Release v0.2.2 - 100% line coverage · BAder82t/fairlearn-fhe

Patch release. 100% line coverage. No API changes.

Test coverage

Mode B (encrypted-mask) paths for every v0.2 metric port (per-rate _difference / _ratio family, scoring disaggregations, regression disaggregations).
Every validate_envelope negative branch: tampered hash, bad schema version, allowed-metric mismatch, depth ceiling/non-integer, security-bits floor, age ceiling, op_counts non-mapping/non-int, unsigned signature block, RSA-instead-of-Ed25519 signature.
Every CLI subcommand: verify (stdin, oversized, signed, RSA-key TypeError, unsigned-with-key, legacy-positional), inspect (legacy metric field, missing key), schema, doctor (with both backends, with one missing).
Every aggregate_difference / aggregate_ratio branch: empty input, between_groups, to_overall with explicit and default overall, zero-ref, zero-value, unknown method.
All scoring-helper zero-division edges (f1, zero-one-loss).
All plaintext fallback paths in _per_rate_metrics and _fairness_metrics (when upstream Fairlearn lacks the helper).
make_derived_metric reserved-arg, unknown-transform, sample-param, and group-min/group-max paths.
_regression_metrics zero-weight-group branch.
_json_safe over numpy scalars + nested containers + repr fallback.
OpenFHE backend sum_all window-clamp branch.

Three branches are marked # pragma: no cover with inline documentation:

CKKSContext.make_evaluator_context() OpenFHE branch — the KeyPair binding is unpickleable; the branch is pinned in tests as an expected TypeError. A future fix (wrapper class around KeyPair) flips the pin from passing to failing.
_pos_neg_counts hasattr guard — positives/negatives are dataclass fields, so the guard only fires for manually-constructed malformed instances.
build_context final ValueError — unreachable because get_backend validates the backend name first.

No breaking changes. pip install --upgrade fairlearn-fhe.