docs: Loveless prod e2e verified (both sc UMAPs) + Werba pseudobulk→DESeq2 clean; ADR-0006 items 7/8 closed

chore(scripts): rename the limma probe so pytest stops collecting it

fix(uploads): scan before parse; drop ungated URL/HF originals (ADR-0011)

fix(uploads): make the deployed malware-scan posture explicit and honest

Merge remote-tracking branch 'origin/main' into feat/sandbox-executor

feat(uploads): wire ADR-0011 safety gate into the Gradio upload UI

docs(adr): close out ADR-0012 — deployed to prod + validated end-to-end

Merge remote-tracking branch 'origin/main' into feat/sandbox-executor

docs(adr): add ADR-0012 authentication & access-control record

feat(integrity): ADR-0010 on-load verify for GEO series-matrix loads

feat(security): ADR-0014 CI security scanning + shared scan definition

feat(uploads): local content scan + manifest drafting (ADR-0011)

feat(auth): ADR-0012 identity seam + identity into audit trace (Now slice)

feat(logging): ADR-0013 audit-trace redaction (secret/credential/PII scrubbing)

docs(adr): ADR-0007 Proposed -> Accepted/in-progress (Phases 0-2 done, 3-4 AWS-blocked)

feat(exec): ADR-0007 Phase 2 local hardening for ContainerLauncher

feat(exec): real MCP handshake + container-launch fixes (ADR-0007 Phase 1 validation)

docs(adr): close ADR-0003/0005 housekeeping; add security-review ADRs 0008-0011

feat(exec): extract Executor seam + EXECUTOR config switch (ADR-0007 Phase 0)

feat(integrity): wire ADR-0010 on-load verify + re-pin 0.1.9 (deploy slice)

feat(uploads): validate flat-matrix (csv/tsv) uploads, not just h5ad

feat(uploads): ADR-0011 manual-upload safety gate ("Now" slice)

Merge feat/configurable-log-sink: always-on audit log sink (ADR-0008 + ADR-0009)

docs(adr-0009): add Appendix A — OHSU bucket & IAM spec (Phase 2 handoff)

feat(logging): implement S3 log sink (ADR-0009 Phase 1)

feat(loveless): Role-2 signature consumable — resolve private signature URLs

feat(loveless): integrate biodata-registry 0.1.8 sc datasets (Path P by modality)

feat(loveless): sc loaders resolve hosted/private h5ad URLs (ADR-0006)

feat(loveless): ADR-0006 #6 — h5ad source type + Path P loading plan

feat(loveless): ADR-0006 + agent-side sc serving scaffold

feat(integration): ComBat per-sample scoring tool decoupler_pool_cohorts (ADR-0001 item 10)

docs(adr): ADR-0001 header — Mode A built + deployed to prod (5cb2737)

ADR-0001 Phase 2 Mode A: early integration (T7 + T8 + T9)

docs(adr): accept ADR-0003/0004/0005; reconcile ADR-0001 checkboxes + concordance

docs(adr): reduce ADR-0001 decision-matrix to a pointer (moved to biodata-registry)

docs(adr): reconcile stale status headers + add ADR-0003/0004/0005

feat(sanity): ADR-0002 Layer-2 result-aware sanity layer (Phase 1 + S1)

ADR-0001: add spin-off task prompts for phases 1-3

ADR-0001 Phase 0: cross-dataset integration contract + specs