release 0.6.0: the A0 re-seal, and what this release does not change

CHANGELOG.md

@@ -2,17 +2,33 @@
 
 ## Unreleased
 
-- CI type-checks every Python block in the README and the guides against the
-  package (`docs.yml`, macula-codebase-checks#8), on every change including
-  doc-only ones, and a release waits on it.
-
-## 0.6.0 (2026-10-19)
+## 0.6.0 (2026-10-29)
 
 The wire 1.0 release, for the fleet's flag day (19 Oct 2026, 18:03 UTC): from
 then on every live station speaks wire 1.0 (macula 15) and nothing older, and
-0.5.0 can no longer connect. The native library is macula-go v0.27.0, whose
-code is v0.27.0-rc.8's; this package's code is 0.6.0rc4's. The entries for
-0.6.0rc1 to 0.6.0rc4 below are what changed since 0.5.0.
+0.5.0 can no longer connect. The native library is macula-go v0.29.0, the
+release that carries the A0 contract (v0.27.0 at the flag day); this package's
+code is 0.6.0rc4's. The entries for 0.6.0rc1 to 0.6.0rc4 below are what changed
+since 0.5.0.
+
+### Changed since this entry was written
+
+- **A call a keyed provider refuses `sealed_required` is resealed and answered**, instead of the
+  caller failing on a stale keyless candidate: the caller seals again to the key in the refusal's
+  signed tbs, which is the key the provider holds now (macula-go v0.29.0, macula-py#15).
+- CI type-checks every Python block in the README and the guides against the package (`docs.yml`,
+  macula-codebase-checks#8), on every change including doc-only ones, and a release waits on it.
+
+### What this release does not change
+
+- Sealing stays preferred, not required, by default, and a pool names a KEM key only when it opts in
+  with `kem_advertise=True`, which is off by default (`src/macula_py/pool.py:483`), so two pools on
+  default arguments talk in the clear. A served procedure is `confidential="preferred"`, which seals
+  to the pool's key when it advertises one, and a caller still reaches a provider that names no key
+  in the clear. Refusing a clear call unless the caller opts out is not in this release.
+- A procedure served with no policy is still advertised open, unary and streaming alike: `serve` and
+  `serve_stream` take `policy` as an optional keyword, and omitting it serves any caller
+  (macula-py#18 for streams, macula-py#20 for unary).
 
 ## 0.6.0rc4 (2026-10-17)
 

README.md

@@ -158,6 +158,12 @@ result, report = await caller.call_report(realm, procedure, payload, confidentia
 assert report.sealed and report.provider == provider.node_id()  # seal_key_id: the key, 16 hex
 ```
 
+When a keyed provider refuses a call `sealed_required`, because the advertisement
+the caller read named no key, the caller reseals to the key in the refusal's
+signed tbs and the call is answered, the key that provider holds now. Before
+macula-py 0.6.0 the call failed on that stale keyless candidate (macula-go
+v0.29.0).
+
 - `kem_advertise` is off by default. Enable it only once every station runs
   macula 12.11 or later and every caller can seal (macula 13, macula-go 0.18,
   macula-py 0.4 or later).