Add CI Python 3.10-3.13 matrix (#10)

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 # PR and main-branch CI — lint and test only (no secrets, no PyPI OIDC).
 # Keep install/lint/test steps in sync with publish-pypi.yml test job until issue #7
-# (reusable workflow) lands.
+# (reusable workflow) lands. PR CI also matrices Python versions; publish stays
+# single-version as a release gate (see docs/TESTING.md).
 
 name: CI
 
@@ -19,12 +20,17 @@ concurrency:
 
 jobs:
   lint-test:
+    name: Python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: ${{ matrix.python-version }}
       - name: Install dev dependencies
         run: |
           python -m pip install --upgrade pip
@@ -35,3 +41,13 @@ jobs:
         run: flake8 aura tests
       - name: pytest
         run: pytest --cov=aura --cov-report=term-missing
+
+  # Stable check name for branch protection (matrix cells are "Python 3.xx").
+  ci-ok:
+    name: lint-test
+    needs: lint-test
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Confirm Python matrix succeeded
+        run: test "${{ needs.lint-test.result }}" = "success"

.github/workflows/publish-pypi.yml

@@ -21,7 +21,8 @@ permissions:
   contents: read
 
 jobs:
-  # Steps must match .github/workflows/ci.yml lint-test job (see docs/TESTING.md).
+  # Commands must match .github/workflows/ci.yml (see docs/TESTING.md).
+  # PR CI matrices 3.10–3.13; this job stays on 3.12 as a single-version release gate.
   test:
     runs-on: ubuntu-latest
     steps:

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **Python 3.13** package classifier — matches the CI matrix and `requires-python = ">=3.10"` ([GH #10](https://github.com/ARPAHLS/aura/issues/10)).
 - **Core test coverage (GH #4)** — config layers, legacy + ULID coexistence, tampered JSONL → audit report `HASH_CHAIN_BROKEN`, constraint allow/deny/token matrix, session mode + project storage paths, compare `agent_ref` / `hash_chain_valid` diffs.
 - **`AuditSpine.from_jsonl()`** — reload spine from disk for verify/tamper checks.
 - **Compare sessions** — `agent_ref.same` and `hash_chain_valid` fields in diff output.
@@ -21,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **PR CI** — `lint-test` now covers Python 3.10–3.13 on Ubuntu (`fail-fast`); publish remains a 3.12 release gate ([GH #10](https://github.com/ARPAHLS/aura/issues/10)).
 - **`AgentRegistry.update_profile`** — registry ref/alias maps stay consistent when `agent_ref` changes.
 - **Global config** — optional persisted `project_dir` in `~/.aura/config.yaml`.
 

CONTRIBUTING.md

@@ -132,7 +132,7 @@ Follow the [Code of Conduct](CODE_OF_CONDUCT.md). We welcome autonomous logical
 
 - Shared fixtures: **`tests/conftest.py`** (`aura_home`, `run_aura` for CLI subprocess tests).
 - Full suite is **64+ tests** across `test_core.py`, `test_core_gaps.py`, `test_v02.py`, `test_v03.py`, `test_cli.py`, `test_examples_smoke.py` — see [TESTING.md](docs/TESTING.md).
-- CI runs on PRs via [`.github/workflows/ci.yml`](.github/workflows/ci.yml) (job **`lint-test`**: pytest with coverage report, black, flake8). See [TESTING.md](docs/TESTING.md).
+- CI runs on PRs via [`.github/workflows/ci.yml`](.github/workflows/ci.yml) (Python **3.10–3.13** matrix; gate job **`lint-test`**: pytest with coverage report, black, flake8). See [TESTING.md](docs/TESTING.md).
 - Wait for green checks before requesting review.
 
 ### CHANGELOG

docs/PUBLISHING.md

@@ -7,7 +7,7 @@ Releases are published automatically by [`.github/workflows/publish-pypi.yml`](.
 
 Pushing a `v*` tag alone does **not** publish; create and publish the GitHub Release from that tag.
 
-The workflow runs tests, builds sdist/wheel, then uploads to PyPI. **Pull requests** are gated separately by [`.github/workflows/ci.yml`](.github/workflows/ci.yml) (`lint-test` on every PR to `main`).
+The workflow runs tests (Python 3.12), builds sdist/wheel, then uploads to PyPI. **Pull requests** are gated separately by [`.github/workflows/ci.yml`](.github/workflows/ci.yml) (Python 3.10–3.13 matrix; `lint-test` on every PR to `main`).
 
 ## One-time PyPI setup
 

docs/TESTING.md

@@ -22,27 +22,35 @@ black aura tests
 flake8 aura tests
 ```
 
-CI expectation: **pytest**, **black**, and **flake8** all pass on `aura/` and `tests/`.
+CI expectation: **pytest**, **black**, and **flake8** all pass on `aura/` and `tests/` for every supported Python version.
 
 ## Continuous integration
 
-GitHub Actions workflow **[`.github/workflows/ci.yml`](../.github/workflows/ci.yml)** (job name: **`lint-test`**) runs on:
+GitHub Actions workflow **[`.github/workflows/ci.yml`](../.github/workflows/ci.yml)** runs on:
 
 - every **pull request** targeting `main`
 - every **push** to `main` (post-merge sanity)
 
-Steps (Python 3.12 on Ubuntu):
+Python matrix on **ubuntu-latest** (`fail-fast: true` — one version failure cancels the rest):
+
+```yaml
+python-version: ["3.10", "3.11", "3.12", "3.13"]
+```
+
+Each cell runs the same steps:
 
 ```bash
 pip install -e ".[dev]"
 black --check aura tests
 flake8 aura tests
-pytest
+pytest --cov=aura --cov-report=term-missing
 ```
 
+The workflow also emits a gate job named **`lint-test`** that succeeds only when every matrix cell passed. That is the check to require in branch protection.
+
 **Fork PRs:** the workflow uses `permissions: contents: read` only — no repository secrets, no PyPI OIDC, no deploy environment.
 
-**Publish workflow:** [`.github/workflows/publish-pypi.yml`](../.github/workflows/publish-pypi.yml) runs the same lint/test steps before release upload; keep both in sync until a reusable workflow lands (separate CI follow-up issue).
+**Publish workflow:** [`.github/workflows/publish-pypi.yml`](../.github/workflows/publish-pypi.yml) runs the same install/lint/test commands on a single Python 3.12 before release upload. Full 3.10–3.13 coverage is the PR CI matrix; keep the *commands* in sync until a reusable workflow lands (separate CI follow-up issue).
 
 **Maintainers:** after the first green `lint-test` run on `main`, enable **branch protection** → required status check **`lint-test`**.
 

docs/contributing/ai_native_workflow.md

@@ -45,7 +45,7 @@ Written for **autonomous and semi-autonomous agents** working on AURA Harness. H
 - **Session export:** `.jsonl`, `.summary.json` (with `audit_report`), `.otel.jsonl`
 - **CLI:** `aura agent create/set`, `config show`, `paths`, `run`, `logs`, `export`, `export-otel`, `compare`
 - **SDK helpers:** `AuditSpine.from_jsonl()` for disk verify; `compare_sessions()` includes `agent_ref` and `hash_chain_valid` diffs
-- **CI:** `lint-test` on every PR ([`ci.yml`](../../.github/workflows/ci.yml))
+- **CI:** Python 3.10–3.13 matrix on every PR; gate job `lint-test` ([`ci.yml`](../../.github/workflows/ci.yml))
 
 ---
 

pyproject.toml

@@ -36,6 +36,7 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
     "Topic :: Scientific/Engineering :: Artificial Intelligence",
     "Topic :: Software Development :: Libraries :: Python Modules",
     "Topic :: System :: Monitoring",