PARTHA v0.2.0 — Sealed Repository Intelligence

Two months and ~445 commits after the v0.1.0 foundation, PARTHA has a single, sealed repository model at its centre.

PARTHA turns a repository revision into one sealed, queryable model — ri.v1 — and every product surface reads that model instead of re-parsing the code. Architecture, dependencies, review, insights, documentation, exports, and the optional AI workspace all consume the same snapshot. Where a fact cannot be proven from stored source, PARTHA now says so rather than guessing.

PARTHA runs locally today with its flagship workflow usable end to end. It is not yet a hardened shared hosted service — read Limitations and security before any shared deployment.

---

Repository Intelligence — the sealed ri.v1 snapshot

• One immutable read model. Every analysis now seals a normalized, canonically hashed ri.v1 snapshot identified by repository_id, revision, schema_version, producer_version_set, and config_hash. The legacy mutable RepositoryIntelligence JSON model has been removed — there is no second source of repository truth.
• Evidence-backed Python and TypeScript/JavaScript extractors. Qualified symbol nodes and definitions, import observations, decorators and route observations, and span- and path-validated evidence with one-based inclusive line spans. Each extractor publishes a support matrix with a parity test, and every unsupported matrix entry is backed by a real diagnostic instead of silence.
• Blind spots are declared, not hidden. Python monkey-patching and other unanalysable constructs are emitted as explicit blind-spot diagnostics.
• Dependency, lockfile, service-interaction, and IaC extraction. Nested manifest discovery, multi-manifest merge before sealing, lockfile pin extraction, and Docker Compose service interactions.
• Deterministic relationship resolution. Stored observations become resolved edges only from proven syntax facts, with one/zero/many candidate outcomes and RI-RES-UNRESOLVED / RI-RES-AMBIGUOUS diagnostics emitted instead of a guessed edge.
• Owner-scoped snapshot API. /intelligence/v1/snapshots reads sealed snapshots only, rejects unsupported schema versions, and never falls back to legacy metadata or a working tree. Adds a revision verification manifest and a snapshot impact (change-blast-radius) query.
• Golden benchmark. A versioned fixture corpus with independently authored expected facts, real-extractor precision/recall and citation validation, repeated-extraction canonical-hash determinism checks, and CI reports. Repository recall threshold raised to 0.95.
• RFC-0001 accepted — the snapshot/evidence schema contract is ratified and the durable pipeline plus product-consumer migration are implemented.

Repository Lineage (RFC-0002)

• Repeated imports of the same repository and branch are grouped into a durable, owner-scoped lineage with 1-based, never-reused sequence allocation and duplicate-revision detection. Uploads and unresolved GitHub imports stay as unlineaged standalone imports; database constraints enforce membership integrity.
• GET /repositories/{id}/lineage returns the ordered history, and the repository detail page renders a Lineage History view.
• Refresh and cross-revision comparison on top of a lineage are not built yet.

Product surfaces

• Architecture graph reads from the sealed snapshot exclusively — corrected node classification and module grouping, fabricated metrics removed, external-code references no longer flagged as findings. New non-visual list view; keyboard- and label-accessible graph; readability improvements.
• Dependency graph is snapshot-bound and rendered from ri.v1; empty and not-computed states are stated honestly rather than shown as a clean bill of health.
• Engineering Review paginates its findings API, requires evidence that addresses the diagnostic it publishes, excludes generated and oversized artifacts, and guards env-evidence and report truncation. Vulnerability scanning stays explicitly not_assessed.
• Insights and Documentation are snapshot-backed with guided no-snapshot states.
• Evidence-backed authentication explanation — GET /analysis/{repositoryId}/architecture/authentication, derived from the sealed snapshot.
• Durable, cancellable analysis jobs with transient poll-failure retry instead of declaring analysis failed.
• Missing-snapshot states are honest across every surface; fabricated analysis results and the fake complexity UI are gone.

AI workspace

• Provider setup UI is driven by a single capability registry — one source for what each provider supports, with a golden CI gate.
• Conversation history is persisted (ai_conversation_messages), with cascade delete on account/repository removal and retention disclosed to users. The workspace no longer claims to forget.
• Ollama reliability: a per-provider local-inference timeout (fixes the frequent hangs on first request) and a one-in-flight-request cap.
• Synthetic citations removed — providers receive structural context only (no source bytes, no line numbers), so answers are intentionally uncited.
• /ai/stream validates ownership and provider config before streaming.

Authentication, ownership, and security

• Accounts and per-user ownership. User model, per-user repository ownership enforced in the service layer, and a cross-owner 404 sweep derived from the router table.
• Sessions. JWT access tokens with rotating refresh sessions; refresh-token reuse revokes the whole token family; concurrent duplicate registration is handled as a 409.
• Invite-gated registration via an admin-managed email allowlist, with a dev-only bypass and first-user-becomes-owner bootstrap.
• OAuth sign-in with Google and GitHub (credentials deferred).
• Verified account deletion across database, storage, and frontend.
• Provider keys are encrypted at rest per user; settings shows the key's last four characters.
• AI provider egress policy — deployment-owned destination allowlist, DNS answers re-checked and pinned to the connection, redirects denied, policy errors that omit destination details.
• Rate limiting per client with path-class budgets, keyed on the validated user id. Security-headers middleware and a locked-down CORS configuration.
• Ingestion hardening — path-traversal and symlink-escape rejection on upload, the same symlink rejection on the GitHub clone walk, upload/clone size caps, AppleDouble artifact stripping.
• Same-site deployment requirement for the SameSite=Lax refresh cookie is now documented.

Frontend and accessibility

• Refreshed product experience: sidebar grouped into Analysis / Assist with a pinned Settings, rewritten AI Workspace copy, theme toggle routed through dark-mode tokens, and a landing page with its own dark mode.
• Session-aware API client with single-flight bootstrap refresh, auth-gated repository fetch, and streaming 401 retry.
• Dashboard surfaces the most recently analysed repository; the repository detail page shows the analysed revision; the repository landing view leads with an outcome-first summary.
• Deep-linked routes no longer crash with a raw 404; a root HydrateFallback silences the router warning.
• WCAG 2.2 AA baseline — reproducible automated coverage for the Phase 0 journeys, WCAG AA contrast fixes on primary actions and section labels, keyboard and accessible-name fixes, and coverage for the mobile navigation drawer.

Marketing site

• A free standalone static marketing site (apps/marketing) that reuses the real landing page.
• Responsive landing for phones and tablets, aligned to the Foundations v1 brand palette and typography, using the designer's illustration assets in the mobile layout.
• Waitlist signup capture; every footer link wired to real content.

Infrastructure, CI, and operations

• W2 queue and control-plane boundary introduced for analysis scale-out.
• Frontend API contracts are generated from the live OpenAPI schema with a CI drift check; full OpenAPI accuracy pass.
• Single-service hosting: FastAPI serves the built frontend; a Render blueprint and Dockerfile for partha.uk.
• Pinned backend pip lockfile for reproducible installs; backend Ruff and Mypy in CI; a repository-hygiene guard; a scheduled dependency-audit scan; CodeQL on the default branch.
• Migration rehearsal and rollback runbook, a rehearsed backup/restore drill on disposable targets, and startup detection/recovery of local dev-database schema drift.
• SQLite lock contention between the analysis worker and the API eliminated.
• Self-hosted release acceptance gate and runbook.

Documentation

• Consolidated local development, testing, and troubleshooting into a single guide.
• Public documentation aligned with current product truth: conversation-retention disclosure, the same-site session requirement, an end-to-end AI provider setup guide, and the unresolved-relationship split.
• Prototype / pre-alpha framing dropped; test:prototype renamed to test:e2e.
• This release also ships a documentation currency pass (#432): a corrected Repository Intelligence flowchart and lineage docs updated to reflect that RFC-0002 is implemented.

---

Full Changelog: v0.1.0...v0.2.0