Release 0.4.0: reproducible consumer handoff and exact contract compatibility

.crab.yml

@@ -0,0 +1,45 @@
+# Hungry Crab maw configuration. Every key is optional; these are the defaults.
+license: null              # SPDX id of this repository; detected from LICENSE when null
+mode: normal               # normal | strict. Strict downgrades COPY to REIMPLEMENT for
+                           # code and copies only configs and templates. Not enforced
+                           # yet: today the setting is accepted and ignored.
+hunger:                    # per nutrient category: true | false | issues-only | ideas-only
+  security: true
+  ci: true
+  tests: true
+  tooling: true
+  ai-config: true
+  hygiene: true
+  docs: true
+  deps: true
+  history-lesson: true
+  issue-lesson: true
+  architecture: issues-only
+  code: ideas-only         # declared, and produced by nothing until 0.4: accepted and inert
+ignore: []                 # globs excluded from this repository's own digest, so that test
+                           # fixtures and vendored trees are not mistaken for your code, e.g.
+                           # [tests/fixtures/**, examples/**]. Patterns are case-sensitive on
+                           # every platform, like the git paths they match.
+budget:
+  policy: warn             # warn | enforce | off for the whole digest Markdown budget
+serve:
+  issues: ask              # auto | ask | off
+  prs: ask                 # auto | ask | off; gates --as pr-branch (REIMPLEMENT and COPY)
+  max_prs_per_run: 3
+  labels: [hungry-crab]
+  assignees: []
+  token_env: ""            # environment variable holding the token to file issues as, e.g.
+                           # CRAB_BOT_TOKEN with a GitHub App installation token. Empty means
+                           # gh's own login: your issues carry your name, not the crab's.
+trust:                     # a license is a promise to strangers; these are not strangers
+  same_owner: true         # prey owned by the account that owns this repository is your own code
+  owners: []               # other accounts whose repositories count as your own, e.g. [acme-inc]
+  bypass_license: false    # last resort: treat every prey as COPY. Every card says so, and the
+                           # verdict is flagged for human review, because this is not a finding
+                           # about the license but a decision to stop asking.
+attribution_file: THIRD_PARTY_NOTICES.md
+                           # where COPY records its sources: rendered by `crab attribution`
+                           # from the receipts in .crab/attributions.json, which
+                           # `crab serve --as pr-branch` writes when it carries prey files in.
+ledger: repo               # repo (.crab/ledger.json, committed) | cache | none
+scoring: {}                # overrides for data/scoring.yml sections; `crab tune` suggests them

.crab/attributions.json

@@ -0,0 +1,53 @@
+{
+  "schema": "hungry-crab.attributions/1",
+  "receipts": [
+    {
+      "nutrient_id": "crab:ci:ci.concurrency",
+      "source": {
+        "label": "pypa/build",
+        "url": "https://github.com/pypa/build",
+        "sha": "58c921aada7f4e03edda65545d42db0c8b000bdc",
+        "license": "MIT"
+      },
+      "taken": [
+        {
+          "maw_path": ".github/workflows/ci.yml",
+          "prey_path": ".github/workflows/test.yml",
+          "verbatim": false
+        }
+      ],
+      "mode": "COPY",
+      "obligation": {
+        "kind": "copyright-notice",
+        "text": "keep the source's copyright and permission notice with the material"
+      },
+      "summary": "carried the concurrency block of pypa/build's test workflow into ci.yml, keyed on the ref with cancel-in-progress, so a push supersedes the run of the commit it replaced; nothing else in the workflow changed",
+      "branch": "crab/ci-ci.concurrency-a444a227",
+      "recorded_at": "2026-09-25T17:51:47+00:00"
+    },
+    {
+      "nutrient_id": "crab:tooling:tooling.dependabot",
+      "source": {
+        "label": "pypa/build",
+        "url": "https://github.com/pypa/build",
+        "sha": "58c921aada7f4e03edda65545d42db0c8b000bdc",
+        "license": "MIT"
+      },
+      "taken": [
+        {
+          "maw_path": ".github/dependabot.yml",
+          "prey_path": ".github/dependabot.yml",
+          "verbatim": false
+        }
+      ],
+      "mode": "COPY",
+      "obligation": {
+        "kind": "copyright-notice",
+        "text": "keep the source's copyright and permission notice with the material"
+      },
+      "summary": "carried pypa/build's github-actions Dependabot block over unchanged (weekly on Tuesday, one grouped pull request, a seven-day cooldown) and added a pip block for pyproject.toml on the same schedule",
+      "branch": "crab/tooling-tooling.dependabot-9de61c0c",
+      "recorded_at": "2026-09-25T17:51:14+00:00"
+    }
+  ]
+}