Full audit: dedup fix, PV tests, README rewrite, release workflow

.env.example

@@ -35,6 +35,7 @@ LANGFUSE_HOST=https://cloud.langfuse.com
 FEW_SHOT_K=3                       # Number of traces to retrieve per query
 MAX_PROMPT_TOKENS=3500             # Token budget for the prompt
 SIMILARITY_DEDUP_THRESHOLD=0.95    # Cosine threshold for deduplication (Section III.E.3)
+SANDBOX_TIMEOUT_SECONDS=30         # Gatekeeper sandbox execution timeout
 
 # === Feedback Loop ===
 FEEDBACK_SCORE_NAME=quality        # Langfuse score name to watch

.github/workflows/release.yml

@@ -5,6 +5,7 @@ on:
     tags: ["v*"]
 
 permissions:
+  contents: read
   id-token: write
 
 jobs:
@@ -16,3 +17,6 @@ jobs:
       - uses: astral-sh/setup-uv@v4
       - run: uv build
       - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+

.gitignore

@@ -31,6 +31,6 @@ Thumbs.db
 
 uv.lock
 
-benchmark_results.json
+benchmark_results*.json
 .chainlit/
 chainlit.md

CONTRIBUTING.md

@@ -59,6 +59,16 @@ git commit -m "your message"
 To run checks manually at any time:
 
 ```bash
+# Using make (recommended)
+make lint         # Lint
+make format       # Auto-format
+make typecheck    # Type check (mypy strict)
+make test         # Run all tests
+make ci           # All checks (lint + format + typecheck + test)
+make validate     # Pipeline validation (no API keys needed)
+make demo         # Offline demo
+
+# Or directly
 uv run ruff check src/ tests/ agent/      # Lint only
 uv run ruff check --fix src/ tests/ agent/ # Lint + auto-fix
 uv run ruff format src/ tests/ agent/      # Format
@@ -69,7 +79,7 @@ uv run pytest                              # Run all tests
 ## Running Tests
 
 ```bash
-# All 104 tests (no external services needed)
+# All tests (no external services needed)
 uv run pytest
 
 # With verbose output