[rocklambros]

What changed

This releases 0.1.4. It bumps the version in all three files that carry it (version.txt, pyproject.toml, uv.lock), adds the 0.1.4 section to the CHANGELOG, and corrects the 0.1.3 date to 2026-10-05, the date of the v0.1.3 tag. The CHANGELOG header now says pre-1.0 patch releases may change the Trace mappings as well as the ACS-Core baseline, because this release does.

0.1.4 is a patch release, and the specification version stays v0.1.0. The Trace changes are breaking for producers and consumers, and the new section says so in its first paragraph. Once this merges and integration is promoted to main, tag-release.yml tags v0.1.4.

What's in it, all already merged into integration:

• Trace specification: the join pair, decision failures and the OCSF Security Control profile (PR Carry the decision's replay facts and decision failures on Trace #275), the OCSF 1.9.0 pin (PR Pin the OCSF mapping to 1.9.0 and use OCSF's class names #258), per-hook conditional attributes (PR Add per-hook conditional attributes to the OTel mapping #261), and the skill lifecycle hook mappings (PR Add the skill lifecycle hooks to the Trace mappings #63).
• Reference implementation: the OTLP exporter and audit converter (PR Export Guardian traces as OTLP to a file and over HTTP #244), the sample trace and walkthrough (PR Commit a sample trace and a walkthrough anyone can run, and fix the collector setup #277), the proxy and rerun fixes (PR Keep a user's proxy exemptions, warn when loopback would reach a proxy, and stop everything before a rerun #279), and the trace-pipeline docs (PR Explain how the reference Guardian produces a trace, with diagrams #280).
• Dependencies: urllib3 2.8.0 (PR deps: bump urllib3 from 2.7.0 to 2.8.0 #202).

Which issue does this implement

Refs #91
Refs #228

How it was checked

• The three version files agree at 0.1.4, checked with the same commands tag-release.yml runs, and uv lock --check passes.
• uv run pytest gives 918 passed, and uv run mkdocs build --strict passes.
• git log v0.1.3..origin/integration was reconciled against the new section. Every merged PR that changes behavior or the specification has a line. Roster and roadmap tooling changes are left out, as in earlier releases.

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI

Type of change

• Documentation
• Tooling or CI

I tested this

• I synced my branch with the base branch before opening this
• uv run pytest -v passes on my machine
• uv run mkdocs build --strict passes on my machine

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

• This change has no security impact

[rocklambros]

@afogel @bar-capsule, this is the 0.1.4 release PR, and it needs an approval from one of you. It's a version bump in three files plus the CHANGELOG, with no code. The part worth a careful read is the new 0.1.4 section, especially the first paragraph saying the Trace changes are breaking while the spec version stays v0.1.0. Please leave comments rather than using "Commit suggestion", because a commit from you would make you the last pusher and cost us the approval. Once it merges, I'll promote integration to main, which tags v0.1.4.

[rocklambros]

Admin-merged on the project lead's call. This PR changes only the release files, the version in three places plus the CHANGELOG, with no code. Ariel and Bar will review the promotion to main instead, and that's the step that ships 0.1.4. Comments on the CHANGELOG wording are still welcome there.