Release 0.9.1

[jothimani-rajendran]

What

The release-prep PR for 0.9.1, one commit. Everything the release ships is already on main in #148; this moves the version and cuts the notes.

• pyproject.toml, CITATION.cff, action.yml's version default and the docs/installation.md example → 0.9.1. tests/test_release_surfaces.py holds the last two to pyproject.toml, so a bump that forgot either fails the suite.
• CHANGELOG.md: ## Unreleased becomes ## 0.9.1 — … with no empty Unreleased heading above it, because release.yml extracts the first ## section as the release notes.
• docs/assets/social-preview.{svg,png} regenerated: they print the version.

Why a patch and not 0.10.0. No emitted byte changes: the runtime goldens are untouched and every adopter's chock sync --check stays clean. The two installer fixes (a policy-less repo keeps the runtime its arm hook runs; the runtime is written LF on Windows) make the install match what it already claimed. The baseline check, the gate-log ignore rule and the pin-github-actions dogfood are additive.

After the tag. The tag runs the full CI matrix, Windows and macOS included. v0.9.0's run was red on all three Windows validate jobs (run 35519645109); the fixes in #148 were made from that job log without a Windows machine, so the v0.9.1 tag run is their confirmation. Check it. Then chock-quickstart#8 can merge.

Round-2 review fixes

Twelve findings from the pre-0.9.1 deep review, each in its own commit:

1. chock add refuses a catalog pack carrying a symlink before hashing it (critical).
2. chock add refuses a manifest whose id differs from its folder name.
3. chock add --ref honours a commit id and a local checkout; a path-like artifact id is a clean error, not a traceback.
4. chock check --only verify attests every pack sync compiles, nested packs included, and fails cleanly on a lockfile that is not valid JSON (high).
5. The baseline check compares policy reach, not surface count, and errors instead of passing on an unresolvable base ref or invalid YAML (high).
6. Config shapes (policies: null, a bare string in disabled, a null or string override, surfaces: 5) are normalised instead of crashing or misreading, and POL-1 holds in sync too.
7. validate names the exact config-shape mistake instead of crashing.
8. egress_allowlist reads a URL the way a fetch library will, closing several host-spelling bypasses (medium).
9. validate rejects a gate regex that fails to compile, instead of tracebacking at the first commit it guards (medium).
10. sync wires in-agent hooks only for supported_agents, not every vendor chock knows (medium).
11. chock review require judges a pull request by the stricter of the base's review policy and the head's, so the change being judged cannot choose what it is judged on (critical).
12. spec/policy-spec.md, spec/enforcement-matrix.md and CHANGELOG.md record all of the above.

Verification

ruff check .                                 All checks passed!
ruff format --check .                        286 files already formatted
pytest -q                                    1375 passed, 6 skipped
pytest acceptance/                           21 passed
chock check                                  [PASS], 0 errors, 0 warnings
chock sync --repo . --check                  Compiled artifacts match their manifests.
chock check --only verify                    verify: all packs match lockfile
chock registry scan                          no diff
docs/assets/gen_brand_assets.py --check      social-preview.svg is current

Not in this PR

The tag. release.yml publishes to PyPI on a v* tag whose version matches pyproject.toml — your click after merge.

Definition of done

• chock check → 0 errors, 0 warnings; the two [INFO] SEC-4 lines on injection-defense/evals/suite.yaml predate this PR
• chock check --only matrix passes; no behaviour change
• chock sync --repo . --check clean
• chock check --only verify clean
• Registry rescanned; no policy added or changed
• pytest -q green
• pytest acceptance/ green
• Existing artifacts migrated — none needed
• Touched manifests: version bump + changelog — this is the version bump + changelog
• ruff check . and ruff format --check . clean

Claims

• No surface is described as enforcing more than it installs. No surface, emitter or installer logic changes in this PR.

🤖 Generated with Claude Code