Prepare the Heartwood 0.2.0 Release

[PSchmiedmayer]

♻️ Current situation & Problem

Heartwood needs enforceable mitigations for the remaining GPU runtime advisories and a clear support and security policy before the first stable 0.2 release. This advances #34 and #48.

⚙️ Release Notes

• Disable vLLM's optional outlines disk cache and reject packaged vLLM TorchScript use.
• Keep runtime caches private and define current support, compatibility, security-reporting, and release ownership policies.
• Promote release-owned metadata, artifacts, dependencies, and documentation to 0.2.0.

📚 Documentation

Adds the repository security policy and Support and Compatibility guide, and updates stable release and platform references for 0.2.0.

✅ Testing

Python, web unit and browser tests, gateway and notebook smoke tests, strict documentation build, REUSE, release version gate, native installer suite, and clean Ubuntu 24.04 installation and inference smoke.

Code of Conduct & Contributing Guidelines

• I agree to follow this project's Code of Conduct and Contributing Guidelines.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

@PSchmiedmayer, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 14526679-5df2-4079-8fe0-d9246352f8a1

📥 Commits

Reviewing files that changed from the base of the PR and between 628a95f and 71b313c.

📒 Files selected for processing (2)

• images/gpu/verify_vllm.py
• packages/compliance/tests/test_container_assets.py

📝 Walkthrough

Walkthrough

The release is finalized as version 0.2.0 across project metadata, packages, fixtures, skills, container builds, installers, and documentation. New support, compatibility, security, and release-governance guidance is linked into project documentation. GPU runtime images now disable vLLM’s outlines disk cache and reject prohibited cache or TorchScript configurations through startup verification. Compliance tests cover the updated release and runtime contracts.

Sequence Diagram(s)

sequenceDiagram
  participant GPU Launcher
  participant vLLM
  participant Verifier
  GPU Launcher->>vLLM: Set outlines disk cache disabled
  GPU Launcher->>Verifier: Run startup checks
  Verifier->>vLLM: Inspect environment and package sources
  vLLM-->>Verifier: Return configuration and source files
  Verifier-->>GPU Launcher: Permit startup or raise RuntimeError

Loading

Possibly related PRs

• SchmiedmayerLab/heartwood#57: Updates the same adapter version resolution and conformance expectations.
• SchmiedmayerLab/heartwood#71: Changes the same adapter verification condition for a release version.
• SchmiedmayerLab/heartwood#91: Updates the same conformance default version and related test.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 23.08% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: preparing Heartwood 0.2.0 for release.
Description check	✅ Passed	The description is directly related to the release-prep changes, policy updates, and mitigations in the PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@images/gpu/verify_vllm.py`:
- Around line 106-137: Update _torchscript_calls to recognize ast.Import entries
for torch.jit, adding each alias (including asname) to jit_names so calls such
as jit.script(...) are detected. Preserve existing from torch import jit and
torch.jit.script handling, and add a regression test covering import torch.jit
as jit followed by jit.script(...).

In `@SECURITY.md`:
- Line 3: Update the SPDX copyright attribution in SECURITY.md at lines 3-3 and
documentation/operate/support.md at lines 3-3 to use the approved Schmiedmayer
Lab at Stanford University wording, replacing the broader Stanford University
attribution in both headers.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 718b1b2f-3e05-4daa-b4df-a2f1d312b553

📥 Commits

Reviewing files that changed from the base of the PR and between 886ba53 and 628a95f.

⛔ Files ignored due to path filters (2)

• packages/webui/package-lock.json is excluded by !**/package-lock.json
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (56)

• AGENTS.md
• README.md
• SECURITY.md
• VERSION.toml
• docker-bake.hcl
• documentation/contribute/releases.md
• documentation/models/offline.md
• documentation/operate/index.md
• documentation/operate/security.md
• documentation/operate/support.md
• documentation/platforms/carina.md
• documentation/platforms/containers.md
• documentation/platforms/native-linux.md
• documentation/platforms/terra.md
• fixtures/synthetic/skills/omop-cohort-summary/SKILL.md
• fixtures/synthetic/skills/omop-cohort-summary/metadata.json
• images/Dockerfile
• images/gpu/heartwood-vllm
• images/gpu/verify_vllm.py
• packages/adapters/pyproject.toml
• packages/adapters/src/heartwood/adapters/__init__.py
• packages/adapters/src/heartwood/adapters/conformance.py
• packages/adapters/tests/test_conformance.py
• packages/audit/pyproject.toml
• packages/audit/src/heartwood/audit/__init__.py
• packages/cli/pyproject.toml
• packages/cli/src/heartwood/cli/__init__.py
• packages/compliance/pyproject.toml
• packages/compliance/src/heartwood/compliance/__init__.py
• packages/compliance/tests/test_container_assets.py
• packages/compliance/tests/test_release_governance.py
• packages/core-adapter/pyproject.toml
• packages/core-adapter/src/heartwood/core_adapter/__init__.py
• packages/detector/pyproject.toml
• packages/detector/src/heartwood/detector/__init__.py
• packages/fixtures/pyproject.toml
• packages/fixtures/src/heartwood/fixtures/__init__.py
• packages/gateway/pyproject.toml
• packages/model-policy/pyproject.toml
• packages/model-policy/src/heartwood/model_policy/__init__.py
• packages/notebook/pyproject.toml
• packages/notebook/src/heartwood/notebook/__init__.py
• packages/schemas/pyproject.toml
• packages/schemas/src/heartwood/schemas/__init__.py
• packages/schemas/tests/test_schema_records.py
• packages/session/pyproject.toml
• packages/session/src/heartwood/session/__init__.py
• packages/skills/pyproject.toml
• packages/webui/package.json
• skills/verified/aggregate-export/SKILL.md
• skills/verified/aggregate-export/metadata.json
• skills/verified/baseline-model/SKILL.md
• skills/verified/baseline-model/metadata.json
• skills/verified/omop-cohort-summary/SKILL.md
• skills/verified/omop-cohort-summary/metadata.json
• zensical.toml

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.