Prepare DevArch 0.4.1: bind derived evidence and disable unsafe legacy paths

.forgejo/workflows/ci.yml

@@ -11,15 +11,16 @@ jobs:
         run: apt-get update -qq && apt-get install -y -qq python3 python3-pip
       - name: Install dependencies
         run: |
-          if [ -f requirements.txt ]; then pip install --break-system-packages -r requirements.txt || true; fi
-          if [ -f pyproject.toml ]; then pip install --break-system-packages -e ".[dev]" 2>/dev/null || true; fi
+          if [ -f requirements.txt ]; then pip install --break-system-packages -r requirements.txt; fi
+          pip install --break-system-packages -e ".[dev]"
       - name: Lint
         run: |
-          pip install --break-system-packages ruff 2>/dev/null
-          ruff check . || true
+          pip install --break-system-packages ruff==0.16.10
+          ruff check .
+          ruff format --check .
       - name: Test
         run: |
           if [ -f pytest.ini ] || [ -f setup.cfg ] || [ -d tests ]; then
-            pip install --break-system-packages pytest 2>/dev/null
-            pytest || true
+            pip install --break-system-packages pytest
+            pytest
           fi

.github/workflows/ci.yml

@@ -39,6 +39,16 @@ jobs:
       run: |
         devarch demo --force --build-db
 
+    - name: Install and verify built wheel outside checkout
+      if: matrix.python-version == '3.12'
+      run: |
+        python -m pip install build twine
+        python -m build
+        python -m twine check dist/*
+        python -m pip uninstall -y devarch-framework
+        python -m pip install --no-deps --force-reinstall dist/devarch_framework-0.4.1-py3-none-any.whl
+        python scripts/check_installed_wheel.py
+
   lint:
     runs-on: ubuntu-latest
     steps:
@@ -57,8 +67,12 @@ jobs:
         python -m pip install --upgrade pip
         pip install -e ".[dev]"
 
+    - name: Lint and format
+      run: |
+        ruff check .
+        ruff format --check .
+
     - name: Check Python syntax
       run: |
         python -m py_compile archaeology/*.py
         python -m py_compile archaeology/**/*.py
-      continue-on-error: true

.ruff.toml

@@ -0,0 +1,14 @@
+target-version = "py310"
+line-length = 100
+
+[lint]
+select = ["E4", "E7", "E9", "F", "I"]
+
+# Repository-only content-generation utilities require Python 3.12.
+[per-file-target-version]
+"scripts/**/*.py" = "py312"
+
+[lint.per-file-ignores]
+# These standalone utilities import project modules after explicit sys.path setup.
+"scripts/data/refresh_data.py" = ["E402"]
+"scripts/sync/generate-bridge.py" = ["E402"]

CHANGELOG.md

@@ -1,3 +1,11 @@
+# 0.4.1 — Unreleased readiness candidate
+
+- Bind analysis, reports and visualizations to exact inputs; reject stale A-to-B runs.
+- Disable unsafe legacy dashboard/static publishing, cascade and opportunity profiling before side effects; remove the active Markdown viewer and wildcard API CORS.
+- Validate installed history HTML without a source-relative Node dependency.
+- Correct package/documentation metadata to the existing Apache-2.0 LICENSE; no relicensing.
+- Add installed-wheel checks to native Python3.12 CI and remove suppressed CI failures.
+
 # 0.4.0 — Evidence integrity
 
 Fix full-history mining for bare repositories/worktrees, reject shallow coverage, bind extraction artifacts, reconcile CSV/SQLite metrics, and generate portable measured visualizations. Replace unsupported agent/ML/quality assertions with explicit uncertainty. See [release notes](docs/RELEASE_0.4.0.md) for output compatibility and validation.

README.md

@@ -4,7 +4,7 @@
 
 [![PyPI version](https://img.shields.io/pypi/v/devarch-framework.svg)](https://pypi.org/project/devarch-framework/)
 [![Python](https://img.shields.io/pypi/pyversions/devarch-framework.svg)](https://pypi.org/project/devarch-framework/)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)
 [![GitHub stars](https://img.shields.io/github/stars/KyaniteLabs/devarch-framework.svg?style=social)](https://github.com/KyaniteLabs/devarch-framework)
 
 **Git repository archaeology framework.** Mine commit history, detect development signals, run 6 analysis vectors, and generate engineering narrative reports — from any git repository, fully local, no external services.
@@ -133,7 +133,7 @@ devarch audit my-project --fail-on MEDIUM
 
 ### Analysis
 - `devarch analyze <project> [--vector] [--prompts]` -- Run analysis vectors
-- `devarch cascade <project> [--dry-run] [--skip-mine]` -- Cascade era labels across repos
+- Legacy `cascade`, `opportunity`, `dashboard` and `publish-static` commands are disabled pending safety/evidence redesign.
 
 ### Visualization & Reporting
 - `devarch visualize <project>` -- Generate HTML visualization
@@ -302,7 +302,7 @@ _config/              -- Developer profile templates
 
 ## License
 
-MIT License -- See LICENSE file for details.
+Apache-2.0 — see the existing LICENSE file. Metadata was corrected; the repository has not been relicensed.
 
 ## Support
 
@@ -411,3 +411,9 @@ Issues and PRs welcome on the canonical remote. Keep public docs free of secrets
 See [LICENSE](LICENSE) in this repository (or package metadata if license is package-only).
 
 <!-- s-plus-geo:end -->
+
+### 0.4.1 readiness candidate (unreleased)
+
+The supported measured-history path is `init → mine → build-db → signals → analyze → visualize → validate → export-report → audit`. Analysis and reports bind to exact local input hashes. After changing history or configuration, rerun the affected stages; stale outputs fail audit/export. Bindings detect drift, not malicious coordinated rewriting or remote authenticity. The validator checks the generated history document and binding; it is not a general browser, accessibility or HTML conformance audit.
+
+Legacy network dashboard/static publishing, cascade and opportunity profiling are explicitly disabled before mutation. Open reviewed local HTML directly. Existing scripts depending on these commands receive a nonzero error; there is no unsafe override. No personal/medical profile inference is supported.

archaeology/__init__.py

@@ -1,3 +1,3 @@
 """DevArch Framework - forensic mining of software development history."""
 
-__version__ = "0.4.0"
+__version__ = "0.4.1"