[erxxc]

Summary

Everything needed before tagging v0.2.0 for the next Zenodo archive, in two commits:

1. Dataset timestamps normalised. dataset/README.md promises T00:00:00Z timestamps; only 4 of 34 report files had them. All 34 now do. Timestamp is the only field touched; all files validate.
2. Release metadata. Version 0.2.0 in pyproject.toml, uv.lock, and the User-Agent fallback; CITATION.cff at 0.2.0 / 2026-09-10 (validated with cffconvert, entity author kept per Fix CITATION.cff: author as entity, not person (fixes Zenodo archival failure) #10); README citation section with the v0.2.0 DOI marked pending; new CHANGELOG.md.

Not done here, on purpose: the tag and GitHub release. Cutting the release is what triggers Zenodo, and the minted DOI then needs a follow-up PR (as #11 did for v0.1.0).

Release checklist after merge

1. git tag -a v0.2.0 -m "chainwatch v0.2.0" <merge commit> and push the tag, or let gh release create v0.2.0 --target main create it.
2. gh release create v0.2.0 --title "v0.2.0 — Research backlog round 1" --notes-file <release notes> — draft notes are in the PR conversation below.
3. Wait for Zenodo to mint the version DOI under concept 10.5281/zenodo.21908505.
4. Follow-up PR: add the new DOI to CITATION.cff identifiers, the README citation section (replace the "pending" line), and the [0.2.0] entry in CHANGELOG.md.

If the tag is cut on a day other than 2026-09-10, adjust date-released in CITATION.cff and the [0.2.0] date in CHANGELOG.md first.

Test plan

• 307 passed, coverage 91.0%; ruff and mypy clean
• uvx cffconvert --validate: valid against CFF 1.2.0
• All 34 dataset JSON files validate; report-*.json glob still counts 18

🤖 Generated with Claude Code

https://claude.ai/code/session_01SrGsKknvZvNgFwvTVnHdUA

[erxxc]

LLM-assisted supply chain diff analyzer combining semantic diff analysis (Claude) with threat intelligence feeds to detect malicious npm/PyPI package updates.

Highlights

• Report schema 0.3.0: per-stage timings, caveats[] naming evidence the LLM did not see (truncated, skipped, or split files; multi-chunk scoring; stripped comments), and diff-visibility fields — all additive, every earlier report still validates
• --strip-comments: the narrative-leakage control from recommendation Performance and detection improvements: bounded concurrency, PyPI Rekor, new-dependency provenance #8 as a one-flag rerun; on the coa/rc narrated placeholders it reproduces the HIGH → MEDIUM flip and attributes 12.5–13.5 points to prose alone
• --split-large-files: send a minified bundle to the LLM whole, in parts, instead of head-truncated — capped per file by CHAINWATCH_MAX_SPLIT_PARTS_PER_FILE
• yarn.lock support in scan (classic v1 and Berry)
• Corpus additions: coa/rc third condition and repeat run (inconclusive-*), lodash reruns with the first timings data points (experiment-*); report timestamps normalised as documented; precision/recall statistics unchanged
• 307 tests, 91.0% coverage, ruff/mypy clean; committed uv.lock; CHANGELOG.md

Citing this release

See CITATION.cff, or cite directly via Zenodo:

• DOI for this release: minted on publication — see the Zenodo record linked from the README badge
• Concept DOI (always latest version): 10.5281/zenodo.21908505

🤖 Generated with Claude Code