feat: harden GreenRisk packaging and reproducibility

.gitattributes

@@ -0,0 +1,12 @@
+* text=auto
+*.py text eol=lf
+*.md text eol=lf
+*.toml text eol=lf
+*.json text eol=lf
+*.csv text eol=lf
+*.ttl text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.lock text eol=lf
+*.png binary
+*.pdf binary

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: monthly

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          enable-cache: true
+          version: "0.11.33"
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --group dev
+      - run: uv run ruff check .
+      - run: uv run pytest -m "not model"
+      - run: uv run python scripts/verify_artifact_integrity.py
+      - run: uv build

.github/workflows/model-smoke.yml

@@ -0,0 +1,23 @@
+name: Pinned model smoke tests
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  models:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          enable-cache: true
+          version: "0.11.33"
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra models --group dev
+      - run: uv run pytest -m model

AGENTS.md

@@ -1,47 +1,35 @@
 # Repository Guidelines
 
-## Project Structure & Module Organization
-
-GreenRisk is a Python 3.12 project for explainable greenwashing-risk scoring. `MASTER_PLAN.md` is the canonical architecture and roadmap; read it before changing behavior.
-
-- Core instrument modules are at the repository root: `models.py`, `linguistic_variables.py`, `rule_base.py`, and `main.py`.
-- Pipeline scripts live in `scripts/`; locked validation harnesses live in `scripts/validation/`.
-- Smoke tests live in `tests/` and are executable Python scripts, not a pytest suite. `tests/property_test_rule_base.py` asserts the locked rule base's documented properties and needs no model download.
-- Input data is under `data/`; generated, committed outputs are under `artifacts/`.
-- `docs/` is for consolidated public documentation, including `decisions.md` (the public decision record) and the project paper. `development/` is intentionally gitignored process material.
-
-## Build, Test, and Development Commands
-
-Use `uv` for dependency management and command execution.
-
-```powershell
-uv sync
-uv run python tests/smoke_test_all_models.py
-uv run python tests/smoke_test_detector_model.py
-uv run python tests/smoke_test_provenance.py
-uv run python scripts/validation/integration_seam_test.py -n 20 --gate 0.5
-uv run python scripts/plot_linguistic_variables.py
-uv run python scripts/first_provenance.py
+`MASTER_PLAN.md` is the canonical repository map. GreenRisk is an installable
+Python 3.12 `src`-layout project; package code lives in `src/greenrisk/`,
+research producers in `scripts/`, tests in `tests/`, inputs in `data/`, and
+committed evidence in `artifacts/`.
+
+Use `uv` and the lockfile:
+
+```bash
+uv sync --frozen --group dev
+uv run ruff check .
+uv run pytest -m "not model"
+uv run python scripts/verify_artifact_integrity.py
+uv build
 ```
 
-`uv sync` installs dependencies from `pyproject.toml` and `uv.lock`. Smoke tests verify model loading, detector behavior, and provenance basics. Validation scripts re-check the locked instrument and may load large ClimateBERT models.
-
-## Coding Style & Naming Conventions
-
-Follow the existing style: 4-space indentation, type hints where useful, concise docstrings, and explicit data structures for model registries and fuzzy rules. Use `snake_case` for functions and variables, `UPPER_CASE` for constants, and short rule IDs such as `S1`, `N2`, or `G1`.
-
-Keep the scoring instrument explicit over clever abstraction. Changes to `MODEL_REGISTRY`, `SIGNAL_MAP`, membership functions, or `RULES` affect reproducibility and must be treated as instrument changes.
-
-## Testing Guidelines
-
-Run the relevant smoke test before submitting any change. For changes to fuzzy logic, provenance, model mappings, or artifacts, also run the matching script in `scripts/validation/` or the artifact producer you touched. Any change touching `RULES` or the membership functions must also pass `uv run python tests/property_test_rule_base.py`. Do not describe tests as pytest-based unless a pytest suite is added.
-
-## Commit & Pull Request Guidelines
-
-Commits use conventional prefixes such as `feat:` and `docs:` with a scoped, imperative summary, for example `feat: add held-out face-validity artifacts`.
+Tests marked `model` download and execute the pinned ClimateBERT revisions;
+run them with `uv sync --frozen --extra models --group dev` when model adapters
+change. Full research scripts require `--extra research`.
 
-Pull requests should include a behavior summary, commands run, artifacts changed, and any linked decision-log entry. Include screenshots only for generated figures or provenance images.
+Use 4-space indentation, type hints where useful, concise docstrings, and
+explicit data structures. Keep the scoring instrument readable. Input
+probabilities must be finite and in `[0,1]`; do not rely on implicit clipping.
+Avoid import-time network, login, filesystem, or credential side effects.
 
-## Architecture & Reproducibility Notes
+The numerical instrument is frozen at `rulebase-locked-v1`. Any change to
+`MODEL_REGISTRY`, `SIGNAL_MAP`, membership functions, or `RULES` is an
+instrument change and must be a separate logged ablation. Do not rewrite
+historical artifacts without running their producer and updating manifest and
+PROV-O hashes. Preserve secrets such as `.env` and `HF_TOKEN`.
 
-The instrument is frozen at tag `rulebase-locked-v1`. Any post-lock change to rules, membership functions, model revisions, or signal mappings must be a separate logged ablation, never a silent edit. Preserve pinned ClimateBERT revisions and avoid committing secrets such as `.env` or `HF_TOKEN`.
+Use conventional commit prefixes. Pull requests should state behavior changes,
+commands run, artifact changes, evidence/claim implications, and any decision
+record entry.

CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+## 0.2.0 — unreleased
+
+- Package GreenRisk with a `src` layout and `greenrisk` CLI.
+- Add raw-text scoring, explicit climate-gate outcomes, per-score PROV-O, and
+  strict signal/input validation.
+- Separate lightweight, model, research, and development dependencies.
+- Pin the TCFD dataset revision and record complete run/environment metadata for
+  future runs.
+- Repair historical artifact hashes for Git-normalized bytes and add automated
+  manifest/PROV-O integrity verification.
+- Add pytest, lint, build CI, and a manual heavyweight model-smoke workflow.
+- Clarify responsible-use boundaries and limitations of the validation claims.
+- Preserve the `rulebase-locked-v1` numerical instrument unchanged.
+
+## 0.1.0 — 2026-07-02
+
+- Initial archived research release.

CITATION.cff

@@ -13,15 +13,11 @@ authors:
     given-names: Isaac
     email: isaac.dcesares@ufrj.br
     affiliation: "Universidade Federal do Rio de Janeiro (UFRJ) — Programa de Pós-Graduação em Informática (PPGI)"
-version: 0.1.0
-date-released: "2026-07-02"
+version: 0.2.0
 url: "https://github.com/idcesares/GreenRisk"
 repository-code: "https://github.com/idcesares/GreenRisk"
 license: Apache-2.0
 identifiers:
-  - type: doi
-    value: "10.5281/zenodo.21122390"
-    description: "Archived snapshot of this specific software version (v0.1.0) on Zenodo."
   - type: doi
     value: "10.5281/zenodo.21122389"
     description: "Concept DOI representing all versions of this software; always resolves to the latest archived release."