v0.8.6 — Audit Closeout, Landing Redesign & SonarCloud CI

📦 Release

• Version sync to 0.8.6 (app + frontend + core): root pyproject.toml,
  frontend/ml-canvas/package.json / package-lock.json, and
  skyulf-core/setup.py bumped to 0.8.6.

🧠 Core — findings closeout

• F-21 single seed owner: one DEFAULT_RANDOM_STATE constant injected
  at fit resolution; seeds surfaced as non-tunable hyperparameter fields and
  canvas inputs (Random State / Fold Split Seed on training + ensemble
  nodes), with per-node seed docs.
• F-13 decision-threshold tuning in TuningConfig end-to-end:
  tune_threshold grid-searches the binary cutoff after refit (gated on
  predict_proba + 2 classes + validation split), results ride TuningResult
  and are applied by TuningApplier; binary string-label tuning fixed by
  pinning pos_label in f1/precision/recall scorers. Backend forwards the
  flag in fixed/tuned modes and seeds the threshold store from training
  metrics (GET /thresholds exposes source); canvas gained the "Tune
  decision threshold" checkbox and seeded-at-training badges.
• F-12/F-21/F-23 follow-ups: drift pages relabelled to the KS
  statistic (threshold input, table sort, alert evidence, CSV export —
  p-value kept as diagnostic only); legacy graphs omit the IterativeImputer
  seed so the core default stays the single owner; BLE001 staged rollout
  finished (per-file ignores dropped, 121 deliberate broad catches waived
  with per-site reasons).
• F-31/F-14 closeout: lint hygiene (.values → .to_numpy(), named
  statistical threshold constants, sorted __all__), backend compute and
  model-serializer seams moved to ContextVar with scoped context managers,
  optuna import cache onto a locked state object, and scanner re-export
  fixes (explicit lists replace star imports in the preprocessing shims).

🎨 Landing page — redesign, live stats & hero video

• New landing page and theme/color redesign around the hero line "Stop
  trusting your pipeline. Verify it."; badge auto-updates from PyPI,
  example accordion open by default, gallery lightbox (prev/next, counter),
  hardened mobile menu and init script.
• Hero badge images replaced by themed live stat pills — GitHub stars,
  downloads/month (pypistats) and total downloads (parsed from pepy's
  CORS-enabled badge SVG) — fed by keyless live APIs with static fallbacks;
  flaky shields.io badges swapped out of the README too.
• Hero background is a muted looping video (static/video/wolf.mp4) over
  the .hero-bg fallback image, paused for reduced-motion users.
• SEO foundations: root sitemap deployed via the docs workflow, robots.txt
  listing both sitemaps, FAQPage + sameAs structured data, website badge
  in the README.

🧪 Tests — six rounds of Codecov patch coverage

• Six red-green rounds exercise every defensive except/fallback branch
  flagged by the Codecov patch reports: serializer capability probes,
  catalog/S3 cache fallbacks, degraded health/readiness endpoints,
  DataService polars→pandas fallbacks, isolated metric failures, tuning
  loader fallback chains and trial-error paths (incl. both directions of
  the len(fold_errors) > 1 branch), threshold-tuning gates, drift
  enrichment and ks_statistic plumbing, SHAP except path, and the
  balance-recommendation directions.

🚀 CI & quality — SonarCloud in PR Check

• SonarCloud folded into pr_check.yml: a token-gated sonar-gate
  job detects SONAR_TOKEN presence (job-level if: cannot reference the
  secrets context — doing so fails the whole workflow file at validation)
  and drives two parallel coverage jobs (backend-coverage,
  skyulf-core-coverage) that upload Cobertura XML as artifacts;
  sonarcloud-scan downloads both and never re-runs the suites. Without
  the token everything skips silently; the dedicated test workflows stay
  the authoritative gates + Codecov source. Third-party scan action pinned
  to a full commit SHA; index.html excluded from analysis.
• CodeQL fixes: readiness probe returns a generic error
  (py/stack-trace-exposure); pepy badge count parsed with a
  capture-group regex (js/incomplete-multi-character-sanitization).
• ty 0.0.75: optional-import narrowing fixed with the
  TYPE_CHECKING-first idiom; CI pin raised to <0.0.76.

📚 Docs

• Completed dual-engine-correctness initiative docs archived — all waves
  shipped (audit fixes, leakage enforcement, Polars migration, F-15
  per-fold refit, merged-branch refit, holdout/validation-split refit).
  Kept open: the fallback-shapes plan (Phase 0 telemetry done, Phases 1–4
  gated on demand) and the parked SplitDataset ownership design; the
  initiative README is rewritten around the archived/open split.

---