[quantamixsol]

GraQle 0.87.1: the Decision Assurance Gate now works with the flag on

What was wrong. In 0.87.0, with GRAQLE_DAG_ENABLED on, every governed call was stopped and no record was written, because no runtime provider was ever registered. With the flag off (the default) 0.87.0 behaves like 0.86.0.

What this release does (flag off: unchanged, byte for byte):

• Registers a default runtime provider when the flag is on. If it cannot be built, GraQle stops at start-up with an error that names register_runtime; there is no per-call failure.
• Adds the baseline admission rule DAG-RT-BASELINE-ADMIT: EXECUTE only when risk is LOW, impact is zero and all seven hard gates (HG-01..HG-07) pass. Anything else is REJECT or HOLD (DAG-RT-NO-EVIDENCE). No projection score, reliability or residual risk is computed or recorded for these decisions. MEDIUM and above still need explicit configuration.
• Writes every decision, EXECUTE included, as a signed, hash-chained provenance event in the file store, with its evidence tier. If the event cannot be written, the call is not executed.
• Adds scripts/dag_wheel_e2e.py and its recorded run: it builds the wheel, installs the wheel (not the source tree) into a fresh virtual environment and runs the documented enable steps.
• Version 0.87.1 and a changelog entry.

Honest scope. A baseline EXECUTE is a policy-scoped authorisation at evidence tier BASELINE. It is not informed by the graph and is not a safety verification. Evidence-fed scoring is planned for 0.88. The graq dag command group is still not part of the release.

Verification

• Full test suite in a clean checkout, fresh virtual environment, empty environment variables: 10321 passed, 94 skipped, 5 expected failures, 1 unexpected pass, 0 failed.
• Built-wheel end-to-end run, all steps passed: default provider registered at start-up; LOW risk with zero impact gives EXECUTE; MEDIUM gives HOLD; failing hard gates give REJECT; four signed events whose chain and signatures verify in a new process; flag off runs the legacy path only; an invalid provider stops start-up with the register_runtime error.
• Public IP scan of this diff against master: no findings. Trade-secret wheel gate: pass.

Publishing

After merge: tag v0.87.1 on the merge commit. CI builds, signs and publishes to PyPI.

[github-actions]

🛡️ GraQle PR Guardian

💥 Blast Radius: 20 modules affected

Module	Files Changed	Risk Level	Impact Radius
.agents	1	🟡 T2	1
.claude-plugin	1	🟡 T2	1
CHANGELOG.md	1	🟡 T2	1
README.md	1	🟡 T2	1
graqle	7	🟠 T3	7
plugins	2	🟡 T2	2
pyproject.toml	1	🟡 T2	1
scripts	2	🟡 T2	2
server.json	1	🟡 T2	1
tests	3	🟠 T3	3

Total blast radius: 20

---

🏛️ Governance Verdict

🚫 FAIL

• T3: 2 file(s) require explicit approval.

---

🔍 SHACL Violations

No SHACL violations detected. ✅

---

🔐 Approval Requirements

This PR requires approval from: T3

• A registered Tech Lead or Governance Admin must approve.

❌ Approval requirement NOT yet satisfied.

---

Metric	Value
Blast Radius	20
Files Analyzed	20
Blocked	2
SHACL Violations	0
Verdict	FAIL

---

_{🔬 Powered by GraQle PR Guardian v0.1.0 · Scan completed 2026-10-25T06:01:35.116184+00:00}