chore: release v0.5.0 (#25)

Cut the accumulated [Unreleased] into 0.5.0: the artifact-identity v2
fix (logical_key folded into artifact_id — repairs the silent collision
of same-evidence artifacts such as mutually referencing entities; all
artifact ids change, existing databases should be re-indexed), the
`kb watch` incremental re-index daemon (closes the roadmap item), and
the event-handler extractor with its Tier-1 gate (HARD gates 11 -> 12).

pyproject 0.4.0 -> 0.5.0 (+ uv.lock); README Status headline -> v0.5;
DESIGN status banner -> v0.5.

Author: v0ropaev

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-07-07
+
 ### Fixed
 
 - **Silent artifact_id collision for same-evidence artifacts**: `artifact_id` (identity rule v1)
@@ -233,7 +235,8 @@ freshness).
   import oracle, Tier-4 one-hop invalidation, and the store/provenance invariants — run in CI
   against a PostgreSQL 17 service.
 
-[Unreleased]: https://github.com/v0ropaev/knowbase/compare/v0.4.0...HEAD
+[Unreleased]: https://github.com/v0ropaev/knowbase/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/v0ropaev/knowbase/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/v0ropaev/knowbase/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/v0ropaev/knowbase/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/v0ropaev/knowbase/compare/v0.1.0...v0.2.0

DESIGN.md

@@ -1,6 +1,6 @@
 # knowbase — Design
 
-> Status: **agreed MVP design**, implemented through **v0.4**. This document is the source of truth
+> Status: **agreed MVP design**, implemented through **v0.5**. This document is the source of truth
 > for the architecture. It supersedes the original free-form spec. Load-bearing decisions that are
 > expensive to change later are marked **[LOCKED]**; everything else is revisable. The MVP vertical
 > slice in §8 has shipped (provenance spine, import + FastAPI + domain-entity + library-surface

README.md

@@ -84,7 +84,7 @@ flowchart LR
 
 ## Status
 
-**v0.4 — spine, four deterministic extractors (cross-file grounding, incl. the library public-API surface), LLM-grounded descriptions up to per-package architecture overviews, incremental re-index, MCP serving, the knowledge-vs-RAG gates, and published Docker images.** Everything here grounds what it claims, and nothing it cannot:
+**v0.5 — spine (artifact-identity rule v2), five deterministic extractors (cross-file grounding, incl. the library public-API surface and event handlers), LLM-grounded descriptions up to per-package architecture overviews, live incremental re-index (`kb watch`), MCP serving, the twelve knowledge gates, and published Docker images.** Everything here grounds what it claims, and nothing it cannot:
 
 - **Provenance spine** — content-addressed `span_id` (LOCKED); tree-sitter spans with a normalized S-expression fingerprint and per-SHA location; a single-Postgres, Alembic-managed store with content-addressed idempotent writes; the ≥ 1 `derived_from` anti-hallucination invariant enforced in-app *and* by a deferred DB trigger; pygit2 git ingest (no checkout) with a diff-based invalidation seed.
 - **Deterministic extractors** — the **import / dependency graph** (grimp resolves the edge, tree-sitter grounds it on the exact import statement, with an honest `approximate` fallback for re-exports / relative / unmappable imports — never a silent loss); the **FastAPI API-contract** extractor, which grounds a single route **across files** (handler in `routes.py` + `response_model` class in `schemas.py`); the **domain-entity** extractor (pydantic / dataclass / SQLAlchemy classes and their fields, grounded on the class definition **and cross-file on the entities they reference** — purely static, with documented detection limits); the **library public-API-surface** extractor (what a package exposes from its `__init__.py` — `__all__`-authoritative, with `__init__` re-exports resolved **cross-file** to the defining function/class — validated against an independent **griffe** static oracle); and the **event-handler** extractor (pydantic `@field_validator`/`@model_validator`, FastAPI `@app.on_event`, SQLAlchemy `@event.listens_for` — one artifact per handler, grounded on the handler span and **cross-file** on the class it listens to; the call-form `event.listen(...)` and dynamic names are documented gaps).

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "knowbase"
-version = "0.4.0"
+version = "0.5.0"
 description = "Versioned, provenance-grounded knowledge layer over a codebase"
 readme = "README.md"
 requires-python = ">=3.12"