are **not an adversarial sandbox**.
+
+What the guardrails do:
+
+- **Destructive-command blocklist** — `rm -rf` outside the project directory,
+  `mkfs`/`dd`, `curl | bash`, `chmod 777`, fork bombs, and similar patterns
+  are refused before execution.
+- **File ownership** — implementer/repairer agents may only write their own
+  module's files; test files are read-only for them (a one-shot, audited
+  arbitration can grant a repairer access to its module's tests).
+- **Internal state protection** — writes into `.trust5/` (pipeline database,
+  event log) are blocked at both the file-tool layer and the shell layer.
+- **Process hygiene** — every subprocess runs in its own process group and the
+  whole tree is killed on timeout; test runs additionally have a 1-second
+  watchdog that kills the group on process-count or memory explosion.
+- **WebFetch SSRF defense** — private/loopback addresses are refused with DNS
+  resolution pinning, redirects are not auto-followed, responses are size-capped.
+- **Credentials** — OAuth tokens are stored encrypted (Fernet) under
+  `~/.trust5/` with `0600` permissions; the event socket is `0600`. Note the
+  encryption key lives beside the ciphertext, so this protects against other
+  users on the machine, not against something running as *your* user.
+
+What they do **not** do: create a jail. A prompt-injected or otherwise
+misbehaving model can still run arbitrary code as your user — pattern
+blocklists are bypassable by construction. For specs, dependencies, or
+codebases you do not trust, run Trust5 inside a container or VM, and treat
+generated code as untrusted until you have reviewed it.
+
+---
+
 ## License
 
 See LICENSE file for details.