[suffro]

Summary

• harden canonical report loading by recomputing counts, metrics, failures, property summaries, checks, status and exit code
• prevent HTTP error bodies and common secret-like metadata from leaking into reports; keep authenticated healthchecks on the backend origin
• finalize package version/changelog/metadata at 0.1.0 and add a reproducible sub-five-minute demo for fuzzing, replay, regression, production drift, policy routing and SDK use
• expand clean-wheel CI smoke to prove expected exit codes for property, calibration, regression and production-drift failures

Validation

• uv run ruff check .
• uv run ruff format --check .
• uv run mypy
• uv run pytest — 276 passed, 1 skipped
• syngraphe check
• built wheel and sdist; clean wheel smoke passed on Python 3.11, 3.12 and 3.13
• full CLI/SDK workflow verified with exit codes 0/1/2
• runtime dependency/license and hash-pinned lockfile audit passed

Remaining release blocker

The sole blocker before tagging v0.1 is one successful opt-in run against a real decision backend. The existing test requires DECGUARD_EXTERNAL_CONTRACT to reference a reachable non-mock endpoint implementing decguard.http/0.1, or an installed plugin/proxy translating a real TypeSafe/Kev-style POST /v1/systemone service, with credentials supplied through environment variables. No compatible endpoint or credential was available during this validation.

No tag, PyPI publication or GitHub release is included.