release: synchronize project guidance for v0.4.1

Author: reacher-z

CHANGELOG.md

@@ -4,13 +4,21 @@ All notable changes to RewardHarness are recorded here. Versions follow [SemVer]
 
 ## [Unreleased]
 
-Future changes after v0.4.0.
+Future changes after v0.4.1.
+
+## [0.4.1] — 2026-08-26
 
 ### Fixed
 
 - Made post-publish installation verification retry the PyPI Simple API while
   its CDN catches up with JSON metadata, avoiding false-negative release runs.
 
+### Changed
+
+- Synchronized the migration guide, security support matrix, walkthrough,
+  contributor guidance, and test inventory with the v0.4 runtime and Python
+  3.13 support.
+
 ## [0.4.0] — 2026-08-26
 
 ### Added
@@ -234,6 +242,7 @@ deprecated `src` namespace remains as a compatibility layer for v0.2.
 - `make demo` and `make benchmark` default to `--library-dir examples/seed_library` for non-empty starting state.
 - `make help` is now a credentials matrix showing what each target actually needs.
 
+[0.4.1]: https://github.com/TIGER-AI-Lab/RewardHarness/releases/tag/v0.4.1
 [0.4.0]: https://github.com/TIGER-AI-Lab/RewardHarness/releases/tag/v0.4.0
 [0.3.1]: https://github.com/TIGER-AI-Lab/RewardHarness/releases/tag/v0.3.1
 [0.3.0]: https://github.com/TIGER-AI-Lab/RewardHarness/releases/tag/v0.3.0

CITATION.cff

@@ -1,7 +1,7 @@
 cff-version: 1.2.0
 message: "If you use this software, please cite the paper."
 title: "RewardHarness: Self-Evolving Agentic Post-Training"
-version: "0.4.0"
+version: "0.4.1"
 date-released: "2026-08-26"
 type: software
 authors:

CONTRIBUTING.md

@@ -40,7 +40,8 @@ One-line subject (≤72 chars), then optional body. Reference issues with `#NNN`
 
 ## Code style
 
-- Python 3.10+. Type hints encouraged but not required for one-off scripts.
+- Python 3.10–3.13. Type hints are required for runtime code under
+  `rewardharness/` and encouraged for one-off scripts.
 - Don't introduce new dependencies unless you're prepared to argue they're worth the install cost in the PR description.
 - Default to no comments. Add one only when the *why* is non-obvious (a hidden constraint, a workaround, a surprising behavior).
 

MIGRATING.md

@@ -1,8 +1,25 @@
-# Migrating to RewardHarness 0.3
+# Migrating to RewardHarness 0.4
 
-RewardHarness 0.3 removes the deprecated `src.*` compatibility namespace that
-was retained throughout the 0.2 release series. Runtime behavior, configuration
-schema v2, Library files, CLI commands, and result formats remain unchanged.
+RewardHarness 0.4 keeps the canonical `rewardharness.*` namespace introduced in
+0.3 and modernizes configuration handling and interpreter support without
+changing CLI commands, Library files, or result schemas.
+
+## From 0.3 to 0.4
+
+- `RewardHarnessConfig` is now retained throughout benchmark and evolution
+  workflows instead of being converted back to a legacy dictionary.
+- Use `RewardHarnessConfig.to_dict()` for schema-v2 serialization.
+  `to_legacy_dict()` remains available as a compatibility alias.
+- Evolution dataset loading now consumes exactly `train_n + val_n` rows and
+  fails early if the configured split sizes cannot be satisfied.
+- Python 3.13 is supported and continuously tested alongside 3.10–3.12.
+
+No import changes are required when upgrading from 0.3.
+
+## From 0.2 to 0.3
+
+RewardHarness 0.3 removed the deprecated `src.*` compatibility namespace that
+was retained throughout the 0.2 release series.
 
 ## Import replacements
 
@@ -28,7 +45,7 @@ Only the module path changes. Public symbol names such as `EndpointPool`,
 2. Upgrade and reject pre-release caching explicitly:
 
    ```bash
-   python -m pip install --upgrade "rewardharness>=0.3,<0.4"
+   python -m pip install --upgrade "rewardharness>=0.4,<0.5"
    ```
 
 3. Confirm the installed package and configuration:

README.md

@@ -45,6 +45,9 @@ Read [`WALKTHROUGH.md`](WALKTHROUGH.md) for the 9-step path from `git clone` to
 
 ## Updates
 
+- **2026-08-26** — `v0.4.1`: synchronized migration, security, walkthrough,
+  and test documentation, and hardened post-publish verification against PyPI
+  CDN propagation delays.
 - **2026-08-26** — `v0.4.0`: type-safe configuration throughout benchmark
   and evolution workflows, exact validation-split sizing, Python 3.13 CI, and
   Node 24-native release automation.
@@ -144,7 +147,7 @@ At **inference**, the Router selects relevant entries from the Library and the f
 ```bash
 # Install the stable package from PyPI.
 python -m venv .venv && source .venv/bin/activate
-python -m pip install "rewardharness==0.4.0"
+python -m pip install "rewardharness==0.4.1"
 python -c "import rewardharness; print(rewardharness.__version__)"
 ```
 
@@ -290,7 +293,7 @@ The paper's Gemini-2.0-Flash variant uses path (2). For evaluation-only / benchm
 RewardHarness/
 ├── rewardharness/        # Supported package: evaluation, evolution, clients, Library, CLI
 ├── scripts/              # run_evolution.py, run_benchmark.py, vLLM launchers, check_env.py preflight
-├── tests/                # pytest suite (155 tests, no GPU/network)
+├── tests/                # pytest suite (156 tests, no GPU/network)
 ├── examples/             # inspect_library.py + show_reasoning_format.py (no-API demos),
 │                         # score_pair.py (end-to-end), seed_library/, sample_*.json
 ├── configs/              # default.yaml + vLLM endpoints

SECURITY.md

@@ -23,7 +23,8 @@ Only the current `main` branch and the most recent tagged release receive securi
 | Version | Supported |
 |---|---|
 | `main` | ✅ |
-| `v0.3.0` (latest) | ✅ |
+| `v0.4.x` (latest) | ✅ |
+| `v0.3.x` | ❌ |
 | earlier | ❌ |
 
 ## Disclosure history

WALKTHROUGH.md

@@ -1,7 +1,8 @@
 # Walkthrough — from `git clone` to your first preference judgment
 
-The v0.2 examples prefer the unified `rewardharness` CLI. Historical script
-entry points remain available as compatibility wrappers.
+The v0.4 release uses the unified `rewardharness` CLI and typed configuration
+throughout benchmark and evolution workflows. Historical script entry points
+remain available as compatibility wrappers.
 
 This walkthrough takes ~15 minutes if you only want to inspect the library and run the tests, and an additional ~3 minutes of pipeline work for a full `make demo` evolution pass — though vLLM cold-start can add 5–15 minutes the first time the model loads. Each step is independent — feel free to stop after step 3 if you only want to understand the codebase.
 
@@ -13,7 +14,7 @@ This walkthrough takes ~15 minutes if you only want to inspect the library and r
 git clone https://github.com/TIGER-AI-Lab/RewardHarness.git
 cd RewardHarness
 python -m venv .venv && source .venv/bin/activate
-pip install -r requirements.txt
+python -m pip install -e .
 ```
 
 That's enough for steps 2–4. The optional `pip install -r requirements-vllm.txt` is **only** needed when you serve Qwen2.5-VL-7B locally (step 6).
@@ -24,7 +25,7 @@ That's enough for steps 2–4. The optional `pip install -r requirements-vllm.tx
 make test
 ```
 
-You should see `100 passed in ~2s`. Every external service (Gemini, vLLM, Hugging Face) is mocked, so if any test hits the network it's a regression — please [open an issue](https://github.com/TIGER-AI-Lab/RewardHarness/issues).
+You should see `156 passed`. Every external service (Gemini, vLLM, Hugging Face) is mocked, so if any test hits the network it's a regression — please [open an issue](https://github.com/TIGER-AI-Lab/RewardHarness/issues).
 
 ## 3. Inspect the data model
 

rewardharness/_version.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "0.4.0"
+__version__ = "0.4.1"

tests/README.md

@@ -1,6 +1,6 @@
 # Tests
 
-Fully mocked end-to-end test suite (**155 tests**, runs in a few seconds) — no GPU,
+Fully mocked end-to-end test suite (**156 tests**, runs in a few seconds) — no GPU,
 no network, no API keys, and no real Gemini calls. Install development tooling
 from `requirements-dev.txt` before running the complete quality gate.
 
@@ -22,7 +22,7 @@ make test
 | `test_chain_evolver.py` | Full evolution micro-flow: failure examples → ChainAnalyzer → improvement signals → Evolver → SKILL.md on disk. |
 | `test_pipeline.py` | `SelfEvolutionPipeline.evolve` over 2 iterations — separate skill/tool rollback, `>= prev - margin` keep condition, checkpoint write, val-acc regression triggers rollback. |
 | `test_check_env.py` | `scripts/check_env.py::_probe_one` — `/v1/models` body parsing for the VLM-swap mismatch detection added in iter 130. |
-| `test_public_api.py` | Typed v0.2 API, schema v2, compatibility imports, config validation, and path safety. |
+| `test_public_api.py` | Typed v0.4 API, schema-v2 normalization, compatibility serialization, config validation, and path safety. |
 | `test_release.py` | Lazy package imports, canonical PyPI/tag identity, and release-status CLI contracts. |
 
 Everything that touches an external service (Gemini, vLLM, Hugging Face) is mocked with `unittest.mock`. If a test ever makes a real network call, it's a regression — please open an issue.

tests/test_infrastructure.py

@@ -97,7 +97,7 @@ def test_cli_reports_package_version(capsys):
     with pytest.raises(SystemExit) as raised:
         build_parser().parse_args(["--version"])
     assert raised.value.code == 0
-    assert capsys.readouterr().out.strip() == "rewardharness 0.4.0"
+    assert capsys.readouterr().out.strip() == "rewardharness 0.4.1"
 
 
 def test_gemini_text_and_candidate_fallback(monkeypatch):