release: cut v0.7.0

[LanNguyenSi]

Summary

Cuts v0.7.0. Theme: workflows-as-data and full-session audit forensics.

Five user-facing surfaces land in this release:

• harness explain --last (PR feat(explain): add --last to trace the most recent decision #65): trace the most recent policy decision without naming the policy.
• Additive workflows: + review_templates: manifest blocks (PR feat: additive workflows: + review_templates: manifest blocks #66): declare branch policy, review-subagent gating, CI gate, and merge method as schema-validated data. Surfaces via describe, list, doctor. No runtime enforcement yet.
• harness session-export <sessionId> + audit.redact[] (PR feat: harness session-export — join transcript JSONL with evidence ledger #67): join the on-disk Claude Code transcript JSONL with evidence-ledger rows for the same session, emit chronological json/jsonl, with default-on regex redaction extended by manifest-driven regex: and env_var: rules.
• README split into docs/for-humans.md + docs/for-agents.md (PR docs: split README into for-humans + for-agents with mermaid diagrams #68): operator + agent guides with three mermaid diagrams.
• Workflow stateDiagram decoupled from agent-tasks-MCP vocabulary + README control loop (PR docs: decouple workflow diagram from agent-tasks MCP, add README control loop #69): the workflow lifecycle now reads against the four step kinds the schema actually defines; agent-tasks integration moved to a clearly-marked footnote. README gains a "What harness does" control-loop flowchart usable by both audiences.

Operator note

No schema bump (still version: 1). All new manifest fields are optional and additive; manifests written for 0.6.0 parse under 0.7.0 byte-identically. audit.redact[] defaults to a denylist that catches the four obvious key/secret patterns even when no audit: block is declared, so existing operators get redaction-on-by-default for session-export for free.

Dogfood (release-time smoke)

• npm run typecheck clean
• npm run build clean
• npx vitest run 711 / 711 green (two version-pinned tests in tests/cli/doctor.test.ts:316 and tests/cli/program.test.ts:199 bumped to match the new binary header)
• node dist/cli/main.js --version reports 0.7.0
• harness describe --pillar workflows against docs/examples/full-manifest.yaml: parses + renders both example workflows
• harness validate against docs/examples/full-manifest.yaml: schema clean (the 4 errors / 4 warnings reported are pre-existing missing-hook-script / missing-binary findings unrelated to this release)
• harness doctor --shallow header reads harness 0.7.0
• harness session-export <real-sid> --format json -o /tmp/release-export.json: 1040 events joined from a real local transcript, 2 redaction rules active, ledger ok, no AGENT_TASKS_TOKEN leak

Out of scope

• npm publish (the user runs that themselves)
• Tag creation (happens after merge per the release task)
• Phase 6 / Phase 7 work
• Runtime enforcement of workflows:

Test plan

• Reviewer ran the 9-point release checklist and reports ship-it.
• Diff scope is exactly five files: package.json, CHANGELOG.md, README.md, plus the two version-pinned tests.

Refs agent-tasks 1fe55885.