Decision Forge v0.3.1

Version 0.3.1 adds office, HTML, tabular, and OCR ingestion, fixes several integrity and portability
issues in the data pipeline, and is the first release built and attested by the release workflow.
Ingestion metadata has changed; recompile corpora into new output directories.

Added

• Add automatic source format detection and DOCX, XLSX, PPTX, HTML and CSV/TSV parsers with locations.
• Add image and per-page PDF OCR through local RapidOCR/PP-OCR small models, Tesseract, and explicitly
  selected OpenAI-compatible vision endpoints. Keep model weights local during ingestion.
• Preserve OCR model identity, confidence, bounding boxes, access metadata, cache integrity and attempt
  journals. Require an explicit flag for OCR service calls and retain the business review gate.
• Add real local PP-OCR inference tests and a fictional seven-format example generator.
• Add a tag-triggered release workflow that verifies version consistency, runs the test suite, builds and
  smoke-tests the wheel, attests build provenance, creates a GitHub release from the changelog, and
  optionally publishes to PyPI through trusted publishing.
• Ship a py.typed marker so downstream type checkers use the package's inline annotations.
• Add project URLs, supported Python versions, and typing classifiers to the package metadata, and
  repository links to the citation file.
• Add opt-in dependency review on pull requests (DEPENDENCY_REVIEW repository variable), CodeQL analysis
  for Python and workflows, and OpenSSF Scorecard.
• Declare the type/ and area/ label taxonomy in .github/roadmap.json; the roadmap publisher now
  creates and updates those labels and applies them to roadmap issues without removing triage labels.
• Label pull requests by area automatically from the files they change.
• Add .editorconfig and .gitattributes (LF line endings, generated experiment artifacts), and a
  definition-of-done checklist to the pull request template.

Changed

• Ingestion metadata and default format detection have changed. Recompile into a new output directory;
  existing content-bound reviews are not transferred to newly parsed source snapshots.
• Bound archive expansion, image pixels, page counts, spreadsheet traversal and normalized output.
• Run CI on pull requests, merge queues, and main only, cancel superseded pull request runs, bound every
  job with a timeout, and expose a single CI result status for branch protection.
• Group Dependabot updates so related upgrades land in one lock-file change, and track pre-commit hooks.
• Validate workflow and Dependabot files in pre-commit.

Fixed

• Fix compile-corpus failing with "Source content hash changed" after spending its model budget when a
  CSV/TSV, spreadsheet, office, HTML, PDF, or JSON/YAML value contains carriage returns. Parsed text now
  uses \n line endings so stored snapshots read back with the recorded hash.
• Re-derive every model-visible field of imported synthesis rows: load_expansion now rejects rows whose
  question, policy context, candidates, verdicts, or ID differ from what the project produces, even when
  accepted.jsonl and its digest were rewritten together.
• Accept compiler and corpus evidence whose quote differs from the source only in whitespace runs. Such
  quotes were bound during compilation but produced a project.json that failed validation on load.
• Count the recipe planner's available pool after the duplicate removal a build applies, so plan-recipe
  no longer reports quotas as feasible that build --recipe-plan then rejects.
• Hash exported JSONL files and Data Designer outputs as UTF-8 regardless of the platform locale.
• Close SQLite connections after runtime event ingestion, open the read-only event store through a
  properly escaped file URI, and report missing or empty event stores as CLI errors instead of tracebacks.
• Report non-object decision bindings in evaluate-decisions as a CLI error instead of a traceback.