release: 0.7.0 — images, changelog, and the version cut

[DivyamTalwar]

The last pull request before tagging v0.7.0. Three things: the README images, the release record, and the version cut.

---

1 · The three README images

docs/images/README.md has specified three images since the Astra release. They now exist.

File	Where	What it argues
constellation.png	end of The four bodies	four bodies, four pins, and that Astra and Terra are alternatives — one chosen per delegation
flow.png	top of The flow	one delegation end to end, including the four points where it can stop
refusal.png	end of What it will not do	the same command accepted and refused, with the filesystem untouched

Each was checked against the shipped repository rather than accepted on sight. An earlier pass carried a FABLEWRIGHT wordmark and, in the proof image, two role filenames and a command that do not exist here — orrery-sol-researcher.toml, orrery-terra-ops.toml, fw install. Publishing that would have put a claim on the front page that the shipped files contradict, under the words "LAUNCH PROOF".

What is committed uses the real command, the three real filenames, and output whose load-bearing lines are verbatim from an actual run — the INSTALL PASSED line, the ERROR: Astra destination is conflict line, and exit 1. The narrower progress lines between them are a readable dramatization of steps the installer genuinely performs (destination classification, the legacy-Luna check, the post-install exactness re-check) rather than literal stdout.

Alt text describes content rather than naming files, so all three claims survive for anyone reading without images.

---

2 · The changelog catches up

Four pull requests merged into main without a changelog entry between them — #9, #8, #7 and #15. The Unreleased section described only the Astra lane, so the three most user-visible additions since 0.6.0 existed in the code and the README but nowhere in the release record. A changelog that omits four merges is worse than none, because it is read as complete.

Merged	Now recorded as
#7 capability planner	Added — refuses hosts that would silently weaken requested effort or advisor isolation
#8 tool-surface review	Added — turns "the digest moved" into whether the change is permission-bearing; its baseline is asserted by validate so it cannot drift from the digest it explains
#9 semantic doctor	Changed — schema: 2; a marker-only or weakened adapter is no longer reported as healthy
#15 toolchain	Changed — typescript 5.9.2 → 7.0.2 (major, no source changes), with why it was applied by hand recorded

Each entry leads with what the thing refuses to do, because on this project that is the part with value.

---

3 · The version cut

Unreleased becomes 0.7.0; the three declared versions agree.

Minor, not major: a second native implementation lane and three read-only diagnostics are added, nothing is removed, no interface breaks. Whether this should instead be 1.0.0 is a maintainer's call rather than a semver one — and it is arguably the release that earns it.

---

Verification

bun run ci
bun run tag:check -- v0.7.0

VERIFY PASSED three-role · 82 tests across 6 files, 0 fail · validate (which link-checks the image paths, so the embeds and the files agree) · sbom now emitting orrery-0.7.0.cdx.json (18 packaged files, 0 runtime dependencies) · release-check · tag-check passes for v0.7.0.

Risk

Documentation, images, and version metadata. No code, no behaviour change.