[pineforge-app]

Publish pineforge-data 0.3.3 after its own CI and runtime E2E.

Required: Python 3.11/3.12/3.13, manifest/source/OCI verification, real Docker harness and ABI checks, concurrent server/cache checks, disposable database E2E, and installation/backtesting of both distributions. release/ready must pass for the current head and base. Publication reuses the landed commit's CI artifacts.

[graphify-labs]

Graphify reviewed this change.

No issues found by static checks — no coupling regressions or blocking issues in the code graph. That is not the same as safe to merge: see what was not checked.

Not checked: tests were not run; no formal proof of the changed code.

---

Graphify review — findings

Bumps the pinned PineForge release image from 1.6.3 to 1.10.0 and releases pineforge-data as 0.3.3. The default release image in the contract module, the server Dockerfile's image and hub commit, and the bundled release lock and manifest now all point at the new image digest, hub commit, and engine/codegen/hpo versions. The lock's previous entry rolls forward to record 1.6.3 / 0.3.2, and no contract logic changes.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 48 functions depend on the 16 functions this change touches.

Health — grade A; 1 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):

• run_harness() — 3 callers, 11 callees (medium)

Verification — 48 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 45 function(s) in the blast radius were not formally verified this run