release: synchronize v0.4.2 remediation contracts

.github/workflows/release.yml

@@ -65,7 +65,7 @@ jobs:
             --commit $env:GITHUB_SHA `
             --tree $tree `
             --tag $env:GITHUB_REF_NAME `
-            --version 0.4.1 `
+            --version 0.4.2 `
             --url "$env:GITHUB_SERVER_URL/$env:GITHUB_REPOSITORY/releases/tag/$env:GITHUB_REF_NAME" `
             --ci-url "$env:GITHUB_SERVER_URL/$env:GITHUB_REPOSITORY/actions/runs/$env:GITHUB_RUN_ID" `
             --output .hermes/desktop-runtime-v1/runtime/release-identity.json
@@ -127,7 +127,7 @@ jobs:
         run: |
           $expectedAssets = @(
             "ArcheAxis.OS-Windows-x64-setup.exe",
-            "cognitive_loop_os-0.4.1-py3-none-any.whl",
+            "cognitive_loop_os-0.4.2-py3-none-any.whl",
             "release-identity.json",
             "SHA256SUMS.txt"
           ) | Sort-Object

README.md

@@ -12,8 +12,8 @@ ArcheAxis OS 以受治理的统一知识底座连接个人学习链和 AI 使用
 - **个人学习与 AI 使用的双向反馈**：学习笔记、纠错、练习和人工审核不会自动提升为事实；AI 的来源、Claim、解释、任务结果和 Lesson 同样必须先经 Candidate 治理。
 - **可治理的本地运行时**：SQLite 持久化、Outbox/Receipt、失败不改状态、重试与回读，以及不暴露内部审计 ID 的公开投影。
 - **桌面 Workspace A1**：默认 Apple-light，Violet Core 保留为暗色主题；一级 Rail、动态二级导航、上下文与证据检查器和真实活动坞均已接入。真实 Chromium 验证壳层交互后方可发布；Tauri WebView 点击级证据和公开发布资产仍未闭环，不能用 Chromium 结果替代。
-- **当前版本**：`0.4.1`；Release Manifest 仍为 `unreleased / public=false`，公开 Alpha/Beta/Stable 发布尚未宣告。
-- **发布真相**：`v0.4.0` 是保留且不可原地改写的 historical release，但具有 **incomplete checksum payload coverage**；它不证明完整发布完整性。`v0.4.1` 只有在 merge-SHA CI、tag、公开资产集合、下载后 SHA-256、release identity 与 installer lifecycle 全部回读通过后才可宣称发布。
+- **当前版本**：`0.4.2`；Release Manifest 仍为 `unreleased / public=false`，公开 Alpha/Beta/Stable 发布尚未宣告。
+- **发布真相**：`v0.4.0` 是保留且不可原地改写的 historical release，但具有 **incomplete checksum payload coverage**；`v0.4.1` 也是保留且不可重写的历史 tag。`v0.4.2` 只有在 merge-SHA CI、tag、公开资产集合、下载后 SHA-256、release identity 与 installer lifecycle 全部回读通过后才可宣称发布。
 
 Research candidate 仍必须经过人工审查和来源独立性验证，不能自动当作 verified truth。产品定位见 [`docs/PRODUCT_POSITIONING.md`](docs/PRODUCT_POSITIONING.md)；当前事实、限制和验证证据见 [`docs/PROJECT_STATUS.md`](docs/PROJECT_STATUS.md) 与 [`docs/VERIFICATION_POLICY.md`](docs/VERIFICATION_POLICY.md)。
 

THIRD_PARTY_NOTICES.md

@@ -7,7 +7,7 @@ packages, bundled binaries, fonts, or other components.
 ## Declared direct Python dependencies
 
 The release dependency contract is `pyproject.toml` plus the exact resolved
-`uv.lock`. At version 0.4.1 the direct runtime declarations are:
+`uv.lock`. At version 0.4.2 the direct runtime declarations are:
 
 `fastapi`, `python-multipart`, `uvicorn`, `pydantic`, `numpy`, `requests`,
 `pyyaml`, `beautifulsoup4`, `defusedxml`, `apscheduler`, `sqlite-vec`, `loguru`,

app/main.py

@@ -42,7 +42,7 @@ async def core_runtime_lifespan(_: FastAPI):
 app = FastAPI(
     lifespan=core_runtime_lifespan,
     title="Cognitive-Loop-OS",
-    version=str(config.get("app.version", "0.4.1")),
+    version=str(config.get("app.version", "0.4.2")),
     description="AI cognitive runtime with an integrated Knowledge-Base. "
     "Absorbs Obsidian, Tana, Notion, Logseq, Roam, Heptabase, GraphRAG, Zettelkasten.",
     docs_url="/docs",
@@ -362,7 +362,7 @@ def health():
     return {
         "status": "ok",
         "system": "cognitive-loop-os",
-        "version": str(config.get("app.version", "0.4.1")),
+        "version": str(config.get("app.version", "0.4.2")),
         "endpoints": _http_route_counts(),
         "stats": {
             "documents": _c("kb_documents"),
@@ -649,7 +649,7 @@ def architecture():
     Auth-->Router; Router-->Pipeline; Pipeline-->Search; Pipeline-->Garden
     Search-->SQLite; Search-->VecDB; Garden-->GraphDB; Review-->SQLite; SQLite-->Backup
 ```""",
-        "version": str(config.get("app.version", "0.4.1")),
+        "version": str(config.get("app.version", "0.4.2")),
         "measurement_note": "Module and test counts are intentionally not embedded.",
     }
 

app/release-manifest.json

@@ -6,7 +6,7 @@
     "english_name": "ArcheAxis OS",
     "workspace_name": "元枢·观心",
     "workspace_english_name": "ArcheAxis Cognitive Workspace",
-    "version": "0.4.1",
+    "version": "0.4.2",
     "requires_python": ">=3.11"
   },
   "release": {
@@ -23,9 +23,9 @@
   "dependency_lock": {
     "path": "uv.lock",
     "algorithm": "sha256",
-    "digest": "10304d747de08eaefd2a6972ad0191bdc24c1ead3d42c3ca644194daeb4421c3",
+    "digest": "5aac8ceb5823ba27c486108911c26a18dfd5d722d3fdc867f454f96156848429",
     "format_version": 1,
-    "revision": 3
+    "revision": 4
   },
   "migrations": {
     "owners": [

config/defaults.yaml

@@ -1,7 +1,7 @@
 # Public, non-secret baseline for every runtime profile.
 app:
   name: "Cognitive-Loop-OS"
-  version: "0.4.1"
+  version: "0.4.2"
   environment: "development"
   port: 8000
   host: "127.0.0.1"

config/settings.yaml

@@ -4,7 +4,7 @@
 
 app:
   name: "Cognitive-Loop-OS"
-  version: "0.4.1"
+  version: "0.4.2"
   release_version: ""
   environment: "development"
   port: 8000

desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "archeaxis-desktop-shell",
   "private": true,
-  "version": "0.4.1",
+  "version": "0.4.2",
   "scripts": {
     "tauri": "tauri"
   },

desktop/scripts/verify_nsis_install.ps1

@@ -93,14 +93,14 @@ try {
     $base = "http://127.0.0.1:$($normal.Listener.LocalPort)"
     $workspaceStatus = (Invoke-WebRequest "$base/workspace" -UseBasicParsing).StatusCode
     $status = Invoke-RestMethod "$base/workspace/api/status"
-    if ($workspaceStatus -ne 200 -or $status.release.version -ne '0.4.1') {
+    if ($workspaceStatus -ne 200 -or $status.release.version -ne '0.4.2') {
         throw 'installed Workspace returned an invalid product response'
     }
     if ($RequireReleaseIdentity) {
         $version = Invoke-RestMethod "$base/version"
         if (
             $version.release.status -ne 'released' -or
-            $version.release.tag -ne 'v0.4.1' -or
+            $version.release.tag -ne 'v0.4.2' -or
             $version.capabilities.public_installer -ne 'available'
         ) {
             throw 'installed runtime did not expose the verified public release identity'

desktop/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archeaxis-desktop-shell"
-version = "0.4.1"
+version = "0.4.2"
 edition = "2024"
 rust-version = "1.88"
 

desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ArcheAxis OS",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "identifier": "com.archeaxis.cognitive-workspace",
   "build": {
     "frontendDist": "../bootstrap"

docs/PROJECT_STATUS.md

@@ -4,7 +4,7 @@
 
 ## 发布真相
 
-- 当前源码版本为 `0.4.1`，但 packaged source manifest 仍为 `unreleased / public=false`；源码字段不会预先宣告公开发布。
+- 当前源码版本为 `0.4.2`，但 packaged source manifest 仍为 `unreleased / public=false`；源码字段不会预先宣告公开发布。
 - `v0.4.0` 是保留的 historical release，但 readback 已证明 incomplete checksum payload coverage：公开 installer 名称与 manifest 名称不一致，且有一个额外公开 payload 未被 manifest 覆盖。历史 tag、Release 和资产不原地替换。
 - 新版本只有在 tag 精确绑定受保护 `main`、exact-SHA CI 全绿、公开资产集合与 checksum payload allowlist 双向一致、provider digest 可核验、下载后 SHA-256 复算通过、release identity 读回一致、installer lifecycle 通过后，才可报告发布完成。当前没有签名发布声明。
 

knowledge_base/api.py

@@ -1,4 +1,4 @@
-"""Knowledge-Base API — SQLite-backed, v0.4.1.
+"""Knowledge-Base API — SQLite-backed, v0.4.2.
 
 Route counts are reported live by the mounted Core ``/health`` endpoint.
 Full OpenAPI documentation at /docs.
@@ -34,7 +34,7 @@
 
 app = FastAPI(
     title="Cognitive-Loop-OS Knowledge-Base",
-    version="0.4.1",
+    version="0.4.2",
     description="Knowledge management runtime. Absorbs capabilities from Obsidian, Tana, Notion, Logseq, Roam, Heptabase, Capacities, Anytype, GraphRAG, and Zettelkasten.",
     docs_url="/docs",
     redoc_url="/redoc",

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cognitive-loop-os"
-version = "0.4.1"
+version = "0.4.2"
 description = "Local-first cognitive and knowledge runtime with evidence-constrained workflows"
 readme = "README.md"
 requires-python = ">=3.11"

shared/config.py

@@ -25,7 +25,7 @@
 _DEFAULTS: dict[str, Any] = {
     "app": {
         "name": "Cognitive-Loop-OS",
-        "version": "0.4.1",
+        "version": "0.4.2",
         "environment": "development",
         "port": 8000,
         "host": "0.0.0.0",

tests/test_ci_a0_gates.py

@@ -94,8 +94,8 @@ def test_desktop_shell_uses_the_product_version_everywhere() -> None:
     } == {product_version}
 
 
-def test_v0_4_1_release_candidate_uses_one_version_everywhere() -> None:
-    expected_version = "0.4.1"
+def test_v0_4_2_release_candidate_uses_one_version_everywhere() -> None:
+    expected_version = "0.4.2"
     project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
     manifest = json.loads(
         (ROOT / "app/release-manifest.json").read_text(encoding="utf-8")
@@ -125,7 +125,7 @@ def test_v0_4_1_release_candidate_uses_one_version_everywhere() -> None:
     } == {expected_version}
     assert f"--version {expected_version}" in release_workflow
     assert (
-        'name = "cognitive-loop-os"\nversion = "0.4.1"\nsource = { editable = "." }'
+        'name = "cognitive-loop-os"\nversion = "0.4.2"\nsource = { editable = "." }'
         in (ROOT / "uv.lock").read_text(encoding="utf-8")
     )
     for path in (
@@ -142,7 +142,7 @@ def test_v0_4_1_release_candidate_uses_one_version_everywhere() -> None:
     lifecycle = (ROOT / "desktop/scripts/verify_nsis_install.ps1").read_text(
         encoding="utf-8"
     )
-    assert "v0.4.1" in lifecycle
+    assert "v0.4.2" in lifecycle
 
 
 def test_wheel_gate_requires_release_and_workspace_assets() -> None:

tests/test_diagnostics_api.py

@@ -18,7 +18,7 @@ def test_diagnostics_returns_safe_versioned_status() -> None:
     )
     assert payload["release"] == {
         "status": "unreleased",
-        "version": "0.4.1",
+        "version": "0.4.2",
         "channel": "development",
         "source_commit": "unavailable",
     }
@@ -37,7 +37,7 @@ def test_diagnostics_does_not_promote_unverified_release_override(monkeypatch) -
     assert response.status_code == 200
     assert response.json()["release"] == {
         "status": "unreleased",
-        "version": "0.4.1",
+        "version": "0.4.2",
         "channel": "development",
         "source_commit": "unavailable",
     }
@@ -54,7 +54,7 @@ def test_diagnostics_rejects_unsafe_release_version(monkeypatch) -> None:
     assert response.status_code == 200
     assert response.json()["release"] == {
         "status": "unreleased",
-        "version": "0.4.1",
+        "version": "0.4.2",
         "channel": "development",
         "source_commit": "unavailable",
     }

tests/test_release_manifest.py

@@ -30,7 +30,7 @@ def test_release_manifest_is_packaged_truth_and_matches_dependency_lock() -> Non
         "channel": "development",
         "public": False,
     }
-    assert manifest["product"]["version"] == "0.4.1"
+    assert manifest["product"]["version"] == "0.4.2"
     assert manifest["source"]["commit"] == "unavailable"
     assert manifest["verification"]["embedded_test_counts"] is False
     lock_digest = hashlib.sha256((root / "uv.lock").read_bytes()).hexdigest()
@@ -63,7 +63,7 @@ def test_release_manifest_is_packaged_truth_and_matches_dependency_lock() -> Non
     assert manifest["product"]["version"] == config.get("app.version")
     assert safe_release_summary() == {
         "status": "unreleased",
-        "version": "0.4.1",
+        "version": "0.4.2",
         "channel": "development",
         "source_commit": "unavailable",
     }
@@ -145,11 +145,11 @@ def test_bundled_release_identity_exposes_a_verified_public_release_summary(
             {
                 "schema_version": "1.0.0",
                 "release": {
-                    "tag": "v0.4.1",
-                    "version": "0.4.1",
+                    "tag": "v0.4.2",
+                    "version": "0.4.2",
                     "channel": "stable",
                     "public": True,
-                    "url": "https://github.com/DTALEX66/Cognitive-Loop-OS/releases/tag/v0.4.1",
+                    "url": "https://github.com/DTALEX66/Cognitive-Loop-OS/releases/tag/v0.4.2",
                 },
                 "source": {
                     "commit": "34ca0fbd5ae636314a3403c473bde9247ef95907",
@@ -166,12 +166,12 @@ def test_bundled_release_identity_exposes_a_verified_public_release_summary(
 
     assert release.safe_release_summary() == {
         "status": "released",
-        "version": "0.4.1",
+        "version": "0.4.2",
         "channel": "stable",
         "source_commit": "34ca0fbd5ae636314a3403c473bde9247ef95907",
-        "tag": "v0.4.1",
+        "tag": "v0.4.2",
         "ci_run": 30548553629,
-        "url": "https://github.com/DTALEX66/Cognitive-Loop-OS/releases/tag/v0.4.1",
+        "url": "https://github.com/DTALEX66/Cognitive-Loop-OS/releases/tag/v0.4.2",
     }
     assert release.effective_capabilities()["public_installer"] == "available"