v0.4.0 - Guarded STORM runtime

Highlights

• Added a zero-dependency guarded runtime with versioned run state, atomic checkpoints, legal phase transitions, recovery, event hashes, and explicit completion state.
• Added structural artifact validation and citation auditing so Classic STORM cannot complete with malformed files, dangling sources, or unsupported claim mappings.
• Split the workflow into focused Classic, Co-STORM, Local Runner, artifact, safety, and state-schema references while preserving the compatibility index.
• Made guarded execution the default for file-producing Classic and Local Runner requests when Python is available.
• Expanded the executable offline forward-eval contract to 12 cases, including Co-STORM warm start, visible follow-up, chat conclusion, and report-only persistence.
• Documented the unbounded Co-STORM interaction loop, final-report trigger, request-scoped file output, and an end-to-end RAG technology report example.
• Added an upload-ready 1280x640 Social Preview that makes the Fact Researcher, Specialist, Respondent/Critic, and Moderator roles visible.
• Renamed the public repository to lizhouai/storm-research-skill; install with npx skills add lizhouai/storm-research-skill.

Release verification

• 55 unit tests passed.
• 120/120 deterministic offline contract-canary runs passed with zero illegal transitions, 120 fresh subprocesses, and 120 isolated work directories.
• skills@1.5.15 discovered and rendered the full bundle locally and from the public owner/repository path.
• GitHub Validate and Pages deployment passed on main.
• Both public Classic and Co-STORM HTML examples returned 200 text/html from the renamed Pages site.
• Social Preview verified at 1280x640 and 377,429 bytes.

Capability boundaries and known gaps

• Co-STORM remains a prompt-native preview with simulated, visibly attributed participants. This release does not bundle or execute the upstream CoStormRunner or independently running expert agents.
• Persistent Co-STORM state guards outer lifecycle transitions and checkpoint integrity. The Classic artifact validator does not mechanically verify Co-STORM mind-map or report contents; source and citation support still require review.
• Offline fixture canaries validate the evaluation contract, not real-model research quality. The optional real-Codex-host adapter remains non-blocking, and the previously observed local CLI/account model-compatibility gap is not a release gate.
• B5 retrieval upgrades and B6 local-runner adapters are intentionally not included in this release.