Merge branch 'main' into dependabot/pip/python-minor-patch-f0f6cd8fa2

Author: Gavin-Borges

.github/workflows/ci.yml

@@ -107,7 +107,7 @@ jobs:
 
       - name: Run tests with coverage (OpenSSF Silver test_statement_coverage80)
         # Statement + branch coverage on the importable LIBRARY surface, gated at
-        # fail_under=90 via .coveragerc.library (executable research/pipeline
+        # fail_under=95 via .coveragerc.library (executable research/pipeline
         # scripts are validated by the integration/data gates below, not unit
         # coverage). The whole-repo regression floor lives in pyproject.toml for
         # local `pytest --cov` runs. PYTHONPATH + COVERAGE_PROCESS_START activate

.github/workflows/release.yml

@@ -109,7 +109,7 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0
 
       - name: Set up Python for smoke test
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

.gitignore

@@ -209,6 +209,9 @@ cython_debug/
 CLAUDE.md
 CLAUDE.local.md
 .claude/
+#  Project-level MCP server config (developer tooling - personal token references
+#  and local server paths vary per developer; not for public repo).
+.mcp.json
 #  Personal settings overrides - already covered by `.claude/` above; listed
 #  explicitly so the intent survives any future narrowing of that rule.
 .claude/settings.local.json

CHANGELOG.md

@@ -16,6 +16,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
   protected by required-reviewer approval before any upload proceeds.
   Deleted orphaned `environments/requirements-ci-twine.{in,txt}`.
 - **`pyproject.toml`**: removed personal email from author metadata; name retained.
+- **Library coverage gate raised** `90 -> 95` in `.coveragerc.library`. Verified
+  library-scope coverage is **98.91% combined** (~99% statement / ~98% branch;
+  measured 2026-06-22), comfortably clearing the new gate and the OpenSSF Gold
+  targets. Synced the stale `fail_under` references in `docs/security_compliance.md`,
+  `ROADMAP.md`, and the `ci.yml` step comment to the authoritative config value.
 
 ### Added
 - **HBV/HCV proteome ingestion path** (issue #78): `scripts/fetch_viral_proteomes.py`

ROADMAP.md

@@ -21,10 +21,11 @@ _Last updated: 2026-06._
     library surface - `src`/`functions` modules without a `__main__` CLI entry
     point. Measured via `.coveragerc.library` (omit list generated mechanically by
     `tools/check_library_coverage.py`, kept in sync by `--check`). Currently
-    **≈96% statement / ≈94% branch** (combined ≈96%), gated at `fail_under=90`.
+    **~99% statement / ~98% branch** (combined 98.91%), gated at `fail_under=95`.
     This clears the OpenSSF **Gold** targets (≥90% statement, ≥80% branch).
   - **Whole-repo floor**: `pyproject.toml`'s `fail_under` blocks regressions across
-    the entire tree (research/CLI scripts included), currently ≈36% statement.
+    the entire tree (research/CLI scripts included), gated at `fail_under=35`,
+    currently ≈45% statement.
     Executable scripts (those with `__main__`) are validated by the integration
     tests and CI data/benchmark gates rather than unit statement coverage.
 

docs/security_compliance.md

@@ -25,12 +25,15 @@ This document tracks SESTRAV's posture against the [OpenSSF Best Practices Badge
   measured on two scopes, both gated in CI:
   - *Library scope* - the importable library surface (`src`/`functions` modules
     with no `__main__` CLI entry point), measured via `.coveragerc.library` and
-    gated at `fail_under=80`. Currently ≈83% statement / ≈81% branch-inclusive.
+    gated at `fail_under=95`. Currently 98.91% combined (~99% statement /
+    ~98% branch; measured 2026-06-22), clearing the OpenSSF Gold targets
+    (>=90% statement, >=80% branch).
     The omit list is generated mechanically from the presence of a `__main__`
     guard (`tools/check_library_coverage.py --check` enforces it stays in sync),
     so the scope is objective rather than hand-picked.
   - *Whole-repo floor* - a regression floor across the entire tree
-    (`pyproject.toml`), currently ≈30% statement. Executable research/pipeline
+    (`pyproject.toml`), gated at `fail_under=35`, currently ≈45% statement.
+    Executable research/pipeline
     scripts (those with `__main__`) are validated by integration tests and the CI
     data/benchmark gates rather than by unit statement coverage.
 - **Strict Data Typing:** Pydantic is utilized via `SestravConfig` to enforce configuration schema, preventing runtime type coercion errors and hardcoded path injection.

src/train_gnn.py

@@ -144,7 +144,7 @@ def train_gnn(data_path, model_dir='models/gnn', epochs=15, batch_size=64, lr=1e
     # 2. Extract physicochemical features (with Cache resolution)
     # Include dataset fingerprint so switching datasets invalidates the cache.
     import hashlib as _hl
-    _data_tag = _hl.md5(open(data_path, "rb").read(65536)).hexdigest()[:8]  # nosec B324
+    _data_tag = _hl.sha256(open(data_path, "rb").read(65536)).hexdigest()[:8]
     cache_name = f"physico_features_mode{feature_mode}_{_data_tag}.csv"
     X_feats = store.load_cached_features(cache_name)
     if X_feats is None:
@@ -400,7 +400,7 @@ def train_gnn_v2(data_path, model_dir='models/gnn', epochs=50, batch_size=64,
     # Extract feature matrix.  Mode 31 adds 10 per-allele MHCflurry binding scores,
     # matching RF mode 31 feature parity.  Mode 21 uses physico-only features.
     import hashlib as _hl
-    _data_tag = _hl.md5(open(data_path, "rb").read(65536)).hexdigest()[:8]  # nosec B324
+    _data_tag = _hl.sha256(open(data_path, "rb").read(65536)).hexdigest()[:8]
     cache_name = f"physico_features_mode{feature_mode}_{_data_tag}.csv"
     X_feats = store.load_cached_features(cache_name)
     if X_feats is None: