Release v0.7.0

[lchoquel]

Release v0.7.0

Bumps version from 0.6.0 to 0.7.0. This release carries breaking changes, so the minor moves per the repo's pre-1.0 rule.

Closes L-260827-4cf826

Changelog

Added

• Automation: New Claude skill (bump-mthds) and companion script (upstream_notes.py) to automate bumping the mthds dependency, regenerating locks, and adapting the codebase to upstream protocol changes.

Changed

• Dependency: Pinned mthds to an exact version (mthds==0.11.1) instead of a floor (>=0.8.2), ensuring the SDK and its strict extra="forbid" protocol models are always tested against the exact upstream version and preventing runtime parse failures from uncoordinated resolutions. pipelex pins the same version, so the two co-install; the two pins must now move in step, because two exact pins on different versions do not resolve at all. (Breaking)
• Typing: PipelexValidationReport.input_form and pipe_io_contracts are now strictly typed via the standard's own client models (mthds.protocol.input_form.InputForm and mthds.protocol.pipe_io_contracts.PipeIOContracts) rather than opaque dictionaries. As a result, reports with older contracts (e.g. boolean optional instead of presence, or missing multiplicity/item_count) no longer parse; the hosted API emits the reshaped contracts and there is intentionally no compatibility shim for older runners. The types are used, never re-exported — mthds.protocol stays the one import path for the vocabulary — and bundle_blueprint / graph_spec stay opaque, since nothing published declares them. (Breaking)
• Parsing: List items in input forms now parse into nameless unions (e.g. DocumentItem instead of DocumentField), so code narrowing a list's item must target the item layer (the named layer silently fails isinstance checks). Input-form parsing is also tightened to reject contradictory required/presence combinations, gating on optional slots, and explicit nulls on wire slots (except default_value). (Breaking)
• Strictness: The imported artifacts are closed shapes, but the report envelope around them stays extension-open — an unrelated field a future server adds to the report still parses and still rides model_extra. The two regimes nest rather than spread, and a test pins both halves.
• Linting: Updated Ruff to include mthds models (ValidationReport, InvalidValidationReport, ValidationDiagnostic) in runtime-evaluated-base-classes, preventing Pydantic resolution errors from annotations mistakenly moved into TYPE_CHECKING blocks.
• Documentation: Updated README.md and docs/architecture.md to reflect the move from opaque dictionaries to typed MTHDS imports, detailing strictness boundaries and narrowing strategies, and docs/ci-cd.md to record that third-party actions are allowlisted at the enterprise level by exact commit SHA.

Fixed

• Serialization: Generating a serialization-mode JSON Schema from PipelexValidationReport now outputs the real input-form field shapes instead of an opaque object (resolved via the bump to mthds 0.11.1).
• CI/CD: Fixed the GitHub Actions publish workflow by pinning sigstore/gh-action-sigstore-python to an enterprise-allowlisted SHA for v3.5.0 (790bc6befb9d733738f18d8f895854b453640ec9), resolving a deterministic UnsignedMetadataError caused by a Sigstore TUF trust-root rotation that broke the previous v3.0.0 tag.

---

Summary by cubic

Releases v0.7.0 with two breaking changes: mthds moves to an exact pin, and PipelexValidationReport's input-form and pipe-I/O fields are typed by the standard's own models instead of opaque dicts. Payloads from runners predating the contract reshape now fail to parse, so the minor rolls per the pre-1.0 rule.

Breaking changes

• mthds is pinned at ==0.11.1 (was >=0.8.2); pipelex pins the same version, so the two pins must move in step or a co-install fails to resolve.
• input_form is now InputForm | None and pipe_io_contracts is now PipeIOContracts, so input slots read presence and multiplicity as enums.
• List items parse into nameless item models (DocumentItem, not DocumentField); narrow a list's item at the item layer, since the named layer silently fails isinstance.
• Input-form parsing rejects contradictory required/presence, gating on optional slots, and explicit nulls on wire slots (except default_value).
• The imported artifacts are closed shapes, but the report envelope stays extension-open; unrelated future report fields still parse and ride model_extra.

Also in this release

• Serialization-mode JSON Schema now emits the real input-form field shapes instead of an opaque object.
• Publish workflow pins sigstore/gh-action-sigstore-python to an allowlisted SHA (v3.5.0), fixing the TUF root-rotation UnsignedMetadataError from the v3.0.0 tag.
• Ruff now treats the three mthds models as runtime-evaluated base classes, preventing pydantic resolution errors from annotations moved into TYPE_CHECKING.
• Adds the bump-mthds Claude skill and upstream_notes.py script to automate future mthds bumps, and updates README.md, docs/architecture.md, and docs/ci-cd.md.

Closes L-260827-4cf826.

^{Written for commit 7940ab9. Summary will update on new commits.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The version, lockfile, validation model changes, tests, documentation, and publishing workflow remain aligned, and no supported runtime or build path was shown to break.

_{Reviews (1): Last reviewed commit: "Release v0.7.0" | Re-trigger Greptile}

[lchoquel]

@codex

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 7940ab9a14

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".