Prepare v0.8.0 checkpoint and qualify scoped fixture repairs

[MrScripty]

Pumas v0.8.0 needs a pinned source checkpoint with current evidence before final artifacts or publication. This change prepares the release notes, migration/consumer inventory and changelog; repairs two launcher fixture assumptions and one bounded HF cleanup fixture; and records qualification without changing production APIs, schemas, dependency pins or manifests. Version remains 0.8.0-rc.1.

Qualified code candidate: aa40e155846cdac6cd94b6f5c2fd6a35cddce16e. Evidence-only final head: 832e9ecc77e89b642d31e142c795811f30f9b887. Its own Build 38531420040 subsequently completed success: all nine applicable jobs passed; tag-only package/assembly jobs were skipped. The historical aa40 and df53 receipts remain unchanged.

Validation:

• Build 38526618039 completed success: all nine applicable jobs passed, including Rust quality, frontend/desktop, headless, Linux inference packaging, confined audio dependencies and native Linux/Windows/macOS source QA. Tag-only release jobs were skipped.
• No-default and HF core cohorts each passed 2,294 tests, 29 ignored; RPC passed 257, 13 ignored. The explicit ignored Linux kernel confinement proof actually passed. Enabled S3 reader/acquisition tests passed 58; signing/prefix passed 43 with 2 ignored; S3 warning-deny lint passed. These controlled fixtures do not qualify live AWS/MinIO endpoints.
• Original df53 Build 38522709859 failed one HF cleanup fixture (2,069 other units passed). The repair increases only that test's bounded readiness/settlement waits and diagnostics. Local focused/full sequential units (2,070), Clippy and formatting passed. An earlier concurrent-compiler run's three unrelated timeouts remain recorded.
• Actual exact-aa40 Linux package import/load/finite 256-dimensional embeddings/unload/packaged ORT identity/graceful stop passed with an untrained ONNX graph and pinned CPU ORT 1.24.2. Artifact 11877010982: 30,659,584 bytes; GitHub outer-ZIP SHA-256 3dfdca18419edf3b1125f2ad6e6577c2d9b480caa293e3a612d979a7bbac4303. No trained-model or GPU claim.
• Current exact-lock Cargo audit has zero vulnerability entries, three maintenance notices and one lru unsoundness warning with inspected AWS SDK trigger disposition. pnpm production has zero advisories; the moderate build-only sprintf-js finding remains explicitly owned. Default/S3 notices and inventories regenerated byte-identically (378/428 entries), without lock changes or suppressions.
• Pantograph's published independent consumer receipt qualifies df53, not silently aa40: 19 integration, 598 library/2 existing ignores and 4 HTTP contracts. The parent accepts the unchanged-production df53-to-aa40 lineage for this bounded CPU edge, while retaining df53 as the actual executed pin. Parent-side independent cumulative review at final head 832e9ec found no merge-blocking code or documentation defects; this is parent-supplied review evidence, not a GitHub review submission. Historical receipt review limits remain labeled at their observation time.

Machine receipt, dependency review, and minimal remaining release gates retain source/job/artifact identities and limits. Executor proxy denied both earlier artifact byte transfers with tunnel 403 after connector retrieval succeeded: no local ZIP extraction/replay or inner hashes are claimed.

Remaining release gates: required sixteen native final artifacts/workflows; reviewed trained-model/runtime execution on required inference targets; final-file license/SPDX/provenance/checksums and maintainer review; separate aligned 0.8.0 version and parent promotion decision. User inference work was preserved. No tag, release, model download or library migration was performed.

Final-head Linux review artifact 11879760064 is 30,659,573 bytes; GitHub outer-ZIP SHA-256 91fa4e7d875fa988293e5d3c49c1cb9eaef9c34dc7552efdef1007ca6ced8329. Its actual untrained ONNX lifecycle passed in CI. This later metadata does not replace the committed aa40 artifact identities or claim local byte transfer. Final head/base were rechecked as 832e9ec/ef9eead9 before the ready transition and exact-head guarded merge. After the parent supplied additional explicit user merge authorization, the identical ready-transition retry succeeded. PR70 merged at 055222931100eeedc43307271dbf7c504787888d on 2026-10-14 at 08:39:04 UTC, preserving all four branch commits. The merge tree equals final review head 832e9ec: 840eecf2d15faeebaf8a4a9156fd48566782f83b. CI evidence above belongs to the exact review head; no separate post-merge CI result is asserted. Both committed receipt hashes remained unchanged. No tag or publication was performed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8b030d8b-3ecb-4d88-9a7e-25bd99346e96

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] This checkpoint-preparation PR appears safe to merge; it does not approve final release publication.

Summary

Prepares the 0.8.0-rc.1 source checkpoint without changing production code, dependencies, schemas or manifests.

• Release notes map the v0.8.0 checkpoint and its migration path.
• Qualification records tie CI and package evidence to exact candidate revisions.
• Dependency records show audit findings and notice inventory for the candidate.
• The Hugging Face cleanup fixture allows more time to reach each checkpoint.
• Launcher fixtures allow startup time and ignore stopped Linux zombies.

MrScripty explicitly identifies the build-only sprintf-js advisory as known, retains the lru warning with its stated disposition, and defers final release gates. These are not newly introduced defects.

_{Reviews (1) · Last reviewed commit: "docs(release): record terminal v0.8 qual..." · Reviewed by Greptile}