feat(cli)!: prepare universal offline v0.2.0rc1

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -12,19 +15,36 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Install pinned build tooling
+        run: python -m pip install --disable-pip-version-check build==1.3.0 twine==7.0.0 setuptools==84.0.0
       - name: Run unit tests
         run: python -m unittest discover -s tests -v
       - name: Compile source
         run: python -m compileall -q src tests
       - name: Build wheel and sdist
-        run: python -m pip wheel --no-deps --wheel-dir dist .
-      - name: Install and smoke-test wheel
+        env:
+          SOURCE_DATE_EPOCH: 0
+        run: python -m build --sdist --wheel --outdir dist
+      - name: Validate metadata and assets
+        run: |
+          python -m twine check --strict dist/*
+          test "$(find dist -name '*.whl' | wc -l)" -eq 1
+          test "$(find dist -name '*.tar.gz' | wc -l)" -eq 1
+      - name: Fresh-install wheel smoke test
+        run: |
+          env -u PYTHONPATH python -m venv "$RUNNER_TEMP/wheel-env"
+          env -u PYTHONPATH "$RUNNER_TEMP/wheel-env/bin/python" -m pip install --force-reinstall --no-deps dist/*.whl
+          env -u PYTHONPATH "$RUNNER_TEMP/wheel-env/bin/monium" --version
+      - name: Fresh-install sdist smoke test
         run: |
-          python -m pip install --force-reinstall --no-deps dist/*.whl
-          env -u PYTHONPATH monium --version
+          env -u PYTHONPATH python -m venv "$RUNNER_TEMP/sdist-env"
+          env -u PYTHONPATH "$RUNNER_TEMP/sdist-env/bin/python" -m pip install --force-reinstall --no-deps dist/*.tar.gz
+          env -u PYTHONPATH "$RUNNER_TEMP/sdist-env/bin/monium" --version

.github/workflows/release.yml

@@ -0,0 +1,100 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      PYTHONPATH: src
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Test source
+        run: |
+          python -m unittest discover -s tests -v
+          python -m compileall -q src tests
+
+  publish:
+    needs: test
+    if: github.repository == 'kizz-tech/monium'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - name: Validate annotated tag and package version
+        run: |
+          test "$(git cat-file -t "$GITHUB_REF_NAME")" = "tag"
+          tag_commit="$(git rev-list -n 1 "$GITHUB_REF_NAME")"
+          main_commit="$(git rev-parse refs/remotes/origin/main)"
+          test "$tag_commit" = "$main_commit"
+          tag_version="${GITHUB_REF_NAME#v}"
+          package_version="$(PYTHONPATH=src python -c 'from monium_cli import __version__; print(__version__)')"
+          test "$tag_version" = "$package_version"
+      - name: Install pinned build tooling
+        run: python -m pip install --disable-pip-version-check build==1.3.0 twine==7.0.0 setuptools==84.0.0
+      - name: Set source epoch
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
+      - name: Build wheel and sdist once
+        run: python -m build --sdist --wheel --outdir dist
+      - name: Validate metadata and asset count
+        run: |
+          python -m twine check --strict dist/*
+          test "$(find dist -name '*.whl' | wc -l)" -eq 1
+          test "$(find dist -name '*.tar.gz' | wc -l)" -eq 1
+      - name: Fresh-install release assets
+        run: |
+          python -m venv "$RUNNER_TEMP/wheel-env"
+          "$RUNNER_TEMP/wheel-env/bin/python" -m pip install --no-deps dist/*.whl
+          env -u PYTHONPATH "$RUNNER_TEMP/wheel-env/bin/monium" --version
+          python -m venv "$RUNNER_TEMP/sdist-env"
+          "$RUNNER_TEMP/sdist-env/bin/python" -m pip install --no-deps dist/*.tar.gz
+          env -u PYTHONPATH "$RUNNER_TEMP/sdist-env/bin/monium" --version
+          printf '{"message":"ready","service":"telemetry"}\n' | env -u PYTHONPATH "$RUNNER_TEMP/wheel-env/bin/monium" logs parse - --input-format ndjson --summary-only
+      - name: Generate checksums
+        run: |
+          cd dist
+          sha256sum *.whl *.tar.gz > SHA256SUMS
+          sha256sum --check SHA256SUMS
+      - name: Attest release assets
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: |
+            dist/*.whl
+            dist/*.tar.gz
+            dist/SHA256SUMS
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          case "$GITHUB_REF_NAME" in
+            *a*|*b*|*rc*)
+              gh release create "$GITHUB_REF_NAME" --verify-tag --generate-notes --title "Unofficial CLI for Yandex Monium $GITHUB_REF_NAME" --prerelease dist/*.whl dist/*.tar.gz dist/SHA256SUMS
+              ;;
+            *)
+              gh release create "$GITHUB_REF_NAME" --verify-tag --generate-notes --title "Unofficial CLI for Yandex Monium $GITHUB_REF_NAME" dist/*.whl dist/*.tar.gz dist/SHA256SUMS
+              ;;
+          esac

.gitignore

@@ -1,5 +1,6 @@
 __pycache__/
 *.py[cod]
+.DS_Store
 *.egg-info/
 .pytest_cache/
 .mypy_cache/

CHANGELOG.md

@@ -1,10 +1,34 @@
 # Changelog
 
-All notable changes to Monium CLI are documented here.
+## 0.2.0rc1 — 2026-08-11
 
-## [0.1.0] - 2026-08-11
+- Reframed the package as an explicitly offline, credential-free toolkit.
+- Added `logs query`, typed repeated selector clauses, critical-path support,
+  strict trace literal semantics, and HTTPS-origin validation.
+- Added bounded NDJSON/JSON/CSV/text readers with neutral and OpenTelemetry
+  normalization, AnyValue handling, provenance, bounded unknown-field
+  preservation, structured errors, and summary-only omission markers. Records
+  over the field cap fail closed; output is independently capped by bytes and
+  JSON nodes with explicit row-omission warnings and an exact final CLI-envelope
+  size check.
+- Added optional non-secret TOML/environment configuration with deterministic
+  CLI precedence and effective-value echoing.
+- Rebuilt packaging and CI for Python 3.11–3.14, single-build verified and
+  attested release assets, metadata validation, and fresh-install smoke tests.
+- Breaking change: removed the legacy path/status selector shortcuts and their
+  Python keyword arguments; use generic typed field filters instead.
+- Duration selectors accept `us`, `ms`, `s`, `m`, and `h` (not `ns`, `µs`, or
+  `d`). Critical-path selectors use `span.critical_path` PRESENT/ABSENT.
+- Added `monium capabilities`, which reports offline support and explicitly
+  marks native live Alerts/Logs reads unavailable without probing credentials,
+  network, or a browser. Private console APIs are not packaged as providers.
+- Documented the fail-closed live-read release gate. No speculative provider,
+  transport model, alert wire schema, or live plugin API is packaged in this
+  offline release candidate.
+- Rejected generic filters that attempt to override first-class project,
+  cluster, service, log-group, trace, or span scope; sanitized config/export
+  read errors so credential-like path values are not echoed.
 
-- Added offline `monium logs url` URL and selector builder.
-- Added offline `monium traces query` selector builder.
-- Added `monium logs parse` NDJSON normalization, filters, summaries, and clear malformed-input errors.
-- Added standard-library unit tests, packaging metadata, and GitHub CI.
+## 0.1.0 — 2026-08-11
+
+- Initial offline selector builders and NDJSON parser.

CONTRIBUTING.md

@@ -1,21 +1,43 @@
 # Contributing
 
-Thanks for helping improve Monium CLI. Keep changes small and focused.
+Contributions to the current offline release line should keep the project
+credential-free and based on Python's standard library at runtime. Do not add
+uploads, background telemetry, private-project fixtures, private console
+gateways, browser/session fallbacks, or custom live endpoints. A future live
+provider is acceptable only after the official API contract and every release
+gate documented in the README and SECURITY policy are available and tested.
 
-## Local checks
-
-Use Python 3.11 or newer and run:
+Before opening a pull request:
 
 ```console
 make test
 make check
 make build
 ```
 
-Runtime code must remain standard-library-only. Tests must be deterministic,
-offline, and must not launch a browser or use credentials. Add or update unit
-tests for behavior changes and keep JSON output stable for automation.
+Tests are table-driven `unittest` cases and must not require network access or
+credentials. New parsers should enforce input bounds, preserve source
+provenance and unknown fields, and emit structured errors without tracebacks.
+Selector changes should keep typed operators and reject ambiguous/raw
+injection. Update the README and CHANGELOG when public behaviour changes.
+
+Use focused commits and include the exact validation commands in the pull
+request description. Release publication is handled by maintainers through the
+tag workflow; this project does not publish to PyPI.
+
+## Maintainer release checklist
+
+1. Confirm the working tree contains only the intended release changes and the
+   package version matches the planned `v<version>` tag.
+2. Run `make test`, `make check`, `make build`, strict Twine validation, and
+   fresh-install smoke tests for both wheel and sdist.
+3. Push the commit through a pull request and wait for every Python CI matrix
+   job to succeed before merging.
+4. Create an annotated, version-matching tag from the verified `main` commit,
+   for example `git tag -a v0.2.0rc1 -m "Monium CLI v0.2.0rc1"`.
+5. Push only that tag, wait for the Release workflow, then verify the public
+   release state, asset count, `SHA256SUMS`, provenance, and a fresh install of
+   the downloaded wheel.
 
-Please do not add Monium credentials, exported production data, or secrets to
-issues, commits, fixtures, or logs. By submitting a contribution, you agree
-that it may be distributed under the Apache-2.0 license in this repository.
+Never move or reuse an existing release tag. Publish a corrective version and
+revert through normal review if a release candidate is defective.

MANIFEST.in

@@ -0,0 +1,3 @@
+include CHANGELOG.md
+include CONTRIBUTING.md
+include SECURITY.md

Makefile

@@ -7,4 +7,4 @@ check:
 	PYTHONPATH=src python -m compileall -q src tests
 
 build:
-	python -m pip wheel --no-deps --wheel-dir dist .
+	python -m build --sdist --wheel --outdir dist