chore(release): bump brain to v0.7.0

- bump anda_brain and anda-cli versions to 0.7.0
- fold the cancelled 0.6.12 changes into the 0.7.0 changelog entry
- upgrade Anda DB, KIP, and Cognitive Nexus dependencies to 0.8
- refresh KIP prompt assets for reserved metadata, UPDATE, MERGE, EXPORT, semantic search, and version guards
- document self-hosted deployment and current CLI/API examples
- harden agent processing markers, maintenance input validation, recall persistence, token revocation, and list pagination

Co-Authored-By: Anda Bot <noreply@anda.bot>

Author: zensh

CHANGELOG.md

@@ -2,20 +2,31 @@
 
 All notable changes to the Anda Brain project.
 
-## [0.6.12] — 2026-06-11
+## [0.7.0] — 2026-06-11
+
+### Added
+- **KIP prompt assets now document the 0.8 protocol surface.** Brain Formation, Maintenance, Recall, and shared KIP syntax guidance cover reserved `_` metadata, `EXPECT VERSION` optimistic concurrency, predicate variables, multi-key `ORDER BY`, semantic/hybrid `SEARCH`, `UPDATE`, `MERGE`, and `EXPORT` patterns.
+- **Regression coverage was added for new runtime guardrails.** Formation high-water processed markers, Maintenance history ordering and input validation, Recall empty-output preservation, token revoke safety, and conversation list limit clamping now have focused tests.
 
 ### Changed
-- **Brain service lifecycle handling is more robust.** Shutdown now closes loaded spaces concurrently, idle eviction closes databases before removing entries, and scheduled maintenance trigger construction is simplified while preserving the existing cadence.
-- **Shared request handling has been consolidated.** API handlers now use a common sharding validator, and the Chinese website response is pre-rendered with the correct `zh-CN` document language.
-- **`anda-cli` now targets the local Brain service by default and exposes deployment controls.** The CLI default base URL is `http://127.0.0.1:8042`, the reported CLI version is aligned to `0.6.12`, and new `--shard`/`ANDA_SHARD` plus `--timeout`/`ANDA_TIMEOUT` options send `Shard-Id` headers and tune HTTP request timeouts.
+- **Release version advanced to `0.7.0`.** `anda_brain` and `anda-cli` now report `0.7.0`, and the lockfile was refreshed for the release.
+- **Anda ecosystem dependencies moved to the 0.8 line.** `anda_db`, `anda_cognitive_nexus`, and `anda_kip` now use the `0.8` series.
+- **Brain service lifecycle handling is more robust.** Shutdown closes loaded spaces concurrently, idle eviction closes databases before removing entries, and scheduled maintenance trigger construction is simplified while preserving the existing cadence.
+- **Shared request handling has been consolidated.** API handlers use a common sharding validator, and the Chinese website response is pre-rendered with the correct `zh-CN` document language.
+- **`anda-cli` now targets the local Brain service by default and exposes deployment controls.** The CLI default base URL is `http://127.0.0.1:8042`, and new `--shard`/`ANDA_SHARD` plus `--timeout`/`ANDA_TIMEOUT` options send `Shard-Id` headers and tune HTTP request timeouts.
 - **`anda-cli` documentation now reflects the current command surface.** The README documents `status` for service metadata, `info` for space details, `formation-status`, `get-or-init-user`, BYOK retrieval, `daydream` maintenance scope, batch formation exclusions, and single-command KIP readonly requests.
+- **Documentation now reflects self-hosted deployment.** READMEs, website copy, and skill files remove discontinued hosted-service guidance, point users to self-hosted setup, link Anda Bot as a ready-to-run agent, and fix current CLI/API examples and model defaults.
+- **Brain agent instructions are stricter and more operational.** Prompt assets emphasize empty-write discipline, bounded extraction, KIP error recovery, read-modify-write version guards, bulk update patterns, memory portability, and the absence of read-access statistics.
 
 ### Fixed
-- **Formation resumes correctly from an empty processed marker.** Spaces now restart formation from the beginning when no processed marker exists, so conversations queued before the first successful formation pass are not left stuck.
-- **Agent records preserve original input on anomalous empty rounds.** Formation and Maintenance no longer clear a conversation's original messages when a cancelled or empty round returns no chat history.
-- **Agent context history now keeps completed conversations only.** Maintenance and Recall initialization filter out in-progress conversations, and Recall uses the shared completed-history helper when appending successful runs.
+- **Formation resumes correctly from an empty processed marker.** Spaces restart formation from the beginning when no processed marker exists, so conversations queued before the first successful formation pass are not left stuck.
+- **Formation processed markers are monotonic high-water marks.** Reprocessing an older conversation can no longer rewind `brain_processed`.
+- **Agent records preserve original input on anomalous empty rounds.** Formation, Maintenance, and Recall no longer clear a conversation's original messages when a cancelled or empty round returns no chat history.
+- **Agent context history now keeps completed conversations in runtime queue order.** Maintenance and Recall initialization filter out in-progress conversations and restore completed history oldest-to-newest, avoiding transient conversations leaking into later context while preserving newest entries correctly.
+- **Maintenance startup and input handling are safer.** Malformed maintenance input is rejected before claiming the processing slot or creating a conversation.
 - **Idle probes for unknown spaces no longer grow the space map indefinitely.** Uninitialized placeholder entries are evicted once idle, while initialized spaces are still protected against concurrent users and processing work.
-- **Space token lookup is restricted to token-prefixed credentials.** Token verification now rejects non-`ST` keys before credential lookup, keeping other extensions out of the token path.
+- **Space token lookup and revocation are restricted to token-prefixed credentials.** Token verification and revocation now reject non-`ST` keys, keeping platform extensions such as tier and BYOK out of the token path.
+- **Conversation listing clamps zero limits to safe bounds.** `limit=0` no longer allows an empty-page panic or unbounded scan.
 - **`anda-cli formation` now rejects malformed JSON message payloads instead of storing them as plain text.** Valid JSON arrays and objects must decode to messages with role and content, while non-JSON log-like text still submits as a user message.
 - **`anda-cli formation` batch mode avoids submitting bookkeeping and hidden files.** Recursive batch scans skip dot-prefixed entries, the checklist file, and temporary report files while preserving user/agent/topic context and only filling per-file `source` when it was not already provided.
 - **`anda-cli execute-kip-readonly` accepts single-command requests cleanly.** Requests may now use either `command` or `commands`, object command `parameters` are optional and omitted when empty, and the two forms are validated as mutually exclusive.