release: Dev Autopilot v0.5.0 M05

[rsolerortuno]

Summary

Release Dev Autopilot v0.5.0, completing the audited M00–M05 scope:

• continuous no-questions milestone execution;
• point-by-point, diff-bound review evidence;
• fail-closed milestone acceptance and integrity-protected review bundles;
• bounded-memory split/reassembly and Google Drive storage contracts;
• fenced, recoverable Colab workers with heartbeats, checkpoints and retries.

Why

The previous prototype contained useful ledger, bundle, storage and worker
primitives, but those components were not yet connected into one fail-closed
workflow. Drive queue operation, checkpoint recovery, long-running leases and
bundle acceptance also required hardening.

The pre-publication workflow correctly stopped before creating any commit for
Ruff findings and then for 14 strict-mypy findings in five modules. This PR
contains both correction sets and runs static gates before the longer test and
packaging stages.

Type-safety corrections

• Generic, explicitly typed implementation/audit/review parser.
• Strict JSON parsing retained so external string enum values remain valid.
• Exact Literal[False] SQLite context-manager contract.
• Typed installed-package fingerprinting without unsupported metadata access.
• Queue JSON records validated and narrowed to object mappings.
• Explicit narrowing of persisted project charter and milestone structures.
• Project blocker mappings use invariant-safe dict[str, object] types.

Major changes

M00–M01: continuous project execution

• Immutable project charters with mission, definition of done and non-goals.
• Dependency-ordered milestone DAG.
• Safe reversible assumptions and machine-readable blockers.
• Final READY_FOR_HUMAN_RELEASE state.

M02–M03: review and release assurance

• Stable point identifiers and P0–P3 findings.
• Diff-bound findings, verified resolution evidence and stale-review blocking.
• One validated acceptance decision controls milestone and report readiness.
• Baseline, reviews, acceptance and bundle generation integrated into orchestration.
• Checksummed report, folded bundle digest and rejection of undeclared files,
  directories and symlinks.
• Threat model distinguishes integrity checks from origin signatures.

M04: large files and Drive

• Bounded-memory streaming split, hashing and atomic reassembly.
• Direct remote-object splitting.
• Recursive side-effect-free Drive listing.
• Resumable uploads.
• Stable-key retries with exponential backoff and jitter.
• Credential refresh for long-running sessions.
• Simulated Drive contract covering queue submission through completion.

M05: Colab workers

• Safe job IDs and relative paths.
• Leases, heartbeats and fencing tokens.
• Owner-verified checkpoints and terminal publication.
• Explicit checkpoint resume protocol.
• Process-group timeout termination and resource preflight.
• Live-lease protection against eventually consistent duplicate claims.
• Attempt-specific output namespaces.
• Scratch cleanup after durable terminal publication.
• Reusable Colab notebook installing the exact wheel from Drive.

Validation

Executed before creating this PR:

• Ruff safe fixes, lint and format checks.
• Strict mypy over all 38 source modules.
• 155 tests with ResourceWarning promoted to an error.
• Coverage threshold of at least 80%; last measured value: 84.08%.
• Python compilation.
• JSON Schema and notebook validation.
• Wheel and source distribution build.
• Fresh-wheel installation, import and pip check.
• Wheel rebuild from source distribution.
• Clean source archive extraction and complete test rerun.
• Git whitespace validation.

External environment boundary

The implementation and Drive API contract are covered offline. A credentialed
Google Drive and managed Colab smoke run remains an environment acceptance test;
the release does not claim that this external-provider check ran inside CI.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.