feat: v0.8.0

[kiloloop-release]

Promotes v0.8.0. 49 files, +2899 / −70.

v0.8 separates what a task is expected to take from what it is allowed to take. Estimates carry a typed forecast contract, and scoring matches actuals against expected values rather than admission caps.

Breaking changes

Change	Migration
Cap-based scoring rejected; work or wall-time actuals scored against expected values	scoring rules
Legacy calibration DBs need an explicit expected-work attestation	calibrate --basis expected-work
settings.review_overhead rejected with exit code 2	R1 — use --review-mode or execution_profile.review
JSON estimated_cost alias removed	R2 — read heuristic_cost

Both removals were warned about in 0.7.5.

Also in this release

Validated, versioned YAML requests through estimate --spec; caller-supplied token forecasts with explicit local-policy provenance; required-capability enforcement on a named spec executor; expected wall time reported independently of admission caps; agent profile adjustments that scale assigned work without changing assignments.

Release machinery

publish.yml now attaches the built wheel and sdist to the Release that triggers it — the last three releases shipped with no assets. The release: [published] trigger, the workflow-level empty permissions map, the public-repository guard, and the SHA pins on all three existing actions are unchanged; the job's contents: read becomes contents: write.

The upload step runs after the PyPI publish rather than before it: PyPI is immutable and an asset upload is re-runnable, so the irreversible step goes first and a failed upload costs a manual re-upload instead of a version bump.

Export verification

• Export is git archive of the source default branch, honoring .gitattributes export-ignore — the trace schemas, their renderer, and the packaging/regression guards stay out, and their now-empty directories were pruned rather than committed.
• Deletion set computed against the archive's own file list: empty (130 exported files, 118 previously tracked — 12 additions, 0 removals).
• CHANGELOG built by restore-and-insert on the existing public file, never overwritten: the empty [Unreleased] header is preserved, prior sections verified byte-identical, and the new section's 14 relative links were absolutized to match existing public convention.
• Leak scan on the staged tree: no App or installation ids, no secrets, no private repo slugs. The three hits that fired — a synthetic /Users/testuser redaction fixture, a historical org-transfer line in an old changelog section, and Wave N comments in the wave-planner tests — are all pre-existing on main and none is added by this promote.

One item for your call

The ### Fixed entry about restricting publishing to the public repository describes a CI-configuration change with no user-visible delta, which is the class our changelog discipline drops at a version stamp. I carried it across rather than deleting an entry an earlier merged change authored, but it is arguably noise for a public reader — say the word and I will drop it before this merges. The workflow change in this release deliberately carries no changelog line for the same reason.

After merge

Tag v0.8.0, then create the GitHub Release exactly once — that is what triggers the PyPI publish. Then the v0 major tag moves to the release commit and the Marketplace listing is verified.

[kiloloop-release]

⚠️ Do not merge yet — test-min-deps fails on this branch. Fix in progress; I will update this PR and comment again when it is green.

Not a flake. The dependency-floor job added in this release asserts import agent_estimate.tracing.schema, but src/agent_estimate/tracing/** is export-ignored and does not exist in the public repository, so the step fails here by construction while passing upstream:

ModuleNotFoundError: No module named 'agent_estimate.tracing'

The assertion needs to target a module that actually ships. agent_estimate.contract.schema is the right one — it is public and uses the Pydantic surface the 2.5 floor exists for (AwareDatetime, StringConstraints, AfterValidator). The trace-schema import stays covered upstream by its own test, which the same step already runs.

Fixing at source rather than patching this branch, then rebuilding the export.

[kiloloop-release]

✅ Green and ready to merge — supersedes the do-not-merge notice above.

test-min-deps now passes. All 10 checks pass at 6cb6a6e.

The floors assertion targets agent_estimate.contract.schema, which this repository ships, instead of the export-ignored trace-schema module. export-boundary gained a guard that resolves every agent_estimate module an exported workflow imports against the export itself, so this class fails upstream rather than here — verified against both trees, failing on the pre-fix export and passing on this one.

The branch carries 2 commits rather than 1: the release-machinery fix was layered on top of the promote commit instead of amending it, so nothing already pushed was rewritten. The squash merge collapses them.

Tree verified against a fresh export of the upstream default branch — identical except CHANGELOG.md, which is intentionally restore-and-inserted so prior public scrubs are preserved.

After merge: tag v0.8.0, then the Release is created exactly once — that is what triggers the PyPI publish, which now also attaches the wheel and sdist here.