chernistry/bernstein

v1.8.7

Architecture boundaries + CI unblock.

Architecture

• Import-linter contracts. A new CI gate enforces the intended boundaries between cli/, core/, adapters/, and their sub-packages. Violations fail the Lint job before they can land.

CI

• Fixed test collection on main — cheaper_retry and retry_budget back-compat redirects pointed at bernstein.core.cost.* but the modules actually live in bernstein.core.cost.planned.*, so the Ubuntu/macOS test matrix was failing with ModuleNotFoundError. Redirects now match the real locations.
• Cleaned up shellcheck warnings in the mutation-testing workflow (grouped consecutive >> $GITHUB_OUTPUT redirects, dropped two unused variables).
• Added import-linter to the dev dependency group so the new contracts run in CI.
• Added a back-compat shim at bernstein.cli.display.icons after icons moved to core/observability/icons.py.
• Removed accidentally-tracked .sdd/ runtime files that had slipped in through batch merges.
• SonarCloud cleanup: noisy style hotspots suppressed while keeping security rules active; JS event handlers hardened; test-file scope excluded from bug/vulnerability rules.

Orchestrator & server

• Spawner and ingest: pre-emptive fixes for hook 401 and batch 422 responses.
• Boot: LOCKED_FILES paths updated after the sub-package reorg; auth token is auto-generated on first boot.
• TUI / CLI: the Tasks panel was empty because the client wasn't sending an Authorization header — now fixed.

Cost & cleanup

• api_usage.py moved out of the cost/planned/ staging area so the back-compat redirect map resolves.
• CostAutopilot wired into the cost pipeline; duplicate custom_metric_dsl implementation removed.
• Deleted bulletin_board.py (no production importers remained after the communication/ split).

Full changelog: https://github.com/chernistry/bernstein/compare/v1.8.6...v1.8.7