Polymorph v0.4.0a5

Polymorph 0.4.0a5

This pre-release turns Polymorph's conservative write core into a much easier integration surface without weakening Evidence vs Authority.

New

• polymorph-kit connector scaffold: fail-closed source connector starter, no overwrite and no generated GitHub Actions.
• polymorph-kit quality inspect: bounded streaming quality reports with row numbers and issue metadata, never row values.
• Explicit lazy cleaning plans for NFC normalization, whitespace trimming, and empty-to-null.
• Dependency-free EN/DE Web Component plus portable schema-bound review artifacts.
• Thread-safe, in-memory OAuth access-token refresh adapter with redacted representations.
• Durable local recurring-run checkpoints, compare-and-swap generations, idempotent commit receipts, and fenced single-host leases.
• Honest enterprise-readiness, review UI, recurring-run, and ecosystem documentation with copy-paste recipes.

Local acceptance evidence

• Commit: $sha
• 1,249 tests collected; 1,241 passed and 8 environment-dependent skips, with warnings treated as errors.
• Compile, Ruff, format, and strict mypy passed across 72 package modules.
• scripts/validate_local.py passed all checks, three workflows, and all gates.
• World-Benchmark.cmd passed and retained eight historical local observations plus the light-mode SVG.
• Wheel and sdist passed wine check, clean-Venv install, pip check, resource export, entry-point smoke, and generated-connector install/test.
• GitHub Actions remained disabled and did not produce this evidence.

Important boundaries

This is still alpha software. The OAuth adapter is not a token vault or authorization server. Local leases are not distributed locks. Incremental checkpoints are not CDC. Review artifact SHA-256 is content integrity, not identity authentication. No SOC 2, ISO 27001, HIPAA, SLA, or independent-audit claim is made.

Start with README.md, docs/ECOSYSTEM_KIT.md, and docs/ENTERPRISE_READINESS.md. Verify downloads against SHA256SUMS.txt or
elease-manifest.json.