update md file

REPO_STATUS.md

@@ -148,7 +148,7 @@ Two facts to internalise:
 - **Unstructured RAG** over PGVector.
 - **Analytics tools:** 4 registered composite `analyze_*` (descriptive, aggregate, correlation, trend) + 4 data-access tools (check_data, check_knowledge, retrieve_data, retrieve_knowledge). Four further composites (comparison, contribution, profile, segment) exist in code but are **not registered** with the Planner.
 - **Versioned report generation** from persisted records.
-- **Analysis sessions:** data-first creation gate (≥1 bound source), per-analysis data-source binding (#10).
+- **Analysis sessions:** data-first creation gate (≥1 bound source); each turn reads the analysis-scope catalog so it sees only that analysis's bound sources.
 - **Langfuse tracing** (PII-masked), **Redis caching**, **pooled DB engines** + speculative prewarm.
 
 ---
@@ -185,7 +185,7 @@ unless `SKIP_INIT_DB=true`.
 | `report_inputs` *(was `analysis_records`)* | jsonb `AnalysisRecord`, one per slow-path run; **Python-owned** | slow path | ReportGenerator, report readiness |
 | `analyses` *(dedorch, plural)* | uuid `id`, `user_id`, `analysis_title`, `objective`, `business_questions` jsonb, `status` (active\|inactive), `data_bind`(+`data_bind_version`), `report_id`, `report_collection` — **defined by Go migrations**; `problem_statement`/`problem_validated`/`owner_id` already **dropped** there (`0003`/`0004`) | Go `/api/v1/analyses`; Python state store | gate (no-op), Help, report |
 | `reports` *(dedorch)* | uuid, `analysis_id`, `user_id`, `title` + markdown `content` + `version` (UNIQUE per analysis) | Go + Python ReportStore | report API |
-| ~~`data_sources`~~ *(dropped from Python)* | per-analysis binding table; **no longer read or written by Python** — the writer (`/analysis/create`) was Go-owned/unwired so it was always empty. Scoping now reads the analysis-scope `data_catalog` row instead | — | — |
+| `data_sources` *(dedorch, Go-owned)* | per-analysis binding table. **Python no longer reads or writes it** — bindings live in Go's `analyses.data_bind`, which Go materializes into the analysis-scope `data_catalog` row; Python scopes off that row. The table exists (Go migration) but Python is fully decoupled — do **not** drop it manually | Go migration | — (unused by Python) |
 | `analyses_messages` *(dedorch)* | the analysis chat room (`role ∈ user\|ai`); replaces deprecated `rooms`/`chat_messages` | Go `/analyses/{id}/messages` | Python chat path **not yet migrated here** (§12) |
 
 > ✅ **Python ORM ↔ dedorch drift — reconciled 2026-07-01.** `AnalysisStateRow` (`analyses`) dropped
@@ -339,7 +339,7 @@ Python is consumer-only). State **re-verified against the Go source 2026-06-29**
   **Python-owned**; its finalized schema goes to Harry so the dedorch migration creates it post-cutover.
 - **Connection-string cutover DONE (2026-07-01).** Python's `postgres_connstring` now points at
   **dedorch** and reads the Go-migrated tables directly. Every ORM model Python reads (`analyses`,
-  `data_sources`, `analyses_messages`, `data_catalog`) has been reconciled to its dedorch shape.
+  `analyses_messages`, `data_catalog`) has been reconciled to its dedorch shape.
   **`init_db()` is now skipped by default** (`settings.skip_init_db` defaults **True**): its privileged
   DDL (`ALTER TABLE rooms …`, index creation) fails on Go-owned tables
   (`InsufficientPrivilegeError: must be owner of table rooms`). Skipping is safe — Go migration `0001`
@@ -374,9 +374,10 @@ records-based report; floor: ≥1 `analyze_*` success). Wiring Go → Python is
   `cryptography.fernet.InvalidToken` — whose `str()` is **empty**, so it logged as `error=""` and
   masqueraded as a DB-connection failure (the executor now logs `repr(e)` to expose it). Tell-apart:
   a valid-but-wrong key → `InvalidToken`; a malformed key → a non-empty `ValueError` at cipher build.
-- **Never-throw seams** are pervasive (tool invoker, query service, executors, state/binding reads,
+- **Never-throw seams** are pervasive (tool invoker, query service, executors, state/catalog reads,
   record persistence, report summary). Failures degrade into soft output rather than raising — good
-  for UX, but they can mask real breakage (e.g. a binding silently fail-opening to the full catalog).
+  for UX, but they can mask real breakage (e.g. a missing analysis-scope catalog silently falling
+  back to the whole user catalog).
 - **Prompts** live in `src/config/prompts/*.md`. `chatbot_system.md` has `guardrails.md` appended so
   guardrails win on conflict.
 - **Tests** are gitignored (team decision) — run them locally.