v0.1.4

What's Changed

• ci: PyPI Trusted Publishing (parity with finserv) by @linus10x in #1
• release: v0.1.4 (first PyPI distribution) by @linus10x in #2

New Contributors

• @linus10x made their first contribution in #1

Full Changelog: v0.1.3...v0.1.4

v0.1.3

Frontier-autonomy framing: README 'Why this exists for frontier autonomy stacks' + 'for reviewers & safety teams' note; links the non-financial agent-coordination demo. Concept DOI 10.5281/zenodo.20564496.

v0.1.2

Documentation release. README upgraded to the conversion standard (buyer hook, CI/coverage/license badges, real-enforcement proof section); reconciled init version. No source/API changes. Archived to Zenodo (concept DOI 10.5281/zenodo.20564496).

v0.1.1 — private-capital-agent-audit (Zenodo-archived)

Zenodo-archived release (mints the DOI). No API changes from v0.1.0.

Changed

• Independent primary-source fact-check of the public surface: every statutory/CFR citation confirmed, and every named-party SEC enforcement matter in the golden corpus verified against its primary source. The September 2023 nine-adviser marketing-rule sweep is now anchored to its confirmed release (PR 2023-173); the Hi2 custody finding tightened to the order's exact language.
• Added .zenodo.json (native Zenodo deposit metadata) and a CFF-list license so Zenodo archives the release with correct metadata.

Reference IP for adoption — not a control operating in production, and not legal advice. Built to the Investment Advisers Act §206 fiduciary regime. Five corrected primitives + seven adviser-native controls; primary-source-verified obligation map; golden corpus of real public SEC enforcement actions. Zero runtime dependencies; dual-licensed MIT OR Apache-2.0.

v0.1.0 — private-capital-agent-audit

First public release — a standalone governance pattern library for autonomous AI agents at SEC-registered investment advisers, built to the Investment Advisers Act §206 fiduciary regime (duty of care + duty of loyalty, per SEC Release IA-5248).

Five corrected Autonomy Ladder primitives — a level gate requiring independent attestation, an un-self-clearable sovereign veto, a deployer-keyed hash-chain ledger with witness-anchored regeneration/truncation resistance, a DEFCON state machine with a transition-direction guard, and an effective-challenge harness that rejects self-validation — each with a committed adversarial probe.

Seven adviser-native controls — best execution (§206 duty of care), MNPI / market-abuse surveillance (§204A; §10(b)/Rule 10b-5), the custody rule (17 CFR 275.206(4)-2), the marketing rule (17 CFR 275.206(4)-1), cross-client allocation fairness / anti-cherry-picking (§206), books-and-records / off-channel-communications capture (17 CFR 275.204-2), and independent-valuation governance (§206 duty of loyalty).

A sub-vertical obligation map with primary-source-verified citations, and a golden corpus of real public SEC enforcement actions wired as executable test fixtures.

Reference IP for adoption — not a control operating in production, and not legal advice. Zero runtime dependencies; mypy --strict clean; property-tested; 100% mutation kill on the load-bearing predicates. Buyer-facing regulatory content reviewed and signed off by qualified securities counsel.

Dual-licensed MIT OR Apache-2.0.