v1.4.1 — de-identification and accuracy patch

A privacy and accuracy patch on top of v1.4.0. No functional change — build, 124 tests, the theme-matching eval (micro F1 0.974) and npm audit are identical. Full details in the changelog.

If you are on 1.4.0, there is no behavioural reason to upgrade. This release exists so the source tarball matches the repo's de-identification policy.

Fixed

• De-identification restored. This repo has a standing policy, recorded in the 1.2.0 changelog entry: genericize client-identifying content, use Product A / Product B, don't quote client-specific figures. The 1.4.0 documentation reversed it — a README results table naming four real products alongside their conversation volumes and unmatched rates, the client named outright in the changelog, and real product names used as example agent names in tests. Products are now Product A–D, the client is unnamed, and example agents are portal-a / portal-b. Aggregate figures remain, which the policy always permitted; it was the named per-product attribution that did not belong.
• Eval fixture scrubbed. Six lines in evals/theme-matching.jsonl were verbatim or near-verbatim real customer chat messages rather than the synthetic text the fixture is documented to contain. No PII was involved — short product questions with no names, addresses or identifiers, two of them canned widget prompts — but real customer wording does not belong in a public fixture. Replaced with invented phrasings exercising the same keywords; both new themes still score 100% precision and recall.
• server.json no longer claims an npm package. It declared @dkships/pm-copilot on the npm registry, which does not exist and is not planned. The packages block is removed; the manifest describes the server without asserting a distribution channel. Distribution is this GitHub release plus clone-and-build.
• The bug-report template and CONTRIBUTING.md asked reporters to run npm ls @dkships/pm-copilot, impossible for a clone-and-build install. Both now ask for the package.json version or the commit SHA.
• The Chats and Self-serve fail columns in the README composability table held real measured values inside a table its own caption calls illustrative. Now genuinely illustrative.

Why a new version instead of moving the tag

The scrub itself landed on main before this release. But v1.4.0 points at the pre-scrub commit, and GitHub generates a release's source tarball from the tag — so the download still carried the named tables even after the release notes were corrected.

Retagging v1.4.0 would have been a single command. Silently changing what a published tag points to is worse than the problem it solves, so 1.4.1 makes the clean tree the current download and leaves history intact. v1.4.0 remains available, superseded.

Install

Clone and build — see the README. Chatbase remains optional; with no key configured the output shape is unchanged.