v0.1.0 — private-capital-agent-audit

First public release — a standalone governance pattern library for autonomous AI agents at SEC-registered investment advisers, built to the Investment Advisers Act §206 fiduciary regime (duty of care + duty of loyalty, per SEC Release IA-5248).

Five corrected Autonomy Ladder primitives — a level gate requiring independent attestation, an un-self-clearable sovereign veto, a deployer-keyed hash-chain ledger with witness-anchored regeneration/truncation resistance, a DEFCON state machine with a transition-direction guard, and an effective-challenge harness that rejects self-validation — each with a committed adversarial probe.

Seven adviser-native controls — best execution (§206 duty of care), MNPI / market-abuse surveillance (§204A; §10(b)/Rule 10b-5), the custody rule (17 CFR 275.206(4)-2), the marketing rule (17 CFR 275.206(4)-1), cross-client allocation fairness / anti-cherry-picking (§206), books-and-records / off-channel-communications capture (17 CFR 275.204-2), and independent-valuation governance (§206 duty of loyalty).

A sub-vertical obligation map with primary-source-verified citations, and a golden corpus of real public SEC enforcement actions wired as executable test fixtures.

Reference IP for adoption — not a control operating in production, and not legal advice. Zero runtime dependencies; mypy --strict clean; property-tested; 100% mutation kill on the load-bearing predicates. Buyer-facing regulatory content reviewed and signed off by qualified securities counsel.

Dual-licensed MIT OR Apache-2.0.