Dev

.github/PULL_REQUEST_TEMPLATE.md

@@ -27,7 +27,7 @@
 - [ ] Code follows project coding standards (`docs/explain/reference/coding-standards.md`)
 - [ ] FM level classified if semantic change
 - [ ] Published contract schemas regenerated if models changed
-- [ ] Towncrier fragment added under `changelog.d/`, or not needed
+- [ ] PR title is a Conventional Commit (release-please derives the version and `CHANGELOG.md` from it)
 - [ ] Architectural docs updated if applicable
 
 ## Notes for Review

.github/workflows/ci.yml

@@ -20,14 +20,14 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8
       - name: Resolve policy base revision
         id: base
         run: |
@@ -58,20 +58,20 @@ jobs:
           uv tool run --from 'nox[uv]==2026.4.10' nox -f noxfile.py -s verify -- "${verify_args[@]}"
       - name: Upload coverage report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-report
           path: implementations/python/coverage.xml
 
   fuzz:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8
       - name: Run fuzz session
         run: uv tool run --from 'nox[uv]==2026.4.10' nox -f noxfile.py -s fuzz
 
@@ -82,12 +82,12 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8
       - name: Probe for a container runtime
         id: runtime
         run: |
@@ -110,17 +110,17 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8
       - name: Run OSV-scanner (advisory)
         run: uv tool run --from 'nox[uv]==2026.4.10' nox -f noxfile.py -s osv_scan
       - name: Upload OSV-scanner report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: osv-scanner-report
           path: implementations/python/osv-scanner-report.json
@@ -131,14 +131,14 @@ jobs:
     needs: [verify]
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: coverage-report
           path: implementations/python/
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@299e4b793aaa83bf2aba7c9c14bedbb485688ec4 # v7
+        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/docs.yml

@@ -0,0 +1,54 @@
+name: Docs
+
+# Build the Sphinx documentation on every PR (as a breakage check) and publish it
+# to GitHub Pages on pushes to the default branch. Pages must be enabled with the
+# "GitHub Actions" build source (Settings -> Pages) for the deploy job to succeed.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main, dev]
+  workflow_dispatch:
+
+concurrency:
+  group: docs-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+      - name: Install uv
+        uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8
+      - name: Build Sphinx docs
+        run: |
+          uv sync --extra docs --directory implementations/python
+          implementations/python/.venv/bin/sphinx-build -W --keep-going -b html docs docs/_build/html
+      - name: Upload Pages artifact
+        if: github.ref == 'refs/heads/main'
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        with:
+          path: docs/_build/html
+
+  deploy:
+    if: github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/pr-title-lint.yml

@@ -34,10 +34,10 @@ jobs:
       # tools/check_pr_title.py must not be able to weaken its own required
       # check (codex review finding, issue #567). The shared validator is still
       # exercised against the PR's own code by the test suite in ci.yml.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ github.event.pull_request.base.sha }}
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
       - name: Validate PR title

.github/workflows/release-please.yml

@@ -36,7 +36,7 @@ jobs:
       release_created: ${{ steps.rp.outputs.release_created }}
       tag_name: ${{ steps.rp.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: rp
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -52,16 +52,16 @@ jobs:
       contents: write   # upload the built distributions to the Release
       id-token: write   # OIDC trusted publishing to PyPI (no stored token)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8
 
       - name: Build the corpus-bundled wheel + sdist
         run: uv build --out-dir dist implementations/python
@@ -114,7 +114,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
       - name: Open the back-merge PR (main -> dev)

CONTRIBUTING.md

@@ -40,9 +40,9 @@ uv sync --all-extras
    surface changes.
 5. For documentation changes, follow
    [`docs/explain/reference/documentation-style-guide.md`](docs/explain/reference/documentation-style-guide.md).
-6. Add a towncrier fragment under [`changelog.d/`](changelog.d/) unless the
-   change is only internal maintenance. See
-   [`changelog.d/README.md`](changelog.d/README.md).
+6. Use a [Conventional Commit](https://www.conventionalcommits.org/) PR title
+   (for example `feat:` or `fix:`): release-please derives the version bump and
+   the `CHANGELOG.md` entry from it. Do not hand-edit `CHANGELOG.md`.
 7. Run the relevant checks locally.
 8. Open a pull request against `dev` with a concrete description of what
    changed and why.
@@ -68,11 +68,11 @@ artifact, or shared runtime changes.
 
 ## Changelog
 
-Release notes are generated from towncrier fragments under `changelog.d/`.
-Do not hand-edit `CHANGELOG.md`.
-
-Fragment names follow the pattern described in
-[`changelog.d/README.md`](changelog.d/README.md).
+`CHANGELOG.md` is generated by
+[release-please](https://github.com/googleapis/release-please) from the
+Conventional Commit history on `main`; do not hand-edit it or add changelog
+fragments. The Conventional Commit PR title is the entry release-please reads.
+See [`docs/explain/releasing.md`](docs/explain/releasing.md).
 
 ## Security Reports
 

README.md

@@ -129,7 +129,6 @@ uv run aces-mcp
 - `docs/` - explanatory documentation, API docs, and architecture decisions
 - `research/` - supporting literature and reference ecosystem material
 - `tools/` - repository maintenance, policy, and publication tooling
-- `changelog.d/` - towncrier release note fragments
 
 ## Lineage
 
@@ -191,10 +190,12 @@ conformance, and existing scenario examples.
 
 ## Versioning
 
-The Python package currently declares its version in
-[`implementations/python/pyproject.toml`](https://github.com/Brad-Edwards/aces/blob/main/implementations/python/pyproject.toml).
-Release notes are collated from towncrier fragments in
-[`changelog.d/`](https://github.com/Brad-Edwards/aces/tree/main/changelog.d). Do not hand-edit `CHANGELOG.md`.
+The Python package version lives in
+[`implementations/python/pyproject.toml`](https://github.com/Brad-Edwards/aces/blob/main/implementations/python/pyproject.toml)
+and is bumped by [release-please](https://github.com/googleapis/release-please)
+from the Conventional Commit history on `main`, which also generates
+`CHANGELOG.md`. Do not hand-edit the version or `CHANGELOG.md`. See
+[`docs/explain/releasing.md`](https://github.com/Brad-Edwards/aces/blob/main/docs/explain/releasing.md).
 
 Published JSON Schemas use versioned contract identifiers such as
 `sdl-authoring-input-v1`, but the suffix is not the same as a stability promise.
@@ -225,3 +226,5 @@ If you use ACES SDL in academic work, cite the repository:
 ## License
 
 Released under the MIT License. See [LICENSE](https://github.com/Brad-Edwards/aces/blob/main/LICENSE).
+Third-party attribution and license notices are recorded in
+[THIRD_PARTY_NOTICES.md](https://github.com/Brad-Edwards/aces/blob/main/THIRD_PARTY_NOTICES.md).

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,29 @@
+# Third-Party Notices
+
+## Open Cyber Range SDL Parser
+
+Portions of the ACES SDL model structure were translated and adapted from Open
+Cyber Range SDL Parser v0.21.2, revision
+`fe83e8281fc4b954967fbaa5a0d099007ddcb06c`.
+
+The MIT License (MIT)
+
+Copyright (c) 2022 CR14
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

contracts/README.md

@@ -6,7 +6,10 @@ The goal of this bucket is organizational clarity:
 
 - `schemas/` contains published contract schemas
 - `fixtures/` contains valid and invalid payload corpora for those contracts
-- `profiles/` contains capability profile declarations
+- `profiles/` contains capability profiles and separately versioned
+  scientific-completeness taxonomy/assessment declarations
+- `realization-envelopes/` contains configuration-bound backend realization
+  declarations whose identity is carried through manifests, plans, and snapshots
 
 `schema-publication-manifest.json` is the authoritative publication inventory
 for the current machine-readable schema set. The contracts verification gate
@@ -88,3 +91,5 @@ The canonical machine-readable manifest of the authority boundary
 governed by
 [ADR-019](../docs/decisions/adrs/adr-019-normative-authority-boundary-manifest.md)
 and enforced by `tools/check_authority_boundary.py`.
+The `provenance/` family contains revision-pinned SDL lineage, derivation, and
+third-party notice dispositions governed by ADR-019 and ADR-080.

contracts/concept-authority/controlled-vocabularies-v1.json

@@ -722,7 +722,15 @@
       "terms": {
         "conditions": {
           "title": "Conditions",
-          "description": "Condition section support."
+          "description": "Legacy executable probe declaration support."
+        },
+        "propositions": {
+          "title": "Propositions",
+          "description": "Backend-neutral typed observable proposition support."
+        },
+        "assertions": {
+          "title": "Assertions",
+          "description": "Typed proposition-use and truth composition support."
         },
         "objectives": {
           "title": "Objectives",