0.4.6

Apizr 0.4.6 connects the data-scientist workflow from local Python and Jupyter experiments to shared Run history, VS Code comparison and explicit REST/MCP prediction services. Python 3.11–3.15 is supported on the qualified Linux and macOS targets. Scientific frameworks remain your workload dependencies; the minimal core still depends only on Pydantic.

What changes

• Record an explicit Python block with tracking.session, or decorate selected calls with tracking.experiment. Capture bounded parameters, inputs, metrics and artifacts while preserving ordinary results and exceptions.
• Use the same sessions in Jupyter, with actual cell IDs, execution counts and source digests. Missing or unsaved scientific evidence remains unknown.
• Find and compare the same Runs from CLI, SDK and the VS Code extension. The extension uses an explicitly selected installed engine and respects workspace trust, read permissions and telemetry controls.
• Expose a successful Run's selected prediction through real REST and MCP interfaces, bound to its recorded model and dependencies. Serving does not retrain the model; changed artifacts are refused.
• Select scientific recognition providers explicitly. History remains readable independently of the producing provider. Telemetry is off by default and has no production transmission in this version.
• Use stable uv 0.12.x or 0.13.x for plugin preparation, including native glibc 2.41 hosts. Homebrew qualification uses Python 3.15 on Apple Silicon.
• Migrate from the retired historical pipeline and Python compatibility facades to their canonical owning APIs. The existing notebook exporter and published evidence schemas are preserved.

Start with SDK tracking, the ordinary notebook journey, or installation. The migration guide lists the removed entrypoints and store contracts.

Compatibility and qualification

Windows, unqualified VS Code remotes and Intel Homebrew runtime are outside the qualified matrix. Jupyter uses the recorded ipykernel/IPython versions; unsaved notebook text does not acquire source execution authority. Existing Academy videos and artwork remain available; new recordings and a private telemetry collector follow separately.

The dated records below preserve the implementation and qualification history, including earlier candidate metadata, actual test counts and their exact source identities. They do not substitute for the final coordinated artifact/provenance record required by the release procedure.

Integrated journey qualification

The documented fraud-detection journey now also captures two successful training variants and one real failing cell in an installed Jupyter kernel (#325). The CLI and installed VSIX read the same three canonical records and comparison. The SDK sessions explicitly bind the exported Python source; unsaved kernel text does not acquire notebook execution authority.

The second successful Run supplies the model for real REST and MCP calls. Both return the same prediction. A modified model refuses with run_artifact_changed; history remains readable with the built-in provider disabled and its implementation unavailable. A serving observer has positive controls for both train and scikit-learn fit, measures the actual serving processes and calls, and verifies zero training calls and an unchanged training marker. The executed notebook, canonical records/diff, bundles, dependency inventories, logs and timings are retained.

The existing eight Linux/macOS candidate targets run this kernel/CLI/transport qualification. The VS Code job additionally consumes the same core candidate and its once-built VSIX; their source commit and archive digests must match their build records. The retained local evidence records the native macOS qualification. Hosted matrix qualification and the coordinated version change/publication remain separate completion gates.

Canonical imports and autonomous source closures

The 73 remaining root, plugin-management and artifact-verification forwarding modules are removed (#291). The exact migration table records every canonical target, its pre-removal documentation references and the documentation-only deprecation decision. All 75 old forwarding tests passed before removal. The normative root debt/compatibility inventories are empty; there are no embedded-import exceptions or historical source-path maps. The architecture gate rejects restoring them, expanding the root module inventory or importing missing core modules.

The 11 affected implementation modules use canonical imports. Generated governed closures use contracts/* and capabilities/inspection.py under their autonomous namespace. Source bytes and enclosing manifest hashes change; evidence schemas, public interface declarations and direct bundles do not. Eight current single-source/repository governed manifest goldens are regenerated; frozen published history remains unchanged. Qualification evidence retains digests for all 16 mode/transport combinations and installed-wheel, independent-plugin and real-container checks. No external consumer notification was requested or sent.

Complete legacy pipeline removal

The historical FastAPI pipeline was deprecated at its shared renderer in b4fb8b1e, with 263 passing pipeline/HTTP/plugin characterizations, before removal in this development line (#284, #331). The complete modules, legacy and extensions perimeter, six legacy forwarding paths, their templates/i18n, mutable step plugins, upload service and legacy extra are removed. Unknown commands exit 2; the retired top-level flags explain the modern migration.

apizr.notebooks owns the retained non-executing exporter. Eighteen frozen pre-move notebook cases preserve exact exported and formatted bytes and the magic refusal. The modern source-admission security mutations still target that one implementation. The global and modern domain coverage floors remain; only the deleted tree's 59.5% floor retires. The container matrix now exercises the modern notebook REST bundle, with an explicit test Dockerfile instead of the old pipeline.

The migration table maps former CLI, Python, HTTP, configuration and plugin surfaces. Existing page URLs remain as migration entries, with original videos, artwork and styles preserved. questionary is removed from the universal lock; dependencies still needed by notebook/HTTP/MCP workflows remain in their owning extras. The separate #291 change below completes the remaining facade removal.

Retained qualification records installed-wheel, isolated extras/plugin, notebook, container and security proofs. The wheel has 416 files and is 552,993 bytes, down from 508 files and 617,427 bytes. Candidate metadata remains 0.4.5 pending coordinated promotion; this change does not publish a release.

Executable SDK journey and trust qualification

The SDK quickstart now runs from a first explicit session through two decorated variants, shared CLI history, Jupyter and VS Code. Its marked commands execute verbatim against an installed candidate outside the checkout. The ordinary notebook path remains available without instrumentation; the provider guide, approved telemetry policy and 0.4.5 migration notes explain selection, unknown evidence, independent record versions and current development limits. Existing Academy videos and visuals are preserved; planned recordings link to the written lessons.

Retained evidence records 371 focused Python tests, 57 final qualification checks, 14 Node tests, 172 killed security mutants and strict 127-page HTML validation. Exact candidate wheel/VSIX hashes and the parent fully successful CI run are retained there.

Thirteen CLI/SDK Python processes and 24 extension-launched Apizr processes make zero DNS/INET attempts under a guard with real positive controls. Restricted Mode starts no engine, including telemetry controls. A valid project request without an operator grant refuses before opening its Python source. Interruption between Plan and Run publication leaves no partial Run, releases the SDK context and allows recovery. Explicit private scientific values and exception text are absent from telemetry, which still has no production sender.

Real frozen Runs produced by 0.4.5 retain their original bytes and digests. Their canonical show/export and JSON/text comparison match independent reference outputs from the exact v0.4.5 tagged source byte-for-byte. New v2 records do not imply that an old engine can read them. The separate full journey (#325), Python 3.15 and release publication requirements remain open.

Operator verification authority

Managed Attest attest, publish and admit now bind the operator's reviewed native verifier (path, version and executable SHA-256), expected signer, trust directory and public trust content digest. All values must match within one complete grant. The pure core decision precedes plugin invocation, credential reads and signing-key access. Native verification uses a bounded private trust snapshot whose digest is checked before invoking Attest.

Older v1 policies and requests remain readable. Existing grants without the verification binding refuse these three operations until explicitly reviewed and extended. Historical receipts/results, read-only verification, image-only publication, and Git/build/analysis authorization keep their existing contracts. See the operator migration instructions.

Focused qualification passes 460 tests, including managed CLI/API refusals, MCP and multi-destination delivery. All 118 security mutations are killed, including removal of the signing/publication/admission authority binding and runtime trust-snapshot digest check. Ruff, Pyright, the package architecture gate, strict documentation build and core wheel/sdist inspection pass. Full suite and installed delivery qualification are recorded separately when complete.

Initial grouped Python dependency intake

Development takes the five Python Dependabot proposals together: Pydantic 2.14.1 (pydantic-core 2.50.1), Black 26.10.1, Ruff 0.17.0, FastAPI 0.143.0 and Hypothesis 6.169.0. The lock changes exactly those six distributions. This updates the development branch; the master-targeted proposals and stable publication remain separate.

Prequalification passes 810 contract/transport/authorization tests, 84 dependency and Homebrew policy checks, and 195 notebook/onboarding checks. Ruff accepts the existing source formatting and Pyright passes. The exact hash-verified source notices were reviewed and retained, including Ruff's newly vendored Unicode names code and Unicode data notices under licenses already allowed by policy. The development Homebrew full-lock identity is updated; frozen publication fixtures remain unchanged. Full coordinated CI qualifies the integrated batch.

Complete development dependency refresh

The subsequent universal-lock refresh updates 40 dependency names within the existing project bounds, including FastAPI 0.143.2, Starlette 1.8.0, Uvicorn 0.54.0, nbconvert 7.17.2 and Hypothesis 6.169.4. Soupsieve resolves to 2.10 for Python 3.11.0–3.11.4 and 3.0.3 for newer supported interpreters; both versions have separate archive and notice reviews.

The inventory covers 147 third-party versions and 211 distinct notice texts. Four notice texts change: two documentation references and two copyright year updates, with the existing component terms and nine scoped exceptions retained. Pluggy 1.7.0 also refreshes the isolated Homebrew build closure and its development qualification identity. The release checklist requires the reviewed lock to be frozen before candidate construction and retained unchanged through qualification and any separately authorized publication.

Native plugin preparation

Commit 8dda8c71 adds qualified stable uv 0.13.x and native glibc 2.41 preparation. Development uses uv 0.13.1, with 0.13.0 and 0.12.0 qualification baselines. The preparation policy defines the exact matrix and forward refusal policy.

Measured local evidence on 2026-10-14 includes:

Host	Interpreter / resolver	Result
macOS ARM	CPython 3.12.13 / uv 0.13.1	Core resolution; MCP, OCI and Attest prepared outside checkout
Debian 13 aarch64, glibc 2.41	CPython 3.14.8 / uv 0.12.0 and 0.13.1	Core and all three plugin closures prepared with the unchanged hash lock
Glama development image, Debian 13 aarch64	CPython 3.14.8 / uv 0.13.1	Exact source SHA, UID 999, three MCP tools and a successful real analysis call through HTTP

uv does not accept an explicit manylinux_2_41 CLI triple. The recorded native-aarch64-glibc-2.41/native-x86_64-glibc-2.41 mode resolves on the verified native host and preserves PyPA wheel-tag selection. No older libc is substituted. No source builds, dependency downgrade or implicit activation are used. Intel MCP's secure locked closure remains unavailable and is qualified by an explicit compatible-wheel refusal.

The strengthened preparation domain retains 100% line and branch coverage. All 105 security mutations are killed. The broader suite identified stale Homebrew qualification metadata after the preceding packaging-bound change; development and frozen publication identities are now handled separately, with no build-wheel changes or wider publication permission.

The initial CI and MCP workflow runs on the implementation commit are 38598348010 and 38598343648. The initial Linux preparation transactions succeeded but their artifact uploader could not read container-owned private directories. A follow-up qualification returns only the disposable proof tree to the runner's ownership before upload.

Completed development qualification — 2026-10-14

The follow-up 2ef71ab7 qualified every native preparation target and retained its proof artifacts. The shared OCI environment probe then needed to account for the worker-owned APIZR_SERVED_PROCESS=1 capture-suppression marker. The test-only correction c252806d also verifies that the worker replaces an inherited private value, preserving the environment allowlist and confidentiality assertions.

Qualification	Exact source	Result
Full CI, 23 jobs	c252806d	Successful; six Linux/macOS suites, OCI isolation, security mutations and installed candidate journeys
MCP and native preparation	2ef71ab7	Successful; all uv/libc targets, real stdio clients and retained preparation artifacts
Homebrew Formula	2ef71ab7	Successful real installation on the Apple Silicon CI VM
Homebrew build inputs	2ef71ab7	Successful

The eight candidate wheel/sdist archives from both source commits are byte-identical. The core wheel SHA-256 is 73b6eecaf6143e532ec91874b36eb620d7bda0e9861cbcc5fc8ea3df1066ba8b. The Python 3.14 suite passed 7,095 tests (74 skipped), with 95.28% coverage. The OCI qualification passed 416 isolation tests and 16 repeated samples, with 98.47% coverage. These are development proofs; they do not complete the remaining 0.4.6 journey or authorize version promotion or publication.

Live Jupyter tracking

The ordinary tracking session and decorator now observe an existing kernel's active cell without importing kernel packages or installing hooks. The SDK records the optional frontend cell id, active prompt counter and bounded raw request digest independently of saved-file and defining-function evidence. The SDK reference and executable notebook describe this development surface (#305).

Local qualification on macOS ARM/CPython 3.12.13 uses ipykernel 7.4.0, IPython 9.17.1 and jupyter-client 8.10.0. The installed-candidate proof runs four scenarios and records eleven canonical Runs outside checkout, covering re-execution, function redefinition, unknown in-memory inputs, preserved stdout/stderr and display handles, real interruption and recovery, and the documented notebook. The 187 focused SDK/contract/dependency/Homebrew tests pass. The kernel observer has 100% line and branch coverage; the tracking domain has 94.26% combined coverage. All 108 security mutations are killed.

scripts/experiment_jupyter_proof.py owns this qualification. CI retains its proof and exact hashed requirements in the existing build-evidence artifact; the complete CI matrix also exercises real kernels. Kernel dependencies are development-only. Their upstream notices are retained, including debugpy's cumulative third-party notices; its scoped license exception is rejected if it enters any runtime/extra closure. The development Homebrew full-lock identity is refreshed while the build wheels and frozen publication identity are preserved. Frontend-specific UI qualification and the remaining 0.4.6 journey are separate.

The implementation source d9b6555a completed all 23 CI jobs, Security, Documentation, MCP/native preparation, Homebrew Formula and Homebrew build inputs successfully on 2026-10-14. The retained Jupyter proof and requirements hashes match the build-evidence manifest; its core candidate hash matches that manifest's distribution entry.

Scientific provider and SDK adapter contracts

The v1 contract separates bounded source-only recognition from explicitly selected in-process observations. It reuses canonical experiment values, the existing extension envelope and ordinary SDK sessions. Core admission rejects source/producer mismatches, undeclared capabilities, out-of-source locations, runtime claims from static providers and oversized or non-finite evidence. The architecture inventory prohibits scientific imports and direct store publication by the provider domain.

Local qualification on macOS ARM / CPython 3.12.13 includes 1,714 related regression tests (including 62 targeted contract and adapter tests), 100% line and branch coverage of the new production modules, all 112 security mutations killed, complete Pyright/pre-commit checks and strict MkDocs with 117 HTML pages checked. The candidate wheel also passes the contract and SDK proof from an isolated installation outside the checkout with only the five locked core dependencies. Its SHA-256 is d3ae6d292b3a0eff46e17643266cd0d8f449bd27ede31056f54e992cad886987. Source locations follow Python's physical LF/CRLF/CR lines; Unicode separators inside strings or comments cannot invent additional lines. The installed proof also exercises this boundary.

The final implementation source cc85eeda completed all 23 CI jobs, Security and Documentation successfully on 2026-10-14. Linux CPython 3.14 passed 7,188 tests (74 skipped) with 95.33% total coverage; the other Linux/macOS matrix targets, installed candidate journeys and OCI isolation also passed. The retained scientific proof matches its entry in the exact-source build-evidence manifest; all 18 retained file hashes were verified and the CI/local core wheels are byte-identical.

Official built-in scientific provider

The four existing scientific recognizers now live in the declared scientific_providers/builtin domain (#309), including their lexical rules, import candidates and original notebook occurrence locations. The core retains canonical models, explicit selections/values, file fingerprinting, parameters, main guards and immutable storage. The core wheel includes the provider and ordinary inspection uses it by default. Provider contracts and admission form the separate scientific_providers/contracts domain; previous public imports remain available.

Ten JSON/text artifacts frozen before extraction at 62f3ec7b remain byte-identical for relocated Python/notebook fixtures and the fraud example. Local macOS ARM / CPython 3.12.13 qualification passes 1,738 related tests and 87 packaging, golden and architecture checks. Every provider module has 100% line and branch coverage; all 41 experiment/provider modules meet the existing line/branch floors. All 114 security mutations are killed. Pyright, pre-commit, repository-wide Ruff checks and strict MkDocs/117-page link checks pass.

The isolated installed candidate, with only the five locked core dependencies, proves all four built-in capabilities, default inspection, contract admission and ordinary SDK reporting. Both wheel and source archives retain all required runtime modules/resources. The core candidate wheel SHA-256 is 71b4ec1079bd83f44b8402b4a564be04cd4de9b135e36d736a81aab370838315. Provider selection, diagnostics and stored producer inventory remain #310 work.

Implementation 51932082 completed all 23 CI jobs, Security and Documentation successfully on 2026-10-15. Linux CPython 3.14 passed 7,212 tests (74 skipped) with 95.35% total coverage. All Python/Linux/macOS targets, installed journeys and OCI isolation passed. The 18 retained build-evidence file hashes and source identity were verified; CI/local wheel and source archives are byte-identical. The installed CI proof confirms all four built-in capabilities and default inspection. Separately, all six Python golden artifacts reproduce with only the five core dependencies; all ten reproduce with the locked notebook extra.

Qualification throughput

The official 0.4.6 branch automatically starts all 14 qualification entry workflows on each push. Plugin preparation is qualified through the MCP caller without a duplicate standalone push run. Development pushes always select full product and installed-example checks. Manual reruns remain available; master web-only routing, publication guards and all existing check thresholds retain their contracts. See automatic development qualification for recording exact-source push evidence.

The next work prioritizes security triage and the CI/dependency maintenance batch before additional product features. The first lifecycle change (#295) adds PR-only supersession to all 14 PR qualification workflows, removes five confirmed retired branch triggers and keeps PR artifacts for seven days while retaining qualification artifacts for 90 days. Push, scheduled and manual runs have unique groups; the documentation deployment keeps its existing serialization. Job guards also allow cancellation while preserving failure-artifact steps. Dependabot's development configuration groups minor/patch uv updates and groups monthly Actions updates, including all CodeQL steps together.

These settings are prepared on 0.4.6; existing master-targeted Dependabot PRs still use the default branch's configuration. The required codeql check now reuses exact-commit/ref native analyses for Python, JavaScript/TypeScript and Actions on default/protected refs and their PRs, retaining downloaded SARIF instead of starting a duplicate scan. Other refs retain an explicit three-language analysis. Missing, failed or stale native evidence fails closed; GitHub branch protections are unchanged. Live PR cancellation proof is recorded separately. Pytest parallelism (#296), shared qualification orchestration (#297) and development triggers (#298) have their own qualification records below. No measured full-suite speedup is claimed by the lifecycle change.

Local qualification passes 132 lifecycle, routing, DCO and documentation tests, actionlint 1.7.12 on the 14 modified PR workflows, repository-wide Ruff, pre-commit, package architecture and strict MkDocs/117-page HTML checks.

Built-in recognizer extraction and automatic selection/inventory remain the next milestone work (#309 and #310). This qualification makes no claim about a live scientific-library adapter, provider registration or a published 0.4.6 package.

Parallel pytest and native qualification matrix

The development full suites now use two auto-selected pytest-xdist workers, scheduled by file, without automatic worker restarts. The new MIT-licensed pytest-xdist 3.8.0 and execnet 2.1.2 are development-only dependencies. Test identities, JUnit/coverage artifact names and all existing coverage floors stay in place. Real Docker qualification is explicitly serial. The dedicated same-source performance comparison retains serial/parallel results on Ubuntu and macOS Python 3.14; its acceptance target is at least 40% shorter pytest time. Measured results belong to the exact source and retained run, not this target.

Qualification contexts	Development matrix
compatibility	Ubuntu Python 3.11, 3.12, 3.13, 3.14; full parallel suites
macos and release-target	macOS 3.11 and 3.14 unchanged; full suites and installed candidates
MCP stdio, packaging uv-tool	Ubuntu 3.11–3.14; macOS 3.14
MCP generated-recovery	Ubuntu and macOS 3.11 unchanged
cleanup, git-worker-cleanup	Ubuntu 3.11/3.14 and macOS 3.14; 25 repetitions each
Client native-formats, onboarding local-dx	Ubuntu 3.11/3.14 and macOS 3.14
Homebrew, ARM/Intel preparation, libc qualification, OCI isolation	Existing distinct native proofs unchanged

Six satellite macOS 3.11 cells are removed; their full-suite/installed-target coverage remains in the main CI. Native cleanup retains repeated macOS evidence. The 17 protected check names remain unchanged. See the resource audit, comparison method and per-cell rationale. This development matrix does not change published-release verification or authorize publication.

Deferred external work

Academy Parts VI–XI are available in the experiment learning path. The native VS Code recording remains tracked in #334. The private telemetry collector (#335) remains separate work. Production telemetry stays unavailable until the private collector is independently qualified.

VS Code client and remote workspace qualification

The development extension consumes apizr.editor/v1 from an explicitly selected installed engine. It contains no Python engine and no runtime npm dependency. The VS Code guide records settings, trust, saved/dirty inspection, canonical history/comparison and unsupported environments.

Qualification on 2026-10-16 covers VS Code 1.140.0 / extension-host Node 24.21.0:

UI / workspace host	Engine	Result
macOS / native macOS	Installed candidate wheel, Python 3.12.13	Interpreter and actual uv tool executable; clean-profile journeys pass
Linux CI / native Linux	Same-run candidate wheel, Python 3.14	Installed VSIX, synthetic update, incompatible engine and uninstall pass
macOS / Remote SSH to Linux ARM64	Installed candidate wheel, Python 3.14	Real ssh-remote extension host; canonical notebook inspection, navigation, CLI/SDK/Jupyter history, show/diff and publication refresh pass

The retained Linux job binds clean source 63c95083c6b4f1cfc89951aa9eca022fcdf617cb and the same VSIX bytes qualified independently on macOS: SHA-256 4b1dc5fc54b44beb4927b6eac186bdcaef6dd8cf8b3ab13fac8e6f51cddef496. Its artifact contains build/notice manifests, successful trusted/restricted proofs and an unfiltered npm audit with zero findings. The initial SSH proof uses those same product bytes. Remote SSH 0.128.0 and the temporary Debian-based server image are pinned in policy/vscode-distribution.json. The repeatable SSH proof joins the same CI job and records the candidate hashes, actual host, tools and cleanup.

Activation and typing launch no engine; save inspection remains opt-in. Restricted Mode starts none. Global telemetry opt-out wins in every child, and no production sender exists. Remote paths refer to the workspace host; Dev Containers, other remote transports, Windows-native and virtual/browser workspaces remain unqualified. Marketplace/Open VSX publication and publisher ownership remain separate decisions.

Python 3.15 development support

The 0.4.6 development line supports Python 3.11–3.15 for the core, optional distributions and generated targets. Published releases retain their original bounds. The public Action keeps its Python 3.14 default while its published Apizr default remains unchanged; candidate CI explicitly exercises 3.15. Package metadata, classifiers, runtime validation, Action admission, launcher metadata and qualification matrices share an anti-drift test.

The existing Linux 3.11–3.14 and macOS 3.11/3.14 jobs remain. New Linux and macOS 3.15 jobs cover installed candidates, MCP, notebooks and generated containers. Candidate inventories declare all eight installation targets; attachment preparation refuses missing or mislabeled exports. The plugin wheel checker accepts the regular abi3 member of compressed abi3.abi3t tags (PEP 803), while retaining its interpreter minimum, CPU/platform and free-threaded refusal checks. Historical retained candidates keep their original six-target requirement.

uvicorn[standard] is replaced by explicit Uvicorn, uvloop, httptools and websockets requirements. Normal REST/MCP serving keeps the accelerated HTTP, event-loop and WebSocket implementations. The optional reload watcher is no longer a mandatory dependency, so installing HTTP or MCP does not build watchfiles with Rust. Locked dependency versions and source identities remain unchanged; the lock adds the available 3.15 wheel hashes and removes the unused watcher and dotenv dependencies.

PyYAML 6.0.3 does not yet provide a 3.15 wheel. Explicit dependency preparation accepts only its hash-verified locked source, disables the LibYAML extension and C/C++/Rust compilers, then retains a py3-none-any wheel with source/build provenance. Offline candidate installations consume that retained wheel. Every other dependency still requires an upstream binary wheel. This source exception is confined to qualification preparation; plugin preparation keeps its binary-only admission policy. Users installing the clients extra directly can use PyYAML's pure-Python source installation without a compiler.

Homebrew qualification uses the official python@3.15 and pydantic providers. The six build-only wheels stay unchanged and isolated from the installed runtime. The runtime virtualenv admits the declared provider through Homebrew homebrew_deps.pth and excludes unrelated global site-packages. The previous physical-machine evidence remains a historical 3.14 record. New 3.15 physical-machine build and Formula proofs are retained in review/python315-0.4.6/, including a temporary keg-only probe that preserves an existing Apizr installation. Coordinated release publication and public verification remain tracked by #326; this development change does not publish.

Local Python 3.15 qualification passed 7,598 ordinary tests; two collected qualification failures were corrected and passed the 1,139-test focused run. Final coverage is 97.44%, with all 22 existing coverage checks passing. The installed pip/uv/pipx, all-extra, HTTPS/SSH, full MCP and scientific journeys pass. The science notebook reaches REST/MCP prediction parity in 34.51 seconds, excluding environment acquisition. The real 3.15 worker passes ten focused kernel/transport/cleanup tests. The detached-child observer uses a direct file read instead of starting a second Python under the bounded CPU allocation; its deadlines, execution policy and safety assertions are retained.

Hosted integrated journey evidence

CI 38909667156 is successful for source 53238688cbdf40395e9e54d046c4eed972e91a05. All eight supported candidate targets (Linux Python 3.11–3.15 and macOS Python 3.11, 3.14, 3.15) plus the installed VSIX job pass the complete Jupyter/CLI/SDK/ REST/MCP journey. Their shared candidate manifest is ca44efa2502c11331e938ccf3cea0acc80435287efdef141a0762a8ef5d5d441.

Retained matrix and downloaded proof bind the nine exact jobs and CI artifacts. All nine notebooks and 27 canonical v2 records were validated again after download. Each journey produces two successful variants and one failed cell; CLI and extension records agree, REST/MCP predictions match, tampered models refuse, provider-independent history remains readable, and serving records zero training calls after two positive controls. The artifacts retain full logs, notebooks, bundles and installable exports for 90 days; final durable release archival remains #326.

CI lifecycle and metadata gate evidence records real automatic PR supersession, unchanged required checks, native SARIF readback and the frozen-source publication checks. The ten Dependabot PRs

336–#345 were closed as superseded by the consolidated 0.4.6 development line.

Their updates still require maintainer review and protected integration via PR #346.

These are development qualification results. Final protected-source qualification, publication authorization, public-byte verification and release archival remain

326/#327. No branch merge, tag, release, registry, package, extension or site

publication is established by this evidence.

Coordinated candidate and review preparation

The v2 candidate inventory covers four wheels, four sdists and the VSIX from one clean source commit. Artifact kinds, exact sizes and SHA-256 digests are checked before consumption. VSIX admission also binds the complete ZIP contents, source, licences and reproducibility record; dirty or synthetic fixture builds are refused. The editor qualification consumes these exact bytes on development and protected master, and the protected signer waits for that qualification. Release attachments retain the extension and its records alongside the Python candidates. Full editor and journey evidence is included in the signed validation archive.

The PyPI public-byte verifier reads only the regular metadata/source blobs from the verified full Git commit. It does not check out or execute release code. The original metadata snapshot and actual public archive comparisons remain mandatory. The dated directory checklist records the remaining observations after authorized publication.

These development changes prepare maintainer review. They do not validate or merge the branch, authorize publication, or establish that 0.4.6 is publicly available.