PARTHA v0.2.0 — Sealed Repository Intelligence

Two months and ~445 commits after the v0.1.0 foundation, PARTHA has a single, sealed repository model at its centre.

PARTHA turns a repository revision into one sealed, queryable model — ri.v1 — and every product surface reads that model instead of re-parsing the code. Architecture, dependencies, review, insights, documentation, exports, and the optional AI workspace all consume the same snapshot. Where a fact cannot be proven from stored source, PARTHA now says so rather than guessing.

PARTHA runs locally today with its flagship workflow usable end to end. It is not yet a hardened shared hosted service — read Limitations and security before any shared deployment.

---

Repository Intelligence — the sealed ri.v1 snapshot

• One immutable read model. Every analysis now seals a normalized, canonically hashed ri.v1 snapshot identified by repository_id, revision, schema_version, producer_version_set, and config_hash. The legacy mutable RepositoryIntelligence JSON model has been removed — there is no second source of repository truth.
• Evidence-backed Python and TypeScript/JavaScript extractors. Qualified symbol nodes and definitions, import observations, decorators and route observations, and span- and path-validated evidence with one-based inclusive line spans. Each extractor publishes a support matrix with a parity test, and every unsupported matrix entry is backed by a real diagnostic instead of silence.
• Blind spots are declared, not hidden. Python monkey-patching and other unanalysable constructs are emitted as explicit blind-spot diagnostics.
• Dependency, lockfile, service-interaction, and IaC extraction. Nested manifest discovery, multi-manifest merge before sealing, lockfile pin extraction, and Docker Compose service interactions.
• Deterministic relationship resolution. Stored observations become resolved edges only from proven syntax facts, with one/zero/many candidate outcomes and RI-RES-UNRESOLVED / RI-RES-AMBIGUOUS diagnostics emitted instead of a guessed edge.
• Owner-scoped snapshot API. /intelligence/v1/snapshots reads sealed snapshots only, rejects unsupported schema versions, and never falls back to legacy metadata or a working tree. Adds a revision verification manifest and a snapshot impact (change-blast-radius) query.
• Golden benchmark. A versioned fixture corpus with independently authored expected facts, real-extractor precision/recall and citation validation, repeated-extraction canonical-hash determinism checks, and CI reports. Repository recall threshold raised to 0.95.
• RFC-0001 accepted — the snapshot/evidence schema contract is ratified and the durable pipeline plus product-consumer migration are implemented.

Repository Lineage (RFC-0002)

• Repeated imports of the same repository and branch are grouped into a durable, owner-scoped lineage with 1-based, never-reused sequence allocation and duplicate-revision detection. Uploads and unresolved GitHub imports stay as unlineaged standalone imports; database constraints enforce membership integrity.
• GET /repositories/{id}/lineage returns the ordered history, and the repository detail page renders a Lineage History view.
• Refresh and cross-revision comparison on top of a lineage are not built yet.

Product surfaces

• Architecture graph reads from the sealed snapshot exclusively — corrected node classification and module grouping, fabricated metrics removed, external-code references no longer flagged as findings. New non-visual list view; keyboard- and label-accessible graph; readability improvements.
• Dependency graph is snapshot-bound and rendered from ri.v1; empty and not-computed states are stated honestly rather than shown as a clean bill of health.
• Engineering Review paginates its findings API, requires evidence that addresses the diagnostic it publishes, excludes generated and oversized artifacts, and guards env-evidence and report truncation. Vulnerability scanning stays explicitly not_assessed.
• Insights and Documentation are snapshot-backed with guided no-snapshot states.
• Evidence-backed authentication explanation — GET /analysis/{repositoryId}/architecture/authentication, derived from the sealed snapshot.
• Durable, cancellable analysis jobs with transient poll-failure retry instead of declaring analysis failed.
• Missing-snapshot states are honest across every surface; fabricated analysis results and the fake complexity UI are gone.

AI workspace

• Provider setup UI is driven by a single capability registry — one source for what each provider supports, with a golden CI gate.
• Conversation history is persisted (ai_conversation_messages), with cascade delete on account/repository removal and retention disclosed to users. The workspace no longer claims to forget.
• Ollama reliability: a per-provider local-inference timeout (fixes the frequent hangs on first request) and a one-in-flight-request cap.
• Synthetic citations removed — providers receive structural context only (no source bytes, no line numbers), so answers are intentionally uncited.
• /ai/stream validates ownership and provider config before streaming.

Authentication, ownership, and security

• Accounts and per-user ownership. User model, per-user repository ownership enforced in the service layer, and a cross-owner 404 sweep derived from the router table.
• Sessions. JWT access tokens with rotating refresh sessions; refresh-token reuse revokes the whole token family; concurrent duplicate registration is handled as a 409.
• Invite-gated registration via an admin-managed email allowlist, with a dev-only bypass and first-user-becomes-owner bootstrap.
• OAuth sign-in with Google and GitHub (credentials deferred).
• Verified account deletion across database, storage, and frontend.
• Provider keys are encrypted at rest per user; settings shows the key's last four characters.
• AI provider egress policy — deployment-owned destination allowlist, DNS answers re-checked and pinned to the connection, redirects denied, policy errors that omit destination details.
• Rate limiting per client with path-class budgets, keyed on the validated user id. Security-headers middleware and a locked-down CORS configuration.
• Ingestion hardening — path-traversal and symlink-escape rejection on upload, the same symlink rejection on the GitHub clone walk, upload/clone size caps, AppleDouble artifact stripping.
• Same-site deployment requirement for the SameSite=Lax refresh cookie is now documented.

Frontend and accessibility

• Refreshed product experience: sidebar grouped into Analysis / Assist with a pinned Settings, rewritten AI Workspace copy, theme toggle routed through dark-mode tokens, and a landing page with its own dark mode.
• Session-aware API client with single-flight bootstrap refresh, auth-gated repository fetch, and streaming 401 retry.
• Dashboard surfaces the most recently analysed repository; the repository detail page shows the analysed revision; the repository landing view leads with an outcome-first summary.
• Deep-linked routes no longer crash with a raw 404; a root HydrateFallback silences the router warning.
• WCAG 2.2 AA baseline — reproducible automated coverage for the Phase 0 journeys, WCAG AA contrast fixes on primary actions and section labels, keyboard and accessible-name fixes, and coverage for the mobile navigation drawer.

Marketing site

• A free standalone static marketing site (apps/marketing) that reuses the real landing page.
• Responsive landing for phones and tablets, aligned to the Foundations v1 brand palette and typography, using the designer's illustration assets in the mobile layout.
• Waitlist signup capture; every footer link wired to real content.

Infrastructure, CI, and operations

• W2 queue and control-plane boundary introduced for analysis scale-out.
• Frontend API contracts are generated from the live OpenAPI schema with a CI drift check; full OpenAPI accuracy pass.
• Single-service hosting: FastAPI serves the built frontend; a Render blueprint and Dockerfile for partha.uk.
• Pinned backend pip lockfile for reproducible installs; backend Ruff and Mypy in CI; a repository-hygiene guard; a scheduled dependency-audit scan; CodeQL on the default branch.
• Migration rehearsal and rollback runbook, a rehearsed backup/restore drill on disposable targets, and startup detection/recovery of local dev-database schema drift.
• SQLite lock contention between the analysis worker and the API eliminated.
• Self-hosted release acceptance gate and runbook.

Documentation

• Consolidated local development, testing, and troubleshooting into a single guide.
• Public documentation aligned with current product truth: conversation-retention disclosure, the same-site session requirement, an end-to-end AI provider setup guide, and the unresolved-relationship split.
• Prototype / pre-alpha framing dropped; test:prototype renamed to test:e2e.
• This release also ships a documentation currency pass (#432): a corrected Repository Intelligence flowchart and lineage docs updated to reflect that RFC-0002 is implemented.

---

Full Changelog: v0.1.0...v0.2.0

PARTHA v0.1.0 — Engineering Intelligence Platform Foundation

The first public release of PARTHA.

PARTHA is an Engineering Intelligence Platform that transforms repositories into actionable engineering knowledge, enabling developers to understand complex software systems, assess change impact, and make engineering decisions with confidence.

---

Highlights

Repository Intelligence

• Repository ingestion and analysis
• Repository Explorer with file preview
• Repository Intelligence Engine

Engineering Intelligence

• Architecture analysis
• Dependency analysis
• Documentation generation
• Engineering Review

AI Foundation

• Provider abstraction architecture
• Multi-provider AI foundation
• Extensible AI orchestration

Reports & Exports

• Engineering review reports
• Documentation export
• Architecture export
• Unified export pipeline

Platform

• Production readiness baseline
• Health & readiness endpoints
• Structured logging
• Docker & CI improvements

---

Roadmap

Development now continues with:

• AI Provider Integrations
• Repository Context Retrieval
• Streaming Infrastructure
• Conversation Persistence
• Citations & Evidence
• Production AI Workspace

---

What's Changed

• feat(core): stabilize repository ingestion and analysis pipeline by @parthrohit22 in #18
• docs: add contributor workflow and development guidelines by @parthrohit22 in #21
• feat(core): implement repository intelligence engine by @parthrohit22 in #19
• feat(explorer): real file preview with binary + image support by @SHAURYAKSHARMA24 in #23
• feat(reports): add reusable export pipeline for engineering review by @SHAURYAKSHARMA24 in #25
• refactor(ai): establish AI provider architecture foundation by @parthrohit22 in #26
• refactor(ai): introduce dedicated provider implementationsFeature/ai workspace provider integration by @parthrohit22 in #28
• feat(reports): complete engineering review, documentation & export by @SHAURYAKSHARMA24 in #29
• chore: stop tracking TypeScript build cache by @parthrohit22 in #31
• chore(platform): harden production readiness foundation by @SHAURYAKSHARMA24 in #30
• release: v0.1.0 - Engineering Intelligence Platform Foundation by @parthrohit22 in #38

New Contributors

• @parthrohit22 made their first contribution in #18
• @SHAURYAKSHARMA24 made their first contribution in #23

Full Changelog: https://github.com/Second-Origin/PARTHA/commits/v0.1.0