epic(post4): checklist release 1.7.4.post4 — bugs UX + Dependabots + wheelhouse hospedado + operator-gated

[FabioLeitao]

Guarda-chuva do próximo release 1.7.4.post4 — rastreia (não duplica) as issues/PRs existentes e agrega o checklist. Tema: continuar o "installed-user frictionless" + higiene supply-chain + o wheelhouse hospedado. TIGHT: só bugfix/UX/docs/packaging/deps — features comerciais = 1.8.x. Octet anda no release, não por-merge.

🔧 Bugs / UX (coração do post4)

• [P1][bugfix][ux] post3: help mostra data-boar + caminho concreto por-OS (não uv run main.py nem ~) #1130 [P1][bugfix][ux] — help mostra data-boar + caminho errado ← mais urgente
• [P2][bugfix][docs] man pages (.1/.5): python main.py user-facing → data-boar + guard anti-drift #1131 [P2][bugfix][docs] — man pages (.1/.5)
• [P2][chore][ux] Validar onboarding + primeiro-scan como demo-ao-vivo (cronometrar pipx-install → scan → laudo) #1103 [P2][chore][ux] — validar onboarding + primeiro-scan
• /logs demo fix — GET /logs/{sid} não acha o audit trail em --demo (log em workspace temp). Sem issue ainda — criar.

🔒 Supply-chain (zerar Dependabots)

• deps(uv): bump the uv-minor-patch group across 1 directory with 37 updates #1178 deps uv-minor-patch group · [ ] ci(actions): bump actions/setup-python from 6.2.0 to 6.3.0 #1107 setup-python 6.3.0 · [ ] deps(uv): bump torch from 2.10.0 to 2.12.1 #975 torch 2.12.1

📦 Packaging / wheelhouse

• [P1][packaging] wheelhouse piso→teto: cp313/14 musllinux + auditwheel-repair + hospedar índice (fecha void-musl; provado 1.7.4.post3) #1182 [P1] wheelhouse hospedado — void-musl provado e2e 2026-07-11 (build→auditwheel repair→26; ver comentários). Falta publicar (GH Pages data-boar-site + .whl em Releases) + cp313 sklearn + no-AVX completo. Pode ir semente incremental (cp314 já pronto) sem travar o cut.
• [P3][chore][giveback] cpufetch — APKBUILD para Alpine aports #1173 [P3][giveback] cpufetch APKBUILD

📋 Governança / operator-gated (decisão do operador)

• docs(adr): ADR-0073 band-fix — maturity counter starts at 1 #1124 ADR-0073 band-fix (requer update do test_scripts.py) · [ ] docs(ops): BUS gitleaks binary org-wide sweep (#10) #1125 gitleaks BUS org-wide · [ ] fix(api): RBAC default-deny + constant-time API key (#1133 #1134) #1143 RBAC default-deny (terminar) · [ ] chore(cursor): Tier B situationalization wave (#1154) #1155 Tier B situationalization

✅ Já resolvido (não pesa no post4)

• alpine-findings = artefato de timeout do smoke, não parser-gap (de-claim [P2][docs] docs(ops): de-claim musl parser gap after timeout artifact #1187 merged) · void-musl parity doc ([P2][docs] docs(ops): add void-musl parity note to install matrix #1188 merged) · two-tier gate split ([P3][docs] docs(cursor): two-tier check-all gate #1185 merged)

⏭️ Cauda pós-1.8.0-beta (NÃO trava o post4)

FreeBSD (8º canto) · 32-bit #1172 · abi3 matrix #782 · [1.8.x] packaging extras #1059

---

Corte mínimo pra "zerar a dívida": #1130 + os 3 Dependabots + os operator-gated; wheelhouse (#1182) em semente incremental. Verificar "bastou": re-rodar matriz pip+pipx no post4 → zero? Sobrou → post5. Zerou → 1.8.0-beta.

(Aberta por Claude Code — RO-auditor, recomendatório. Cursor materializa PLAN/fixes. Loose-ref às issues, sem closing-keywords — este epic não fecha nada.)

[FabioLeitao]

Item /logs demo fix agora tem issue própria: #1190 ([P2][bugfix][ux] /logs/{session_id} não acha audit trail em --demo). Atualiza o checklist da seção 🔧 Bugs/UX.

[FabioLeitao]

post4 P0 blockers (recommend milestoning to this epic). From the 07-12 cross-vendor audit, two confirmed/structural P0s should gate post4:

• [P0][critical][sql] SQLAlchemy autobegin causa scan SQL silenciosamente vazio (zero findings) #1194 — SQLAlchemy autobegin -> SQL scan silently returns zero findings. Confirmed on source. Fix: short-lived connections per sample + behavioral test.
• [P0][detection] Compliance profile terms silently ineffective (predict_proba[0][1] single-class + ml_patterns replace-not-merge) #1195 — compliance profile terms silently ineffective (single-class predict_proba[0][1] + ml_patterns replace-not-merge). Fix: guard single-class, merge-not-replace, deterministic layer for declared terms; behavioral test before/after.

Suggest: set milestone=post4 on #1194 and #1195. #1198 (prefilter recall-first) pending a source trace to decide P0(post4) vs P1(post5) — reporting shortly. (Filed by Claude Code — RO auditor.)

[FabioLeitao]

Deps para post5: #1107 (setup-python) e #1178 (uv-group) ficam para o post5 (higiene, baixo risco; churn de rebase nao justifica no post4). Torch ja foi via #1216. post4 restante: /logs-demo-fix (#1218) + wheelhouse #1182 + bump/release. (Claude Code RO auditor.)