chore: prepare 2.0.0a6 release

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## 2.0.0a6 - 2026-08-10
+
 ### Added
 
 - opt-in process-local per-tool token buckets with explicit sustained rate and
@@ -10,6 +12,8 @@
 
 ### Changed
 
+- recorded independent consumer `0.2.11` adoption evidence for the process-local
+  per-tool rate-limit contract.
 - recorded immutable `v2.0.0a5` release checksums, provenance, and clean installed-wheel
   lifecycle evidence.
 

CITATION.cff

@@ -4,8 +4,8 @@ title: "Samsarix Core"
 type: software
 authors:
   - name: "Samsarix LLC"
-version: "2.0.0a5"
-date-released: "2026-08-02"
+version: "2.0.0a6"
+date-released: "2026-08-10"
 repository-code: "https://github.com/Deathcharge/samsarix-core"
 url: "https://samsarix.com"
 license: "MPL-2.0"

README.md

@@ -41,8 +41,9 @@ accounts, no API keys, no external service, and no hosted operating cost.
 
 Python 3.10 or newer is required.
 
-The immutable [`v2.0.0a5` GitHub prerelease](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a5)
-contains an installable wheel, source distribution, SHA-256 manifest, and verifiable
+The latest published immutable prerelease is
+[`v2.0.0a5`](https://github.com/Deathcharge/samsarix-core/releases/tag/v2.0.0a5),
+with an installable wheel, source distribution, SHA-256 manifest, and verifiable
 GitHub Actions build provenance. A compact verified-wheel path is:
 
 ```bash
@@ -135,7 +136,7 @@ progress and logging, bounded task retention, admission limits, and security bou
 ## Proven external consumer
 
 [Samsarix Integration Examples](https://github.com/Deathcharge/samsarix-integration-examples)
-version 0.2.10 pins Core commit `e20a4e982b24dbc7ff2b5c78714742bfd1ee2f90`
+version 0.2.11 pins Core commit `6492495a426b1ae9856bf27f331d7cfec67006e6`
 and uses only the
 public API to expose a privacy-first, resumable redaction workflow over MCP. Its
 consumer-owned tests exercise initialization, discovery, stdio invocation,
@@ -157,6 +158,10 @@ Its host-owned lifecycle handler also receives correlated `started` and `success
 events for the real policy-gated redaction call while consumer tests prove that source
 secrets, filenames, output names, run IDs, and workspace paths never enter the event
 stream.
+The same adapter can opt into a Core token bucket for that exact registration. Its
+consumer-owned test proves one policy-gated redaction succeeds, an immediate second call
+returns a safe retryable `rate_limited` result, no second artifact is created, and the
+content-free success and rate-limit metrics each increment exactly once.
 The preceding v0.2.6 contract was also discovered and invoked through official MCP
 Inspector 0.21.2; a portable VS Code workspace is configuration-discovered, with
 signed-in trust and tool approval still awaiting operator acceptance.

ROADMAP.md

@@ -39,8 +39,8 @@ remain separate decisions.
 - Strict `TypedDict` input and output contracts now preserve named nested fields,
   descriptions, and required/optional key semantics in JSON Schema and runtime
   validation.
-- External consumer: `samsarix-integration-examples` version 0.2.10 pins Core
-  commit `e20a4e982b24dbc7ff2b5c78714742bfd1ee2f90` and proves a confined,
+- External consumer: `samsarix-integration-examples` version 0.2.11 pins Core
+  commit `6492495a426b1ae9856bf27f331d7cfec67006e6` and proves a confined,
   privacy-first redaction workflow, exact typed result discovery, and
   response-free asynchronous cancellation through the public MCP API. It also
   proves progress-token correlation, monotonic content-free updates, notification
@@ -57,6 +57,9 @@ remain separate decisions.
   policy bypass, private-argument redaction, and capacity cleanup after cancellation.
   A host-owned Core lifecycle handler also proves paired, correlated start/success
   events without secrets, filenames, run IDs, output names, or workspace paths.
+  It now also proves a policy-gated real redaction succeeds under an opt-in per-tool
+  token bucket while an immediate second call is safely rate limited without execution,
+  a second artifact, private-input retention, or incorrect aggregate metrics.
 - Next: complete the signed-in Visual Studio Code trust/tool-approval journey and rerun
   the consumer matrix after GitHub Actions billing is restored. Use observed
   demand and confirmed contract gaps—not framework parity—to prioritize broader
@@ -79,6 +82,8 @@ remain separate decisions.
 - [x] Publish immutable GitHub prerelease `v2.0.0a5` with privacy-safe lifecycle
   observability, independent consumer, clean-install, checksum, and SLSA provenance
   evidence.
+- [ ] Publish immutable GitHub prerelease `v2.0.0a6` with per-tool rate limiting,
+  independent consumer, clean-install, checksum, and SLSA provenance evidence.
 
 ## Samsarix adoption
 

docs/ADOPTION.md

@@ -7,9 +7,9 @@ volume, or service-level commitment.
 
 The latest published `2.0.0a5` prerelease has independently verified artifacts and
 installed-wheel lifecycle behavior. The repository consumer below pins the merged
-lifecycle-observability commit immediately before the release metadata commit, so its
-exact Git installation reports package metadata `2.0.0a4`. Release verification is not
-presented as consumer-adoption evidence.
+per-tool rate-limit commit after that release, so its exact Git installation reports
+package metadata `2.0.0a5`. The `2.0.0a6` candidate incorporates that contract; release
+verification is tracked separately and is not presented as consumer-adoption evidence.
 
 ## Privacy-first redaction MCP consumer
 
@@ -18,15 +18,15 @@ Repository:
 
 | Evidence | Value |
 | --- | --- |
-| Core contract commit | `e20a4e982b24dbc7ff2b5c78714742bfd1ee2f90` |
-| Core package metadata at pinned commit | `2.0.0a4` |
-| Consumer merge commit | `0455b7a16e0309ba295c0ddd8ad3776d709ea782` |
-| Consumer pull request | [samsarix-integration-examples#13](https://github.com/Deathcharge/samsarix-integration-examples/pull/13) |
-| Consumer package version | `0.2.10` |
+| Core contract commit | `6492495a426b1ae9856bf27f331d7cfec67006e6` |
+| Core package metadata at pinned commit | `2.0.0a5` |
+| Consumer merge commit | `a446c4a80295928e6161627a8c03cc2bca4a8f27` |
+| Consumer pull request | [samsarix-integration-examples#14](https://github.com/Deathcharge/samsarix-integration-examples/pull/14) |
+| Consumer package version | `0.2.11` |
 | Integration Guard provenance | [`samsarix-integration-guard`](https://github.com/Deathcharge/samsarix-integration-guard) `0.2.0` at `1aa711d89eaedcc396f0cd6eb416fb4253da3f5e` |
 | Orchestration provenance | [`samsarix-agent-orchestration`](https://github.com/Deathcharge/samsarix-agent-orchestration) `0.1.0` at `0dfc050cf9a4582c9fa8d34d74b1ca97d43c9005` |
 | Declared consumer Python | 3.11-3.13 |
-| Executed consumer Python in this record | 3.14.6 source tree and fresh installed wheel |
+| Executed consumer Python in this record | 3.11.9 fresh exact-pin editable environment and clean installed wheel |
 | Compatibility owner | Samsarix LLC |
 | Support level | Best effort; no SLA |
 
@@ -61,6 +61,16 @@ secrets, the source and output filenames, the private run identifier, and the re
 workspace path are absent. This is provider-neutral process-local observation, not a
 durable audit log, trace exporter, or claim that arbitrary downstream handlers are safe.
 
+The same public factory accepts an optional `ToolRateLimit` and applies it only to the
+exact redaction registration. A consumer-owned test admits one real policy-gated
+redaction, then immediately calls it again through the same runtime. The first call
+succeeds and publishes its artifact; the second returns status `rate_limited`, safe code
+`tool_rate_limited`, and a numeric retry delay without executing or publishing another
+artifact. The final content-free metrics report one success and one rate-limited call,
+and serialized results contain neither seeded private values nor the workspace path.
+This proves one process-local tool quota boundary, not distributed coordination,
+per-tenant accounting, authorization, or a service-level quota.
+
 The consumer adapter now installs a fail-closed host policy through Core's public
 `ToolPolicyContext` and `ToolPolicyDecision` API. It admits only the exact redaction
 name, version, tags, task mode, safety annotations, and default-filled argument set.
@@ -77,7 +87,7 @@ returns status `busy` and safe, retryable code `runtime_busy`; the policy evalua
 count remains one, no second tool execution occurs, no private argument is reflected,
 and no artifact is created. Cancelling the admitted call returns
 `pending_invocations` to zero. This proves process-local load shedding through Core's
-public API; it is not request-rate limiting, per-client fairness, or authorization.
+public API; that admission fixture alone is not per-client fairness or authorization.
 
 The same consumer redaction tool advertises task support as optional, preserving the
 ordinary call and older-client contract. A task-aware MCP `2025-11-25` client receives
@@ -110,54 +120,54 @@ was signed out of Copilot, so no trust prompt or VS Code tool call was accepted.
 desktop configuration-discovery evidence, not a completed desktop-agent journey.
 
 The consumer's merged
-[`pyproject.toml`](https://github.com/Deathcharge/samsarix-integration-examples/blob/0455b7a16e0309ba295c0ddd8ad3776d709ea782/pyproject.toml)
+[`pyproject.toml`](https://github.com/Deathcharge/samsarix-integration-examples/blob/a446c4a80295928e6161627a8c03cc2bca4a8f27/pyproject.toml)
 is the dependency manifest. It declares
-`samsarix-core @ git+https://github.com/Deathcharge/samsarix-core.git@e20a4e982b24dbc7ff2b5c78714742bfd1ee2f90`;
-the installed public package reports Core version `2.0.0a4`. The same manifest
+`samsarix-core @ git+https://github.com/Deathcharge/samsarix-core.git@6492495a426b1ae9856bf27f331d7cfec67006e6`;
+the installed public package reports Core version `2.0.0a5`. The same manifest
 records the Guard and Orchestration commits above, and the compatibility test
 asserts all three installed package versions.
 
 ## Verified contract
 
-The installed-wheel consumer contract checks completed locally on Windows with Python
-3.14.6:
+The exact-pin consumer contract checks completed locally on Windows in a fresh editable
+environment with Python 3.11.9:
 
 ```text
 python -m ruff check .       -> passed
 python -m mypy               -> passed, strict mode
-python -m pytest             -> 36 passed, 91.03% branch coverage from installed wheel
+python -m pytest             -> 37 passed, 91.64% branch coverage
 python -m bandit -q -r src   -> passed
 ```
 
-The isolated release build and metadata checks separately passed on Python 3.14.6:
+The isolated release build and strict metadata checks separately passed on Python 3.11.9:
 
 ```text
 python -m build                    -> isolated wheel and sdist passed
 python -m twine check <artifacts> -> wheel and sdist passed
 ```
 
 A fresh virtual environment installed the consumer wheel with dependencies resolved
-from their exact public Git commits. Import metadata resolved to `0.2.10`, and pip cloned
-Core and resolved commit `e20a4e982b24dbc7ff2b5c78714742bfd1ee2f90`.
-Outside the source checkout, the installed consumer suite proved both the permitted real
-redaction path and safe denial of the out-of-contract tool. Both installed CLIs also
-passed their help journeys. The source-tree development run on Python 3.14.6 separately
-completed the same 36 tests at 91.64% branch coverage. Python 3.12 and 3.13 remain
-declared consumer support, but their hosted jobs did not execute in this record because
-the account billing gate stopped the matrix before checkout.
+from their exact public Git commits. Import metadata resolved to consumer `0.2.11` and
+Core `2.0.0a5`; the consumer import resolved from the environment's `site-packages`.
+Outside the source checkout, both installed CLIs passed their help journeys and the
+focused installed-wheel contract proved one real redaction succeeds while an immediate
+second call is safely rate limited with no second artifact. `pip check` reported no
+broken requirements. Python 3.12 and 3.13 remain declared consumer support, but their
+hosted jobs did not execute in this record because the account billing gate stopped the
+matrix before checkout.
 
 Final local artifacts were:
 
 | Artifact | Bytes | SHA-256 |
 | --- | ---: | --- |
-| `samsarix_integration_examples-0.2.10-py3-none-any.whl` | 18,838 | `8cf067bd326d7a565b3879580af0ffa66570e6137ea8b6f389bdf2d119e7af1e` |
-| `samsarix_integration_examples-0.2.10.tar.gz` | 39,381 | `169d8ab69d568ada568d7224c2f0f459ee2ee0b7e583738b6195d3e3aa97b398` |
+| `samsarix_integration_examples-0.2.11-py3-none-any.whl` | 19,194 | `2a3f1b5be02b67eff2878e26e90471feddd931cf580f8f9e362e35ab3bfe1da8` |
+| `samsarix_integration_examples-0.2.11.tar.gz` | 40,795 | `ed86462aa5c5bb2569554453709f2ceebe43581fcd9e0cf8a1eec0c78f138a46` |
 
 CodeRabbit attached a green high-level status, but its free-plan notice says the pass
 provides only a summary and walkthrough; it is not counted as independent line-level
 review evidence. The consumer's
-[pull-request run](https://github.com/Deathcharge/samsarix-integration-examples/actions/runs/30746005628)
-and [post-merge run](https://github.com/Deathcharge/samsarix-integration-examples/actions/runs/30746052161)
+[pull-request run](https://github.com/Deathcharge/samsarix-integration-examples/actions/runs/31447006222)
+and [post-merge run](https://github.com/Deathcharge/samsarix-integration-examples/actions/runs/31448580817)
 did not start their jobs: GitHub attached an account
 billing/spending-limit failure before checkout, leaving zero executed steps and
 no job logs. That infrastructure failure is not represented as hosted test

docs/API_REFERENCE.md

@@ -1,6 +1,6 @@
 # API reference
 
-This page describes the complete supported API on `main` after `2.0.0a5`. Imports not exposed
+This page describes the complete supported API in the `2.0.0a6` alpha. Imports not exposed
 from `samsarix_core.__all__` are internal.
 
 ## `samsarix_tool`

docs/PRODUCTIZATION.md

@@ -281,12 +281,12 @@ All baseline commands were run on Windows with Python 3.11.9 at commit
   asynchronous cancellation, bounded content-free progress, and client-filtered
   operational logging, retained sync-worker capacity after timeout, and bounded
   shutdown quiescence, official MCP Inspector invocation, and Visual Studio Code
-  configuration discovery from `samsarix-integration-examples`; version 0.2.10 at merge
-  commit `0455b7a16e0309ba295c0ddd8ad3776d709ea782` pins Core commit
-  `e20a4e982b24dbc7ff2b5c78714742bfd1ee2f90` and additionally proves the bounded
+  configuration discovery from `samsarix-integration-examples`; version 0.2.11 at merge
+  commit `a446c4a80295928e6161627a8c03cc2bca4a8f27` pins Core commit
+  `6492495a426b1ae9856bf27f331d7cfec67006e6` and additionally proves the bounded
   experimental task lifecycle, allow/deny invocation policy, fail-fast runtime
-  admission, and paired content-free lifecycle observation on the real redaction
-  adapter.
+  admission, paired content-free lifecycle observation, and process-local per-tool
+  rate limiting on the real redaction adapter.
 
 ## Deferred work and rationale
 
@@ -298,11 +298,11 @@ release. One independent repository now proves the stable MCP boundary, experime
 task lifecycle, bounded policy gate, fail-fast runtime admission, and privacy-safe
 lifecycle observation. Core now also supplies the process-local per-tool rate control
 required by its supported MCP tool boundary. Subsequent surface
-area should follow concrete consumer demand. Core's admission release post-merge
-[Python 3.10-3.14 hosted matrix](https://github.com/Deathcharge/samsarix-core/actions/runs/30741198541)
+area should follow concrete consumer demand. Core's per-tool rate-limit pull request
+[Python 3.10-3.14 hosted matrix](https://github.com/Deathcharge/samsarix-core/actions/runs/31241493059)
 is green. The consumer's separate Python 3.11-3.13 jobs could not start because GitHub
-reported an account billing/spending-limit problem, so its local 36-test installed-wheel
-evidence is recorded separately in `docs/ADOPTION.md`.
+reported an account billing/spending-limit problem, so its local 37-test exact-pin and
+clean-wheel behavioral evidence is recorded separately in `docs/ADOPTION.md`.
 
 ## Owner-, credential-, or production-blocked tasks
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "samsarix-core"
-version = "2.0.0a5"
+version = "2.0.0a6"
 description = "A small, dependency-free runtime for typed local Python tools"
 readme = "README.md"
 requires-python = ">=3.10"

src/samsarix_core/_version.py

@@ -3,4 +3,4 @@
 
 """Single source of truth for the distribution version."""
 
-__version__ = "2.0.0a5"
+__version__ = "2.0.0a6"