Reject non-object catalog manifest rows

.github/workflows/ci.yml

@@ -273,8 +273,23 @@ jobs:
         uv run pytest tests/unit/test_no_raw_text_logging.py -q
 
     - name: Test with pytest
-      run: |
-        uv run pytest --cov=openmed --cov-report=xml --cov-report=term-missing
+      timeout-minutes: 45
+      run: >-
+        uv run --frozen python -c
+        "import faulthandler, pytest; diagnostics = type('CiSummaryDiagnostics', (), {'pytest_sessionfinish': lambda self, session, exitstatus: faulthandler.dump_traceback_later(120, repeat=True)})(); raise SystemExit(pytest.main(plugins=[diagnostics]))"
+        --cov=openmed --cov-report=xml --cov-report=term-missing
+        --tb=line --show-capture=no --color=no --code-highlight=no -ra
+        --junitxml=pytest-results.xml
+
+    - name: Upload test diagnostics
+      if: always()
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      with:
+        name: pytest-${{ matrix.os }}-py${{ matrix.python-version }}-${{ github.run_attempt }}
+        path: |
+          pytest-results.xml
+          coverage.xml
+        if-no-files-found: warn
 
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
@@ -284,6 +299,76 @@ jobs:
         name: codecov-umbrella
         fail_ci_if_error: false
 
+  sdk-compatibility:
+    # Bounded core contracts and installed artifacts on every advertised lane.
+    # Model/runtime qualification remains separate; no weights are downloaded.
+    needs: repo-policy
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    env:
+      OPENMED_OFFLINE: "1"
+      HF_HUB_OFFLINE: "1"
+      TRANSFORMERS_OFFLINE: "1"
+      HF_DATASETS_OFFLINE: "1"
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      with:
+        python-version: ${{ matrix.python-version }}
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      with:
+        version: "0.11.28"
+        enable-cache: true
+        cache-dependency-glob: |
+          pyproject.toml
+          uv.lock
+    - name: Prepare frozen test and package dependencies
+      shell: bash
+      run: |
+        uv sync --frozen --extra dev --python "${{ matrix.python-version }}"
+        uv export --frozen --no-hashes --no-emit-project --extra cli --extra service --extra mcp --output-file "$RUNNER_TEMP/compat-constraints.txt"
+    - name: Core privacy and platform contracts
+      run: >-
+        uv run --frozen pytest -q --timeout=120 --timeout-method=thread
+        tests/unit/install/test_smoke_check.py
+        tests/unit/release/test_release_budget_workflow.py
+        tests/unit/service/test_brief_surfaces.py
+        tests/unit/ner/test_infer.py
+        tests/unit/test_no_raw_text_logging.py
+    - name: Build wheel and source distribution
+      shell: bash
+      run: uv build --out-dir "$RUNNER_TEMP/compat-dist"
+    - name: Verify clean core and adapter installs plus missing-resource controls
+      shell: bash
+      run: >-
+        python scripts/install/smoke_check.py
+        --artifacts "$RUNNER_TEMP/compat-dist"
+        --constraints "$RUNNER_TEMP/compat-constraints.txt"
+        --report sdk-compatibility.json
+    - name: Upload value-free compatibility evidence
+      if: always()
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      with:
+        name: sdk-compatibility-${{ matrix.os }}-${{ matrix.python-version }}
+        path: sdk-compatibility.json
+        if-no-files-found: warn
+
+  sdk-compatibility-gate:
+    # Stable required-check name; a missing/cancelled matrix is not success.
+    needs: sdk-compatibility
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+    - name: Require every advertised combination
+      env:
+        MATRIX_RESULT: ${{ needs.sdk-compatibility.result }}
+      run: test "$MATRIX_RESULT" = success
+
   security:
     needs: repo-policy
     runs-on: ubuntu-latest
@@ -496,6 +581,7 @@ jobs:
     - yasbd-integration
     - i18n-cjk-indic
     - browser-extension
+    - sdk-compatibility-gate
     if: >-
       always() &&
       needs.repo-policy.result == 'success' &&
@@ -505,6 +591,7 @@ jobs:
       needs.spacy-integration.result == 'success' &&
       needs.yasbd-integration.result == 'success' &&
       needs.browser-extension.result == 'success' &&
+      needs.sdk-compatibility-gate.result == 'success' &&
       (
         needs.i18n-cjk-indic.result == 'success' ||
         needs.i18n-cjk-indic.result == 'skipped'
@@ -531,6 +618,65 @@ jobs:
       run: |
         uv build
 
+    - name: Verify refreshed wheel-size baseline
+      id: wheel_baseline
+      shell: bash
+      if: github.event_name == 'pull_request'
+      env:
+        BASE_SHA: ${{ github.event.pull_request.base.sha }}
+      run: |
+        git fetch --no-tags --depth=1 origin "$BASE_SHA"
+        if git diff --quiet "$BASE_SHA" HEAD -- gates/release_budgets.json; then
+          echo "Release budgets unchanged; no baseline refresh to verify."
+          exit 0
+        else
+          diff_status=$?
+          if [ "$diff_status" -ne 1 ]; then
+            exit "$diff_status"
+          fi
+        fi
+        baseline_source="$(mktemp -d)"
+        git archive "$BASE_SHA" | tar -x -C "$baseline_source"
+        uv build --out-dir "$RUNNER_TEMP/openmed-baseline-dist" "$baseline_source"
+        echo "measured=true" >> "$GITHUB_OUTPUT"
+        python - "$RUNNER_TEMP/openmed-baseline-dist" <<'PY'
+        import hashlib
+        import json
+        import os
+        import platform
+        import subprocess
+        import sys
+        import zipfile
+        from pathlib import Path
+
+        wheels = list(Path(sys.argv[1]).glob("openmed-*.whl"))
+        if len(wheels) != 1:
+            raise SystemExit("Expected exactly one frozen-base wheel")
+        wheel = wheels[0]
+        measured = wheel.stat().st_size
+        budget = json.loads(Path("gates/release_budgets.json").read_text())
+        expected = budget["entries"]["package::openmed::wheel"]["metrics"]["baseline_bytes"]
+        with zipfile.ZipFile(wheel) as archive:
+            metadata_paths = [name for name in archive.namelist() if name.endswith(".dist-info/WHEEL")]
+            if len(metadata_paths) != 1:
+                raise SystemExit("Expected exactly one wheel metadata record")
+            wheel_metadata = archive.read(metadata_paths[0]).decode("utf-8")
+        receipt = {
+            "base_sha": os.environ["BASE_SHA"],
+            "python": platform.python_version(),
+            "uv": subprocess.check_output(["uv", "--version"], text=True).strip(),
+            "wheel_metadata": wheel_metadata,
+            "measured_bytes": measured,
+            "proposed_baseline_bytes": expected,
+            "sha256": hashlib.sha256(wheel.read_bytes()).hexdigest(),
+            "matches": measured == expected,
+        }
+        (wheel.parent / "baseline-receipt.json").write_text(json.dumps(receipt, indent=2) + "\n")
+        print(f"Frozen-base wheel: {measured} bytes, sha256={hashlib.sha256(wheel.read_bytes()).hexdigest()}")
+        if measured != expected:
+            raise SystemExit(f"Wheel baseline mismatch: measured {measured}, proposed {expected}")
+        PY
+
     - name: Enforce wheel size budget and record language-extra footprints
       run: |
         python scripts/release/check_size_budget.py \
@@ -569,3 +715,10 @@ jobs:
           dist/
           size-budget-report.json
       if: always()
+
+    - name: Upload wheel baseline evidence
+      if: always() && steps.wheel_baseline.outputs.measured == 'true'
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      with:
+        name: wheel-size-baseline
+        path: ${{ runner.temp }}/openmed-baseline-dist/

CHANGELOG.md

@@ -309,6 +309,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   moved under a later caller (#3501).
 
 - Hash dataset files with bounded memory (#3510).
+- Report non-object catalog JSONL rows through the normal coherence diagnostic
+  path with physical line numbers, without exposing row values or paths (#3562).
 - Respect explicitly empty gold annotations (#3511).
 - Load prefetched Hugging Face models from the standard cache during offline
   inference, including Transformers 5.x pipeline and component loading (#1983).

README.ar.md

@@ -470,7 +470,7 @@ curl -X POST http://127.0.0.1:8080/pii/extract \
 
 </div>
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.de.md

@@ -393,7 +393,7 @@ Wenn OpenMed für deine Forschung nützlich ist, zitiere es bitte:
 
 Wenn OpenMed dir nützlich ist, hilft ein Stern anderen, es zu entdecken.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.es.md

@@ -393,7 +393,7 @@ Si OpenMed te resulta útil en tu investigación, cítalo:
 
 Si OpenMed te resulta útil, una estrella ayuda a que otros lo descubran.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.fa.md

@@ -472,7 +472,7 @@ OpenMed بر پایهٔ کارهای عالیِ متن‌باز ساخته شد
 
 </div>
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.fr.md

@@ -393,7 +393,7 @@ Si OpenMed vous est utile dans vos recherches, merci de le citer :
 
 Si OpenMed vous est utile, une étoile aide les autres à le découvrir.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.hi.md

@@ -750,7 +750,7 @@ OpenMed SDK का स्रोत [Apache-2.0 License](LICENSE) के अं
 
 यदि OpenMed आपके लिए उपयोगी है, तो एक star दूसरों को इसे खोजने में मदद करता है।
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.it.md

@@ -393,7 +393,7 @@ Se OpenMed ti è utile nella tua ricerca, ti preghiamo di citarlo:
 
 Se OpenMed ti è utile, una stella aiuta altri a scoprirlo.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.ja.md

@@ -393,7 +393,7 @@ OpenMed SDK のソースは [Apache-2.0 License](LICENSE) の下で公開され
 
 OpenMed が役立つと感じたら、スターを付けると他の人が見つけやすくなります。
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.md

@@ -745,7 +745,7 @@ papers, posters, and derived documentation.
 
 If OpenMed is useful to you, a star helps others discover it.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.nl.md

@@ -393,7 +393,7 @@ Als OpenMed nuttig is in je onderzoek, citeer het dan:
 
 Als OpenMed nuttig voor je is, helpt een ster anderen om het te ontdekken.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.pt.md

@@ -393,7 +393,7 @@ Se o OpenMed for útil na sua pesquisa, por favor, cite:
 
 Se o OpenMed for útil para você, uma estrela ajuda outros a descobri-lo.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.sw.md

@@ -610,7 +610,7 @@ OpenMed katika makala, mabango na nyaraka zinazotokana nayo.
 
 Ikiwa OpenMed inakufaa, nyota huwasaidia wengine kuipata.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.te.md

@@ -393,7 +393,7 @@ OpenMed SDK సోర్స్ [Apache-2.0 License](LICENSE) క్రింద
 
 OpenMed మీకు ఉపయోగకరంగా ఉంటే, ఒక స్టార్ ఇతరులు దాన్ని కనుగొనడంలో సహాయపడుతుంది.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.tr.md

@@ -393,7 +393,7 @@ OpenMed araştırmanızda faydalı olduysa, lütfen atıfta bulunun:
 
 OpenMed sizin için faydalıysa, bir yıldız başkalarının onu keşfetmesine yardımcı olur.
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

README.zh-CN.md

@@ -726,7 +726,7 @@ OpenMed SDK 源代码基于 [Apache-2.0 License](LICENSE) 发布。第三方资
 
 如果 OpenMed 对你有帮助，点个 star 能帮助更多人发现它。
 
-[5,100+ GitHub stars · 30 Aug 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
+[5,400+ GitHub stars · 3 Oct 2026 snapshot](https://github.com/maziyarpanahi/openmed/stargazers)
 
 ---
 

deploy/security/cve-allowlist.yaml

@@ -8,8 +8,13 @@ allowlist:
   - id: CVE-2026-81726
     package: nltk
     target: uv.lock
-    expires: 2026-09-28
+    expires: 2026-10-17
     reason: >-
-      Re-reviewed 2026-09-14: NLTK still has no fixed release; OpenMed does
-      not call the affected model-artifact APIs and the service image excludes
-      NLTK.
+      Owner-authorized review 2026-10-03: upstream GHSA-8mgp-746c-j5xp still
+      lists no patched release and PyPI latest is 3.10.3. NLTK is reachable
+      only through agents, llamaindex, medspacy, quickumls and scrubadub extras;
+      it is absent from the core closure and service image. OpenMed does not
+      call the affected model-artifact APIs. This temporary acceptance is not
+      remediation: do not pass untrusted model paths to those optional
+      integrations. The gate rejects this waiver when a fixed version is
+      reported, for any other package or target, or after 2026-10-17.

docs/brand/social/manifest.json

@@ -5,7 +5,7 @@
   "source_hashes": {
     "docs/brand/social/_src/exports.json": "385c4ed79de723b47e8af696bd83cd8e06abdd8a6f07edb60ffb150545a59353",
     "docs/brand/social/_src/profile-copy.json": "04255d0564edcc50363d952bdc4c0cc4945ddaad24cccfddd52e57596c7409cf",
-    "docs/brand/system/claims.yml": "152df7ffdf7ca519309c6d6a21cbc30108d063c3334d01e3ab77724421812e34",
+    "docs/brand/system/claims.yml": "543790f7284e7db09cfd6011a91abd9bf003712678bd99f689e355d3b368b388",
     "docs/brand/social/exports/README.md": "e28ac10689d4ae392509bad8a7102fba63d3895ab1c6d862ff2e13bb5d5178a0"
   },
   "approved_exports": {

docs/brand/system/claims.yml

@@ -1,6 +1,6 @@
 {
   "schema_version": 2,
-  "generated_at": "2026-08-30",
+  "generated_at": "2026-10-03",
   "generation": {
     "command": "python scripts/brand/update_claims.py --write",
     "network": "forbidden",
@@ -24,15 +24,15 @@
     },
     "github_stars_snapshot": {
       "status": "verified",
-      "value": 5181,
-      "display": "5,100+ GitHub stars",
+      "value": 5444,
+      "display": "5,400+ GitHub stars",
       "definition": "Exact stargazers_count from the committed GitHub API evidence; public display is conservatively floored to the preceding 100-star quantum.",
       "source": "docs/brand/system/evidence/github-repository.json",
-      "as_of": "2026-08-30",
+      "as_of": "2026-10-03",
       "owner": "repository-owner",
-      "public_wording": "5,100+ GitHub stars",
-      "qualification": "Dated offline snapshot, not a live counter; the exact raw value was 5,181 when captured.",
-      "review_by": "2026-09-30",
+      "public_wording": "5,400+ GitHub stars",
+      "qualification": "Dated offline snapshot, not a live counter; the exact raw value was 5,444 when captured.",
+      "review_by": "2026-11-03",
       "follow_up_by": null
     },
     "repository_model_snapshot": {