release 0.7.0: the version the A0 work goes out under

CHANGELOG.md

@@ -2,20 +2,22 @@
 
 ## Unreleased
 
-## 0.6.0 (2026-10-29)
+## 0.7.0 (2026-10-29)
 
-The wire 1.0 release, for the fleet's flag day (19 Oct 2026, 18:03 UTC): from
-then on every live station speaks wire 1.0 (macula 15) and nothing older, and
-0.5.0 can no longer connect. The native library is macula-go v0.29.0, the
-release that carries the A0 contract (v0.27.0 at the flag day); this package's
-code is 0.6.0rc4's. The entries for 0.6.0rc1 to 0.6.0rc4 below are what changed
-since 0.5.0.
+The A0 release: the native library is macula-go v0.29.0, the release that
+carries the A0 contract where 0.6.0 shipped v0.27.0, and a call a keyed provider
+refuses `sealed_required` is now resealed and answered. No wire change: this
+package's code is 0.6.0's plus the entries below.
 
-### Changed since this entry was written
+### Changed
 
 - **A call a keyed provider refuses `sealed_required` is resealed and answered**, instead of the
   caller failing on a stale keyless candidate: the caller seals again to the key in the refusal's
   signed tbs, which is the key the provider holds now (macula-go v0.29.0, macula-py#15).
+- **The wire and blocking paths meet the structural floor** (macula-io/macula-codebase-checks#9):
+  the map conversion in `_wire.py` and the blocking call path in `_blocking.py` have their helpers
+  extracted so no function nests past the cap, with no baseline and no inline disables, and the
+  error a caller sees is unchanged (24c1b39).
 - CI type-checks every Python block in the README and the guides against the package (`docs.yml`,
   macula-codebase-checks#8), on every change including doc-only ones, and a release waits on it.
 
@@ -30,6 +32,14 @@ since 0.5.0.
   `serve_stream` take `policy` as an optional keyword, and omitting it serves any caller
   (macula-py#18 for streams, macula-py#20 for unary).
 
+## 0.6.0 (2026-10-19)
+
+The wire 1.0 release, for the fleet's flag day (19 Oct 2026, 18:03 UTC): from
+then on every live station speaks wire 1.0 (macula 15) and nothing older, and
+0.5.0 can no longer connect. The native library is macula-go v0.27.0, whose
+code is v0.27.0-rc.8's; this package's code is 0.6.0rc4's. The entries for
+0.6.0rc1 to 0.6.0rc4 below are what changed since 0.5.0.
+
 ## 0.6.0rc4 (2026-10-17)
 
 ### Added

README.md

@@ -19,11 +19,18 @@
 
 ---
 
+> **A0, 0.7.0 (2026-10-29):** over macula-go v0.29.0's C ABI. A call a keyed
+> provider refuses `sealed_required` is now resealed to the key that refusal
+> carries and answered, instead of failing on a stale keyless candidate. Sealing
+> stays preferred, not required, by default, and a procedure served with no
+> policy is still open; refusing a clear call unless the caller opts out is not
+> in this release. A plain `pip install macula-py` resolves 0.7.0.
+>
 > **Wire 1.0, 0.6.0 (2026-10-19):** built on macula-go v0.27.0, it speaks wire
 > 1.0 (macula 15) and nothing older, so it reaches only a wire 1.0 station. The
 > fleet moved to wire 1.0 on 19 Oct 2026 at 18:03 UTC, and from then on 0.5.0
 > and everything before it can no longer connect. A plain
-> `pip install macula-py` resolves 0.6.0. It adds sealed group pub/sub, the
+> `pip install macula-py` resolved 0.6.0 until 0.7.0. It adds sealed group pub/sub, the
 > member's side: a Python node joins a realm group, pulling its epoch keys
 > from the org's distributor over a sealed call with the org's grant, and
 > publishes and reads the group's sealed events.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "macula-py"
-version = "0.6.0"
+version = "0.7.0"
 description = "A Python node on the macula mesh: post-quantum identity and key exchange, calls, streams, pub/sub, the DHT and node-served content, over macula-go's C ABI."
 readme = "README.md"
 license = "Apache-2.0"