feat: prepare MainFrame v0.4.0 with MindGraph

[camerontjs-dot]

MainFrame v0.4.0 public review candidate

This PR promotes the reviewed MindGraph capability into the public MainFrame
surface. It is generated from merged private main, uses the positive export
manifest, and does not tag or release v0.4.0.

Source chain

• Public base: 726f9d83126ce65f17224bc6599ce222b21b54ad
  (403de41eb3b5daa065caee1de53609998c7f2fdc).
• Merged private MainFrame source: f0b6083ade7b63589756ea11ee76329cc6feda40
  (919e45d28060c829791c2ac03f6c3226feb79435).
• Merged standalone MindGraph main: 6501024a19dd9feae415a7197a65c70ff214c40a
  (e08d009836e62f5d23754886329d3fc91bc4fcae).
• Qualified standalone MindGraph source preserved in ancestry:
  71280be791edd98baf5b684dbd682acb07a86129
  (e08d009836e62f5d23754886329d3fc91bc4fcae).

The standalone merge advanced the commit identity without changing the
qualified tree. The exporter still binds the selected nested files to the
qualified source commit and tree.

Public snapshot

• Branch: codex/mainframe-v04-public
• Candidate commit: 6bfa334b53de75d5eda792e66b6dbed104aa3baa
• Git tree: cb1134498905158979dfd6313b3742a7796af46a
• Export profile: engine-with-optional-semantic-and-mcp
• File count: 154
• Candidate bytes SHA-256:
  781cffa982e7bf7fdf084e3dadb45b8b263db0b126d04c3c6af67766e2f156e3
• Candidate tree digest:
  5b3b7eb0a16b5c13cebcca31c87050d7bc8b924c4c2483e3424aa29e0b5d5aa
• Manifest SHA-256:
  7119035e617cfc7b7b5660562deedf0cbbf9d6959675736cfefb3b09dc3e64e4
• Export receipt SHA-256:
  f45f9ee2ab4cd5bcf6a2433718da99a9da86866ee49eb0b2cf43699fa9af8a38

The candidate is identical to the earlier pre-merge candidate. The only
receipt-level change is the private source SHA: ee805cea... became merged
private f0b6083...; the private tree, selected files, and output bytes did
not change.

MindGraph provenance binding

• Binding algorithm: git-blob-sha1.
• Selected identity-copy files: 46.
• Commit verified: true.
• Tree verified: true.
• Selected-file binding digest:
  8e60480a52e295e806a3c292e1525f03e7aec7412ee4a1c049a08a05751e30c8.
• Qualification receipts are bound to source
  71280be791edd98baf5b684dbd682acb07a86129 and tree
  e08d009836e62f5d23754886329d3fc91bc4fcae:
  • core receipt:
    5be688bc582f3219d676ebd2dd688025adce11ab6bbe085d5f2af779ab31540d
  • semantic receipt:
    214c74890a268b25891b7c5a550a6f6bc0c4e56bbc7a257541b4ede9949b3685
  • MCP receipt:
    ee4c94ffe3a9193aac076d29c3e91728d734290a2ae55edc1b0dc46060a64ae9

Difference from v0.3.0

The diff contains 48 changed paths:

• 46 new bounded MindGraph files: engine source, package metadata, examples,
  maintained tests, and uv.lock.
• The public README is updated for the capability and its nomination-only
  boundary.
• .github/workflows/public-core.yml adds the dependency-light MindGraph core
  test step.

All 108 tracked v0.3.0 control files remain present. No databases, model
caches, private state, or MainFrame operational outputs were copied.

Qualification

Run from a clean copy of the exact regenerated candidate:

• MainFrame/MPE boundary: 72 passed and 3 subtests passed.
  JUnit SHA-256:
  3d6eaad1e034f2253a342860a272f6f8613f082b10fb460c9bd5bd9b40eddc57.
• MindGraph core: 293 passed under Python 3.12 with 20 installed packages and
  48,368 KiB environment size; no semantic, Torch, Transformers, or MCP
  packages.
  JUnit SHA-256:
  155563f08a91a663446e0a1d5beed3416bc4c604ce3f0daec7db6321c3f3eb37.
• Source-bound semantic qualification: 293 passed with 50 packages, 911,644
  KiB environment size, and 89,480 KiB model cache after explicit
  all-MiniLM-L6-v2 bootstrap.
• Source-bound MCP qualification: 41 passed with 44 packages and 75,456 KiB
  environment size using MCP 1.30.0 under mcp>=1.0.0,<2.
• Core CLI import/help and public CLI exercises passed.
• contract-lint --selftest: 13/13 passed.
• Missing-DB query: exited 1 and did not create the database.
• uv lock --check: passed.
• Workflow YAML parse: one workflow parsed successfully.
• Exporter/public-candidate integrity: 2 passed.

Semantic and MCP behavior remains covered by the exact source-bound receipts
above. The candidate bytes and selected MindGraph blobs were independently
compared with the pre-merge candidate and are identical.

Privacy and export boundary

The positive manifest and exporter check passed with:

• publication_performed=false;
• no private MindGraph AGENTS.md or .gitignore;
• no test_link_audit.py or retired test_pruning.py;
• no database, WAL/SHM, cache, or model artifact files;
• no machine-specific paths, credentials, or private-corpus markers.

The only /home/ string is the generic documentation example
/home/me/notes in MindGraph's provenance model; it is not a host path from
the build environment. Generic ~/.mindgraph references describe the
documented runtime default and do not include local state.

Known CI history

Private MainFrame run 34542351550 and current-head run 34560423883
remain CI_NOT_ASSESSED: GitHub reported failed jobs with zero executed steps
and no logs. They are not treated as product test failures. The public
repository Actions run for this exact branch is the release-surface behavioral
gate.

Release boundary

This PR is review-only. MainFrame v0.2.0 and v0.3.0 are unchanged. No v0.4.0
tag or release has been made. Merge and release remain separate decisions after
the public Actions result and final review.

[camerontjs-dot]

Public CI receipt

The public release-surface workflow has now executed against this exact PR head:

• Run: https://github.com/camerontjs-dot/MainFrame/actions/runs/34604993481
• Job: public-core (103281131253)
• Head: 6bfa334b53de75d5eda792e66b6dbed104aa3baa
• Result: success after 4m20s

This was a real executed run. The following product steps completed successfully:

• Run public tests
• Run MindGraph core tests
• Exercise public CLIs

The earlier private-repository zero-step failures remain recorded as CI_NOT_ASSESSED; they are not being reinterpreted as product failures. This public run closes the release-surface behavioral gate for the candidate. No public v0.4.0 merge, tag, or release has been made.