clusteraudiencekit 7.3.1__tar.gz → 7.4.2__tar.gz

{clusteraudiencekit-7.3.1 → clusteraudiencekit-7.4.2}/.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     name: Rust Build & Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -36,9 +36,9 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -63,7 +63,7 @@ jobs:
     name: Cargo Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 

{clusteraudiencekit-7.3.1 → clusteraudiencekit-7.4.2}/.github/workflows/tests.yml

@@ -7,8 +7,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install

clusteraudiencekit-7.4.2/.github/workflows/wheels.yml

@@ -0,0 +1,86 @@
+name: Build & Test Wheels
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+    branches: [main]
+
+jobs:
+  build-wheels:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64
+          - os: macos-14
+            target: aarch64-apple-darwin
+          - os: macos-14
+            target: x86_64-apple-darwin
+          - os: windows-latest
+            target: x86_64
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Set up Rust
+        if: runner.os != 'macOS'
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Build wheels (macOS, via maturin-action for cross-compilation)
+        if: runner.os == 'macOS'
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist
+
+      - name: Build wheels (Linux/Windows, native)
+        if: runner.os != 'macOS'
+        run: |
+          pip install --upgrade pip
+          pip install maturin
+          maturin build --release --out dist
+
+      - name: Test wheel
+        # Skip on the cross-compiled Intel-from-ARM leg -- the wheel is
+        # built for a different CPU architecture than this runner.
+        if: matrix.target != 'x86_64-apple-darwin'
+        shell: bash
+        run: |
+          pip install dist/*.whl
+          pip install pytest scikit-learn
+          pytest tests/ -q
+
+      - name: Upload wheel artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.os }}-${{ matrix.target }}
+          path: dist/*.whl
+
+  publish:
+    name: Publish to PyPI
+    needs: build-wheels
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          pattern: wheels-*
+          merge-multiple: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

{clusteraudiencekit-7.3.1 → clusteraudiencekit-7.4.2}/.gitignore

@@ -62,3 +62,5 @@ target/
 *.log
 temp/
 tmp/
+
+graphify-out/

clusteraudiencekit-7.4.2/.graphifyignore

@@ -0,0 +1,31 @@
+# Graphify ignore file - https://docs.graphify.com/reference/configuration
+# Keep the scan (and therefore the agent's graph) focused on real source.
+.git/
+.github/
+graphify-out/
+
+# Build output / artifacts
+target/
+dist/
+build/
+*.egg-info/
+node_modules/
+.venv/
+venv/
+env/
+
+# Caches
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.tox/
+.nox/
+.coverage
+htmlcov/
+
+# Vendored / generated
+*.min.js
+*.min.css
+*.lock

clusteraudiencekit-7.4.2/AUDIT.md

@@ -0,0 +1,64 @@
+# Repository Audit — ClusterAudienceKit
+
+## Health
+
+**GREEN.** This repo arrived already in unusually good shape — three prior
+dedicated passes (OSS-standardization, quick-fix, and a "deep code-review"
+pass that found a real zero-actual-privacy differential-privacy bug) had
+already been merged to `origin/main`, 9 commits ahead of this audit's
+starting clone. This pass fast-forwarded onto that work first, then closed
+a real security gap (3 CVEs via a forced pyo3 major-version bump) and
+verified the external-facing marketing claims against the codebase's own
+source of truth.
+
+## Before Audit (this pass's baseline, after fast-forward to `51cffd2`)
+
+Open debt: 9
+Critical: 0 · High: 1 · Medium: 7 (6 immediately fixable, 1 deep-transitive) · Low: 2
+
+## After Audit
+
+Open debt: 3
+Critical: 0 · High: 0 · Medium: 2 (TD-0006 transitive deps, TD-0007 external description) · Low: 1 (TD-0008 benchmark marker)
+
+## Items Fixed
+
+1. **TD-0001** — 3 real `cargo-audit` CVEs closed: pyo3 buffer-overflow (RUSTSEC-2025-0020), pyo3 missing-`Sync`-bound (RUSTSEC-2026-0177), crossbeam-epoch invalid-pointer-deref (RUSTSEC-2026-0204). Required bumping pyo3 0.22→0.29 and numpy 0.22→0.29.
+2. **TD-0002** — 2 real compile breaks from the pyo3 bump (`PyModule::new_bound`→`new`, `pyo3::PyObject`→`pyo3::Py<PyAny>`).
+3. **TD-0003** — 7 pyo3 0.29 `FromPyObject`-on-`Clone` deprecation warnings, resolved individually per-type (not a blanket fix) based on verified actual usage: 6 types opted into `#[pyclass(from_py_object)]` because they're genuinely extracted from Python arguments; 1 type (`PyFeatureDrift`, construct/return-only) opted out with `#[pyclass(skip_from_py_object)]`.
+4. **TD-0004** — Fixed a real naming bug in the crate's own public API: `ClusterClusterAudienceKitError` → `ClusterAudienceKitError`, mechanically across 18 files and 60+ call sites.
+5. **TD-0005** — Removed a dead `bincode` dependency (zero actual call sites anywhere in the repo) and its dead error-enum variant, closing an "unmaintained crate" `cargo-audit` warning as a side effect.
+
+## Items Remaining
+
+- **TD-0006** (P2) — 2 residual `cargo-audit` *warnings* (not vulnerabilities): `paste` (unmaintained, transitive via `parquet`) and `anyhow` (unsound, transitive via a non-default-target wasm-tooling chain). Neither is a direct dependency; no safe one-line fix exists.
+- **TD-0007** (P2) — The GitHub repo's short description overstates clustering-algorithm count ("6 clustering algorithms" vs. the project's own `info.algorithms` list of `["kmeans", "kprototypes"]`) and makes an unbenchmarked "1M+ customers in <1s" claim. Documented with exact evidence for the subsequent README/positioning pass; not corrected in this pass per the audit's own sequencing rule (fix the software first, document reality after).
+- **TD-0008** (P3) — Unregistered `pytest.mark.benchmark` produces a harmless warning on every test run.
+
+## Future Phase Work
+
+Already comprehensively tracked in the repo's own `docs/ROADMAP_HONEST.md` (5 large Rust-only modules awaiting Python bindings, full K-Prototypes categorical support, gradient-boosting integration) — not duplicated here.
+
+## CI Status
+
+Both workflows (`ci.yml`, `tests.yml`) pass `actionlint` clean. `ruff check .` re-verified clean and genuinely enforced (a prior pass fixed it from silently discarding findings).
+
+## Test Status
+
+Rust: 439/439 passing (re-verified at every step of the pyo3 bump — before, immediately after the compile fixes, and after the final version bump). Python: 227 passed, 2 skipped, re-verified against a freshly `maturin develop`-built extension after all Rust changes, confirming zero behavioral drift from the pyo3/numpy major-version bump.
+
+## Build Status
+
+`cargo build --release`, `cargo test --release --no-default-features --lib`, `cargo clippy --workspace --all-targets` (30 warnings, all pre-existing and confirmed unreachable from the Python API — zero new warnings introduced), `cargo fmt --all -- --check`, and `maturin develop --release` all verified clean at the final commit.
+
+## Security Status
+
+`cargo audit`: 0 vulnerabilities (down from 3), 2 unmaintained/unsound warnings remaining on transitive-only dependencies (documented, not force-fixable).
+
+## Dependency Status
+
+pyo3/numpy bumped to current major versions (0.29) with zero downstream behavioral breakage beyond the 2 expected compile-time API changes. `crossbeam-epoch` patched via `cargo update --precise`. `bincode` removed entirely (was dead weight).
+
+## Final Assessment
+
+This repo's own prior audit passes had already done most of the honesty and bug-fixing work; this pass's genuine contribution is closing a real security gap that required a disruptive major-version dependency bump (not a quick pin) across pyo3/numpy, verified with zero behavioral regression across both the Rust and Python test suites, plus fixing two smaller but real bugs (a dead dependency, a public-API naming typo) this project's own prior passes hadn't caught. The one new finding worth flagging loudly: the GitHub repo's external-facing description makes claims ("6 clustering algorithms", "1M+ customers in <1s") that the project's own internal honesty documentation doesn't support — evidence is captured in `TECHNICAL_DEBT.md` TD-0007 for whoever runs the README/positioning pass next. Version bumped to 7.3.2 for this release; PyPI publish intentionally left to the coordinator to handle directly.

{clusteraudiencekit-7.3.1 → clusteraudiencekit-7.4.2}/CHANGELOG.md

@@ -2,7 +2,88 @@
 
 All notable changes to ClusterAudienceKit are documented here.
 
-## [Unreleased]
+## [7.4.2] - 2026-10-17
+
+### Fixed
+- Audit remediation: security hardening, correctness fixes, and lint/CI gates.
+
+## [7.4.1] - 2026-10-12
+
+### Security
+- **SQL-injection vector through `PyCondition` field names**: the Python
+  `PyCondition(field, operator, value)` constructor interpolated `field`
+  verbatim into the SQL produced by `Condition::to_sql` (reached via
+  `PyBehavioralSegment::export_sql`), with no validation anywhere on that
+  path, so e.g. `PyCondition("x; DROP TABLE t; --", ">", 1.0)` emitted the
+  payload straight into generated SQL. `field` is now passed through the
+  existing `validate_identifier` guard (the same check already enforced in
+  `sql_export.rs`), raising `ValueError` for anything that is not a plain
+  identifier. New regression test `test_condition_field_rejects_sql_injection`.
+- **`engine::privacy::DifferentialPrivacy::laplace_noise`/`gaussian_noise`
+  did not sample any actual randomness**, so `add_laplace_noise`/
+  `add_gaussian_noise` (the Python-exposed differential-privacy API)
+  provided **zero real privacy protection** despite being documented as a
+  real, shipped feature. `laplace_noise` hardcoded `u = 0.5` in place of a
+  uniform(0,1) draw, which — because 0.5 sits exactly on the function's
+  branch boundary — made the noise term evaluate to exactly `0.0` on every
+  call (data returned completely unmodified). `gaussian_noise` hardcoded
+  `sigma * 0.5`, a fixed deterministic shift with no randomness. Both now
+  draw real randomness via `rand::thread_rng()` (inverse-CDF sampling for
+  Laplace; Box-Muller transform for Gaussian). Verified via the real PyO3
+  binding: repeated calls with identical arguments now produce different
+  output instead of byte-identical/constant output. New regression tests
+  `test_laplace_noise_is_actually_random`/
+  `test_gaussian_noise_is_actually_random` assert nonzero variance across
+  repeated calls; both fail against the pre-fix code. See
+  `docs/ROADMAP_HONEST.md`'s "Deep code-review pass (2026-09-27)" for full
+  detail.
+
+### Fixed
+- `engine::lookalike::LookalikeGenerator::generate_lookalike`'s percentile
+  threshold was computed from an unsorted copy of the similarity scores
+  (`let sorted: Vec<f64> = similarities.to_vec();` — no `.sort()` call
+  despite the name), so the "top N%" cutoff silently depended on the
+  candidate list's input order rather than the actual similarity
+  distribution. The same 100 candidates fed in a different order produced
+  10 vs. 91 lookalikes for an identical "top 10%" request. Fixed by
+  actually sorting descending before indexing. New regression test
+  `test_percentile_filtering_is_order_independent` (fails against the
+  pre-fix code with `left: 10, right: 91`).
+- `engine::drift_detection::DriftDetector::detect_feature_drift`'s
+  `DriftMethod::ChiSquare` arm was a hardcoded `0.0` (comment claimed "Use
+  KS as proxy" but never called anything), so any caller of
+  `detect_feature_drift(..., method="chi_square")` — a real,
+  user-selectable, documented option (`parse_drift_method` in
+  `src/python.rs` accepts `"chi_square"`/`"chi2"`) — silently got
+  `drift_score: 0.0`/`severity: "none"` regardless of actual drift: a total
+  false negative. Verified via the real PyO3 binding: a 100x-shifted
+  distribution scored 1.0/critical under `"ks"` but 0.0/none under
+  `"chi_square"` before the fix. Fixed by actually proxying to
+  `kolmogorov_smirnov` (matching the pre-existing `KullbackLeibler` ->
+  `hellinger_distance` proxy pattern one line above) — same score/severity
+  as KS now. New regression test
+  `test_chi_square_drift_method_is_not_a_hardcoded_zero` (fails against the
+  pre-fix code). The separate, correctly-implemented standalone
+  `chi_square()`/`chi_square_drift` (categorical drift) were never affected.
+  See `docs/ROADMAP_HONEST.md` for why a real continuous-data chi-square
+  statistic is a follow-up, not done in this pass.
+- `engine::profiling::ProfilingEngine::profile_segment` returned three
+  hardcoded values — `separation: 0.5`, `health_score: size.min(100)`, and
+  `purity: 0.85` — despite its doc comment promising a real
+  stability/cohesion/separation health score. `separation` is now computed
+  against the complement (all non-member rows) per feature, `health_score` is
+  a bounded combination of the real stability/cohesion/separation
+  components, and `purity` is the true clustering purity when ground-truth
+  `labels` are passed (new optional argument) or a documented label-free
+  homogeneity proxy otherwise. Regression tests assert a well-separated
+  segment scores >0.9 separation, a full-coverage segment scores exactly
+  `0.0`, and the label purity case equals `0.75`.
+- `engine::quality_metrics::StabilityAnalysis::adjusted_rand_index` was not
+  the Adjusted Rand Index at all — it returned `(RandIndex * 2.0 - 1.0)`,
+  which mis-scores even trivial inputs (e.g. `0.0` instead of `-0.5` for the
+  textbook two-pairings-of-four case). Replaced with the standard
+  contingency-table ARI; new tests cover the identical (`1.0`), hand-computed
+  `-0.5`, and partial-agreement cases.
 
 ## [7.3.1] - 2026-09-22