v2.7.0

v2.7.0

Released 2026-05-24.

This release focuses on making Bernstein's automation easier to verify: stricter release gates, a complete Sonar cleanup, deterministic skill authoring tools, and an opt-in maintainer-share telemetry path that stays off by default.

Highlights

• Skills are closer to end-to-end. SKILL.md manifests now carry a versioned schema, and the CLI has deterministic skills init, skills test, skills diff, and skills bench commands. Strict linting can block installs, and sandbox/sanitizer checks protect install-time execution.
• Skill routing and local outcome reporting are more useful. Bernstein can build reproducible local helpfulness reports from the activation log, and deterministic routing tools make skill selection easier to inspect without model calls.
• Opt-in telemetry sharing is wired through a real maintainer-share sink. It is still off by default, requires explicit consent plus BERNSTEIN_TELEMETRY_SHARE_ENDPOINT, uses the same redacted event schema, and signs shared receipts for offline verification.
• Release and CI gates are harder to get wrong. The publish workflow now runs real release tests, checks protocol compatibility, asserts GitHub Release assets, reconciles PyPI/GitHub drift, and ties main-branch eligibility to an explicit SHA marker.
• Sonar is green. Coverage is reported from the CI shard set instead of one partial artifact, the tracker is down to zero open findings, and remaining hotspots were reviewed through a dedicated workflow.
• Several fail-closed paths were tightened. PR review uses trusted action code, issue decomposition has a narrower write boundary, plugin zip extraction is hardened, release attestation is enforced, and lineage/audit checks bind more verification to bytes on disk.

Install

pipx install --upgrade bernstein

Python packages and GitHub Release assets are published for 2.7.0.

The npm wrapper is a convenience distribution path and may lag the Python release while registry permissions are repaired.

Full changelog: v2.6.0...v2.7.0