uofa 0.7.0__tar.gz

uofa-0.7.0/.devcontainer/devcontainer.json

@@ -0,0 +1,29 @@
+{
+  "name": "UofA Development Environment",
+  "image": "mcr.microsoft.com/devcontainers/python:3.11",
+
+  "features": {
+    "ghcr.io/devcontainers/features/java:1": {
+      "version": "17",
+      "installMaven": "true"
+    }
+  },
+
+  "postCreateCommand": "pip install -e '.[test,excel,extract]' && cd src/weakener-engine && mvn package -q",
+
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "redhat.vscode-yaml"
+      ],
+      "settings": {
+        "json.schemas": [
+          {
+            "fileMatch": ["*.jsonld"],
+            "url": "./spec/schemas/uofa.schema.json"
+          }
+        ]
+      }
+    }
+  }
+}

uofa-0.7.0/.gitattributes

@@ -0,0 +1,38 @@
+# Force LF line endings across platforms for ALL text-format files. The
+# Windows default `core.autocrlf=true` would convert LF to CRLF on
+# checkout, which breaks the hash + signature integrity verification:
+# the canonicalized JSON-LD form depends on the exact bytes of the
+# referenced @context file (and the package itself), and CRLF vs LF
+# in those source files produces different canonical hashes.
+#
+# This file pins line endings to LF on disk regardless of platform —
+# the same content + bytes = the same hash on Linux, macOS, and Windows.
+
+*               text=auto eol=lf
+*.jsonld        text eol=lf
+*.json          text eol=lf
+*.rules         text eol=lf
+*.ttl           text eol=lf
+*.yaml          text eol=lf
+*.yml           text eol=lf
+*.py            text eol=lf
+*.md            text eol=lf
+*.toml          text eol=lf
+*.cfg           text eol=lf
+*.ini           text eol=lf
+*.key           text eol=lf
+*.pub           text eol=lf
+*.txt           text eol=lf
+
+# Binary formats — never normalize.
+*.png           binary
+*.jpg           binary
+*.jpeg          binary
+*.gif           binary
+*.pdf           binary
+*.zip           binary
+*.tar.gz        binary
+*.jar           binary
+*.xlsx          binary
+*.xlsm          binary
+*.docx          binary

uofa-0.7.0/.github/workflows/release-wheels.yml

@@ -0,0 +1,396 @@
+name: Release Wheels
+
+# PR 3 scope: full 6-wheel matrix.
+#   * py3-none-any                   — bundles JAR; system Java still required
+#   * py3-none-manylinux_2_28_x86_64
+#   * py3-none-manylinux_2_28_aarch64
+#   * py3-none-macosx_11_0_x86_64
+#   * py3-none-macosx_11_0_arm64
+#   * py3-none-win_amd64
+#
+# Each platform-tagged wheel bundles the JAR AND a per-platform OpenJDK 17
+# JRE; no system Java needed at runtime. Smoke tests run on native runners
+# of each OS to confirm the bundled JRE is the one being executed.
+
+on:
+  push:
+    tags: ['v*']
+  pull_request:
+    paths:
+      - 'pyproject.toml'
+      - 'build-config/hatch_build.py'
+      - 'build-config/jre_manifest.toml'
+      - 'src/uofa_cli/paths.py'
+      - 'src/uofa_cli/commands/rules.py'
+      - 'src/weakener-engine/**'
+      - 'dev/tools/scripts/refresh_jre_manifest.py'
+      - '.github/workflows/release-wheels.yml'
+  workflow_dispatch:
+
+jobs:
+  build-jar:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Build fat JAR
+        run: cd src/weakener-engine && mvn package -q
+
+      - name: Upload JAR artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: weakener-engine-jar
+          path: src/weakener-engine/target/uofa-weakener-engine-*.jar
+          if-no-files-found: error
+          retention-days: 1
+
+  # Source distribution. Doesn't bundle the JAR (per pyproject.toml's
+  # [tool.hatch.build.targets.sdist] exclude); sdist consumers rebuild the JAR
+  # via Maven on install. Runs in parallel with build-jar/build-wheel.
+  build-sdist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install build tooling
+        run: python -m pip install --upgrade pip build
+      - name: Build sdist
+        run: python -m build --sdist
+      - name: Upload sdist artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: uofa-sdist
+          path: dist/*.tar.gz
+          if-no-files-found: error
+
+  build-wheel:
+    needs: build-jar
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: pure
+            artifact: uofa-cli-wheel-pure
+            env_jar: '1'
+            env_platform: ''
+          - variant: linux-x86_64
+            artifact: uofa-cli-wheel-manylinux-x86_64
+            env_jar: ''
+            env_platform: 'manylinux_2_28_x86_64'
+          - variant: linux-aarch64
+            artifact: uofa-cli-wheel-manylinux-aarch64
+            env_jar: ''
+            env_platform: 'manylinux_2_28_aarch64'
+          # macos-x86_64 (Intel) dropped in v0.7.0: GHA queue waits for the
+          # macos-13 runner routinely block PyPI publish. Intel Mac users
+          # install the py3-none-any wheel + system Java 17 instead.
+          - variant: macos-arm64
+            artifact: uofa-cli-wheel-macos-arm64
+            env_jar: ''
+            env_platform: 'macosx_11_0_arm64'
+          - variant: win-amd64
+            artifact: uofa-cli-wheel-win-amd64
+            env_jar: ''
+            env_platform: 'win_amd64'
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install build tooling
+        run: python -m pip install --upgrade pip build
+
+      - name: Download JAR artifact into Maven target/
+        uses: actions/download-artifact@v4
+        with:
+          name: weakener-engine-jar
+          path: src/weakener-engine/target/
+
+      - name: Build wheel (${{ matrix.variant }})
+        env:
+          UOFA_BUNDLE_JAR: ${{ matrix.env_jar }}
+          UOFA_BUNDLE_PLATFORM: ${{ matrix.env_platform }}
+        run: python -m build --wheel
+
+      - name: Assert wheel size under 200 MB
+        run: |
+          for w in dist/*.whl; do
+            size=$(stat -c%s "$w")
+            mb=$((size / 1024 / 1024))
+            echo "$w: ${mb} MB"
+            if [ "$size" -gt $((200 * 1024 * 1024)) ]; then
+              echo "FAIL: wheel exceeds 200 MB ceiling"
+              exit 1
+            fi
+          done
+
+      - name: Upload wheel artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact }}
+          path: dist/*.whl
+          if-no-files-found: error
+
+  smoke-pure-wheel:
+    # py3-none-any wheel: bundled JAR, requires system Java at runtime.
+    needs: build-wheel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Download pure wheel
+        uses: actions/download-artifact@v4
+        with:
+          name: uofa-cli-wheel-pure
+          path: dist/
+
+      - name: Install pure wheel into a fresh venv
+        run: |
+          python -m venv /tmp/uofa-pure-venv
+          /tmp/uofa-pure-venv/bin/pip install --upgrade pip
+          /tmp/uofa-pure-venv/bin/pip install dist/*.whl
+
+      - name: Confirm bundled JAR present, no bundled JRE
+        run: |
+          /tmp/uofa-pure-venv/bin/python <<'PY'
+          from uofa_cli import paths
+          assert paths.bundled_jar() is not None, "bundled JAR missing"
+          assert paths.bundled_jre_executable() is None, "py3-none-any wheel should not include a JRE"
+          print(f"OK: JAR={paths.bundled_jar()}")
+          PY
+
+      - name: Run uofa check against Morrison example
+        run: |
+          /tmp/uofa-pure-venv/bin/uofa check packs/vv40/examples/morrison/cou1/uofa-morrison-cou1.jsonld
+
+  smoke-linux-x86_64:
+    needs: build-wheel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: uofa-cli-wheel-manylinux-x86_64
+          path: dist/
+      - name: Smoke test in python:3.11-slim Docker (no Java preinstalled)
+        run: |
+          cat > /tmp/check_bundled_jre.py <<'PY'
+          from uofa_cli import paths
+          jre = paths.bundled_jre_executable()
+          assert jre is not None and jre.exists(), "bundled JRE missing"
+          assert "site-packages" in str(jre), "bundled JRE not from wheel install"
+          print(f"OK: java_executable={paths.java_executable()}")
+          PY
+          docker run --rm \
+            -v "$PWD:/work" \
+            -v /tmp/check_bundled_jre.py:/check_bundled_jre.py:ro \
+            -w /work \
+            python:3.11-slim bash -c '
+              set -euo pipefail
+              if command -v java; then echo "FAIL: java unexpectedly on PATH"; exit 1; fi
+              pip install --quiet dist/*manylinux_2_28_x86_64*.whl
+              python /check_bundled_jre.py
+              uofa check packs/vv40/examples/morrison/cou1/uofa-morrison-cou1.jsonld
+            '
+
+  smoke-linux-aarch64:
+    needs: build-wheel
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: uofa-cli-wheel-manylinux-aarch64
+          path: dist/
+      - name: Smoke test in python:3.11-slim Docker (no Java preinstalled)
+        run: |
+          cat > /tmp/check_bundled_jre.py <<'PY'
+          from uofa_cli import paths
+          jre = paths.bundled_jre_executable()
+          assert jre is not None and jre.exists(), "bundled JRE missing"
+          assert "site-packages" in str(jre), "bundled JRE not from wheel install"
+          print(f"OK: java_executable={paths.java_executable()}")
+          PY
+          docker run --rm \
+            -v "$PWD:/work" \
+            -v /tmp/check_bundled_jre.py:/check_bundled_jre.py:ro \
+            -w /work \
+            python:3.11-slim bash -c '
+              set -euo pipefail
+              if command -v java; then echo "FAIL: java unexpectedly on PATH"; exit 1; fi
+              pip install --quiet dist/*manylinux_2_28_aarch64*.whl
+              python /check_bundled_jre.py
+              uofa check packs/vv40/examples/morrison/cou1/uofa-morrison-cou1.jsonld
+            '
+
+  smoke-macos:
+    needs: build-wheel
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # macos-13 (Intel) dropped in v0.7.0 — see the matching note in
+          # build-wheel above.
+          - runner: macos-14
+            artifact: uofa-cli-wheel-macos-arm64
+            wheel_glob: '*macosx_11_0_arm64*.whl'
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: ${{ matrix.artifact }}
+          path: dist/
+
+      - name: Hide system Java (Gatekeeper-safe pruning of PATH)
+        run: |
+          # macOS GHA runners have Java preinstalled; mask it so we prove the
+          # bundled JRE is the one being used.
+          echo "JAVA_HOME=" >> "$GITHUB_ENV"
+          # Strip every PATH segment that resolves a 'java' binary.
+          new_path=""
+          IFS=':'
+          for p in $PATH; do
+            if [ -x "$p/java" ]; then continue; fi
+            new_path="${new_path:+$new_path:}$p"
+          done
+          echo "PATH=$new_path" >> "$GITHUB_ENV"
+
+      - name: Confirm no system Java
+        run: |
+          if command -v java; then echo "FAIL: java still on PATH after pruning"; exit 1; fi
+          echo "OK: no system Java on PATH"
+
+      - name: Install wheel and run uofa check
+        run: |
+          python -m venv /tmp/uofa-venv
+          /tmp/uofa-venv/bin/pip install --upgrade pip
+          /tmp/uofa-venv/bin/pip install dist/${{ matrix.wheel_glob }}
+          /tmp/uofa-venv/bin/python <<'PY'
+          from uofa_cli import paths
+          jre = paths.bundled_jre_executable()
+          assert jre is not None and jre.exists(), "bundled JRE missing"
+          assert "site-packages" in str(jre), f"unexpected JRE source: {jre}"
+          print(f"OK: java_executable={paths.java_executable()}")
+          PY
+          /tmp/uofa-venv/bin/uofa check packs/vv40/examples/morrison/cou1/uofa-morrison-cou1.jsonld
+
+  smoke-windows:
+    needs: build-wheel
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: uofa-cli-wheel-win-amd64
+          path: dist/
+
+      - name: Hide system Java (PATH prune)
+        shell: pwsh
+        run: |
+          $env:JAVA_HOME = ""
+          $newPath = ($env:PATH -split ';' | Where-Object {
+              -not (Test-Path (Join-Path $_ 'java.exe'))
+          }) -join ';'
+          "JAVA_HOME=" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "PATH=$newPath" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      - name: Confirm no system Java
+        shell: pwsh
+        run: |
+          if (Get-Command java -ErrorAction SilentlyContinue) {
+              Write-Error "FAIL: java still on PATH"; exit 1
+          }
+          Write-Host "OK: no system Java on PATH"
+
+      - name: Install wheel and run uofa check
+        shell: pwsh
+        run: |
+          python -m venv $env:RUNNER_TEMP\uofa-venv
+          & $env:RUNNER_TEMP\uofa-venv\Scripts\pip.exe install --upgrade pip
+          $wheel = (Get-ChildItem dist\*win_amd64*.whl)[0].FullName
+          & $env:RUNNER_TEMP\uofa-venv\Scripts\pip.exe install $wheel
+          $py = "$env:RUNNER_TEMP\uofa-venv\Scripts\python.exe"
+          & $py -c @"
+          from uofa_cli import paths
+          jre = paths.bundled_jre_executable()
+          assert jre is not None and jre.exists(), 'bundled JRE missing'
+          assert 'site-packages' in str(jre), f'unexpected JRE source: {jre}'
+          print(f'OK: java_executable={paths.java_executable()}')
+          "@
+          & $env:RUNNER_TEMP\uofa-venv\Scripts\uofa.exe check packs/vv40/examples/morrison/cou1/uofa-morrison-cou1.jsonld
+
+  # Publish all wheels + sdist to PyPI via Trusted Publishing (OIDC).
+  # Gates on every smoke job so we never publish a wheel we didn't smoke-test.
+  # Tag-push only — PR runs of this workflow build but don't publish.
+  publish-pypi:
+    needs:
+      - build-sdist
+      - smoke-pure-wheel
+      - smoke-linux-x86_64
+      - smoke-linux-aarch64
+      - smoke-macos      # macos-14 (arm64) only after the macos-13 drop
+      - smoke-windows
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/uofa
+    permissions:
+      id-token: write   # required for OIDC token exchange with PyPI
+    steps:
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      # Pull every wheel + sdist artifact into one dist/ directory. The glob
+      # 'uofa*' matches both legacy `uofa-cli-wheel-*` artifact names and the
+      # new `uofa-sdist`. merge-multiple flattens them into a single dir.
+      - name: Download all wheel + sdist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist/
+          pattern: 'uofa*'
+          merge-multiple: true
+
+      - name: List artifacts to publish
+        run: ls -la dist/
+
+      - name: Validate distribution metadata
+        run: |
+          python -m pip install --upgrade twine
+          twine check dist/*
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        # No `with:` block — Trusted Publishing config on the PyPI side
+        # supplies auth, and the action uploads dist/* by default.

uofa-0.7.0/.github/workflows/validate.yml

@@ -0,0 +1,18 @@
+name: Validate UofA (SHACL + Integrity + Jena Rules)
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build and run in devcontainer
+        uses: devcontainers/ci@v0.3
+        with:
+          push: never
+          runCmd: |
+            make all 

uofa-0.7.0/.gitignore

@@ -0,0 +1,85 @@
+# macOS
+.DS_Store
+._*
+.Spotlight-V100
+.Trashes
+.claude
+
+tests/fixtures/extract/*-extracted.xlsx
+
+# Java / Maven
+target/
+*.class
+*.jar
+*.war
+*.ear
+dependency-reduced-pom.xml
+buildNumber.properties
+.mvn/timing.properties
+.mvn/wrapper/maven-wrapper.jar
+
+# Python
+__pycache__/
+.pytest_cache/
+*.py[cod]
+*$py.class
+*.egg-info/
+dist/
+# build/ — Python wheel build artifacts (top-level convention).
+build/
+# dev/build/ — UofA pipeline outputs (Phase 2.5 refinement workspace +
+# adversarial corpora). Nested under dev/ in Phase E. Everything
+# regenerable from git-tracked sources.
+dev/build/
+# ...except for the documentation README inside dev/build/phase2_5/ (the
+# Phase 2.5 refinement workspace index), which is force-tracked so
+# contributors see the layout without having to regenerate the dir.
+!dev/build/phase2_5/README.md
+*.egg
+.eggs/
+*.whl
+.venv/
+venv/
+env/
+
+# IDE
+.idea/
+*.iml
+.vscode/
+*.swp
+*.swo
+*~
+.project
+.classpath
+.settings/
+
+# Keys (private keys must NOT be committed)
+keys/*.pem
+!keys/*.pub
+
+# OS
+Thumbs.db
+ehthumbs.db
+Desktop.ini
+
+# Logs
+*.log
+hs_err_pid*
+
+# Temp
+*.tmp
+*.bak
+*.orig
+
+# Generated test fixtures (regenerated at test time from generator.py)
+tests/fixtures/import/e2e-*.xlsx
+
+# Wheel-bundled artifacts (populated by hatch_build.py at wheel build time).
+# .jar is already covered by *.jar above; listed explicitly so the location
+# is documented and so the .gitkeep placeholder is preserved.
+src/uofa_cli/_engine/*.jar
+!src/uofa_cli/_engine/.gitkeep
+# JRE tree downloaded by hatch_build.py when UOFA_BUNDLE_PLATFORM is set.
+src/uofa_cli/_runtime/jre/
+src/uofa_cli/_runtime/PLATFORM
+src/uofa_cli/_runtime/JRE_VERSION

uofa-0.7.0/CHANGELOG.md

@@ -0,0 +1,117 @@
+# Changelog — Unit of Assurance (UoFA) Specification
+
+All notable changes to this project are documented here.
+
+## [0.5.0] — 2026-04-21
+
+### Added — v0.5 JSON-LD context
+
+- **New optional vocabulary** (`spec/context/v0.5.jsonld`): 12 additions backing the expanded weakener catalog. All backward-compatible — every v0.4 property is preserved; new properties are optional at the SHACL level.
+  - Data vintage / model revision: `dataVintage`, `modelRevisionDate`
+  - Evidence timestamps: `evidenceTimestamp`, `signatureTimestamp`
+  - Provenance marking: `isFoundationalEvidence`
+  - Model versioning: `modelVersion` (on ModelConfiguration)
+  - Sensitivity + activities: `hasSensitivityAnalysis`, `hasVerificationActivity`
+  - Identifier resolution: `referencesIdentifier`
+  - Staged CLARISSA vocabulary for v0.6 W-AR-06/W-AR-07: `residualRiskJustification`, `consideredAlternative`, `knownLimitation`
+
+### Added — Weakener catalog expansion (12 → 23 patterns)
+
+Eleven new weakener patterns join the `packs/core` catalog. All validated via unit-test fixtures under `tests/fixtures/weakeners/` (27 tests pass) plus inline Morrison regression (see `docs/v0.5-morrison-deltas.md`).
+
+- **W-ON-02** (High) — Unbounded Applicability: COU lacks both `hasApplicabilityConstraint` and `hasOperatingEnvelope`.
+- **W-AR-03** (High) — Inference Method Mismatch: requirement's `requiredVerificationMethod` differs from generating activity's `activityType`.
+- **W-AR-04** (High) — Model Version Drift: `ModelConfiguration.modelVersion` ≠ UofA's `currentModelVersion`.
+- **W-AL-02** (Medium) — Sensitivity Gap: UQ declared but no `hasSensitivityAnalysis` linked.
+- **W-EP-03** (High) — Stale Input Data: dataset `dataVintage` predates UofA `modelRevisionDate`.
+- **W-CON-01** (High) — Factor-Decision Consistency: `Accepted` decision with credibility factors lacking both `requiredLevel` and `achievedLevel`.
+- **W-CON-03** (High) — Future-dated Evidence: `evidenceTimestamp` > UofA `signatureTimestamp`.
+- **W-CON-04** (Medium) — Profile-Structure Consistency: Complete profile with no `hasSensitivityAnalysis` (single-branch v0.5; broader enumeration deferred to v0.6).
+- **W-CON-02** (Medium, **Python**) — Identifier Resolution: `referencesIdentifier` target neither resolves locally nor has an external-fetch hint.
+- **W-CON-05** (High, **Python**) — Activity-Evidence Consistency: `hasVerificationActivity` declared with no evidence linked via `prov:wasGeneratedBy`.
+- **W-PROV-01** (Critical, **Python**) — Provenance Chain Incomplete: BFS upstream from `bindsClaim` — emit at nodes without upstream edges that are not marked `uofa:isFoundationalEvidence=true`.
+
+### Added — CLI
+
+- **`uofa catalog`** — enumerates all weakener patterns across active packs. `--format json` for machine-readable output. Covers Jena rules and Python-implemented rules. Satisfies the "catalog CLI" deliverable.
+
+### Changed — Morrison regression deltas
+
+| | v0.4.0-nafems (baseline) | v0.5.0-pre-phase2 | Delta |
+|---|---|---|---|
+| Morrison COU1 | 14 | 24 | +10 (W-ON-02 + W-CON-01×6 + W-CON-04 + COMPOUND-01×2 cascades) |
+| Morrison COU2 | 6 | 16 | +10 (W-ON-02 + W-AL-02 + W-CON-04 + W-PROV-01×7) |
+
+Per-rule attribution in `docs/v0.5-morrison-deltas.md`.
+
+### Release-branch discipline
+
+- **Frozen reference tag** `v0.4.0-nafems` (on commit `e11b2b4`) preserves the exact state used for NAFEMS demo slide screenshots. All screenshots regenerated from v0.5 will show different counts; the demo runs from the frozen tag regardless.
+- **v0.5.0-pre-phase2** tag lands on `main` as the Phase 2 experimental baseline.
+
+### Known limitations
+
+- Python post-pass rules (W-PROV-01, W-CON-02, W-CON-05) do not feed back into the Jena `COMPOUND-01` cascade. Python-generated Critical weakeners are reported but not paired with Jena-detected High weakeners via the existing compound rule. Compound cascade across engines is deferred to v0.6.
+- W-CON-04 ships one branch (Complete profile missing SensitivityAnalysis). Broader ProfileComplete structural enumeration is deferred to v0.6 once distinct semantics beyond SHACL enforcement are settled.
+- W-CON-02 limits identifier resolution to the local graph plus HTTP(S) URL self-documentation; no HTTP fetch attempts in v0.5.
+- COMPOUND-02 (Factor Credibility Erosion) remains deferred (commented out in `packs/core/rules/uofa_weakener.rules`). `uofa catalog` filters it out.
+
+## [0.4.1] — 2026-04-04
+### Added
+- **`uofa import` command:** Imports practitioner-filled Excel workbooks into signed, validated JSON-LD UofA artifacts. Supports VV40 (13 factors) and NASA-STD-7009B (19 factors) packs, v2 evidence types (`ReviewActivity`, `ProcessAttestation`, `DeploymentRecord`, `InputPedigreeLink`), automatic URI generation, `assessmentPhase` assignment, and `ImportActivity` provenance tracking. Optional `--sign` and `--check` flags for one-command import-sign-validate workflow.
+- **`uofa schema --emit python`:** Generates `excel_constants.py` from SHACL shapes (factor names, level ranges, dropdown enums, evidence types). Keeps import validation in sync with SHACL — no manual constant maintenance.
+- **Excel import pipeline modules:** `excel_reader.py` (parse + validate workbooks), `excel_mapper.py` (intermediate dict → JSON-LD), `excel_constants.py` (generated from SHACL).
+- **`openpyxl` optional dependency:** `pip install uofa-cli[excel]` for Excel import support.
+- **Test corpus:** 15 programmatic Excel test fixtures with manifest-driven parametrized test runner (106 tests covering happy paths, error cases, NASA factors, and URI generation).
+
+## [0.4] — 2026-04-02
+### Added
+- **NASA-STD-7009B support:** New `packs/nasa-7009b/` domain pack with 19 credibility factors (13 shared with V&V 40 + 6 NASA-only), 6 NASA-specific weakener rules (W-NASA-01 through W-NASA-06), and SHACL shapes enforcing CAS level range 0-4 and assessment phase requirement.
+- **Multi-pack CLI support:** `--pack` flag now accepts multiple values (`--pack vv40 --pack nasa-7009b`). SHACL shapes and Jena rules from all specified packs are loaded as a union.
+- **`uofa migrate` command:** Upgrades v0.3 JSON-LD files to v0.4 (updates context URL, adds `factorStandard` to each CredibilityFactor). Supports `--dry-run`.
+- **v0.4 JSON-LD context** (`spec/context/v0.4.jsonld`): 3 new properties (`factorStandard`, `assessmentPhase`, `hasEvidence`) and 4 new evidence classes (`ReviewActivity`, `ProcessAttestation`, `DeploymentRecord`, `InputPedigreeLink`) with supporting properties.
+- **V&V 40 domain pack** (`packs/vv40/`): Extracted V&V 40 factor taxonomy (13 factors, level range 1-5) from core into its own pack.
+- **Aerospace example** (`examples/aerospace/uofa-aero-nasa7009b.jsonld`): Demonstrates multi-standard assessment with all 19 factors, evidence classes, and multi-pack validation.
+- **Evidence class SHACL shapes:** ReviewActivityShape, ProcessAttestationShape, DeploymentRecordShape, InputPedigreeLinkShape added to core shapes.
+- **W-NASA pattern IDs:** WeakenerAnnotation patternId regex updated to accept `W-NASA-NN` format.
+
+### Changed
+- **Core pack is now standards-agnostic:** `packs/core/pack.json` no longer lists specific standards or constrains factorType to V&V 40 values. Factor taxonomy enforcement is delegated to domain packs.
+- **Default pack is `vv40`:** When no `--pack` flag is specified, the CLI defaults to `--pack vv40` for backward compatibility with v0.3 behavior.
+- **Morrison examples upgraded to v0.4:** Context URL updated, `factorStandard: "ASME-VV40-2018"` added to all CredibilityFactor entries.
+- **All skeleton templates and starters updated** to v0.4 context and factorStandard.
+
+## [0.3] — 2026-04-01
+### Added
+- **13-factor expansion:** Morrison COUs now encode all 13 V&V 40 credibility factors (7 assessed + 6 not-assessed), up from the original 7.
+- **W-EP-04 weakener pattern:** Detects unassessed credibility factors at elevated model risk (MRL > 2). Fires 6 times on COU2 (MRL 5) but not on COU1 (MRL 2) — the core risk-driven divergence demonstration.
+- **`uofa diff` command:** Compares weakener profiles across two COUs with identity block, divergence table (core + compound patterns separated), severity summary, and divergence explanations from the rule engine.
+- **Domain packs system:** SHACL shapes, Jena rules, templates, and prompts organized into modular packs under `packs/`. Core pack ships with 13 factors and 13 weakener patterns.
+- **`uofa init` command:** Scaffolds new UofA projects with template JSON-LD, signing keys, and `.gitignore`.
+- **`uofa packs` command:** Lists and inspects installed domain packs.
+- **Starter examples:** Real-world starter templates under `examples/starters/`.
+
+### Changed
+- **`uofa diff` now runs Jena rules dynamically** instead of reading static `hasWeakener` arrays from JSON-LD files.
+- **Morrison COU1 weakener profile:** 14 weakeners across 6 patterns (4 Critical, 10 High). Compound patterns (COMPOUND-01, COMPOUND-03) fire via chained forward-chaining inference.
+- **Morrison COU2 weakener profile:** 6 weakeners, all W-EP-04 (High) — fires on 6 unassessed factors at MRL 5.
+- **COU divergence:** 7 divergent patterns between COU1 and COU2 (5 core + 2 compound), all divergent (no shared patterns).
+- SHACL shapes and Jena rules moved from `spec/` to `packs/core/` with symlinks for backward compatibility.
+- JSON-LD context updated to v0.3 (`spec/context/v0.3.jsonld`).
+
+### Fixed
+- Removed `@type: @id` from `acceptanceCriteria` context definition (was silently dropping strings).
+
+## [0.1] — 2025-11-01
+### Added
+- Initial **UoFA** specification published at https://uofa.net (single-page canonical spec).
+- Namespace established: `https://uofa.net/vocab#` with prefix `uofa`.
+- JSON-LD Context released: `context/v0.1.jsonld`.
+- JSON-LD Frame (skeleton) released: `schema/v0.1.jsonld`.
+- Repository bootstrap: README, licensing (CC BY 4.0), example snippet.
+
+### Notes
+- This is a **draft** intended for early adopters and pilot implementations.
+- Formal validation to be provided via **SHACL shapes** and/or a JSON Schema profile in a subsequent release.
+
+[0.1]: https://uofa.net