AncestryLLM 0.6.0

AncestryLLM 0.6.0 advances the Astral tooling modernization, hardens the packaged desktop sidecar lifecycle, and completes the v0.6 Diátaxis documentation cutover alongside the v0.5.0 desktop foundation.

Highlights

  • Packaged desktop startup now verifies an embedded-digest-bound, exact target/build payload inventory before token generation or process spawn, rejects payload and protocol/build mismatches, bounds crash retries, and supervises full POSIX and Windows process trees through shutdown. Integrity failures preserve the crash-restart budget and recover only through the separately bounded manual retry after the payload is repaired.
  • Shutdown drains the currently implemented Uvicorn listener/server, stdio, sidecar process tree, and temporary launch directory. Future jobs, provider streams, and database sessions must register their own drains before their routes ship.
  • The unreleased desktop source now presents a versioned, allowlisted schema for five non-secret settings with optimistic revisions and atomic owner-only publication. Its fixed bridge also provides status, set, and verified-delete credential operations while keeping values write-only in the Python OS keyring boundary. Environment-managed credentials remain read-only, and the renderer retains status rather than secret input. Packaged-runtime evidence for these new methods remains part of the Issue #131 desktop gate.
  • The unreleased desktop renderer now uses a reusable responsive application shell with typed navigation, capability-gate, seven-state async, coded-error, and dialog-focus contracts. Persistent local/offline status, a keyboard destination palette, deterministic skip and focus behavior, exact-lock Chromium accessibility scans, and minimum-window 200% zoom coverage establish source-level presentation evidence without adding IPC, network, filesystem, provider, consent, or domain authority. Target-matched screen-reader and packaged accessibility evidence remains part of Issue #131.
  • First-run desktop onboarding now recommends the only available mode, Local Desktop, while keeping Connect Remote and Host Remote visibly advanced and unavailable. A typed startup report checks configuration, SQLCipher, keyring, and workspace readiness without exposing secrets, paths, records, prompts, or host identity. Blocking failures preserve a read-only recovery shell; one bounded retry only rechecks state and cannot initialize a database, overwrite a key, fall back to plaintext, or open a listener. Packaged desktop secret access is keyring-only, while the documented CLI/headless environment fallback remains unchanged.
  • A schema-v1 deployment-profile control plane now makes Local Desktop the explicit safe default and exposes reviewed copy, previews, confirmation-bound local recovery, diagnostics, and redacted backup/support metadata through the canonical CLI/service boundary. It never discovers a server, opens or widens a listener, starts a container, or moves genealogy data. Connect Remote and Host Remote remain visibly advanced but fail closed until their separate enrollment and host-runtime work ships.
  • Electron Main now contains a deliberately unwired, schema-v1 host container-control foundation for later Local Desktop and Host Remote work. It verifies an app-owned Unix endpoint and Engine identity, ignores ambient Docker selection, validates an exact hardened Compose plan, runs bounded no-shell lifecycle commands, and reconciles only exactly labeled resources. Native macOS arm64 evidence exercises its isolated Colima lifecycle and cleanup without changing the default engine. No profile activates it, no Docker authority crosses to preload, renderer, or containers, and it is not a container-runtime availability claim.
  • Diátaxis information architecture applied to the documentation navigation and Home.md, with clear Diátaxis mode headings in the sidebar.
  • Page-level SEO metadata sidecar (docs/_data/page_metadata.json) injected into the Pages staging tree; Wiki output remains front-matter free.
  • jekyll-seo-tag and jekyll-sitemap enabled in the Pages build.
  • robots.txt published to the documentation site.
  • GitHub Pages workflow upgraded to upload-pages-artifact v5, which uses the repository-pinned upload-artifact v7 internally.
  • docs/DOCS_AUTHORING.md authoring rules, Diátaxis migration inventory, and editorial baseline added.
  • ADR-0026 records the accepted local-container and advanced remote deployment architecture, ownership model, quantitative budgets, and threat-model gates. The profile control plane and host-only control foundation described above are implemented, but no container or remote application runtime support is added in this release.
  • docs/release-evidence/0.6.0/ evidence directory added.
  • Repository setup, CI, release-readiness, release, desktop-sidecar, and release-project proof jobs verify the pinned uv 0.12.1 release archive, executable hash, and GitHub provenance before first execution.
  • Sanitized schema-v1 bootstrap receipts are retained by CI and are required by release evidence; stock-pip wheel and sdist consumer smoke tests remain.
  • The former dev extra is replaced by locked PEP 735 groups for linting, typing, tests, security, builds, and release verification. Purpose-specific CI jobs synchronize only their declared profiles; provider and desktop extras retain their user-facing installation meaning.
  • Repository environment ownership is centralized in Make and exact uv 0.12.1 commands. A system Python 3.12-3.14 is required, .python-version selects 3.12 by default, and uv cannot download another interpreter.
  • Exact ty 0.0.69 runs visibly beside strict mypy as a nonblocking advisory. Its complete-tree diagnostics, parity fixtures, timings, and suppressions are recorded in the ty advisory evaluation; strict mypy and pydantic.mypy remain the authoritative 0.6 release gate.
  • Ruff remains at 0.16.1 while reviewed typing, performance, modernization, and correctness rule families are enabled in separate batches. Provider-import, Pydantic-runtime, GEDCOM characterization, and startup evidence are recorded in the Ruff rule-expansion evaluation.
  • A locked uv_build 0.12 candidate is evaluated reproducibly beside the unchanged production setuptools backend. Candidate outputs are internally reproducible but fail artifact equivalence because of source, license, metadata, and wheel-record drift, so adoption is rejected/deferred; the complete result is in the uv_build evaluation.
  • Isolated user installation now supports uv tool install ancestryllm alongside the retained pipx and ordinary pip consumer paths.
  • Exact-commit upstream Ruff and uv hooks replace the former local wrappers, while local gitleaks and canonical pre-push gates remain. The complete dependency audit proves parity between uv export --locked --all-extras --all-groups and uv.lock, and every tracked Markdown file receives the same GFM validation.
  • Checked-in VS Code settings use Ruff for linting and formatting without unsafe fixes. Because the 0.6 ty evaluation did not pass every cutover gate, mypy editor ownership and strict pydantic.mypy checking remain authoritative.

Documentation

Upgrade notes

Developer and release tooling now uses the verified repository-local uv bootstrap and purpose-specific locked groups. Contributors must install a supported system Python and run make setup; the repository will not download Python or accept a different uv, and the former .[dev] installation path is no longer supported. No genealogy, provider-consent, storage, or public API contract has changed. The CLI adds the deployment command family for profile copy, status, preview, explicit local recovery, diagnostics, and redacted evidence. The private loopback API and fixed Electron bridge add the versioned settings and write-only credential-management operations described above; packaged Electron sidecar startup and shutdown are hardened as described above.

Project-produced 0.x binaries remain unsigned. The sidecar manifest detects payload substitution relative to the built Electron main process; it is not a publisher signature or whole-application protection. Issue #132 owns publisher signing and notarization for v1.0.0. Verification and process spawn remain separate filesystem operations, leaving a narrow local time-of-check/time-of-use replacement residual. The macOS CI verification overlay preserves the exact manifested payload bytes by excluding only the sidecar resource tree from Electron’s second ad hoc signing pass; PyInstaller’s nested signatures remain intact and the outer application signature still seals the resource tree.

No GEDCOM, provider execution or consent, storage, application-container, or remote-hosting behavior has changed. Selecting a default-provider setting neither activates a provider nor grants cloud consent. Deployment profile selection is now an implemented fail-closed control-plane constraint; the unwired host supervisor is a reviewed future-runtime foundation. Neither is a container or remote-runtime availability claim.