feat(phase-1): enriched dashboard + cited-URL publish gate

[RyanAlberts]

What

Phase 1 PR #3: dashboard now consumes the analyses.json produced by PR #2 and renders four LLM-derived charts on top of the coverage baseline. Cited-URL link verification becomes a hard publish gate.

Closes #3.

Why

PR #1 surfaced which companies we can analyze; PR #2 classifies them; PR #3 makes that classification visible without losing the credibility lever. Every chart still drills down to source rows. Every cited URL is re-verified before the dashboard ships.

How

Module	Change
dashboard.py	New analyses= arg. When provided, renders 4 LLM-derived charts. Heatmap is a CSS-only intensity table (capability × industry). OSS posture uses a stacked bar with green-to-red mapping. Coverage-only mode unchanged.
dashboard.collect_cited_urls / write_broken_links_report	Publish-gate plumbing. Dedupes URLs across analyses; attributes each broken URL back to the slugs that cited it.
cli.py	After enrichment, every cited URL goes through verifier.check_urls. Dead URLs → exit code 4 unless --allow-dead-links, which writes BROKEN_LINKS.md and surfaces a banner.
researcher.py	_drop_unknown_industries: filter industry_secondary to enum members rather than fail the whole row when the model emits a reasonable-but-out-of-set category. Primary industry stays strict.

W26 full-batch run (the real test)

Ran ycai run-coverage --batch winter-2026 --yc-official-count 196 --enrich --allow-dead-links on subscription. 6 minutes, ~free.

Confidence

• 83 high (67%) + 41 low (33%) out of 124 Tier A+B companies.
• Of the 41 low: 29 schema-validation failures, 12 honest model lows, 0 hallucinated source URLs (the guard exists; nothing tripped it on this run).

Top finding

65% of high-confidence W26 companies build agents (54 of 83). Followed by nlp-classic (30), rag (26), data-pipeline (19). 8 companies correctly tagged no-ai — the trust signal.

OSS posture

Mostly unknown (45 of 83). Model is honest about not being able to determine OSS posture from a YC long_description. B007 (depth=1 website crawl) would shift these to real values; tracked.

Publish gate

3 cited URLs returned 4xx/5xx at publish time:

• arzule.com — 429
• maywoodai.com — 404
• caretta.so — SSL handshake failure

Each named in BROKEN_LINKS-w26-2026-05-01.md. Without --allow-dead-links, the pipeline would have aborted with exit 4 — that's the gate.

Test plan

• 92 tests passing (14 new). Coverage-only and enriched dashboard rendering, all OSS posture values, publish-gate banner behavior, drill-down presence, dropped register completeness.
• Mypy --strict clean.
• make publish-check clean.
• Real-data smoke captured under examples/output/.

Anti-hallucination invariants preserved

1. Numbers come from pandas, not the LLM. Every chart is computed from the validated DataFrame.
2. Drill-down on every chart traces back to the rows that produced it.
3. Cited URLs are verified before publish.
4. Low-confidence rows excluded from charts; surfaced in methodology footer.
5. industry_primary, ai_capability, tech_stack, oss_posture enums stay strict. Only industry_secondary got lenient parsing.

Backlog spawned

• B008: schema-validation failure rate at 23% on the full run is too high for v0.1 release. Either extend lenient parser to ai_capability / tech_stack, or use tool_use enforcement on the API backend. Targeted for PR PR #4 — Typer CLI, Rich progress, hot-restart resume #4.

Acceptance

• make validate-p0 green
• make publish-check green
• LLM-path invariants preserved
• Live smoke run captured

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces an enriched dashboard for the YC AI Pulse tool, adding AI-capability heatmaps, tech-stack distributions, and OSS-posture charts. It implements a "publish gate" that verifies cited URLs, preventing the generation of dashboards with dead links unless overridden by a new --allow-dead-links flag. Additionally, the PR includes detailed quality reports for the Winter 2026 batch, a lenient parser for secondary industries to reduce validation failures, and comprehensive tests for the new dashboard features. Feedback focuses on consolidating imports, utilizing the standard library's HTML escaping, and improving the naming of internal helper functions.

[gemini-code-assist]

The imports from ycai.dashboard are redundant and can be consolidated into a single block for better readability and maintainability.

from ycai.dashboard import (
    collect_cited_urls,
    render as render_dashboard,
    write_broken_links_report,
)

[gemini-code-assist]

Add import html to support a more robust escaping mechanism.

Suggested change

	import json
	import html
	import json

[gemini-code-assist]

The manual implementation of _escape is incomplete (e.g., it misses single quotes) and redundant. Using html.escape from the standard library is safer and more idiomatic.

Suggested change

	def _escape(text: str) -> str:
	return text.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;").replace('"', "&quot;")
	def _escape(text: str) -> str:
	return html.escape(text, quote=True)

[gemini-code-assist]

The function _first_url is poorly named and misleading. It should be renamed to reflect its purpose of providing a model description.

Suggested change

	"schema; sources must be from the company's website or YC profile."
	f"{_get_model_description()} via the configured backend with a strict pydantic "

[gemini-code-assist]

The function name _first_url is misleading as it returns a model description, not a URL. Additionally, it accepts an analyses parameter that is completely ignored. Renaming it and removing the unused parameter improves clarity.

Suggested change

	def _first_url(analyses: list[CompanyAnalysis]) -> str:
	"""Best-effort: return the model identifier from the first analysis if available.
	Used in methodology text. Currently the schema doesn't carry the model
	name on each row (it's a per-run constant), so we just say 'a Sonnet model'.
	"""
	return "a Sonnet model"
	def _get_model_description() -> str:
	"""Return the model identifier used for enrichment.
	Currently hardcoded as the schema doesn't carry the model name per row.
	"""
	return "a Sonnet model"