v4.3.1

v4.3.1 — CI hardening + GT lane robust (ruff + SBOM dynamic + ws venv)

Data Science Agent v4.3.0 — Adoption, Verifiable Evaluation & Project Reliability

Data Science Agent v4.3.0

Adoption, Verifiable Evaluation & Project Reliability

This release strengthens Data Science Agent as a verifiable, reproducible AI data-science platform while preserving the Stable SDK contract.

Highlights

• Auditable real-model execution with explicit provider/model provenance
• Four controlled evaluation paths:
  • full DSA
  • DSA without the evidence critic
  • vanilla LLM + tools
  • LLM-only control
• Publication-integrity validation for real-model artifacts
• Secure credentialed four-way smoke workflow
• Stronger contributor and adoption paths
• Windows quickstart and benchmark contribution workflow
• Flagship case studies and improved project discovery
• Hardened web runtime and dependency/security gates
• Clean-wheel installation and CLI/SDK release verification
• API and Web Docker verification
• Deterministic release evidence and SBOMs

Verification

The final release commit passed:

• full pytest suite
• Ruff lint and formatting
• mypy
• npm high-severity audit
• CodeQL for Python and JavaScript
• secret scanning / gitleaks
• wheel + sdist build
• clean-environment wheel installation
• public SDK import/version smoke
• installed dsa --help
• API and Web Docker builds
• container CLI smoke
• Next.js production build
• Docker Compose validation
• MkDocs strict build

The release-candidate SonarQube Quality Gate passed with no security hotspots.

Reporting boundary

v4.3.0 provides the machinery for controlled real-model comparisons, but it does not publish or imply comparative real-model benchmark scores without reviewed credentialed artifacts.

The deterministic/stub benchmark remains harness validation, not evidence of real-model quality.

Python 3.12+ remains the supported baseline. Proposed Python 3.14 and Node 26 runtime jumps are intentionally deferred to a separate compatibility cycle.

Release date: 2026-08-30

What's Changed

📚 Documentation

• docs: sharpen positioning and benchmark credibility by @Jackxiaozhiren in #14
• feat: make the web app ready for a hosted demo by @Jackxiaozhiren in #18
• feat: add explicit real-model LLM planning and benchmark provenance by @Jackxiaozhiren in #19
• docs: surface demo and real-model evaluation by @Jackxiaozhiren in #34
• eval: add reproducible evidence-critic ablation by @Jackxiaozhiren in #36
• eval: add reproducible LLM baseline runners by @Jackxiaozhiren in #38
• eval: add secure four-way real-model smoke workflow by @Jackxiaozhiren in #39
• docs: surface flagship case studies near the demo by @Jackxiaozhiren in #41
• docs: add verified Windows PowerShell quickstart by @Jackxiaozhiren in #42
• docs: add benchmark task contribution walkthrough by @Jackxiaozhiren in #43
• docs: add executable hello-world plugin walkthrough by @Jackxiaozhiren in #44
• eval: add four-way artifact publication validator by @Jackxiaozhiren in #40
• release: prepare v4.3.0 rc1 by @Jackxiaozhiren in #48
• release: prepare v4.3.0 candidate by @Jackxiaozhiren in #47

🔐 Security & Dependencies

• fix(web): patch Next.js and Sharp security vulnerabilities by @Jackxiaozhiren in #20
• security(web): move to fully patched Next 16 runtime by @Jackxiaozhiren in #30
• chore: sync root npm workspace lock by @Jackxiaozhiren in #35

Other Changes

• ci: prevent contributor workflow notification storms by @Jackxiaozhiren in #11
• ci: deduplicate branch and pull-request CI runs by @Jackxiaozhiren in #12
• test: align v4.3.0 release-candidate ref check by @Jackxiaozhiren in #49

New Contributors

• @Jackxiaozhiren made their first contribution in #11

Full Changelog: v4.2.10...v4.3.0

v4.2.10 — Self-Contained Publish (Umbrella Only)

v4.2.10 — Self-Contained Publish (Umbrella Only)

The first fully working PyPI release via Trusted Publishing (OIDC), with PEP 740 attestations attached.

What changed

• jack-data-science-agent is now self-contained: all dsa_* modules are vendored into the wheel (src/data_science_agent/_vendor), so pip install jack-data-science-agent works standalone — no separate dsa-* distributions needed.
• Publish workflow publishes only the umbrella: rm -rf dist && uv build + packages-dir: dist/. Prior attempts failed because all workspace packages were built into dist/ and the dsa-* have no trusted publisher (HTTP 400).

Verified

• pip install jack-data-science-agent from PyPI succeeds; Agent().analyze_sync() runs end-to-end from the vendored copy (COMPLETED + evidence).
• Wheel: 0 dsa-* Requires-Dist, includes the dsa console script.
• Gates: pytest 257 · mypy 104 clean · ruff pass · mkdocs --strict pass.

Provenance

• Attestations: jack_data_science_agent-4.2.10-py3-none-any.whl.publish.attestation + sdist — verify with gh attestation verify or PyPI.
• Tags v4.2.0–v4.2.9 unchanged.

v4.2.5

release: v4.2.5 — fix publish action image tag

v4.2.3 — Docs Cleanup & PyPI Publish Path

v4.2.3 — Docs Cleanup & PyPI Publish Path

Patch release on top of the immutable v4.2.2. No breaking public API change.

Added

• PyPI Trusted Publishing workflow (.github/workflows/publish.yml) — triggered on version tags: runs the full gate (mypy/ruff/pytest) on the tagged commit, then publishes the wheel + sdist via OIDC (no long-lived token; actions pinned by SHA) and attaches artifacts to the release.
• SECURITY.md Publishing section — documents the publish path; no PyPI credentials exist in the repository.

Changed

• Stripped all remaining internal-era markers (§NN, W# §, Phase N) from the user docs, SECURITY, CONTRIBUTING, and the MCP ADR.

Fixed

• publish.yml checkout pinned to the correct actions/checkout@v5 SHA.

Gates (live)

pytest 257 · mypy 104 clean · ruff pass · mkdocs --strict pass · check_public_claims 0 issues · CI green (main + tag runs).

Honest flags

PyPI publish requires the owner to enable OIDC Trusted Publishing on the PyPI project + create a pypi GitHub environment (PENDING OWNER ACTION). Tags v4.2.0–v4.2.2 unchanged.

v4.2.2 — Repository Hygiene, CI Fixes & Docs Refresh

v4.2.2 — Repository Hygiene, CI Fixes & Docs Refresh

Patch release on top of the immutable v4.2.1. No breaking public API change.

Fixed

• API ORM models now tracked — apps/api/src/dsa_api/models/* were silently excluded by an unanchored models/ rule in .gitignore; CI/fresh clones were missing them (API couldn't import on clean checkout). Rule root-anchored to /models/, files committed.
• CI deterministic — mypy_path pins all workspace packages to source; CI installs node deps for the vscode test + web build.
• Actions bumped to Node-24 majors (checkout@v5, setup-python@v6, codeql-action@v4, dependency-review@v5, gitleaks@v3) — deprecation warning cleared.

Changed

• Repository trimmed to core artifacts — removed spec/prompt docs, demo/, versioned audit docs, human-eval/, reproduction/external/, ~17 MB of regenerable JSONs. Tags v4.2.0/v4.2.1 untouched.
• README rewritten in high-star OSS style (FastAPI/Polars/DuckDB/LangChain conventions).
• User-facing docs refreshed (docs/getting-started.md rewritten; internal-era headers removed).

Gates (live)

pytest 257 · mypy 104 clean · ruff pass · mkdocs --strict pass · check_public_claims 0 issues · CI green (18 steps, no warnings) · internal benchmark v1 50/50 @1.00 · 8/8 case studies verified.

Honest flags

PyPI publish of 4.2.2 pending owner mechanism. Tags v4.2.0/v4.2.1 still contain the removed content (release-truth rule: no tag rewrite).

v4.2.1 — Post-Release Reconciliation

v4.2.1 — Post-Release Reconciliation (V4.3 W1)

Patch release on top of the immutable v4.2.0. No breaking public API change.

Fixed

• mypy release gate restored (human_eval.py/cli.py type-narrowing rewritten through guarded loops; no new # type: ignore) → mypy 104 clean, dsa verify-release v4.2.0 back to 12/12 PASS.
• CS04/CS05 dataset-schema honesty tables repaired (malformed markdown) — marketing/financial documented as sales.csv-generator schema, not channel/OHLC.

Verified

• CS03-08 executed with the real Agent pipeline (2026-08-25) → 8/8 case studies Verified with committed outputs/ evidence (no mock).
• 18 real tool-call failures preserved as research evidence across CS01-08 (train_model on forecast questions, causal_check/correlation DuplicateError, hypothesis_test group<2, non-numeric features) — in outputs/tool_calls.json, README limitations, and the benchmark-vs-real-world gap analysis.

Documentation

• Reconciled case-study index, Product Evidence, V4.2 research report + benchmark gap analysis.
• Added docs/v4_3/V4_2_1_CHANGESET_AUDIT.md and docs/v4_3/V4_2_1_RECONCILIATION.md.
• Preserved the historical docs/v4_3/V4_2_FINAL_TRUTH.md v4.2.0 audit.

Gates (live)

pytest 257 passed · mypy 104 clean · ruff pass · npm build PASS · docker valid · mkdocs --strict PASS · dsa doctor warn (LLM stub) · dsa demo PASS · verify-release 12/12 PASS · accessory suites 145 passed. Internal benchmark v1 canonical 50/50 @1.00 preserved.

Honest flags

External validation = 1 real + 2 simulated (not independent human reviewers). SBOM 4.2.1 regeneration pending (clean env). PyPI publish pending owner mechanism.

v4.2.0 — V4.2 Validation

V4.2 Post-Release Integrity, Real-World Validation & Adoption (W1-W12, Phase A-L). Gates: 257 passed / 104 mypy / 13/13 / 12/12 PASS. See CHANGELOG.md for v4.2.0 and docs/v4_2/.

v4.1.0 — Ecosystem Validation

V4.1 Ecosystem Validation, Integration Hardening & Production Readiness

Gates: 257 passed / 104 mypy / 13/13 routes / 12/12 verify-release
See CHANGELOG.md for v4.1.0 and docs/v4_1/RELEASE_MATRIX.md