release: Python SDK v6.7.0 (#158)

* chore(release): Python SDK v6.7.0

Minor release. Wire-shape canonicalization sweep — purely additive, new
fields default to None, deprecated aliases preserved.

Bumps:
- pyproject.toml + axonflow/_version.py: 6.6.2 -> 6.7.0
- CHANGELOG [Unreleased] -> [6.7.0] - 2026-04-25

Wire-shape baseline regenerated against community SHA 10d44eb4 (post
platform v7.4.2 spec corrections). DynamicPolicyInfo entry auto-resolves
(spec was wrong, SDK was correct). Regen also surfaces 11 newly-discovered
drift entries from the v6.7 sweep that weren't captured in the earlier
baseline — these become tracked debt for future burndown per the
CONTRIBUTING.md baseline-burndown policy. Net 26 -> 37.

Coordinated v6 alignment release: ships same day as TypeScript v6.0.0,
Java v6.0.0, Go v5.7.0.

* ci: retrigger wire-shape gate with spec-pin-bump label

* fix(wire-shape): regenerate baseline against the correct local axonflow

The earlier regen picked up a stale editable axonflow 6.3.0 install at
/opt/homebrew/lib/python3.11/site-packages/__editable__.axonflow-6.3.0.pth
that points at a sibling clone, not this worktree. When invoked as
"python scripts/refresh.py", sys.path[0] is scripts/ which has no
axonflow — so the import falls through to the stale editable install,
discovers an old MCPCheckInputRequest with 4 fields, and writes ghost
drift into the baseline. CI didn't repro because CI does pip install
-e . in the PR checkout itself.

After pip install -e . in this worktree, axonflow resolves to the v6.7
code in this branch, the regen produces the correct 25-entry baseline,
and only DynamicPolicyInfo auto-resolves vs prior baseline — matching
the auto-resolution shape of TS/Go/Java.

Net 26 -> 25.

Lesson: developer-run regen scripts that import the SDK should use a
fresh editable install or fail loudly when sys.modules['axonflow'] is
not the worktree they were invoked against. Filing as follow-up.

Author: saurabhjain1592

CHANGELOG.md

@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.7.0] - 2026-04-25 — Wire-shape canonicalization
+
+Minor release. Purely additive — new fields default to `None`, deprecated aliases preserved for compile-time compat. Coordinated with TypeScript v6.0.0 / Java v6.0.0 / Go v5.7.0 SDK releases. The wire-shape contract gate's pinned OpenAPI spec SHA bumps with the platform v7.4.2 spec corrections; one baseline drift entry (`DynamicPolicyInfo`) auto-resolves.
+
 ### Added
 
 - **`WebhookSubscription.secret`** — HMAC-SHA256 signing key now exposed on the response from `create_webhook`. Required to verify the `X-AxonFlow-Signature` header on inbound webhook deliveries; without it, callers couldn't validate payload authenticity. Also adds `org_id` and `tenant_id` (ownership scoping).

axonflow/_version.py

@@ -1,3 +1,3 @@
 """Single source of truth for the AxonFlow SDK version."""
 
-__version__ = "6.6.2"
+__version__ = "6.7.0"

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "axonflow"
-version = "6.6.2"
+version = "6.7.0"
 description = "AxonFlow Python SDK - Enterprise AI Governance in 3 Lines of Code"
 readme = "README.md"
 license = {text = "MIT"}

tests/fixtures/wire_shape_baseline.json

@@ -177,7 +177,7 @@
       ]
     }
   },
-  "openapi_specs_sha": "bf1ca22ae4bee37dbccc91aee7e03c805f73f853",
+  "openapi_specs_sha": "10d44eb4585a7b5321d7286b354ff8b43b8c6a57",
   "per_model_drift": {
     "AuditLogEntry": {
       "sdk_only": [
@@ -248,23 +248,6 @@
       ],
       "spec_only": []
     },
-    "DynamicPolicyInfo": {
-      "sdk_only": [
-        "orchestrator_reachable",
-        "policies_evaluated",
-        "processing_time_ms"
-      ],
-      "spec_only": [
-        "block_reason",
-        "blocked",
-        "enabled",
-        "error",
-        "evaluated",
-        "evaluation_time_ms",
-        "policies_checked",
-        "policies_matched"
-      ]
-    },
     "DynamicPolicyMatch": {
       "sdk_only": [
         "reason"