Polymorph 0.4.0a6 - evidence-bound review

Corrective pre-release

This release makes review and recurring-run evidence match the real execution objects instead of test-only shapes.

What changed

• Route preparations now expose source and destination schema fingerprints directly.
• Review artifacts apply to the real MoveSession API and preserve the reviewer identity.
• polymorph-kit review model derives a bounded, metadata-only UI model from preparation JSON.
• Review UI presents evidence classes first; numeric confidence is advisory detail and never authority.
• Commit receipts fail closed when a write result has no stable run ID. No random checkpoint identity is fabricated.
• OAuth refresh failures suppress secret-bearing exception causes.
• Windows documentation now states the exact Job Object resource boundary without claiming filesystem or network isolation.
• Quality CLI wording now matches its current content-inspected local-file behavior.

Verification

• Compile, Ruff, formatting, and strict mypy passed.
• Full pytest suite passed with warnings treated as errors.
• scripts/validate_local.py and World-Benchmark.cmd passed locally.
• Wheel and sdist passed Twine checks.
• A clean virtual environment installed the wheel, exported the UI, scaffolded a connector, installed its [test] extra, and passed its generated contract test.
• GitHub Actions remain disabled; this release did not run Actions.

Start

py -m pip install polymorph_bridge-0.4.0a6-py3-none-any.whl
polymorph-kit --help
polymorph-kit connector scaffold my-source
polymorph-kit ui export review-ui

This remains a pre-release. Live database, HTTP, and custom-source execution stays fail-closed until source snapshot evidence is implemented for that boundary.