fiberpath 0.7.0__tar.gz → 0.7.2__tar.gz

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/actions/setup-node/action.yml

@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: ${{ inputs.node-version }}
         cache: npm

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/actions/setup-python/action.yml

@@ -19,18 +19,18 @@ runs:
   using: composite
   steps:
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ inputs.python-version }}
 
     - name: Set up uv
-      uses: astral-sh/setup-uv@v3
+      uses: astral-sh/setup-uv@v8.2.0
       with:
         enable-cache: true
         cache-dependency-glob: "pyproject.toml"
 
     - name: Cache Python virtual environment
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: .venv
         key: venv-${{ runner.os }}-${{ inputs.python-version }}-${{ hashFiles('pyproject.toml') }}-${{ inputs.cache-key-suffix }}

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/actions/setup-rust/action.yml

@@ -18,7 +18,7 @@ runs:
       uses: dtolnay/rust-toolchain@stable
 
     - name: Cache cargo artifacts
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.cargo/bin

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/backend-ci.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -39,7 +39,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -52,7 +52,7 @@ jobs:
 
       - name: Upload coverage
         if: matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           files: ./coverage.xml
           flags: backend

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/ci-check.yml

@@ -15,14 +15,10 @@ on:
       - "setup.cfg"
       - "mkdocs.yml"
       - "README.md"
-      - "scripts/sync_gui_docs.py"
-      - ".github/workflows/ci-check.yml"
-      - ".github/workflows/backend-ci.yml"
-      - ".github/workflows/gui-ci.yml"
-      - ".github/workflows/docs-ci.yml"
-      - ".github/actions/setup-python/**"
-      - ".github/actions/setup-node/**"
-      - ".github/actions/setup-rust/**"
+      - "CHANGELOG.md"
+      - "scripts/**"
+      - ".github/workflows/**"
+      - ".github/actions/**"
   pull_request:
     branches: [main]
     paths:
@@ -37,14 +33,10 @@ on:
       - "setup.cfg"
       - "mkdocs.yml"
       - "README.md"
-      - "scripts/sync_gui_docs.py"
-      - ".github/workflows/ci-check.yml"
-      - ".github/workflows/backend-ci.yml"
-      - ".github/workflows/gui-ci.yml"
-      - ".github/workflows/docs-ci.yml"
-      - ".github/actions/setup-python/**"
-      - ".github/actions/setup-node/**"
-      - ".github/actions/setup-rust/**"
+      - "CHANGELOG.md"
+      - "scripts/**"
+      - ".github/workflows/**"
+      - ".github/actions/**"
   workflow_dispatch:
 
 permissions:
@@ -60,11 +52,11 @@ jobs:
       docs: ${{ steps.filter.outputs.docs }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Detect changed areas
         id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           filters: |
             backend:

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/dependency-audit.yml

@@ -3,6 +3,8 @@ name: Dependency Audit
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
   schedule:
     - cron: "0 7 * * 1"
   workflow_dispatch:
@@ -16,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -44,7 +46,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js environment
         uses: ./.github/actions/setup-node
@@ -67,7 +69,7 @@ jobs:
         working-directory: fiberpath_gui/src-tauri
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup-rust
@@ -75,7 +77,7 @@ jobs:
           install-linux-deps: "false"
 
       - name: Install cargo-audit
-        run: cargo install cargo-audit --locked
+        run: cargo audit --version 2>/dev/null || cargo install cargo-audit --locked
 
       - name: Run cargo audit (JSON report)
         run: cargo audit --json > cargo-audit.json

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/docs-ci.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/docs-deploy.yml

@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Configure GitHub Pages
         id: pages
@@ -47,7 +47,7 @@ jobs:
         run: uv run mkdocs build --strict --site-dir site
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           path: site
 

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/gui-ci.yml

@@ -16,7 +16,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js environment
         uses: ./.github/actions/setup-node
@@ -44,7 +44,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js environment
         uses: ./.github/actions/setup-node
@@ -56,7 +56,7 @@ jobs:
         run: npm run test:coverage
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           files: ./fiberpath_gui/coverage/lcov.info
           flags: gui
@@ -78,7 +78,7 @@ jobs:
           echo "Build successful - dist/ directory created"
 
       - name: Upload bundle metrics artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: gui-bundle-metrics
           path: fiberpath_gui/perf/reports/bundle-metrics.json

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/gui-e2e-smoke.yml

@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download packaged GUI artifact
         uses: actions/download-artifact@v8

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/gui-packaging.yml

@@ -13,6 +13,20 @@ on:
       - ".github/actions/setup-node/**"
       - ".github/actions/setup-rust/**"
       - ".github/actions/setup-python/**"
+  pull_request:
+    branches: [main]
+    paths:
+      - "fiberpath/**"
+      - "fiberpath_cli/**"
+      - "fiberpath_gui/**"
+      - "!fiberpath_gui/docs/**"
+      - "scripts/freeze_cli.py"
+      - "scripts/ci/**"
+      - ".github/workflows/gui-packaging.yml"
+      - ".github/workflows/gui-e2e-smoke.yml"
+      - ".github/actions/setup-node/**"
+      - ".github/actions/setup-rust/**"
+      - ".github/actions/setup-python/**"
   workflow_call:
     inputs:
       release_tag:
@@ -37,7 +51,7 @@ jobs:
         os: [windows-latest, macos-latest, ubuntu-latest]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python (no cache for freeze)
         uses: actions/setup-python@v6
@@ -116,7 +130,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download frozen CLI artifact
         uses: actions/download-artifact@v8
@@ -157,14 +171,11 @@ jobs:
         run: |
           echo "Checking if Tauri build succeeded with bundled CLI..."
           if [ "$RUNNER_OS" == "Windows" ]; then
-            # Windows: Verify actual installer files were created
-            MSI_COUNT=$(find src-tauri/target/release/bundle/msi -name "*.msi" 2>/dev/null | wc -l)
+            # Windows: Verify MSI was created and use 7-zip to confirm the CLI binary is embedded.
+            MSI_FILE=$(find src-tauri/target/release/bundle/msi -name "*.msi" 2>/dev/null | head -1)
             NSIS_COUNT=$(find src-tauri/target/release/bundle/nsis -name "*.exe" 2>/dev/null | wc -l)
 
-            if [ "$MSI_COUNT" -gt 0 ] || [ "$NSIS_COUNT" -gt 0 ]; then
-              echo "[OK] Windows installers created successfully:"
-              find src-tauri/target/release/bundle -type f \( -name "*.msi" -o -name "*.exe" \) -exec ls -lh {} \;
-            else
+            if [ -z "$MSI_FILE" ] && [ "$NSIS_COUNT" -eq 0 ]; then
               echo "ERROR: No Windows installer files (.msi or .exe) found!"
               echo "MSI directory contents:"
               ls -la src-tauri/target/release/bundle/msi/ 2>/dev/null || echo "  Directory not found"
@@ -172,6 +183,30 @@ jobs:
               ls -la src-tauri/target/release/bundle/nsis/ 2>/dev/null || echo "  Directory not found"
               exit 1
             fi
+
+            echo "[OK] Windows installers created:"
+            find src-tauri/target/release/bundle -type f \( -name "*.msi" -o -name "*.exe" \) -exec ls -lh {} \;
+
+            # Verify the CLI binary is embedded in the MSI using 7-zip.
+            if [ -n "$MSI_FILE" ]; then
+              SEVENZIP=""
+              if command -v 7z &>/dev/null; then SEVENZIP="7z"; fi
+              if [ -z "$SEVENZIP" ] && [ -f "C:/Program Files/7-Zip/7z.exe" ]; then SEVENZIP="C:/Program Files/7-Zip/7z.exe"; fi
+              if [ -n "$SEVENZIP" ]; then
+                echo "Inspecting MSI contents for fiberpath.exe..."
+                if "$SEVENZIP" l "$MSI_FILE" 2>/dev/null | grep -i "fiberpath.exe"; then
+                  echo "[OK] fiberpath.exe found inside MSI"
+                else
+                  echo "WARNING: fiberpath.exe not directly visible in MSI listing."
+                  echo "This may occur when 7-zip shows only the embedded Cabinet stream;"
+                  echo "the E2E smoke test performs a two-pass extraction to handle this case."
+                  echo "MSI file listing (first 40 entries):"
+                  "$SEVENZIP" l "$MSI_FILE" 2>/dev/null | head -40 || true
+                fi
+              else
+                echo "WARNING: 7-zip not found; skipping MSI content inspection."
+              fi
+            fi
           else
             # macOS/Linux: Search for bundled CLI file in app bundle
             if find src-tauri/target/release/bundle -name "fiberpath" -type f 2>/dev/null | grep -q .; then
@@ -195,7 +230,7 @@ jobs:
 
       - name: Upload release assets
         if: github.event_name == 'release' || inputs.release_tag != ''
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ inputs.release_tag || github.ref }}
           fail_on_unmatched_files: false

{fiberpath-0.7.0 → fiberpath-0.7.2}/.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
       tag: ${{ steps.check.outputs.tag }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Create SBOM output directory
         run: mkdir -p sbom
@@ -109,7 +109,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download SBOM artifacts
         uses: actions/download-artifact@v8
@@ -134,7 +134,7 @@ jobs:
 
       - name: Generate release notes
         id: notes
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const prevTag = '${{ steps.previous-tag.outputs.previous }}';
@@ -226,7 +226,7 @@ jobs:
           echo "Assets will be uploaded by build-gui-installers workflow"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ needs.validate.outputs.tag }}
           name: Release ${{ inputs.version }}
@@ -249,7 +249,7 @@ jobs:
       url: https://pypi.org/project/fiberpath/
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python

{fiberpath-0.7.0 → fiberpath-0.7.2}/CHANGELOG.md

@@ -8,6 +8,82 @@ The format is based on Keep a Changelog, and this project follows semantic versi
 
 ## [Unreleased]
 
+## [0.7.2] - 2026-06-24
+
+### Security
+
+- Hardened API path policy (`enforce_input_path_policy`) to reject absolute paths (POSIX `/`, Windows drive `C:\`, UNC `\\`), NUL bytes, `..` traversal segments, and empty/whitespace inputs with 400 before any filesystem access. Resolved CodeQL alert #9 ("Uncontrolled data used in path expression").
+- Patched `starlette` CVE-2026-48710 (BadHost) by upgrading to a fixed release.
+- Cleared the GUI dev-tree advisories `js-yaml` (GHSA-h67p-54hq-rp68, merge-key DoS → 4.2.0) and `undici` (GHSA-vmh5-mc38-953g and related → 7.28.0). Both are dev-only; the shipped application is unaffected.
+- Bumped `rand` to 0.8.6 (GHSA-cq8v-f236-94qc). A residual, build-time-only `rand` 0.7.3 is pinned upstream in the Tauri toolchain with no available fix and is tracked in `TODO.md`.
+
+### Changed
+
+- API file endpoints now require relative paths; the configured `FIBERPATH_API_ALLOWED_ROOTS` controls which directories they resolve against.
+- Rebuilt user-supplied paths from validated components (`Path(*parts)`) instead of passing raw input to `Path()`, breaking the taint chain for static analysis.
+- API plan/simulate routes map core-engine input errors (`PlanningError`, `SimulationError`) to HTTP 400 via centralized exception handlers instead of surfacing them as 500s, and `/stream` caps the G-code payload at 10 MB.
+- Routed streaming `[DEBUG]`/`[ERROR]` output through the `logging` module instead of `print(..., file=sys.stderr)`, so a normal run is quiet by default while the stdout JSON protocol is unchanged.
+- Upgraded Tauri to 2.11 (Cargo + npm aligned) and refreshed CI actions.
+
+### Fixed
+
+- `MarlinStreamer` transport guards now raise `StreamError` instead of `assert`, so they behave identically under `python -O` rather than degrading to a `None` dereference.
+- Tauri `plot_definition`, `plot_preview`, and `validate_wind_definition` no longer leak temporary `.wind`/`.gcode`/`.png` files on error paths; an RAII guard removes them on every exit.
+
+### Removed
+
+- Removed the unused `fiberpath/geometry/` stub module (dead code advertising non-cylindrical capability that does not exist; the roadmap is documented instead).
+- Removed dead branches in `planning/layer_strategies.py` (a no-op `build_layer_summary` conditional and an unreachable circuit-divisibility guard superseded by upstream validation).
+
+### Added
+
+- `tests/api/test_path_policy.py` — 18 dedicated tests covering all rejected input classes (NUL bytes, POSIX absolute, Windows drive/UNC, `..` traversal with forward and backslash separators, empty/whitespace, absolute-inside-root) and accepted cases (bare filename, nested relative, multiple roots, single-dot normalisation).
+- Integration-level rejection tests in `test_plan_route.py` and `test_simulate_route.py` for absolute-path and traversal inputs.
+- Tests for API error-to-4xx mapping, `MarlinStreamer` transport guards (including a `python -O` subprocess check), streaming logging staying quiet by default, and the Tauri temp-file cleanup guard.
+
+### Documentation
+
+- Aligned the README and architecture docs with the implemented scope (cylindrical mandrels; hoop/helical/skip layers), framed geodesic/curved-surface support as roadmap, and removed the stale `examples/complex_surface/` placeholder.
+
+### Dependencies
+
+- Tooling/CI: `astral-sh/setup-uv` v8.2.0 (Node 24), `codecov/codecov-action` v7, `actions/checkout` v7.
+- Python (uv): `starlette` 1.3.1, `urllib3` 2.7.0, `idna` 3.15, `pymdown-extensions` 10.21.3.
+- npm: `@types/node` 26, `lucide-react`, `fast-uri` 3.1.2, plus the npm prod and dev minor-patch dependency groups.
+- Cargo: the cargo minor-patch dependency groups.
+
+## [0.7.1] - 2026-04-16
+
+### Added
+
+- Expanded GUI test suite to 614 tests across 53 files via three RTL sprint phases covering pure components, store-coupled components, hooks, canvas rendering, CLI health, and stream branches (79.81% line / 91.17% branch / 87.73% function coverage).
+
+### Fixed
+
+- Fixed Python audit CI failure caused by CVE-2025-71176 in `pytest 9.0.2`; bumped to `pytest 9.0.3`.
+- Fixed Windows E2E smoke test failure caused by WiX MSI two-pass CAB extraction not being handled in `extract-package-runtime.ps1`.
+- Fixed Windows E2E smoke test failure where accumulated MSI artifacts caused the oldest version to be selected instead of the newest; extraction now sorts by `LastWriteTime` descending.
+- Fixed `cargo audit` CI failure when `cargo-audit` was already installed (`exit 101`); guarded install with a version check.
+- Fixed `ci-check.yml` required-status gate never posting on `scripts/ci/**` and workflow changes; broadened path filter to `scripts/**` and `.github/workflows/**`.
+
+### Changed
+
+- Extended `dependency-audit.yml` and `gui-packaging.yml` to trigger on pull requests, not only post-merge pushes.
+- Improved `find-bundled-cli.ps1` with a wider path regex and full diagnostics output on failure.
+
+### Dependencies
+
+- Bumped `pillow` (uv).
+- Bumped `tokio` (Cargo, two patches).
+- Bumped npm prod and dev minor-patch dependency groups.
+- Bumped `react-zoom-pan-pinch` to 4.0.3.
+- Bumped `actions/upload-pages-artifact` from 4 to 5.
+- Bumped multiple Cargo minor-patch dependency groups.
+
+### Internal
+
+- Synchronized release version metadata across Python (`pyproject.toml`, `uv.lock`), npm (`package.json`, `package-lock.json`), and Tauri (`Cargo.toml`, `Cargo.lock`, `tauri.conf.json`).
+
 ## [0.7.0] - 2026-04-08
 
 ### Added

{fiberpath-0.7.0 → fiberpath-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fiberpath
-Version: 0.7.0
+Version: 0.7.2
 Summary: Modern filament winding planner, simulator, and G-code toolkit.
 Author: Cameron K. Brooks
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
@@ -680,6 +680,7 @@ Requires-Dist: rich>=13.7
 Requires-Dist: typer>=0.12
 Provides-Extra: api
 Requires-Dist: fastapi>=0.110; extra == 'api'
+Requires-Dist: starlette>=1.0.1; extra == 'api'
 Requires-Dist: uvicorn[standard]>=0.24; extra == 'api'
 Provides-Extra: cli
 Requires-Dist: rich>=13.7; extra == 'cli'
@@ -708,7 +709,7 @@ Description-Content-Type: text/markdown
 
 **Plan, simulate, and manufacture composite parts with precision fiber winding.**
 
-[![Version](https://img.shields.io/badge/version-0.7.0-4c7284)](https://github.com/CameronBrooks11/fiberpath/releases)
+[![Version](https://img.shields.io/badge/version-0.7.2-4c7284)](https://github.com/CameronBrooks11/fiberpath/releases)
 [![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-00695C.svg)](LICENSE)
 [![Backend CI](https://img.shields.io/github/actions/workflow/status/CameronBrooks11/fiberpath/backend-ci.yml?branch=main&label=Backend%20CI&logo=python&logoColor=white)](https://github.com/CameronBrooks11/fiberpath/actions/workflows/backend-ci.yml)
 [![GUI CI](https://img.shields.io/github/actions/workflow/status/CameronBrooks11/fiberpath/gui-ci.yml?branch=main&label=GUI%20CI&logo=react&logoColor=white)](https://github.com/CameronBrooks11/fiberpath/actions/workflows/gui-ci.yml)
@@ -729,12 +730,12 @@ Description-Content-Type: text/markdown
 
 FiberPath automates the complex process of **filament winding**—wrapping fiber-reinforced composites around mandrels to create lightweight, high-strength cylindrical parts like pressure vessels, pipes, and aerospace structures.
 
-Design multi-layer winding patterns in a visual interface, simulate the full manufacturing process, and stream G-code directly to Marlin-based hardware. FiberPath handles the mathematics of geodesic paths, fiber tension calculations, and machine kinematics so you can focus on part design.
+Design multi-layer winding patterns in a visual interface, simulate the full manufacturing process, and stream G-code directly to Marlin-based hardware. FiberPath handles the winding mathematics — hoop and helical path generation, tow coverage, and machine kinematics for cylindrical mandrels — so you can focus on part design.
 
 ### Features
 
 - **Visual Layer Editor** – Design winding patterns with live preview
-- **Geodesic Path Planning** – Automatic computation of stable fiber trajectories
+- **Winding Path Planning** – Automatic hoop, helical, and skip pattern generation for cylindrical mandrels
 - **Hardware Simulation** – Validate motion before manufacturing
 - **Direct Machine Control** – Stream G-code to Marlin controllers with pause/resume
 - **XAB-Native Axis Output** – Standardized rotational-axis output with clear logical axis mapping
@@ -742,6 +743,8 @@ Design multi-layer winding patterns in a visual interface, simulate the full man
 - **Command-Line Tools** – Scriptable workflows for automation and CI/CD
 - **Comprehensive Documentation** – Architecture guides, examples, and API reference
 
+> **Scope & roadmap:** FiberPath currently plans **cylindrical mandrels** with hoop, helical, and skip layers. Non-cylindrical (geodesic) surface support — including tapered and custom mandrels — is planned but not yet implemented.
+
 ## Quick Start
 
 ### Option 1: Desktop GUI (Recommended)
@@ -902,10 +905,9 @@ FiberPath consists of four coordinated components:
                 ▼
 ┌─────────────────────────────────────────────────┐
 │           Core Engine (Python)                  │
-│  • Geodesic path planning                       │
+│  • Winding path planning (hoop/helical/skip)    │
 │  • Layer strategies                             │
 │  • G-code generation                            │
-│  • Geometry utilities                           │
 └─────────────────────────────────────────────────┘
                 ▲
                 │ imports

{fiberpath-0.7.0 → fiberpath-0.7.2}/README.md

@@ -4,7 +4,7 @@
 
 **Plan, simulate, and manufacture composite parts with precision fiber winding.**
 
-[![Version](https://img.shields.io/badge/version-0.7.0-4c7284)](https://github.com/CameronBrooks11/fiberpath/releases)
+[![Version](https://img.shields.io/badge/version-0.7.2-4c7284)](https://github.com/CameronBrooks11/fiberpath/releases)
 [![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-00695C.svg)](LICENSE)
 [![Backend CI](https://img.shields.io/github/actions/workflow/status/CameronBrooks11/fiberpath/backend-ci.yml?branch=main&label=Backend%20CI&logo=python&logoColor=white)](https://github.com/CameronBrooks11/fiberpath/actions/workflows/backend-ci.yml)
 [![GUI CI](https://img.shields.io/github/actions/workflow/status/CameronBrooks11/fiberpath/gui-ci.yml?branch=main&label=GUI%20CI&logo=react&logoColor=white)](https://github.com/CameronBrooks11/fiberpath/actions/workflows/gui-ci.yml)
@@ -25,12 +25,12 @@
 
 FiberPath automates the complex process of **filament winding**—wrapping fiber-reinforced composites around mandrels to create lightweight, high-strength cylindrical parts like pressure vessels, pipes, and aerospace structures.
 
-Design multi-layer winding patterns in a visual interface, simulate the full manufacturing process, and stream G-code directly to Marlin-based hardware. FiberPath handles the mathematics of geodesic paths, fiber tension calculations, and machine kinematics so you can focus on part design.
+Design multi-layer winding patterns in a visual interface, simulate the full manufacturing process, and stream G-code directly to Marlin-based hardware. FiberPath handles the winding mathematics — hoop and helical path generation, tow coverage, and machine kinematics for cylindrical mandrels — so you can focus on part design.
 
 ### Features
 
 - **Visual Layer Editor** – Design winding patterns with live preview
-- **Geodesic Path Planning** – Automatic computation of stable fiber trajectories
+- **Winding Path Planning** – Automatic hoop, helical, and skip pattern generation for cylindrical mandrels
 - **Hardware Simulation** – Validate motion before manufacturing
 - **Direct Machine Control** – Stream G-code to Marlin controllers with pause/resume
 - **XAB-Native Axis Output** – Standardized rotational-axis output with clear logical axis mapping
@@ -38,6 +38,8 @@ Design multi-layer winding patterns in a visual interface, simulate the full man
 - **Command-Line Tools** – Scriptable workflows for automation and CI/CD
 - **Comprehensive Documentation** – Architecture guides, examples, and API reference
 
+> **Scope & roadmap:** FiberPath currently plans **cylindrical mandrels** with hoop, helical, and skip layers. Non-cylindrical (geodesic) surface support — including tapered and custom mandrels — is planned but not yet implemented.
+
 ## Quick Start
 
 ### Option 1: Desktop GUI (Recommended)
@@ -198,10 +200,9 @@ FiberPath consists of four coordinated components:
                 ▼
 ┌─────────────────────────────────────────────────┐
 │           Core Engine (Python)                  │
-│  • Geodesic path planning                       │
+│  • Winding path planning (hoop/helical/skip)    │
 │  • Layer strategies                             │
 │  • G-code generation                            │
-│  • Geometry utilities                           │
 └─────────────────────────────────────────────────┘
                 ▲
                 │ imports

{fiberpath-0.7.0 → fiberpath-0.7.2}/TODO.md

@@ -18,4 +18,6 @@
 
 - [ ] Track Dependabot moderate alert #3 (GHSA-wrw7-89jp-8q8g / glib). Current Tauri GTK stack pins `glib` 0.18.x (`^0.18` via `gtk`), so patched `glib` 0.20.0 cannot be adopted yet. Do not block a release solely for this; re-check after upstream Tauri/GTK dependency line moves to non-vulnerable glib.
 
+- [ ] Track Dependabot low alert (GHSA-cq8v-f236-94qc / `rand`). The `rand 0.8.x` instance was patched to 0.8.6; a residual `rand 0.7.3` remains, pinned via `phf_generator 0.8.0` (`^0.7`) in Tauri's `tauri-build` → `kuchikiki` → `selectors`/`cssparser` chain. It is a **build-time-only** dependency (CSS-parser codegen), not in the shipped runtime, and the advisory (runtime `rand::rng()` soundness) does not apply to it — effectively zero risk. No 0.7.x fix exists; re-check after the Tauri `tauri-utils`/`kuchikiki` dependency line moves off `phf 0.8`. Do not block a release for this.
+
 - [ ] Manual cross-platform validation (waived for v0.6.0, required before v1.0 or first public release): Linux `.deb`/`.AppImage` (Ubuntu 22.04, Debian 12, Fedora 39) and macOS `.dmg` (Intel + Apple Silicon) install, bundled CLI discovery, full workflow (validate → plan → simulate → visualize), serial port, file ops, upgrade, and uninstall. See `planning/roadmap-v6.md` Phases 1 & 2 for the full checklist.

{fiberpath-0.7.0 → fiberpath-0.7.2}/docs/architecture/overview.md

@@ -24,7 +24,7 @@ together and where to extend them.
 └──────────────────────┘
 ```
 
-- **Core Engine (`fiberpath/`)** – Immutable planners, geometry helpers, machine abstractions, and
+- **Core Engine (`fiberpath/`)** – Immutable planners, machine abstractions, and
   G-code emitters. The modules are designed to run without side effects so they can be imported from both CLI and API layers.
 - **Interface Layer** – `fiberpath_cli` hosts the Typer commands, while `fiberpath_api` turns the
   same operations into REST endpoints. The desktop GUI wraps the CLI and communicates via Tauri IPC
@@ -35,7 +35,6 @@ together and where to extend them.
 | Module                 | Responsibility                                                                         | Notes                                                                                            |
 | ---------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
 | `fiberpath.planning`   | Parses `.wind` files, validates machine/layer constraints, produces command sequences. | `PlanOptions` governs verbosity and optional advanced dialect override.                          |
-| `fiberpath.geometry`   | Curve/surface math shared between planner and simulator.                               | Pure functions make it safe for reuse.                                                           |
 | `fiberpath.gcode`      | Dialects and writers for Marlin-style controllers.                                     | Extend here when adding custom headers or commands. Axis mapping configured via `MarlinDialect`. |
 | `fiberpath.simulation` | Time/distance estimations based on planned feed rates.                                 | Feeds CLI `simulate` summaries. Axis-aware for proper rotational calculations.                   |
 | `fiberpath.execution`  | PySerial streaming, pause/resume, and progress tracking.                               | Used by CLI streaming and API `/stream`.                                                         |

{fiberpath-0.7.0 → fiberpath-0.7.2}/docs/development/dependency-policy.md

@@ -21,7 +21,7 @@ Applies to:
 
 ## Ownership
 
-- Primary triage owner: maintainers responsible for the active release planning document in `planning/`
+- Primary triage owner: maintainers responsible for the active release planning document in `docs/feature-backlog.md`
 - PR review owner: area maintainer for the affected ecosystem
 - Security escalation owner: release manager on current target milestone
 
@@ -62,6 +62,6 @@ When an update is deferred:
 
 ## Documentation and Traceability
 
-- Roadmap and release source of truth: `CHANGELOG.md` and current active planning documents in `planning/`.
+- Roadmap and release source of truth: `CHANGELOG.md` and `docs/feature-backlog.md`.
 - Release-level summary: `CHANGELOG.md`.
 - CI architecture reference: `docs/development/ci-cd.md`.

{fiberpath-0.7.0 → fiberpath-0.7.2}/docs/development/packaging.md

@@ -43,7 +43,7 @@ freeze-cli:
         python-version: "3.11"
     - run: pip install . pyinstaller
     - run: python scripts/freeze_cli.py
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       with:
         name: fiberpath-cli-${{ matrix.os }}
         path: dist/fiberpath*