v0.2.1 — pre-public-announce review

[0.2.1] - 2026-04-17

Final pre-public-announce review pass. No user-visible behaviour changes;
every fix is either first-adopter ergonomics, supply-chain hardening, or
internal abstraction hygiene so a future contributor can't trip on the
same sharp edges the review found.

Fixed

• athenaeum serve pre-init hint — the "Run athenaeum init --path {args.path}" line printed the literal placeholder because the f-string prefix was missing; pre-init users saw {args.path} and lost trust
• VectorBackend.query now logs a WARNING with the exception class name when get_collection fails, instead of swallowing silently — "vector returns nothing" was the top first-adopter confusion in the v0.2.0 review
• query_topics API failures now log at WARNING (was DEBUG) with the exception class name — silent fall-through to the regex extractor hid degraded proper-noun recall

Changed

• Release workflow hardened — all GitHub Actions pinned to full commit SHAs (supply-chain hardening against tag retag attacks); PEP 740 build-provenance attestations enabled
• Search backend unification — the in-memory keyword scorer is now a first-class KeywordBackend in athenaeum.search, registered alongside FTS5 and vector via the same SearchBackend Protocol; mcp_server.recall_search dispatches all three backends through one code path
• athenaeum serve cache sanity check — warns on startup when the configured search_backend has no index on disk (so recall doesn't silently return zero hits)
• EntityIndex now exposes __iter__, __len__, and items(); callers no longer reach into _by_name directly
• Public API types tightened: status() returns a StatusInfo TypedDict; parse_frontmatter / render_frontmatter use dict[str, object]
• Dependency upper bounds added to anthropic (<1.0), fastmcp (<3.0), chromadb (<2.0), pyyaml (<7) — surprise majors can't silently break a released wheel
• Wheel build explicitly includes src/athenaeum/py.typed and src/athenaeum/schema/**/*.md (was implicit via hatchling defaults)
• README links to GitHub-hosted docs instead of relative paths so they render on PyPI
• Claude Code call-out added to the README tagline pointing to the transparent sidecar section
• examples/claude-code/README.md leads with claude mcp add as the preferred MCP install recipe (matches canonical form)