bindsight 0.3.5__tar.gz → 0.3.7__tar.gz

bindsight-0.3.7/.gitattributes

@@ -0,0 +1,25 @@
+* text=auto eol=lf
+
+*.py text diff=python
+*.md text
+*.yaml text
+*.yml text
+*.toml text
+*.cff text
+Snakefile text
+
+# Binary-y data
+*.parquet binary
+*.tar.gz binary
+*.gz binary
+*.zip binary
+*.cif binary
+*.pdb binary
+
+# Recorded evidence is checksum-addressed: retain its exact archived bytes.
+benchmarks/numerical_validation/** -text whitespace=cr-at-eol
+docs/audits/** -text whitespace=cr-at-eol
+# R's captured session/log output intentionally pads its printed columns.
+benchmarks/numerical_validation/reference/**/session-info.txt whitespace=-blank-at-eol
+benchmarks/numerical_validation/reference/setup-session-info.txt whitespace=-blank-at-eol
+benchmarks/numerical_validation/reference/**/execution.log whitespace=-blank-at-eol

{bindsight-0.3.5 → bindsight-0.3.7}/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -41,7 +41,7 @@ body:
     attributes:
       label: Version
       description: "Output of `bindsight --version`."
-      placeholder: "0.3.5"
+      placeholder: "0.3.7"
     validations:
       required: true
 
@@ -59,6 +59,7 @@ body:
     attributes:
       label: How you installed it
       options:
+        - "pip install bindsight (PyPI)"
         - "git clone + pip install -e"
         - "conda/mamba from envs/discover.yaml"
         - "Docker"

{bindsight-0.3.5 → bindsight-0.3.7}/.github/workflows/ci.yml

@@ -19,23 +19,30 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.11"
+          python-version: "3.11.18"
+          check-latest: true
           cache: "pip"
       - name: Install
         run: |
-          python -m pip install --upgrade pip
+          python -m pip install --upgrade "pip>=26.2.2"
           pip install -e ".[dev,discover,report]"
       - name: Ruff check
-        run: ruff check bindsight tests scripts benchmarks
+        run: ruff check bindsight tests scripts benchmarks companion
+      - name: Test the read-only website relay
+        run: node --test hosting/site-proxy.test.mjs
+      - name: Test the production Worker request implementation
+        run: |
+          npm install --prefix "$RUNNER_TEMP/relay-runtime" --no-audit --no-fund miniflare@5.20260926.1-alpha
+          BINDSIGHT_MINIFLARE_DIR="$RUNNER_TEMP/relay-runtime" node --test hosting/site-proxy.workerd-test.mjs
       - name: Ruff format
-        run: ruff format --check bindsight tests scripts benchmarks
+        run: ruff format --check bindsight tests scripts benchmarks companion
       # Blocking. pyproject sets strict = true and CI swallowed the result with
       # `|| true`, so 53 errors accumulated unnoticed -- including the arity bug
       # that left the Snakemake front-end dead for five weeks. That front-end is
       # scripts/, which this step did not check: the justification named a
       # directory outside its own scope.
       - name: mypy
-        run: mypy bindsight scripts benchmarks
+        run: mypy bindsight scripts benchmarks companion
 
   test:
     name: Test (Python ${{ matrix.python-version }} on ${{ matrix.os }})
@@ -52,10 +59,11 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
+          check-latest: true
           cache: "pip"
       - name: Install
         run: |
-          python -m pip install --upgrade pip
+          python -m pip install --upgrade "pip>=26.2.2"
           pip install -e ".[dev,discover,report]"
       # The Snakemake front-end is now exercised in CI. It runs offline via
       # BINDSIGHT_CACHE_DIR and adds ~15 s. Linux only: Snakemake's Windows
@@ -90,11 +98,12 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.11"
+          python-version: "3.11.18"
+          check-latest: true
           cache: "pip"
       - name: Install exactly what the release records
         run: |
-          python -m pip install --upgrade pip
+          python -m pip install --upgrade "pip>=26.2.2"
           pip install -c envs/constraints.txt -e ".[dev,discover,report]"
       - name: The installed versions are the recorded ones
         run: python scripts/check_pinned_environment.py
@@ -125,19 +134,109 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.11"
+          python-version: "3.11.18"
+          check-latest: true
       - name: Install build deps
         run: pip install build twine
       - name: Build
         run: python -m build
       - name: Twine check
         run: twine check dist/*
+      - name: Exercise the installed wheel outside the source checkout
+        run: |
+          python -m venv "$RUNNER_TEMP/release-wheel"
+          PYTHON="$RUNNER_TEMP/release-wheel/bin/python"
+          "$PYTHON" -m pip install --upgrade "pip>=26.2.2"
+          WHEEL=$(find dist -name '*.whl' -print -quit)
+          "$PYTHON" -m pip install -c envs/constraints.txt "${WHEEL}[discover,report]" "httpx2>=2,<3" packaging
+          VERSION=$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')
+          "$PYTHON" -I scripts/check_release_install.py --expected-version "$VERSION"
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
 
+  gpu-recipe:
+    name: GPU recipe installation and imports (CPU runner)
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11.18"
+          check-latest: true
+      - name: Install the setup driver
+        run: python -m pip install -e . "psutil>=5.9,<8"
+      - name: Resolve and import both actual scientific environments
+        run: python -m bindsight.report.web.gpu_setup --check-recipe --root "$RUNNER_TEMP/bindsight-gpu-recipe"
+      - name: Retain the dependency check record
+        uses: actions/upload-artifact@v7
+        with:
+          name: gpu-recipe-import-check
+          path: ${{ runner.temp }}/bindsight-gpu-recipe/recipe_check.json
+          if-no-files-found: error
+      # This installs actual GPU packages, but deliberately downloads no model
+      # weights, runs no GPU computation and never creates a ready.json receipt.
+
+  companion:
+    name: Companion (${{ matrix.platform }})
+    runs-on: ${{ matrix.os }}
+    env:
+      UV_PYTHON_PREFERENCE: only-managed
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: windows-latest, platform: windows-x64}
+          - {os: macos-latest, platform: macos-arm64}
+          - {os: macos-15-intel, platform: macos-x64}
+          - {os: ubuntu-22.04, platform: linux-x64}
+    steps:
+      - uses: actions/checkout@v7
+      - name: Read the audited runtime pins for this platform
+        id: runtime-pins
+        shell: bash
+        env:
+          PLATFORM: ${{ matrix.platform }}
+        run: |
+          node <<'JS'
+          const fs = require('node:fs');
+          const pins = JSON.parse(fs.readFileSync('companion/pins.json', 'utf8'));
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, [
+            `uv=${pins.uv_version}`,
+            `python=${pins.python_version}`,
+            `checksum=${pins.artifacts[process.env.PLATFORM].sha256}`,
+            '',
+          ].join('\n'));
+          JS
+      # setup-python does not distribute security-only Python 3.12 releases
+      # on every OS. Build with the same patched runtime the companion installs.
+      - name: Install the verified installer and patched build Python
+        id: build-runtime
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: ${{ steps.runtime-pins.outputs.uv }}
+          checksum: ${{ steps.runtime-pins.outputs.checksum }}
+          python-version: ${{ steps.runtime-pins.outputs.python }}
+          activate-environment: true
+          venv-path: ${{ runner.temp }}/companion-build
+          no-project: true
+          enable-cache: false
+      - name: Verify the actual build interpreter
+        run: python -c "import json, platform; expected = json.load(open('companion/pins.json'))['python_version']; actual = platform.python_version(); print('Build Python:', actual); assert actual == expected, (actual, expected)"
+      - name: Install the pinned packaging tool
+        run: uv pip install --python "${{ steps.build-runtime.outputs.venv }}" -r companion/requirements-build.txt
+      - name: Package the companion for this tested source
+        run: python companion/build.py --revision ${{ github.sha }} --output companion-dist
+      - name: Upload the companion and its build record
+        uses: actions/upload-artifact@v7
+        with:
+          name: companion-${{ matrix.platform }}
+          path: companion-dist/
+          if-no-files-found: error
+
   gate:
     # One check for the branch ruleset on `main` to require.
     #
@@ -151,7 +250,7 @@ jobs:
     # this file by tests/test_packaging_pins.py rather than by memory.
     name: All CI jobs passed
     runs-on: ubuntu-latest
-    needs: [lint, test, pinned, build]
+    needs: [lint, test, pinned, build, companion, gpu-recipe]
     # Without this the gate is skipped when anything it needs fails, and a
     # skipped required check never reports -- the merge would block on silence
     # rather than on the failure, which reads like an outage.

{bindsight-0.3.5 → bindsight-0.3.7}/.github/workflows/docker.yml

@@ -33,6 +33,8 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
+          # Refresh system certificate packages instead of reusing old layers.
+          no-cache: true
           # Publishing is opt-in. It needs two account-level settings that
           # `permissions:` cannot grant: the ghcr.io package must list this
           # repository under Manage Actions access with role Write (the

bindsight-0.3.7/.github/workflows/docs.yml

@@ -0,0 +1,102 @@
+name: Docs
+
+# Build the mkdocs-material site and publish it to GitHub Pages. Pages is
+# served from GitHub Actions (Settings → Pages → Source: "GitHub Actions"),
+# which is what lets this deploy without a gh-pages branch.
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build-deploy:
+    # A public update follows the successful tested main commit, never PR code.
+    if: >-
+      (github.event_name == 'workflow_run' &&
+       github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.head_repository.full_name == github.repository) ||
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+      - name: Refuse to republish an older main revision
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          test "$(git rev-parse HEAD)" = "$(gh api "repos/$GITHUB_REPOSITORY/commits/main" --jq .sha)"
+      - name: Require a successful CI run for manual publication
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          test "$(gh run list --workflow ci.yml --branch main --commit "$GITHUB_SHA" --json conclusion --jq 'any(.[]; .conclusion == "success")')" = true
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11.18"
+          check-latest: true
+          cache: "pip"
+      # The core install is enough: bindsight.report resolves render_run lazily,
+      # so the results generator reaches report/showcase.py without pulling in
+      # pandas or jinja2. tests/test_report_lazy_import.py guards that.
+      - name: Install docs deps
+        run: pip install -e ".[docs]"   # the extra exists for exactly this; one place holds the bound
+      - name: Regenerate the results page from benchmarks/
+        run: python scripts/build_docs_results.py
+      # --strict fails the build on broken internal links. It caught nine
+      # already-live 404s the first time it was switched on.
+      - name: Build site
+        run: mkdocs build --strict --site-dir site
+      - name: Build the research workspace from this tested commit
+        run: python scripts/build_website.py --out site/workspace
+      - name: Resolve the successful matching CI run
+        id: tested
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TRIGGER_RUN: ${{ github.event.workflow_run.id }}
+        run: |
+          if [ -n "$TRIGGER_RUN" ]; then
+            echo "id=$TRIGGER_RUN" >> "$GITHUB_OUTPUT"
+          else
+            RUN=$(gh run list --workflow ci.yml --branch main --commit "$GITHUB_SHA" --json databaseId,conclusion --jq '[.[] | select(.conclusion == "success")][0].databaseId')
+            test -n "$RUN" && test "$RUN" != null
+            echo "id=$RUN" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Fetch companion builds from the same successful CI run
+        uses: actions/download-artifact@v8
+        with:
+          pattern: companion-*
+          path: companion-builds
+          run-id: ${{ steps.tested.outputs.id }}
+          github-token: ${{ github.token }}
+      - name: Verify and publish the matching companions
+        run: python scripts/publish_companions.py --artifacts companion-builds --workspace site/workspace
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+      - name: Confirm main has not moved during the build
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          test "$(git rev-parse HEAD)" = "$(gh api "repos/$GITHUB_REPOSITORY/commits/main" --jq .sha)"
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5

{bindsight-0.3.5 → bindsight-0.3.7}/.github/workflows/draft-pdf.yml

@@ -53,7 +53,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.event.release.tag_name }}
         # Renamed so the asset says which document it is next to the wheel,
-        # the sdist and the bioRxiv manuscript's PDF.
+        # the sdist and the methods manuscript's PDF.
         run: |
           cp paper/paper.pdf "bindsight-${TAG}-joss-paper.pdf"
           gh release upload "$TAG" "bindsight-${TAG}-joss-paper.pdf" --clobber --repo "${{ github.repository }}"

bindsight-0.3.7/.github/workflows/manuscript-pdf.yml

@@ -0,0 +1,162 @@
+name: Manuscript PDF
+
+# The methods manuscript is LaTeX and the machine it is written on has no TeX
+# distribution, so CI typesets it. Every push that touches the manuscript or
+# the shared bibliography leaves a `methods-manuscript` artifact on the run,
+# and every published release carries the same PDF as an asset named for the
+# tag. `paper/README.md` sends a submitter to one of those two places.
+#
+# Overleaf is not the fallback it looks like. `manuscript.tex` reaches its
+# bibliography with \addbibresource{../paper.bib} -- one directory up, shared
+# with the JOSS paper so a citation is fixed in one place. Zipping
+# `paper/methods/` alone uploads a project with no bibliography, which still
+# compiles and hands back a PDF with a question mark where every citation
+# should be. The action below runs in the full checkout, so the relative path
+# resolves, and latexmk runs biber by itself when it sees the .bcf that
+# biblatex writes. A step after the build fails the run on any citation that
+# stayed undefined, so that failure cannot render.
+
+on:
+  push:
+    paths:
+      - 'paper/methods/**'
+      - 'paper/validation/**'
+      - 'paper/paper.bib'
+      - '.github/workflows/manuscript-pdf.yml'
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Typeset the methods manuscript
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Compile manuscript.tex with latexmk
+        # Pinned to the commit the `v4` tag points at (release 4.1.0), like
+        # every other third-party action here; tests/test_packaging_pins.py
+        # refuses a branch or a moving ref.
+        uses: xu-cheng/latex-action@6549dc21effb2730855a1281407ecfcececc6c1b  # v4 (4.1.0)
+        with:
+          working_directory: paper/methods
+          root_file: manuscript.tex
+          args: -pdf -file-line-error -halt-on-error -interaction=nonstopmode
+      - name: Fail on undefined citations or references
+        # A missing bibliography does not stop latexmk; it leaves "[?]" where
+        # every citation should be and a warning in the log. Stop here instead.
+        run: |
+          if grep -E "Citation .* undefined|Reference .* undefined|There were undefined" paper/methods/manuscript.log; then
+            echo "::error::the typeset manuscript has undefined citations or references"
+            exit 1
+          fi
+      - uses: actions/upload-artifact@v7
+        with:
+          name: methods-manuscript
+          path: paper/methods/manuscript.pdf
+          if-no-files-found: error
+
+  study:
+    name: Typeset the validation study
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install pandoc and a PDF engine
+        # apt rather than a third-party action: no new pinning question, and
+        # tests/test_packaging_pins.py allows actions/* at a version tag only.
+        #
+        # lmodern is named explicitly because pandoc's default LaTeX template
+        # loads it and none of the texlive-* metapackages pull it in: the first
+        # run of this job died on a missing lmodern.sty. The study also needs
+        # xelatex rather than pdflatex -- it contains a superscript minus
+        # (U+207B), which inputenc cannot represent.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            pandoc texlive-xetex texlive-fonts-recommended texlive-latex-recommended \
+            lmodern fonts-dejavu-core
+      - name: Render manuscript.md
+        # The study is Markdown with a hand-numbered reference list and no
+        # embedded images, so there is nothing to resolve outside the file.
+        #
+        # mainfont is not cosmetic. Latin Modern has no glyph for U+2265 or
+        # U+207B, and xelatex prints nothing where a glyph is missing, so the
+        # first green build of this job dropped both: the Methods sentence
+        # "|log2fc| >= 1" lost its operator, and the adjusted p-value
+        # "5.6 x 10^-11" lost the minus from its exponent, in both places it
+        # appears. DejaVu Serif has both glyphs. The check below is the part
+        # that matters -- a font can change again, silence cannot be allowed to.
+        run: |
+          # pipefail because the pipe into tee below would otherwise report
+          # tee's exit code and hide a failed render completely.
+          set -o pipefail
+          cd paper/validation
+          pandoc manuscript.md \
+            --from=gfm \
+            --output=manuscript.pdf \
+            --pdf-engine=xelatex \
+            --variable=mainfont:'DejaVu Serif' \
+            --variable=monofont:'DejaVu Sans Mono' \
+            --variable=geometry:margin=1in \
+            --variable=fontsize:11pt \
+            --standalone 2>&1 | tee pandoc.log
+      - name: Fail on any character the font could not print
+        # pandoc warns and exits 0. A size floor cannot see this and neither
+        # can a reader: the number just reads differently. Same reasoning as
+        # the undefined-citation check in the job above.
+        run: |
+          if grep -F 'Missing character' paper/validation/pandoc.log; then
+            echo "::error::the study PDF is missing glyphs; characters above were dropped silently"
+            exit 1
+          fi
+      - name: Fail if the PDF came back empty
+        # pandoc exits 0 on a document it rendered as one blank page. The study
+        # is ~2,800 words, so anything under 40 kB is a build that silently
+        # produced nothing -- the failure mode this whole file is arranged
+        # against.
+        run: |
+          size=$(stat -c%s paper/validation/manuscript.pdf)
+          echo "manuscript.pdf is ${size} bytes"
+          if [ "$size" -lt 40000 ]; then
+            echo "::error::the study PDF is ${size} bytes; it did not render"
+            exit 1
+          fi
+      - uses: actions/upload-artifact@v7
+        with:
+          name: study-manuscript
+          path: paper/validation/manuscript.pdf
+          if-no-files-found: error
+
+  attach:
+    name: Attach to the release
+    needs: [build, study]
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: methods-manuscript
+          path: paper/methods
+      - uses: actions/download-artifact@v8
+        with:
+          name: study-manuscript
+          path: paper/validation
+      - env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name }}
+        # Renamed so each asset says which document it is next to the wheel,
+        # the sdist and the JOSS paper's PDF. Three PDFs now travel with a
+        # release and they are all `manuscript.pdf` or `paper.pdf` in the tree,
+        # so the release-page name is the only thing telling them apart.
+        run: |
+          cp paper/methods/manuscript.pdf "bindsight-${TAG}-methods-manuscript.pdf"
+          cp paper/validation/manuscript.pdf "bindsight-${TAG}-validation-study.pdf"
+          gh release upload "$TAG" \
+            "bindsight-${TAG}-methods-manuscript.pdf" \
+            "bindsight-${TAG}-validation-study.pdf" \
+            --clobber --repo "${{ github.repository }}"

bindsight-0.3.7/.github/workflows/release-artifacts.yml

@@ -0,0 +1,111 @@
+name: Release artifacts
+
+# Attach a wheel, an sdist and their SHA-256 checksums to every published
+# release, and upload the same two files to PyPI.
+#
+# The attach job always runs, so a release is installable without PyPI:
+#     pip install https://github.com/mikhaeelatefrizk/bindsight/releases/download/<tag>/bindsight-<version>-py3-none-any.whl
+#
+# The PyPI job runs when the `PYPI_TRUSTED_PUBLISHING` repository variable is
+# `true` and the `pypi` environment exists -- both since 0.3.5, the first
+# release published there. The project is registered on PyPI as a trusted
+# publisher of this repository, workflow `release-artifacts.yml`, environment
+# `pypi`, so the upload is authorised by OIDC and no API token is ever stored
+# in this repository. Without the variable the job is skipped, not failed.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  build:
+    name: Build wheel + sdist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Require successful main CI for this exact release commit
+        if: github.event_name == 'release'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          test "$(gh run list --workflow ci.yml --branch main --commit "$GITHUB_SHA" --json conclusion --jq 'any(.[]; .conclusion == "success")')" = true
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12.16"
+          check-latest: true
+      - run: python -m pip install --quiet build twine
+      - name: Point the README's relative links at this tag for PyPI
+        # PyPI renders the long description with no base URL, so every
+        # relative link in README.md is dead there. The checkout is rewritten
+        # (never committed) so the sdist and wheel carry absolute links.
+        run: python scripts/pypi_readme.py --write --ref "${{ github.event.release.tag_name || github.ref_name }}"
+      - run: python -m build
+      - name: Check metadata
+        run: python -m twine check dist/*
+      - name: Exercise the exact wheel that will be published
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION=$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')
+          if [ "$GITHUB_EVENT_NAME" = release ]; then test "$RELEASE_TAG" = "v$VERSION"; fi
+          python -m venv "$RUNNER_TEMP/release-wheel"
+          PYTHON="$RUNNER_TEMP/release-wheel/bin/python"
+          "$PYTHON" -m pip install --upgrade "pip>=26.2.2"
+          WHEEL=$(find dist -name '*.whl' -print -quit)
+          "$PYTHON" -m pip install -c envs/constraints.txt "${WHEEL}[discover,report]" "httpx2>=2,<3" packaging
+          "$PYTHON" -I scripts/check_release_install.py --expected-version "$VERSION"
+      - name: Checksum
+        working-directory: dist
+        run: sha256sum bindsight-*.whl bindsight-*.tar.gz > SHA256SUMS
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  attach:
+    name: Attach to the release
+    needs: build
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist
+      - env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ github.event.release.tag_name }}" dist/* --clobber --repo "${{ github.repository }}"
+
+  pypi:
+    name: Publish to PyPI
+    needs: build
+    if: github.event_name == 'release' && vars.PYPI_TRUSTED_PUBLISHING == 'true'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist
+      - name: Drop the checksum file
+        # SHA256SUMS is a release asset, not a distribution; twine rejects it.
+        run: rm -f dist/SHA256SUMS
+      # Pinned by commit, like the JOSS action in draft-pdf.yml, whose comment
+      # argues a floating ref is unacceptable for something that builds a
+      # submission. The argument is stronger here: `release/v1` is a *branch*,
+      # so this step -- the one holding the credential that publishes to PyPI
+      # -- ran whatever had most recently been pushed to it. A tag is at least
+      # a statement of intent; a branch is not.
+      #
+      # v1.14.3 removes the affected emSign certificate trust chain;
+      # GHSA-5xjx-3w67-w9x9. The signed upstream tag resolves to this commit.
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3

{bindsight-0.3.5 → bindsight-0.3.7}/.gitignore

@@ -8,6 +8,11 @@ results/
 *.zip
 !tests/fixtures/**/*.parquet
 !tests/fixtures/**/*.tar.gz
+!benchmarks/numerical_validation/results/
+!benchmarks/numerical_validation/results/**/
+!benchmarks/numerical_validation/results/**/*.parquet
+!benchmarks/numerical_validation/diagnostics/dds_var.parquet
+!benchmarks/numerical_validation/diagnostics/results.parquet
 
 # Vendored data dependencies and local caches (not committed)
 data/surface_bind/
@@ -103,7 +108,7 @@ desktop.ini
 site/
 
 # LaTeX build intermediates. No compiled PDF is committed either: CI typesets
-# paper/biorxiv/manuscript.tex and attaches the PDF to every release.
+# paper/methods/manuscript.tex and attaches the PDF to every release.
 paper/**/*.aux
 paper/**/*.bbl
 paper/**/*.bcf
@@ -121,7 +126,9 @@ benchmarks/designer_benchmark/run/
 _bindsight_spec_*/
 
 # Compiled manuscripts are built at submission time, never committed
-paper/biorxiv/*.pdf
+paper/methods/*.pdf
+paper/validation/*.pdf
+paper/validation/pandoc.log
 
 # Designer-benchmark staging. A run writes here first so a failure cannot
 # overwrite the committed result; only the promoted artifacts are tracked.
@@ -131,3 +138,4 @@ benchmarks/designer_benchmark/run_t4/
 
 # Editor and agent tooling, not part of the project.
 .claude/
+.venv-bindsight/

{bindsight-0.3.5 → bindsight-0.3.7}/ARCHITECTURE.md

@@ -421,7 +421,7 @@ See [LICENSING.md](LICENSING.md) for the full inventory and commercial-use guida
 5. **SURFACE-Bind coverage gaps** — roughly 2,800 proteins against a shipped surfaceome of 4,801 (SURFY's 2,886 unioned with a UniProt cell-membrane extension). Extending the surfaceome widened this gap rather than closing it: more proteins are now reachable by expression than have a known targetable site. Mitigation: graceful drop tagged `no_surfacebind_entry`, which is recorded rather than silent. The fpocket fallback that would close it is not implemented.
 6. **Designer choice will age.** Mitigation: a plugin interface, with RFdiff+MPNN as the shipped default and BindCraft and BoltzGen wired behind flags. Only the first is executable: no shipped backend builds an environment the other two can run in, so the three-way benchmark is deferred, not delivered.
 7. **Disease specificity is hard, and the signal is weaker than this section used to claim.** "Up in cancer, low in vital tissue" does *not* predictably find known antigens. Measured against a pre-registered panel over fifteen unstratified TCGA projects, recall at rank 20 is 1 of 17 on approved-agent antigens (95% CI 0.01 to 0.27) and 0 of 8 over independent antigens. Twelve of seventeen are not over-expressed in a bulk tumour-versus-normal contrast: eleven fail the significance rule and a twelfth is measured as down-regulated. (This said "thirteen", which is the count across all twenty-two pairs, not across the seventeen approved-tier ones.) Their agents are licensed, so the antigens are real; the limit is in the signal, not the ranking. The earlier claim survived because the headline cohort was stratified by a PAM50 subtype call, and ERBB2 is one of the fifty genes that classifier is built from. Layering scRNA-seq, co-expression and immunopeptidomics is the plausible route to a stronger signal, and none of it is implemented.
-8. **Competing with VC-funded teams** (Tamarind, Chai, Generate). Mitigation: compete on transparency + reproducibility + provenance + academic integration. JOSS + bioRxiv + GitHub stars is a real moat for academic users.
+8. **Competing with VC-funded teams** (Tamarind, Chai, Generate). Mitigation: compete on transparency + reproducibility + provenance + academic integration. JOSS + a citable preprint + GitHub stars is a real moat for academic users.
 9. **PyDESeq2 ≠ DESeq2 numerically.** Documented in `bindsight/deg/pydeseq2_runner.py`. There is no R bridge: users who need exact DESeq2/edgeR numbers must run those tools themselves and feed the resulting DEG table in.
 10. **R-strong dev learning Python+Snakemake.** The DEG step is pure Python (pydeseq2); Snakemake's R rule support is unused.