dataeval-flow 0.1.0__tar.gz → 0.1.1__tar.gz

{dataeval_flow-0.1.0 → dataeval_flow-0.1.1}/.gitignore

@@ -15,6 +15,9 @@ __pycache__/
 *.egg-info/
 dist/
 build/
+# hatch-vcs writes the runtime version file at build/install time;
+# source of truth is git tags. Do not commit.
+src/dataeval_flow/_version.py
 
 # Cache
 .pytest_cache/

{dataeval_flow-0.1.0 → dataeval_flow-0.1.1}/PKG-INFO

@@ -1,13 +1,12 @@
 Metadata-Version: 2.4
 Name: dataeval-flow
-Version: 0.1.0
+Version: 0.1.1
 Summary: DataEval Workflows container for data evaluation
 Project-URL: Repository, https://gitlab.jatic.net/jatic/aria/dataeval-flow
 License-Expression: MIT
 License-File: LICENSE
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Science/Research
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
@@ -15,51 +14,42 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Scientific/Engineering
 Classifier: Typing :: Typed
-Requires-Python: <3.14,>=3.10
-Requires-Dist: dataeval==1.0.4
+Requires-Python: >=3.10
+Requires-Dist: dataeval==1.0.6
 Requires-Dist: datasets>=4.0.0
 Requires-Dist: maite-datasets>=0.0.12
+Requires-Dist: numpy>=1.24.2
 Requires-Dist: pydantic>=2.0
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: all-cpu
 Requires-Dist: onnx>=1.15; extra == 'all-cpu'
 Requires-Dist: onnxruntime>=1.20; extra == 'all-cpu'
 Requires-Dist: opencv-python-headless>=4.8.0; extra == 'all-cpu'
-Requires-Dist: textual>=3.0; extra == 'all-cpu'
+Requires-Dist: textual>=3.0; (python_version < '3.14') and extra == 'all-cpu'
 Requires-Dist: torch>=2.2.0; extra == 'all-cpu'
 Requires-Dist: torchvision>=0.17.0; extra == 'all-cpu'
 Provides-Extra: all-cu118
 Requires-Dist: onnx>=1.15; extra == 'all-cu118'
 Requires-Dist: onnxruntime-gpu>=1.20; extra == 'all-cu118'
 Requires-Dist: opencv-python-headless>=4.8.0; extra == 'all-cu118'
-Requires-Dist: textual>=3.0; extra == 'all-cu118'
+Requires-Dist: textual>=3.0; (python_version < '3.14') and extra == 'all-cu118'
 Requires-Dist: torch>=2.2.0; extra == 'all-cu118'
 Requires-Dist: torchvision>=0.17.0; extra == 'all-cu118'
-Provides-Extra: all-cu124
-Requires-Dist: onnx>=1.15; extra == 'all-cu124'
-Requires-Dist: onnxruntime-gpu>=1.20; extra == 'all-cu124'
-Requires-Dist: opencv-python-headless>=4.8.0; extra == 'all-cu124'
-Requires-Dist: textual>=3.0; extra == 'all-cu124'
-Requires-Dist: torch>=2.2.0; extra == 'all-cu124'
-Requires-Dist: torchvision>=0.17.0; extra == 'all-cu124'
 Provides-Extra: all-cu128
 Requires-Dist: onnx>=1.15; extra == 'all-cu128'
 Requires-Dist: onnxruntime-gpu>=1.23.2; extra == 'all-cu128'
 Requires-Dist: opencv-python-headless>=4.8.0; extra == 'all-cu128'
-Requires-Dist: textual>=3.0; extra == 'all-cu128'
+Requires-Dist: textual>=3.0; (python_version < '3.14') and extra == 'all-cu128'
 Requires-Dist: torch>=2.2.0; extra == 'all-cu128'
 Requires-Dist: torchvision>=0.17.0; extra == 'all-cu128'
 Provides-Extra: app
-Requires-Dist: textual>=3.0; extra == 'app'
+Requires-Dist: textual>=3.0; (python_version < '3.14') and extra == 'app'
 Provides-Extra: cpu
 Requires-Dist: torch>=2.2.0; extra == 'cpu'
 Requires-Dist: torchvision>=0.17.0; extra == 'cpu'
 Provides-Extra: cu118
 Requires-Dist: torch>=2.2.0; extra == 'cu118'
 Requires-Dist: torchvision>=0.17.0; extra == 'cu118'
-Provides-Extra: cu124
-Requires-Dist: torch>=2.2.0; extra == 'cu124'
-Requires-Dist: torchvision>=0.17.0; extra == 'cu124'
 Provides-Extra: cu128
 Requires-Dist: torch>=2.2.0; extra == 'cu128'
 Requires-Dist: torchvision>=0.17.0; extra == 'cu128'
@@ -77,6 +67,19 @@ Description-Content-Type: text/markdown
 
 Workflow orchestration for DataEval with GPU support.
 
+## Target Audience
+
+<!-- start JATIC interop -->
+
+DataEval Flow is intended for data scientists, ML engineers, and T&E engineers
+who want to run automated data-evaluation pipelines — outlier and duplicate
+detection, drift and OOD monitoring, dataset splitting, prioritization, and
+statistical analysis — against their image datasets and models. For users of
+the JATIC product suite, DataEval Flow has native interoperability when using
+MAITE-compliant datasets and models.
+
+<!-- end JATIC interop -->
+
 ## Quick Start
 
 ```bash
@@ -93,6 +96,32 @@ docker run --gpus all \
   dataeval:cu118
 ```
 
+## Pulling pre-built images
+
+Pre-built, cosign-signed images are published to Harbor for every merge to `main` and every release tag. Pull one of these instead of building from source if you don't need to modify the code.
+
+**Rolling channel** — tracks the latest commit on `main`. The tag is overwritten on every merge.
+
+```bash
+docker pull harbor.jatic.net/aria/dataeval:cu118   # cpu / cu118 / cu128
+```
+
+**Pinned release channel** — immutable, version-tagged images cut from `v*` git tags. Use these for reproducible workloads.
+
+```bash
+docker pull harbor.jatic.net/aria/dataeval:0.1.0-cu118
+```
+
+**Verifying the signature** — every published image is signed with [cosign](https://docs.sigstore.dev/cosign/). The public key is committed at [docker/cosign.pub](docker/cosign.pub).
+
+```bash
+cosign verify --key docker/cosign.pub harbor.jatic.net/aria/dataeval:cu118
+```
+
+Then drop the `dataeval:cu118` reference in the Quick Start `docker run` commands above with the fully-qualified `harbor.jatic.net/aria/dataeval:cu118` (or pinned version) and skip step 1.
+
+> **Note on feature branches.** Containers are only built and published from `main` and release tags — no image is produced for MRs or topic branches. If you want to run a feature branch as a container, check it out and follow the Quick Start to build locally; the resulting image will pick up the branch's version via `git describe`.
+
 ## Requirements
 
 | Requirement | Version |
@@ -253,7 +282,7 @@ Configs can be saved as YAML or JSON.
 
 The Docker build may appear frozen during the `uv sync` step:
 
-```
+```text
 => [builder 7/7] RUN uv sync --frozen --no-dev --no-install-project    1139.3s
 ```
 
@@ -272,19 +301,68 @@ The Docker build may appear frozen during the `uv sync` step:
 The `dataeval_flow` package can be used standalone without Docker.
 
 **Installation:**
+
+Three installer toolchains are supported. Choose whichever fits your environment;
+all three install the same dependencies pinned in their respective lockfiles.
+
+`uv` (default toolchain):
+
 ```bash
 git clone https://gitlab.jatic.net/jatic/aria/dataeval-flow.git
 cd dataeval-flow
-uv sync
+uv sync --extra cpu      # or cu118 / cu128 for CUDA variants
 ```
 
+`pip` from PyPI (no source checkout). PyTorch is hosted on a separate
+wheel index, so pass `--extra-index-url` matching the variant you want
+(omit it and you'll get the CUDA-bundled manylinux build of torch from
+PyPI, which is much larger):
+
+```bash
+# CPU-only PyTorch
+pip install "dataeval-flow[cpu]" --extra-index-url https://download.pytorch.org/whl/cpu
+
+# CUDA 11.8 PyTorch
+pip install "dataeval-flow[cu118]" --extra-index-url https://download.pytorch.org/whl/cu118
+
+# CUDA 12.8 PyTorch
+pip install "dataeval-flow[cu128]" --extra-index-url https://download.pytorch.org/whl/cu128
+```
+
+`poetry` (source checkout; uses committed `poetry.lock`):
+
+```bash
+git clone https://gitlab.jatic.net/jatic/aria/dataeval-flow.git
+cd dataeval-flow
+poetry install
+```
+
+`conda` / `mamba` (source checkout; uses committed `environment.yml`):
+
+```bash
+git clone https://gitlab.jatic.net/jatic/aria/dataeval-flow.git
+cd dataeval-flow
+conda env create -f environment.yml
+conda activate dataeval-flow
+pip install -e .         # install the package itself; conda manages deps
+```
+
+Notes:
+
+- PyTorch is installed from PyPI/`download.pytorch.org` in every path
+  (it is no longer maintained on conda-forge).
+- GPU variants (`cu118`, `cu128`) are only wired through `uv` and
+  `pip` today; the Poetry/conda paths install the CPU build of PyTorch.
+
 **CLI Usage:**
+
 ```bash
 python -m dataeval_flow --config /path/to/config --output /path/to/output
 python -m dataeval_flow --data /path/to/data --output /path/to/output
 ```
 
 **Python API Usage:**
+
 ```python
 from pathlib import Path
 from dataeval_flow import load_config, run_tasks
@@ -295,11 +373,51 @@ print(results[0].report())
 ```
 
 **Development:**
+
 ```bash
 uv sync --group dev
 nox
 ```
 
+## Versioning
+
+The package version is **derived from git tags** — there is no hardcoded version anywhere in the source tree. `hatch-vcs` reads `git describe --tags` at build/install time and writes the resolved version to a generated `src/dataeval_flow/_version.py` (gitignored), which `dataeval_flow.__init__` imports at runtime.
+
+**Release flow for container images:**
+
+1. Push a semver tag (e.g. `v0.2.0`) — this is the single source of truth for the release version.
+2. The `push:docker` CI job runs `git describe --tags --always --dirty | sed 's/^v//'` to resolve `${VERSION}`, then passes `--build-arg DATAEVAL_FLOW_VERSION="${VERSION}"` to `docker buildx build` for both the `test` and `prod` stages.
+3. The `prod` stage in [docker/Dockerfile.j2](docker/Dockerfile.j2) redeclares the ARG and:
+   - Bakes the resolved version into `/app/src/dataeval_flow/_version.py` so `dataeval_flow.__version__` matches the wheel version at runtime.
+   - Stamps the OCI `org.opencontainers.image.version` label with the same value.
+4. The image is pushed to Harbor and cosign-signed.
+
+The `ARG DATAEVAL_FLOW_VERSION="…"` default rendered into each committed `docker/Dockerfile.<variant>` by `docker/generate.py` is only used for **local** `docker build` invocations that don't pass `--build-arg`. Release builds always override it, so the committed default is allowed to drift from the latest tag and does not need to be regenerated at release time.
+
 ## License
 
-MIT
+MIT — see [LICENSE](LICENSE).
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for bug reports and contribution
+guidelines, and [BRANCHING.md](BRANCHING.md) for the branching and release
+strategy.
+
+## Contact
+
+For questions or feedback, reach out to <dataeval-flow@ariacoustics.com>.
+
+## Acknowledgement
+
+### CDAO Funding Acknowledgement
+
+<!-- start acknowledgement -->
+
+This material is based upon work supported by the Chief Digital and Artificial
+Intelligence Office under Contract No. W519TC-23-9-2033. The views and
+conclusions contained herein are those of the author(s) and should not be
+interpreted as necessarily representing the official policies or endorsements,
+either expressed or implied, of the U.S. Government.
+
+<!-- end acknowledgement -->

{dataeval_flow-0.1.0 → dataeval_flow-0.1.1}/README.md

@@ -2,6 +2,19 @@
 
 Workflow orchestration for DataEval with GPU support.
 
+## Target Audience
+
+<!-- start JATIC interop -->
+
+DataEval Flow is intended for data scientists, ML engineers, and T&E engineers
+who want to run automated data-evaluation pipelines — outlier and duplicate
+detection, drift and OOD monitoring, dataset splitting, prioritization, and
+statistical analysis — against their image datasets and models. For users of
+the JATIC product suite, DataEval Flow has native interoperability when using
+MAITE-compliant datasets and models.
+
+<!-- end JATIC interop -->
+
 ## Quick Start
 
 ```bash
@@ -18,6 +31,32 @@ docker run --gpus all \
   dataeval:cu118
 ```
 
+## Pulling pre-built images
+
+Pre-built, cosign-signed images are published to Harbor for every merge to `main` and every release tag. Pull one of these instead of building from source if you don't need to modify the code.
+
+**Rolling channel** — tracks the latest commit on `main`. The tag is overwritten on every merge.
+
+```bash
+docker pull harbor.jatic.net/aria/dataeval:cu118   # cpu / cu118 / cu128
+```
+
+**Pinned release channel** — immutable, version-tagged images cut from `v*` git tags. Use these for reproducible workloads.
+
+```bash
+docker pull harbor.jatic.net/aria/dataeval:0.1.0-cu118
+```
+
+**Verifying the signature** — every published image is signed with [cosign](https://docs.sigstore.dev/cosign/). The public key is committed at [docker/cosign.pub](docker/cosign.pub).
+
+```bash
+cosign verify --key docker/cosign.pub harbor.jatic.net/aria/dataeval:cu118
+```
+
+Then drop the `dataeval:cu118` reference in the Quick Start `docker run` commands above with the fully-qualified `harbor.jatic.net/aria/dataeval:cu118` (or pinned version) and skip step 1.
+
+> **Note on feature branches.** Containers are only built and published from `main` and release tags — no image is produced for MRs or topic branches. If you want to run a feature branch as a container, check it out and follow the Quick Start to build locally; the resulting image will pick up the branch's version via `git describe`.
+
 ## Requirements
 
 | Requirement | Version |
@@ -178,7 +217,7 @@ Configs can be saved as YAML or JSON.
 
 The Docker build may appear frozen during the `uv sync` step:
 
-```
+```text
 => [builder 7/7] RUN uv sync --frozen --no-dev --no-install-project    1139.3s
 ```
 
@@ -197,19 +236,68 @@ The Docker build may appear frozen during the `uv sync` step:
 The `dataeval_flow` package can be used standalone without Docker.
 
 **Installation:**
+
+Three installer toolchains are supported. Choose whichever fits your environment;
+all three install the same dependencies pinned in their respective lockfiles.
+
+`uv` (default toolchain):
+
 ```bash
 git clone https://gitlab.jatic.net/jatic/aria/dataeval-flow.git
 cd dataeval-flow
-uv sync
+uv sync --extra cpu      # or cu118 / cu128 for CUDA variants
 ```
 
+`pip` from PyPI (no source checkout). PyTorch is hosted on a separate
+wheel index, so pass `--extra-index-url` matching the variant you want
+(omit it and you'll get the CUDA-bundled manylinux build of torch from
+PyPI, which is much larger):
+
+```bash
+# CPU-only PyTorch
+pip install "dataeval-flow[cpu]" --extra-index-url https://download.pytorch.org/whl/cpu
+
+# CUDA 11.8 PyTorch
+pip install "dataeval-flow[cu118]" --extra-index-url https://download.pytorch.org/whl/cu118
+
+# CUDA 12.8 PyTorch
+pip install "dataeval-flow[cu128]" --extra-index-url https://download.pytorch.org/whl/cu128
+```
+
+`poetry` (source checkout; uses committed `poetry.lock`):
+
+```bash
+git clone https://gitlab.jatic.net/jatic/aria/dataeval-flow.git
+cd dataeval-flow
+poetry install
+```
+
+`conda` / `mamba` (source checkout; uses committed `environment.yml`):
+
+```bash
+git clone https://gitlab.jatic.net/jatic/aria/dataeval-flow.git
+cd dataeval-flow
+conda env create -f environment.yml
+conda activate dataeval-flow
+pip install -e .         # install the package itself; conda manages deps
+```
+
+Notes:
+
+- PyTorch is installed from PyPI/`download.pytorch.org` in every path
+  (it is no longer maintained on conda-forge).
+- GPU variants (`cu118`, `cu128`) are only wired through `uv` and
+  `pip` today; the Poetry/conda paths install the CPU build of PyTorch.
+
 **CLI Usage:**
+
 ```bash
 python -m dataeval_flow --config /path/to/config --output /path/to/output
 python -m dataeval_flow --data /path/to/data --output /path/to/output
 ```
 
 **Python API Usage:**
+
 ```python
 from pathlib import Path
 from dataeval_flow import load_config, run_tasks
@@ -220,11 +308,51 @@ print(results[0].report())
 ```
 
 **Development:**
+
 ```bash
 uv sync --group dev
 nox
 ```
 
+## Versioning
+
+The package version is **derived from git tags** — there is no hardcoded version anywhere in the source tree. `hatch-vcs` reads `git describe --tags` at build/install time and writes the resolved version to a generated `src/dataeval_flow/_version.py` (gitignored), which `dataeval_flow.__init__` imports at runtime.
+
+**Release flow for container images:**
+
+1. Push a semver tag (e.g. `v0.2.0`) — this is the single source of truth for the release version.
+2. The `push:docker` CI job runs `git describe --tags --always --dirty | sed 's/^v//'` to resolve `${VERSION}`, then passes `--build-arg DATAEVAL_FLOW_VERSION="${VERSION}"` to `docker buildx build` for both the `test` and `prod` stages.
+3. The `prod` stage in [docker/Dockerfile.j2](docker/Dockerfile.j2) redeclares the ARG and:
+   - Bakes the resolved version into `/app/src/dataeval_flow/_version.py` so `dataeval_flow.__version__` matches the wheel version at runtime.
+   - Stamps the OCI `org.opencontainers.image.version` label with the same value.
+4. The image is pushed to Harbor and cosign-signed.
+
+The `ARG DATAEVAL_FLOW_VERSION="…"` default rendered into each committed `docker/Dockerfile.<variant>` by `docker/generate.py` is only used for **local** `docker build` invocations that don't pass `--build-arg`. Release builds always override it, so the committed default is allowed to drift from the latest tag and does not need to be regenerated at release time.
+
 ## License
 
-MIT
+MIT — see [LICENSE](LICENSE).
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for bug reports and contribution
+guidelines, and [BRANCHING.md](BRANCHING.md) for the branching and release
+strategy.
+
+## Contact
+
+For questions or feedback, reach out to <dataeval-flow@ariacoustics.com>.
+
+## Acknowledgement
+
+### CDAO Funding Acknowledgement
+
+<!-- start acknowledgement -->
+
+This material is based upon work supported by the Chief Digital and Artificial
+Intelligence Office under Contract No. W519TC-23-9-2033. The views and
+conclusions contained herein are those of the author(s) and should not be
+interpreted as necessarily representing the official policies or endorsements,
+either expressed or implied, of the U.S. Government.
+
+<!-- end acknowledgement -->

{dataeval_flow-0.1.0 → dataeval_flow-0.1.1}/pyproject.toml

@@ -1,14 +1,13 @@
 [project]
 name = "dataeval-flow"
-version = "0.1.0"
+dynamic = ["version"]
 description = "DataEval Workflows container for data evaluation"
 readme = "README.md"
 license = "MIT"
-requires-python = ">=3.10,<3.14"
+requires-python = ">=3.10"
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Science/Research",
-    "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
@@ -18,9 +17,10 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "dataeval==1.0.4",
+    "dataeval==1.0.6",
     "datasets>=4.0.0",
     "maite-datasets>=0.0.12",
+    "numpy>=1.24.2",
     "pydantic>=2.0",
     "pyyaml>=6.0",
 ]
@@ -28,17 +28,15 @@ dependencies = [
 [project.optional-dependencies]
 cpu = ["torch>=2.2.0", "torchvision>=0.17.0"]
 cu118 = ["torch>=2.2.0", "torchvision>=0.17.0"]
-cu124 = ["torch>=2.2.0", "torchvision>=0.17.0"]
 cu128 = ["torch>=2.2.0", "torchvision>=0.17.0"]
 onnx = ["onnx>=1.15", "onnxruntime>=1.20"]
 onnx-gpu = ["onnx>=1.15", "onnxruntime-gpu>=1.20"]
 opencv = ["opencv-python-headless>=4.8.0"]
-app = ["textual>=3.0"]
+app = ["textual>=3.0; python_version < '3.14'"]
 # Convenience extras for common combinations
-all-cpu = ["torch>=2.2.0", "torchvision>=0.17.0", "onnx>=1.15", "onnxruntime>=1.20", "opencv-python-headless>=4.8.0", "textual>=3.0"]
-all-cu118 = ["torch>=2.2.0", "torchvision>=0.17.0", "onnx>=1.15", "onnxruntime-gpu>=1.20", "opencv-python-headless>=4.8.0", "textual>=3.0"]
-all-cu124 = ["torch>=2.2.0", "torchvision>=0.17.0", "onnx>=1.15", "onnxruntime-gpu>=1.20", "opencv-python-headless>=4.8.0", "textual>=3.0"]
-all-cu128 = ["torch>=2.2.0", "torchvision>=0.17.0", "onnx>=1.15", "onnxruntime-gpu>=1.23.2", "opencv-python-headless>=4.8.0", "textual>=3.0"]
+all-cpu = ["torch>=2.2.0", "torchvision>=0.17.0", "onnx>=1.15", "onnxruntime>=1.20", "opencv-python-headless>=4.8.0", "textual>=3.0; python_version < '3.14'"]
+all-cu118 = ["torch>=2.2.0", "torchvision>=0.17.0", "onnx>=1.15", "onnxruntime-gpu>=1.20", "opencv-python-headless>=4.8.0", "textual>=3.0; python_version < '3.14'"]
+all-cu128 = ["torch>=2.2.0", "torchvision>=0.17.0", "onnx>=1.15", "onnxruntime-gpu>=1.23.2", "opencv-python-headless>=4.8.0", "textual>=3.0; python_version < '3.14'"]
 
 [project.urls]
 Repository = "https://gitlab.jatic.net/jatic/aria/dataeval-flow"
@@ -52,6 +50,11 @@ base = [
     "nox-uv>=0.6.2",
     "uv>=0.8.0",
 ]
+lock = [
+    { include-group = "base" },
+    "pyproject2conda>=0.22",
+    "poetry>=2.2.0; python_version<'3.14'",
+]
 lint = [
     { include-group = "base" },
     "ruff>=0.11",
@@ -65,6 +68,12 @@ test = [
     "pytest-xdist>=3.6.1",
     "coverage[toml]>=7.6",
 ]
+verify = [
+    { include-group = "base" },
+    "pytest>=8.3",
+    "pytest-asyncio>=0.24",
+    "pyyaml>=6.0",
+]
 type = [
     { include-group = "base" },
     "pyright[nodejs]>=1.1.400",
@@ -88,6 +97,12 @@ docker = [
     "jinja2>=3.1",
     "pyyaml>=6.0",
 ]
+security = [  # keep in sync with [tool.uv.constraint-dependencies]
+    "pillow>=12.2.0",
+    # "setuptools>=82.0.0",  excluded due to conflict with pytorch
+    "onnx>=1.21.0",
+    "urllib3>=2.7.0"
+]
 dev = [
     { include-group = "lint" },
     { include-group = "type" },
@@ -97,21 +112,19 @@ dev = [
 [tool.uv]
 # Pin minimum versions for transitive deps with known CVEs
 constraint-dependencies = [
-    "pillow>=12.1.1",          # CVE-2026-25990: OOB write via PSD image
-    "setuptools>=82.0.0",      # CVE-2026-23949: (jaraco_context) path traversal in tarball()
-                               # CVE-2026-24049: (wheel) privilege escalation via unpack
-    "onnx>=1.20.1",            # CVE-2026-28500: Untrusted Repository Warnings Suppressed by silent=True
+    "pillow>=12.2.0",
+    "setuptools>=82.0.0",
+    "onnx>=1.21.0",
+    "urllib3>=2.7.0"
 ]
 
 conflicts = [
   [
     { extra = "cpu" },
     { extra = "cu118" },
-    { extra = "cu124" },
     { extra = "cu128" },
     { extra = "all-cpu" },
     { extra = "all-cu118" },
-    { extra = "all-cu124" },
     { extra = "all-cu128" },
   ],
   [
@@ -119,7 +132,6 @@ conflicts = [
     { extra = "onnx-gpu" },
     { extra = "all-cpu" },
     { extra = "all-cu118" },
-    { extra = "all-cu124" },
     { extra = "all-cu128" },
   ]
 ]
@@ -134,11 +146,6 @@ name = "pytorch-cu118"
 url = "https://download.pytorch.org/whl/cu118"
 explicit = true
 
-[[tool.uv.index]]
-name = "pytorch-cu124"
-url = "https://download.pytorch.org/whl/cu124"
-explicit = true
-
 [[tool.uv.index]]
 name = "pytorch-cu128"
 url = "https://download.pytorch.org/whl/cu128"
@@ -150,8 +157,6 @@ torch = [
   { index = "pytorch-cpu", extra = "all-cpu" },
   { index = "pytorch-cu118", extra = "cu118" },
   { index = "pytorch-cu118", extra = "all-cu118" },
-  { index = "pytorch-cu124", extra = "cu124" },
-  { index = "pytorch-cu124", extra = "all-cu124" },
   { index = "pytorch-cu128", extra = "cu128" },
   { index = "pytorch-cu128", extra = "all-cu128" },
 ]
@@ -160,18 +165,40 @@ torchvision = [
   { index = "pytorch-cpu", extra = "all-cpu" },
   { index = "pytorch-cu118", extra = "cu118" },
   { index = "pytorch-cu118", extra = "all-cu118" },
-  { index = "pytorch-cu124", extra = "cu124" },
-  { index = "pytorch-cu124", extra = "all-cu124" },
   { index = "pytorch-cu128", extra = "cu128" },
   { index = "pytorch-cu128", extra = "all-cu128" },
 ]
 
+[tool.poetry]
+version = "0.0.0"
+
+[[tool.poetry.source]]
+name = "pytorch-cpu"
+url = "https://download.pytorch.org/whl/cpu"
+# `supplemental` (not `explicit`) is required so the `torch`/`torchvision`
+# source override below applies to transitive requests too.
+priority = "supplemental"
+
+[tool.poetry.dependencies]
+torch = { version = ">=2.2.0", source = "pytorch-cpu", optional = true }
+torchvision = { version = ">=0.17.0", source = "pytorch-cpu", optional = true }
+
+[tool.pyproject2conda.dependencies]
+# `dataeval` is available on conda-forge. `maite-datasets` is PyPI-only.
+maite-datasets = { pip = true }
+
 # --- Build System ---
 
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling", "hatch-vcs"]
 build-backend = "hatchling.build"
 
+[tool.hatch.version]
+source = "vcs"
+
+[tool.hatch.build.hooks.vcs]
+version-file = "src/dataeval_flow/_version.py"
+
 [tool.hatch.build.targets.sdist]
 include = ["src/dataeval_flow"]
 
@@ -184,6 +211,8 @@ include = ["src/dataeval_flow"]
 # --- Pytest ---
 
 [tool.pytest.ini_options]
+# Only unit tests run here (and under the coverage gate). The requirements
+# verification suite (verification/) runs in its own `nox -s verify` session.
 testpaths = ["tests"]
 pythonpath = ["src"]
 asyncio_mode = "auto"
@@ -205,6 +234,7 @@ source = ["src/dataeval_flow"]
 branch = true
 concurrency = ["multiprocessing"]
 parallel = true
+omit = ["src/dataeval_flow/_version.py"]
 
 [tool.coverage.report]
 exclude_also = [
@@ -213,6 +243,7 @@ exclude_also = [
     "if TYPE_CHECKING:",
 ]
 include = ["*/src/dataeval_flow/*"]
+omit = ["src/dataeval_flow/_version.py"]
 fail_under = 90
 show_missing = true
 
@@ -241,6 +272,7 @@ exclude = [
     ".tox",
     ".nox",
     "prototype",
+    "src/dataeval_flow/_version.py",
 ]
 line-length = 120
 target-version = "py310"
@@ -258,7 +290,7 @@ ignore = [
     "C416",
 ]
 fixable = ["ALL"]
-per-file-ignores = { "tests/*" = ["ANN", "S101", "D", "SLF001", "ARG002", "PT019"], "docs/*" = ["D", "E402", "E501", "S101"] }
+per-file-ignores = { "tests/*" = ["ANN", "S101", "D", "SLF001", "ARG002", "PT019"], "docs/*" = ["D", "E402", "E501", "S101"], "verification/*" = ["ANN", "S101", "D", "SLF001", "ARG001", "ARG002", "PT011", "PT019"] }
 
 [tool.ruff.lint.pydocstyle]
 convention = "pep257"
@@ -273,5 +305,5 @@ indent-style = "space"
 # --- Codespell ---
 
 [tool.codespell]
-skip = "./*env*,./output,./htmlcov,./.nox,uv.lock,./docs/source/notebooks/*,./docker/cosign.pub,./docker/Dockerfile.*,*.onnx"
+skip = "./*env*,./output,./htmlcov,./.nox,*.lock,./docs/source/notebooks/*,./docker/cosign.pub,./docker/Dockerfile.*,*.onnx"
 ignore-words-list = ["statics"]