chore: update rhiza to v1.4.2

.github/workflows/rhiza_benchmark.yml

@@ -20,5 +20,5 @@ on:
 
 jobs:
   benchmark:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml@v1.3.4
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml@v1.4.2
     secrets: inherit

.github/workflows/rhiza_book.yml

@@ -29,7 +29,7 @@ on:
 
 jobs:
   book:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_book.yml@v1.3.4
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_book.yml@v1.4.2
     secrets: inherit
     permissions:
       contents: read

.github/workflows/rhiza_ci.yml

@@ -26,5 +26,5 @@ on:
 
 jobs:
   ci:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_ci.yml@v1.3.4
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_ci.yml@v1.4.2
     secrets: inherit

.github/workflows/rhiza_codeql.yml

@@ -39,7 +39,7 @@ on:
 
 jobs:
   codeql:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml@v1.3.4
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml@v1.4.2
     secrets: inherit
     permissions:
       security-events: write   # Upload CodeQL results to code scanning

.github/workflows/rhiza_marimo.yml

@@ -28,5 +28,5 @@ on:
 
 jobs:
   marimo:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml@v1.3.4
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml@v1.4.2
     secrets: inherit

.github/workflows/rhiza_mutation.yml

@@ -42,7 +42,7 @@ jobs:
     # this repo sets the `MUTATION_ENABLED` variable to 'true'. Gating here in
     # the caller keeps it optional regardless of the pinned reusable workflow.
     if: ${{ vars.MUTATION_ENABLED == 'true' }}
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_mutation.yml@v1.3.4
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_mutation.yml@v1.4.2
     secrets: inherit
     permissions:
       contents: read

.github/workflows/rhiza_paper.yml

@@ -28,7 +28,7 @@ on:
 
 jobs:
   paper:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_paper.yml@v1.3.4
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_paper.yml@v1.4.2
     secrets: inherit
     permissions:
       contents: write

.pre-commit-config.yaml

@@ -30,6 +30,36 @@ repos:
         language: system
         pass_filenames: false
 
+      # The architectural import contracts in [tool.importlinter]: the analytics
+      # subpackages (_stats, _plots, _reports, _utils) annotate against the structural
+      # Protocols in _protocol.py and must never import the concrete Data / Portfolio at
+      # runtime.
+      #
+      # This used to be a `make arch` target hooked into `test` with a double-colon rule,
+      # which made it a CI gate only because rhiza v1.3.x ran `make test` in CI. v1.4.0
+      # retired the make layer and rhiza_ci.yml now runs `uvx rhiza-task test` directly,
+      # so a Makefile hook no longer reaches CI at all — the contracts would have gone
+      # unchecked while every job stayed green. As a hook it runs under `rhiza-task fmt`,
+      # which is what the `ci / Pre-commit hooks` job executes.
+      #
+      # `uv run --with import-linter` is the exact command the old `arch` target used, and
+      # it is not interchangeable with an isolated `language: python` hook: import-linter
+      # resolves `root_package = "jquantstats"` by importing it, so it needs the project
+      # ITSELF on the path. In a pre-commit venv holding only import-linter that fails with
+      # "Could not find package 'jquantstats' in your Python path". `uv run` uses the
+      # project environment, where jquantstats is installed, and `--with` keeps
+      # import-linter out of [dependency-groups] — matching the policy there of declaring
+      # only what something resolves from the venv.
+      #
+      # pass_filenames is off because lint-imports reads its whole contract set from
+      # pyproject.toml rather than taking paths; `files` only decides *whether* to run.
+      - id: import-linter
+        name: Architectural import contracts (import-linter)
+        entry: uv run --with import-linter lint-imports
+        language: system
+        pass_filenames: false
+        files: '^(src/.*\.py|pyproject\.toml)$'
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: 'v0.16.2'
     hooks: