[SaulBuilds]

This is the version bump for the r1007 release, as the owner approved. PyPI currently has citrate-labs-sdk 0.8.0.

0.8.0 to 0.9.0, a minor bump: the change is breaking, and the package is 0.x. #23 moved the vendored federation contract and the expected genesis to r1007, so the client and managers refuse an r1006 node.

• pyproject.toml, citrate_sdk.__version__ and the citrate-labs-sdk entry in uv.lock go to 0.9.0.
• CHANGELOG.md gets [0.9.0] - 2026-11-12: the r1007 network, covering the network change and the moved post-genesis addresses.
• README.md: the network text names the r1007 book (citrate-chain root contracts/addresses/40204.json) and its genesis.

Tests: pytest 966 passed, 8 skipped. That includes test_publish_metadata, which checks that __version__ equals the pyproject version, and the r1007 network guard. The local pre-push gate passed through the normal hook.

Not tagged or released. The lead tags after merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_019cgBjDQkjCEEZwG1zJNnQi

[BerryManifold]

Automated Codex static review of 87d6e10fd309e66c0a3cd85d038c657f3c06effb is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

Automated Codex static review of 87d6e10fd309e66c0a3cd85d038c657f3c06effb is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[BerryManifold]

MAC independent reviewer agent, not Codex, not DGX. Reviewed head 87d6e10.

• No stale 0.8.0 in anything published: pyproject.toml version and citrate_sdk/__init__.py __version__ are 0.9.0. The only 0.8.0 left in the tree are the unrelated dependencies eth-hash and eth-keys in uv.lock, plus CHANGELOG history.
• Lockfile: uv.lock's self entry citrate-labs-sdk (editable) is 0.9.0, the only lock change. uv-lock-check covers consistency.
• Publish gates:
  • tests/test_publish_metadata.py asserts __version__ equals the built distribution's version, which fails the release's test job on any drift.
  • The manual workflow_dispatch path additionally refuses artifacts that are not citrate_labs_sdk-<typed version>.
  • A GitHub release publishes the built pyproject version (0.9.0).
• README and CHANGELOG: r1007 wording, accurate.

P3: the release: published path does not compare the release tag to pyproject. Tag the release exactly v0.9.0.

CI is green. No P1/P2.

[Matr0xshka]

MAC independent reviewer agent, not Codex, not DGX. Reviewed head 87d6e10.

• Versions are consistent. 0.8.0 becomes 0.9.0 in pyproject.toml (citrate-labs-sdk), citrate_sdk/__init__.py __version__, and the package's own entry in uv.lock. The remaining 0.8.0 strings in uv.lock are eth-hash and eth-keys.
• The CHANGELOG is accurate. v0.8.0..main is exactly #23 (the r1007 contract), and the entry describes it. The named APIs exist (CitrateClient, pinned_send, verify_wallet_address_on_chain, WrongNetworkError), and the genesis and the 28 post-genesis contracts match #579. The README is updated to r1007.
• Release: publish.yml runs on release: published, or on dispatch from main with an exact publish_version. It runs test, then build (python -m build, twine check, the key-share wheel tripwire), then publishes the single citrate-labs-sdk dist through PyPI OIDC. A GitHub Release v0.9.0 on this commit publishes citrate-labs-sdk 0.9.0, and nothing else.

Note for the release step: this workflow does not run on a bare v* tag push. The tag needs a GitHub Release published from it, unlike sdk-js.

P3, pre-existing: the built-version check runs only on the dispatch path. On the release path nothing compares the release tag with the built version. Adding WANT=${GITHUB_REF_NAME#v} for release events would close that.

No P1. CI is green. Approved.