release: v0.0.5 — consolidation of 59 PRs + changelog + evidence review

[lucastononro]

Summary

Promotion of release/v0.0.5 to main: consolidation of 59 merged PRs/issues on top of the v0.0.4 line, plus CHANGELOG.md and a fresh evidence review (docs/evidence/v0.0.5-review.md). Per-PR merge detail (Greptile follow-ups, conflict resolutions, per-wave test counts) is in STAGING-v0.0.5.md on this branch.

Product features

• Compare leaderboard (Comparison leaderboard UI consuming the /compare endpoint #161), snapshot reproduce (feat: "Reproduce" action — replay a snapshot and diff metrics vs the original run #162), prediction playground (Add an in-app prediction playground for deployed models #163)
• Dataset preview + profiling (feat(data): raw dataset preview + quick-profile on upload #168), sample-datasets gallery (feat: surface sample datasets with a guided first-run gallery #169)
• Training controls (Pre-flight training controls: metric, model families, trial budget, wall-clock/cost caps #164), cost budgets with budget_exceeded SSE (Enforce per-project cost budgets with a hard-stop guardrail #165)
• Resume sessions (feat: resume / re-run for aborted and failed sessions #170), HITL approval gate (feat: human-in-the-loop approval checkpoints before expensive stages #171), EDA action cards (feat: turn EDA findings into one-click-to-prep action cards #172)
• Workspace zip download (feat(download): bulk workspace export — session + project zip endpoints #87), file-authoring skills ([P2] [feature-request] Split file authoring from code execution — give agents write-file / edit-file / run-file (plus notebook cell edit/delete/rerun) so they refactor instead of re-paste #85)

Compute: RunPod provider (#145); per-project GPU allowance (#160)

Frontend: session-scoped SSE bus (#148), chat memoization (#150), autoscroll pinning (#152), typed SSE union (#157), error boundaries (#159), page.tsx split (#166), react-resizable-panels v4 migration (#24)

Security: opt-in bearer auth (#138), CORS fail-fast (#140), prod compose secrets + localhost binds (#136), .env 0600 (#134), S3 upload bounds + bucket allowlist (#141/#143/#147)

Reliability: LLM timeout normalization (#142), concurrent readyz probes (#144), Sentry capture fix (#151), boto3/DuckDB event-loop offload (#143/#139)

Database: Alembic migration framework (#153) + revisions for training_config (#164), budget_usd (#165), deployments provider columns (#145)

CLI: status/logs/--version + Docker preflight (#126), first CLI test suite + env perms (#134), README refresh (#129)

CI/tooling: pinned ruff (#137/#135), coverage gate (#149), Postgres CI (#154), advisory vuln scans (#156), actions major bumps (#7–#10), hashed requirements.lock (#173/#128)

Dependencies: fastapi 0.136.1, sqlalchemy 2.0.49, sse-starlette 3.3.4, python-multipart 0.0.28, python-dotenv 1.2.2, react-markdown 10, react-syntax-highlighter 16, postcss 8.5, prettier 3.9.6

Evidence (fresh runs on this branch, 2026-07-29)

• Backend pytest: 647 passed, 8 skipped (70s)
• CLI pytest: 12 passed
• ruff@0.15.22 check + format --check: clean (220 files)
• Frontend: vitest 20/20, tsc --noEmit clean, next lint clean, prettier clean, production next build OK (8 routes, / prerenders)
• Alembic: fresh-sqlite upgrade head through 4 revisions, single head b7d3f5a91c02; migration tests 7/7
• docker compose config -q: dev + prod OK with dummy secrets (fails closed without)
• CLI smoke: --version / --help OK (note: wheel still reports 0.0.4 — version bump expected at release cut)
• Boot smoke: uvicorn boots on temp sqlite without Modal/S3 creds; /api/health ok; /api/readyz fail-closed not_ready without S3; bearer gate 401 without / 200 with token

NOT evidenced — honest gap list

• Live RunPod API execution — no credentials; worker image never built. Needs: build docker/runpod-worker/, set RUNPOD_*, run one sandbox + kernel + serving deploy.
• Live Modal sandbox runs — no creds exercised; sandbox/kernel paths tested against mocks only. Needs: a real trainable up session with Modal tokens.
• GitHub Actions workflow runs — CI never ran on this branch; bumped actions (chore(deps): bump docker/login-action from 3 to 4 #7–chore(deps): bump docker/build-push-action from 5 to 7 #10) and new vuln-scan jobs (ci: add advisory dependency and container image vulnerability scanning #156) statically validated only. The first run on this PR is the real test.
• Browser/E2E click-through of the new UI — no e2e harness; frontend evidence is unit/type/lint/build level. Needs: a Playwright/browser pass over the new features.
• Real Postgres migration of a production legacy DB — tested on fixtures, fresh sqlite, and one postgres:16 container run (wave 5); never against real production data with the pre-Alembic stamp path. Needs: restore a v0.0.4 production dump and run stamp + upgrade head.
• Multi-user auth — design only (docs(design): multi-user auth + ownership design note (#113) #167), not implemented; issue Add multi-user auth, ownership, and experiment sharing #113 open.
• Per-project workspace isolation — issue [P1] [feature-request] Per-project workspace isolation — a session must not be able to read another project's files #80 open, unaddressed.

Greptile Summary

This release consolidates the v0.0.5 feature set across backend compute, migrations, security, workspace tooling, frontend streaming and UI, CLI behavior, dependencies, and CI.

• Adds RunPod compute, workspace exports, dataset tooling, training controls, budgets, approvals, session resume, and snapshot reproduction.
• Introduces Alembic migrations, opt-in bearer authentication, production secret hardening, and S3 validation.
• Refactors the frontend around a session-scoped SSE bus and new workspace/chat components.
• Adds pinned dependency lockfiles, expanded tests, coverage enforcement, and advisory vulnerability scans.

Confidence Score: 4/5

The authentication integration must be fixed before merging because setting the advertised API_AUTH_TOKEN makes the bundled frontend’s API requests and SSE connection fail with 401 responses.

The backend now requires a shared credential on all protected API traffic, but neither the frontend API client nor its EventSource construction can provide that credential.

Files Needing Attention: backend/auth.py, frontend/src/lib/api.ts, frontend/src/lib/useSessionStream.ts

Important Files Changed

Filename	Overview
backend/auth.py	Adds a global opt-in bearer gate, but enabling it blocks the bundled frontend because no client credential path is wired.
frontend/src/lib/api.ts	Expands the typed API surface but does not support the newly introduced bearer-auth configuration.
frontend/src/lib/useSessionStream.ts	Adds consolidated session streaming, but its EventSource URL remains unauthenticated when API_AUTH_TOKEN is enabled.
backend/routers/download.py	Adds session and project workspace ZIP endpoints consistent with the repository's current shared-token, single-user authorization model.
backend/db.py	Replaces boot-time schema mutation with Alembic upgrade and legacy-schema stamping logic.
backend/services/compute/runpod_provider/serving.py	Adds RunPod-backed serving lifecycle support as part of the new compute-provider abstraction.
frontend/src/lib/useSessionStream.ts	Centralizes session SSE state and event handling, with the authentication integration gap noted above.
.github/workflows/ci.yml	Expands CI with PostgreSQL-backed tests, coverage artifacts, frontend tests, and advisory dependency and image scans.

Sequence Diagram

sequenceDiagram
    participant B as Browser frontend
    participant P as Next.js /api rewrite
    participant A as FastAPI auth middleware
    participant R as API/SSE route
    B->>P: GET /api/... (no bearer token)
    P->>A: Forward unchanged request
    alt API_AUTH_TOKEN configured
        A-->>B: 401 Unauthorized
    else API_AUTH_TOKEN unset
        A->>R: Forward request
        R-->>B: API response or SSE stream
    end

Loading

_{Reviews (1): Last reviewed commit: "docs(release): v0.0.5 changelog + eviden..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Context used - AGENTS.md (source)

[lucastononro]

@greptile-apps review

[greptile-apps]

Bearer gate blocks the frontend

When API_AUTH_TOKEN is configured, this middleware requires credentials on every non-exempt /api request, but the bundled API client and session EventSource provide no token, causing normal UI requests and session streaming to fail with 401 responses.

Context Used: AGENTS.md (source)