SixSentences v0.2.0-alpha.1 · community source + engine artifacts

Note

This release publishes the complete tagged community application source, including the tested macOS Companion source. The downloadable, attested build artifacts below cover the sixsentences-engine Python distribution. API, web, and Companion sources are validated from the tag; containers and the macOS app remain deployment-built so configuration and signing authority stay explicit.

SixSentences v0.2.0-alpha.1

This prerelease turns the public project into a complete, self-hostable
SixSentences research workspace. It is intended for evaluation and controlled
pilots; public APIs, database migrations, and browser contracts can still
change before 1.0.

Highlights

• Full community stack: Python research engine, FastAPI service, background
  worker, Next.js workspace, PostgreSQL migrations, Caddy/Docker Compose, and
  source for the Chromium browser-capture client and native macOS Companion.
• Research workflows for discovery and review, projects, data and figures,
  surveys, text and spoken interviews, knowledge, brainstorming, and writing.
• Operator-supplied mail, metadata, model, speech, search, and parser
  integrations with explicit provider, budget, privacy, and retention gates.
• Reference local and TLS deployment modes plus preflight, backup, restore, and
  authenticated erasure-journal handling.
• Expanded CI, CodeQL, dependency review, DCO validation, secret and
  configuration scanning, container validation, SBOMs, checksums, and build
  provenance.

Run the community stack

git clone --branch v0.2.0-alpha.1 --depth 1 https://github.com/SixSentences/sixsentences.git
cd sixsentences
bash deploy/community/init-env.sh --local
docker compose --env-file .env.selfhost up --build --detach --wait

Review deploy/community/README.md and
deploy/community/BACKUP-RESTORE.md before accepting user data. Keep
registration and external processing disabled until mail, participant notices,
provider terms, retention, and deployment-specific privacy controls are ready.

The release workflow rebuilds both containers from the immutable tag. Images
remain deployment-built in this alpha so API configuration stays local and the
web image receives the operator's public origins and legal-document versions at
build time. No misleading generic web image or mutable latest tag is
published.

On macOS, the Companion source can be tested and built against one explicit
self-hosted origin. It preserves local Apple Speech for spoken live interviews
and private brainstorming and includes native paper chat. See
apps/companion-macos/README.md. This prerelease publishes source only; it does
not provide an official .app, ZIP, DMG, update feed, or App Store package.

Not yet proven in this alpha

Three things this prerelease documents but does not yet demonstrate under
automation. They are named here rather than left for an operator to discover.

• No rehearsed install, upgrade, backup, restore, and erasure-replay drill.
  The scripts and their failure modes are unit-tested and the runbook in
  deploy/community/BACKUP-RESTORE.md describes the procedure, but no job takes
  a clean deployment through the full cycle and asserts that erased records stay
  erased. Rehearse it yourself before this holds participant data. Tracked in
  #29.
• No single deterministic operations runbook. Prerequisites, TLS, the first
  owner, health, upgrades, and key rotation are spread across
  deploy/community/README.md, BACKUP-RESTORE.md, and SECURITY.md instead of
  one verified path. Tracked in
  #30.
• No attested container images. SBOM, checksums, and build provenance cover
  the Python engine artifacts only. Both images stay deployment-built, so their
  digests are whatever your own build produces and there is nothing to verify
  them against. Tracked in
  #19.

Treat this alpha as evaluation software: run it on synthetic data, or on real
data only after you have rehearsed recovery yourself.

Deliberate boundary

Billing, pricing, checkout, subscriptions, commercial-plan enforcement,
hosted-service administration, production infrastructure, production data,
provider credentials, signed/notarized native binaries, signing material,
update feeds, and the separately deployed marketing website are not part of
this release.

The source and written documentation are Apache-2.0 except where noted. The
SixSentences name and visual identity remain protected marks. See LICENSE,
THIRD_PARTY_NOTICES.md, and TRADEMARKS.md.

SixSentences v0.1.0-alpha.1 · source + Python engine artifacts

Note

This release publishes the tagged community source tree. The downloadable, attested build artifacts below cover only the sixsentences-engine Python distribution; no prebuilt web application, container, hosted service, or deployment stack is published.

SixSentences v0.1.0-alpha.1

This is the first public alpha of the SixSentences open-source project. It
publishes both portable Python research building blocks and a sanitized source
snapshot of the research-workspace web client.

Included

Python research engine

• Boolean query parsing and translation for local and external search targets.
• A builder and verifier for caller-owned, checksummed DuckDB/Parquet corpora.
• Conservative DOI deduplication, companion-report linking, ranking, and
  citation snowballing.
• Query-expansion validation and assumption-gated Chao2 coverage estimates.
• Screening calibration, reviewer-overlap diagnostics, and source-quote checks.
• Caller-supplied PRISMA and PRISMA-S-style reporting helpers.
• Bounded CSV, TSV, JSON, and XLSX import that rejects oversized or ambiguous
  inputs instead of silently truncating them.
• Deterministic full-table profiles and typed recipes for missingness,
  descriptives, grouped summaries, Pearson correlation, and classic
  DerSimonian–Laird random-effects pooling.
• A typed Python library and command-line interface for Python 3.12–3.14.

Web client

• Next.js source for literature runs and review, library, projects, research
  data, scientific figures, surveys, interviews, knowledge, brainstorming, and
  manuscript/LaTeX interfaces.
• Typed browser-side API calls, streaming progress, source and provenance
  presentation, responsive workspace layouts, and focused tests.
• Sanitized local configuration defaults without credentials or an implicit
  production API target.

Important alpha boundaries

Interfaces and serialized formats may change before 1.0. SixSentences
exposes methods and assumptions but does not guarantee search completeness,
establish PRISMA compliance, validate a statistical analysis plan, produce a
systematic review by itself, or replace expert judgment.

The web client requires a separately supplied API implementing its HTTP,
Server-Sent Events, and WebSocket contracts. The Python package in this release
is not that server, and the project is not yet a complete self-hosting stack.

The release excludes the marketing and landing website, hosted SaaS backend,
databases, workers, model-provider orchestration, billing, pricing,
administration, operations, production infrastructure, browser extension,
macOS companion, credentials, customer data, and proprietary corpora.

Release integrity

The GitHub source archive contains the Python engine and apps/web client.
The separately attached wheel and source distribution package only the Python
sixsentences-engine.

The release workflow produces that wheel and source distribution together with
SHA256SUMS and a CycloneDX 1.5 runtime SBOM. GitHub records build-provenance
attestations for the artifacts and an SBOM attestation for the Python
distributions. See docs/RELEASING.md for verification commands.