[v0.8] Add release_readiness_report, branding gate, approval gate, and package hygiene checks

[Stahl-G]

Parent: #89

Depends on: #90, #93

Summary

Add output/intermediate/release_readiness_report.json, a deterministic control surface that determines whether a reader-facing brief is eligible for its declared release mode.

Release eligibility is not publication authorization. It means the artifact is eligible to enter the appropriate human review / delivery path under its mode.

Motivation

finalize already creates reader-facing delivery artifacts and performs reader-clean / audit-binding checks. But v0.8 needs a separate release-readiness layer for risks that are not purely rendering or traceability issues:

• unauthorized institutional branding;
• confidential/internal-use labels without authorization context;
• evidence blockers from evidence_report.json;
• legal/policy/investment-advice boundary issues;
• missing human approval for formal release candidate;
• dirty or incomplete delivery package.

Proposed files

src/multi_agent_brief/release/__init__.py
src/multi_agent_brief/release/readiness.py
src/multi_agent_brief/release/contract.py
src/multi_agent_brief/cli/release_commands.py
tests/test_release_readiness.py

Update:

src/multi_agent_brief/cli/main.py
configs/artifact_contracts.yaml
configs/stage_specs.yaml
configs/policy_packs/*.yaml

CLI

Add:

multi-agent-brief release check --workspace <ws> --mode research_review --json
multi-agent-brief release show --workspace <ws> --json
multi-agent-brief release validate --workspace <ws> --json

Inputs

Read, do not mutate:

output/intermediate/workflow_state.json
output/intermediate/artifact_registry.json
output/intermediate/audit_report.json
output/intermediate/quality_gate_report.json
output/intermediate/semantic_review_report.json
output/intermediate/evidence_report.json
output/intermediate/finalize_report.json
output/intermediate/human_approval_ledger.json
output/delivery/*
config.yaml

Output schema

{
  "schema_version": "multi-agent-brief-release-readiness/v1",
  "release_mode": "research_review",
  "workflow_status": "pass",
  "semantic_review_status": "completed",
  "evidence_status": "conditional",
  "release_status": "blocked",
  "allowed_use": ["internal discussion draft", "analyst review input"],
  "not_allowed_use": ["formal external publication", "institution-branded distribution"],
  "blocking_reasons": [],
  "findings": [],
  "metadata": {}
}

Allowed release_status values:

- pass
- conditional
- blocked
- not_checked

Required gates

1. Branding authorization gate

Scan reader-facing delivery artifacts for terms such as:

Confidential
Internal Use Only
内部使用
面向.*行研
证券
银行
基金
律所
政府
监管

If institutional branding/confidential labels appear without an authorization config, block release.

Suggested config:

release:
  authorization:
    allowed_branding: true
    organization: "Example Institution"
    allowed_confidential_label: true

2. Evidence blocker gate

If evidence_report.json has blocking findings for the selected mode, release must be blocked.

3. Use-boundary gate

Always write explicit allowed_use and not_allowed_use based on mode.

Example for research_review:

allowed_use:
  - internal discussion draft
  - analyst review input
not_allowed_use:
  - formal external publication
  - institution-branded distribution without approval
  - investment recommendation
  - legal or compliance conclusion

4. Human approval gate

For formal_release_candidate, require required approval roles to be approved in human_approval_ledger.json.

5. Package hygiene gate

Check delivery package for:

required: output/delivery/brief.md
required if docx configured: output/delivery/*.docx
forbidden: .DS_Store, __MACOSX/**, ~$*.docx, .~*.docx, *.tmp
forbidden: internal local paths, src markers, bare claim IDs, debug residue

6. Investment/legal boundary gate

If release mode is research_review or formal_release_candidate, block when delivery text includes unqualified investment advice, legal conclusion, or unsupported finality wording.

Acceptance criteria

• release check writes output/intermediate/release_readiness_report.json.
• release show returns current report or empty not-checked report.
• release validate validates schema and references.
• Unauthorized institutional branding blocks release.
• Evidence blockers propagate into release blockers.
• formal_release_candidate requires human approval.
• internal_draft does not require human approval.
• Delivery package hygiene findings are recorded.
• The report always includes allowed_use and not_allowed_use.
• Tests cover pass, conditional, blocked, unauthorized branding, missing approval, package hygiene, and evidence-blocker propagation.

Non-goals

• Do not authorize publication.
• Do not send or publish anything externally.
• Do not call LLMs.
• Do not replace legal/compliance/analyst approval.
• Do not make finalize depend on release readiness in this issue unless explicitly configured.