feat(sources): add row-level CSV evidence source

.github/workflows/build-artifacts.yml

@@ -55,7 +55,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true
@@ -379,7 +379,15 @@ jobs:
             --no-index \
             --find-links "$BUNDLE_ROOT/wheelhouse" \
             "$cli_wheel[cli]"
-          build/cli-smoke-venv/bin/powercontext skill remote-sync --help
+          if [ -f scripts/ci_role_smoke.py ]; then
+            build/cli-smoke-venv/bin/python -I scripts/ci_role_smoke.py cli
+          else
+            # Requested historical refs may predate the role smoke harness.
+            build/cli-smoke-venv/bin/powercontext skill remote-sync --help
+          fi
+          if [ -f src/powercontext/cli/archive.py ]; then
+            build/cli-smoke-venv/bin/powercontext archive --help
+          fi
 
           plugin_root="$BUNDLE_ROOT/integrations/plugins/powercontext"
           (
@@ -402,7 +410,7 @@ jobs:
             > "build/output/${ARTIFACT_NAME}.tar.gz.sha256"
 
       - name: Upload customer artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: ${{ steps.metadata.outputs.artifact_name }}
           path: |

.github/workflows/build-docker.yml

@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.10.12"
           enable-cache: true
@@ -117,7 +117,7 @@ jobs:
           exit 1
 
       - name: Upload Docker image archives
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: ${{ steps.metadata.outputs.artifact_name }}
           path: docker-images/*.tar

.github/workflows/candidate-schema-replay.yml

@@ -0,0 +1,70 @@
+name: Candidate schema replay
+
+on:
+  pull_request:
+    paths:
+      - src/powercontext/builtin/persistence/**
+      - src/powercontext/builtin/artifacts/**
+      - tests/builtin/persistence/**
+      - scripts/replay_candidate_migration.py
+      - .github/workflows/candidate-schema-replay.yml
+      - .github/actions/setup-upgrade-oceanbase/**
+      - pyproject.toml
+      - uv.lock
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: candidate-replay-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  replay:
+    name: Candidate replay (${{ matrix.backend }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        backend: [sqlite, seekdb, oceanbase]
+    env:
+      POWERCONTEXT_TEST_MIGRATION_SEEKDB: "1"
+      POWERCONTEXT_TEST_MIGRATION_OCEANBASE_URL: mysql+aoceanbase://root%40test:powercontext-e2e@127.0.0.1:2881/pc_migration_probe_candidate_replay?charset=utf8mb4
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: ./.github/actions/setup-python-env
+      - name: Start isolated OceanBase
+        if: matrix.backend == 'oceanbase'
+        uses: ./.github/actions/setup-upgrade-oceanbase
+      - name: Create the scratch database namespace
+        if: matrix.backend == 'oceanbase'
+        run: >-
+          docker exec upgrade-oceanbase
+          obclient -h127.0.0.1 -P2881 -uroot@test -ppowercontext-e2e
+          -e 'CREATE DATABASE pc_migration_probe_candidate_replay'
+      - name: Replay and recover the frozen Candidate conversion without skips
+        run: >-
+          uv run --locked --extra seekdb python scripts/replay_candidate_migration.py
+          ${{ matrix.backend }} --output "$RUNNER_TEMP/candidate-replay"
+      - name: Preserve OceanBase diagnostics
+        if: always() && matrix.backend == 'oceanbase'
+        run: |
+          mkdir -p "$RUNNER_TEMP/candidate-replay"
+          docker logs upgrade-oceanbase > "$RUNNER_TEMP/candidate-replay/oceanbase.log" 2>&1 || true
+          docker stop --timeout 30 upgrade-oceanbase || true
+      - name: Save generated inventories and comparisons
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: candidate-replay-${{ matrix.backend }}-${{ github.sha }}
+          path: ${{ runner.temp }}/candidate-replay/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/capture-release-schema.yml

@@ -0,0 +1,63 @@
+name: Capture released Server schema
+
+on:
+  pull_request:
+    paths:
+      - scripts/capture_release_schema.py
+      - scripts/upgrade_database_probe.py
+      - scripts/upgrade_process.py
+      - tests/release_upgrades/test_full_server.py
+      - .github/workflows/capture-release-schema.yml
+      - .github/actions/setup-upgrade-oceanbase/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-schema-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  capture:
+    name: Capture 1.4.0 (${{ matrix.backend }}, ${{ matrix.configuration }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        backend: [sqlite, seekdb, oceanbase]
+        configuration: [full-server-no-vector, full-server-code, full-server-vector, full-server-vector-code]
+    env:
+      PC_UPGRADE_OCEANBASE_URL: mysql+aoceanbase://root%40test:powercontext-e2e@127.0.0.1:2881/pc_upgrade_test?charset=utf8mb4
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: ./.github/actions/setup-python-env
+      - name: Start isolated OceanBase
+        if: matrix.backend == 'oceanbase'
+        uses: ./.github/actions/setup-upgrade-oceanbase
+      - name: Capture installed release without current runtime initialization
+        run: >-
+          .venv/bin/python scripts/upgrade_process.py
+          --parent-pid $$ --timeout 1800 --shutdown-timeout 60 --
+          .venv/bin/python scripts/capture_release_schema.py
+          ${{ matrix.backend }} --configuration ${{ matrix.configuration }}
+          --output "$RUNNER_TEMP/release-schema"
+      - name: Preserve OceanBase diagnostics
+        if: always() && matrix.backend == 'oceanbase'
+        run: |
+          mkdir -p "$RUNNER_TEMP/release-schema"
+          docker logs upgrade-oceanbase > "$RUNNER_TEMP/release-schema/oceanbase.log" 2>&1 || true
+          docker stop --timeout 30 upgrade-oceanbase || true
+      - name: Save source schema and provenance
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: release-1.4.0-${{ matrix.backend }}-${{ matrix.configuration }}-${{ github.sha }}
+          path: ${{ runner.temp }}/release-schema/
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/ci-changes.yml

@@ -0,0 +1,30 @@
+name: Detect CI scope
+
+on:
+  workflow_call:
+    outputs:
+      suites:
+        description: JSON object of suites selected for this event
+        value: ${{ jobs.detect.outputs.suites }}
+
+permissions:
+  contents: read
+
+jobs:
+  detect:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      suites: ${{ steps.select.outputs.suites }}
+    steps:
+      - name: Check out the complete PR history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Select checks
+        id: select
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: python3 scripts/ci_changes.py

.github/workflows/deploy-docs.yml

@@ -35,7 +35,13 @@ jobs:
         uses: ./.github/actions/setup-python-env
 
       - name: Set up website tools
-        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
+
+      - name: Cache website dependencies
+        uses: ./.github/actions/cache-pnpm
+        with:
+          working-directory: website
+          cache-dependency-glob: website/pnpm-lock.yaml
 
       - name: Build website
         run: make docs-build