groupoid 0.1.0.dev1__tar.gz → 0.1.0.dev2__tar.gz

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/.github/workflows/ci.yml

@@ -13,8 +13,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -40,8 +40,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
@@ -58,8 +58,8 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -95,8 +95,8 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -107,8 +107,8 @@ jobs:
   benchmark:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -128,7 +128,7 @@ jobs:
           pytest benchmarks/ -v --benchmark-json=benchmark_results.json || true
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: benchmark-results
           path: benchmark_results.json
@@ -137,8 +137,8 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - name: Install dependencies

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/.github/workflows/docs-deploy.yml

@@ -18,8 +18,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -29,7 +29,7 @@ jobs:
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site/
 
@@ -41,4 +41,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

groupoid-0.1.0.dev2/.github/workflows/release.yml

@@ -0,0 +1,107 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]*"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Existing tag/ref to build and publish to PyPI (e.g. v0.1.0.dev1). PyPI only — does NOT create a GitHub Release or Zenodo deposit. Leave blank for a normal tag-triggered release."
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # provenance OIDC
+      attestations: write   # actions/attest-build-provenance + attest-sbom
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip build
+          pip install cyclonedx-bom
+      - name: Build sdist + wheel
+        run: python -m build
+      - name: Generate CycloneDX SBOM
+        run: cyclonedx-py requirements -o sbom.cdx.json <(pip freeze)
+      - name: Provenance attestation (dist)
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        with:
+          subject-path: "dist/*"
+      - name: SBOM attestation (CycloneDX)
+        uses: actions/attest-sbom@5026d3663739160db546203eeaffa6aa1c51a4d6  # v1
+        with:
+          subject-path: "dist/*"
+          sbom-path: "sbom.cdx.json"
+      - name: Upload artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: release-artifacts
+          path: |
+            dist/*
+            sbom.cdx.json
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # PyPI Trusted Publishing OIDC
+    environment:
+      name: pypi
+      url: https://pypi.org/project/groupoid/
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
+        with:
+          name: release-artifacts
+          path: .
+      - name: Publish to PyPI (Trusted Publishing, OIDC)
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+        with:
+          packages-dir: dist
+          print-hash: true
+
+  sign-and-release:
+    needs: build
+    # Only on a real tag push — a manual workflow_dispatch (used to publish an
+    # already-released tag to PyPI) must NOT create a duplicate GitHub Release
+    # or trigger a second Zenodo deposit.
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write       # create GitHub Release
+      id-token: write       # Sigstore signing OIDC
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
+        with:
+          name: release-artifacts
+          path: .
+      - name: Sign artifacts with Sigstore
+        uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46  # v3.0.0
+        with:
+          inputs: |
+            dist/*.tar.gz
+            dist/*.whl
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
+        with:
+          generate_release_notes: true
+          files: |
+            dist/*
+            sbom.cdx.json
+            *.sigstore.json

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/.zenodo.json

@@ -1,8 +1,8 @@
 {
   "upload_type": "software",
   "title": "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds",
-  "version": "0.1.0.dev1",
-  "description": "<p>Pre-alpha research prototype exploring groupoid-based aggregation for federated learning on Riemannian manifolds. Implements transport groupoid morphisms, first cohomology (H^1) for consistency detection, the cellular sheaf Laplacian for spectral analysis, parallel transport (Schild's and pole ladders), and Karcher mean aggregation via geomstats.</p><p><strong>Erratum / supersession notice:</strong> this version (v0.1.0.dev1) corrects mathematical bugs present in the earlier v0.1.0.dev0 snapshot (version DOI 10.5281/zenodo.20563975): the sheaf (connection) Laplacian is now a verified positive-semidefinite operator with a transport-consistent kernel; persistence diagrams retain the homology-dimension label so H0 and H1 are no longer conflated; and H^1 cohomology raises on incomplete cocycles instead of forming partial holonomy. The v0.1.0.dev0 version DOI must not be cited for results. Cite the concept DOI (10.5281/zenodo.20563974), which always resolves to the latest corrected version, or this version or later.</p>",
+  "version": "0.1.0.dev2",
+  "description": "<p>Pre-alpha research prototype exploring groupoid-based aggregation for federated learning on Riemannian manifolds. Implements transport groupoid morphisms, first cohomology (H^1) for consistency detection, the cellular sheaf Laplacian for spectral analysis, parallel transport (Schild's and pole ladders), and Karcher mean aggregation via geomstats.</p><p><strong>Erratum / supersession notice:</strong> this version (v0.1.0.dev2) carries the mathematical corrections introduced in v0.1.0.dev1 over the earlier v0.1.0.dev0 snapshot (version DOI 10.5281/zenodo.20563975): the sheaf (connection) Laplacian is a verified positive-semidefinite operator with a transport-consistent kernel; persistence diagrams retain the homology-dimension label so H0 and H1 are no longer conflated; and H^1 cohomology raises on incomplete cocycles instead of forming partial holonomy. It additionally corrects a first-step magnitude inflation in the RiemannianAdam optimizer's bias initialization (a component not used by the aggregation results). The v0.1.0.dev0 version DOI must not be cited for results. Cite the concept DOI (10.5281/zenodo.20563974), which always resolves to the latest corrected version, or this version or later.</p>",
   "creators": [
     {
       "name": "Maniches, Santiago",
@@ -26,7 +26,7 @@
       "scheme": "doi"
     },
     {
-      "identifier": "10.5281/zenodo.20563975",
+      "identifier": "10.5281/zenodo.20719394",
       "relation": "isNewVersionOf",
       "scheme": "doi"
     },

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/CHANGELOG.md

@@ -10,6 +10,20 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 Nothing yet.
 
+## [0.1.0.dev2] - 2026-06-21
+
+### Fixed
+- **RiemannianAdam first-moment bias initialization**: the first moment was
+  seeded as `grad` while the zero-init bias correction `m / (1 - beta1**t)` was
+  still applied, leaving `1/(1 - beta1)` uncancelled and inflating the first
+  optimization step ~10x (beta1 = 0.9). Now seeded as `(1 - beta1) * grad` so the
+  bias correction recovers `grad`, matching standard Adam. The optimizer is not
+  integrated into the aggregation pipeline, so no published result changes (#39).
+
+### Changed
+- `STATUS.md` corrected to state the package is published on PyPI as a development
+  pre-release (`groupoid 0.1.0.dev2`) rather than "not published on PyPI" (#39).
+
 ## [0.1.0.dev1] - 2026-06-16
 
 First tag cut on mathematically corrected code. The earlier `v0.1.0.dev0` tag and
@@ -72,6 +86,7 @@ Date shown is the tag commit (`v0.1.0.dev0` -> 2a02954). `CITATION.cff` records
 `date-released: 2026-05-25`, when the core implementation landed; the tag was
 later placed on the metadata commit.
 
-[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev1...HEAD
+[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev2...HEAD
+[0.1.0.dev2]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev1...v0.1.0.dev2
 [0.1.0.dev1]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev0...v0.1.0.dev1
 [0.1.0.dev0]: https://github.com/smaniches/GROUPOID/releases/tag/v0.1.0.dev0

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/CITATION.cff

@@ -2,8 +2,8 @@ cff-version: 1.2.0
 message: "If you use this software, please cite it as below."
 type: software
 title: "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds"
-version: 0.1.0.dev1
-date-released: 2026-06-16
+version: 0.1.0.dev2
+date-released: 2026-06-21
 license: Apache-2.0
 repository-code: "https://github.com/smaniches/GROUPOID"
 doi: 10.5281/zenodo.20563974

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: groupoid
-Version: 0.1.0.dev1
+Version: 0.1.0.dev2
 Summary: Research prototype: groupoid-based aggregation for federated learning on Riemannian manifolds
 Author-email: Santiago Maniches <santiago.maniches@gmail.com>
 License-Expression: Apache-2.0
@@ -29,7 +29,7 @@ Requires-Dist: POT>=0.9
 Requires-Dist: networkx>=3.0
 Requires-Dist: einops>=0.7
 Requires-Dist: numpy<2.0,>=1.24
-Requires-Dist: scipy<1.14,>=1.10
+Requires-Dist: scipy<1.16,>=1.10
 Requires-Dist: torch>=2.0
 Requires-Dist: pydantic>=2.0
 Requires-Dist: loguru>=0.7
@@ -66,6 +66,7 @@ Dynamic: license-file
 # GROUPOID
 
 [![CI](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml/badge.svg)](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/groupoid.svg)](https://pypi.org/project/groupoid/)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Python 3.10-3.12](https://img.shields.io/badge/python-3.10--3.12-blue.svg)](https://www.python.org/downloads/)
 [![Status](https://img.shields.io/badge/status-pre--alpha-orange.svg)](#status)
@@ -187,7 +188,13 @@ Requires **Python 3.10, 3.11, or 3.12**. Python 3.13+ is not supported: the
 [LIMITATIONS.md](LIMITATIONS.md)) have no wheels there, so `pip` will refuse
 with a `Requires-Python` message rather than attempt a source build.
 
-From source (not published on PyPI):
+From PyPI:
+
+```bash
+pip install groupoid
+```
+
+From source (for development):
 
 ```bash
 git clone https://github.com/smaniches/GROUPOID.git

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/README.md

@@ -1,6 +1,7 @@
 # GROUPOID
 
 [![CI](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml/badge.svg)](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/groupoid.svg)](https://pypi.org/project/groupoid/)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Python 3.10-3.12](https://img.shields.io/badge/python-3.10--3.12-blue.svg)](https://www.python.org/downloads/)
 [![Status](https://img.shields.io/badge/status-pre--alpha-orange.svg)](#status)
@@ -122,7 +123,13 @@ Requires **Python 3.10, 3.11, or 3.12**. Python 3.13+ is not supported: the
 [LIMITATIONS.md](LIMITATIONS.md)) have no wheels there, so `pip` will refuse
 with a `Requires-Python` message rather than attempt a source build.
 
-From source (not published on PyPI):
+From PyPI:
+
+```bash
+pip install groupoid
+```
+
+From source (for development):
 
 ```bash
 git clone https://github.com/smaniches/GROUPOID.git

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/STATUS.md

@@ -32,7 +32,8 @@
 - No federated training loop with real neural networks exists yet.
 - No differential privacy mechanism is implemented.
 - No formal convergence analysis or proofs exist.
-- The package is not published on PyPI.
+- The package is published on PyPI only as an early development pre-release
+  (`groupoid 0.1.0.dev2`); no stable release exists yet.
 
 ## Validation status
 
@@ -70,5 +71,5 @@ not capture.
 
 ## Versioning
 
-This project uses `0.1.0.dev1` to indicate pre-release development.
+This project uses `0.1.0.dev2` to indicate pre-release development.
 The API is unstable and will change without notice.

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/codemeta.json

@@ -6,7 +6,7 @@
   "codeRepository": "https://github.com/smaniches/GROUPOID",
   "programmingLanguage": "Python",
   "license": "Apache-2.0",
-  "version": "0.1.0.dev1",
+  "version": "0.1.0.dev2",
   "author": [
     {
       "@type": "Person",

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/groupoid/__init__.py

@@ -1,6 +1,6 @@
 """GROUPOID: Groupoid-based federated learning with Riemannian geometry."""
 
-__version__ = "0.1.0.dev1"
+__version__ = "0.1.0.dev2"
 
 from groupoid.aggregation import (
     DisconnectedClientGraphError,

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/groupoid/optimizer.py

@@ -138,10 +138,14 @@ class RiemannianAdam:
         grad = self.manifold.to_tangent(euclidean_grad, point)
         grad_norm_sq = float(np.sum(grad**2))
 
-        # Update biased first moment (tangent vector)
+        # Update biased first moment (tangent vector). Seed from zero like the
+        # second moment below: m_1 = (1 - beta1) * grad, so the bias correction
+        # m_hat = m_1 / (1 - beta1) recovers `grad` on the first step. Seeding
+        # m_1 = grad directly would leave the 1/(1-beta1) factor uncancelled and
+        # inflate the first update by ~10x (beta1=0.9).
         first_moment: npt.NDArray[np.float64]
         if self._m is None:
-            first_moment = grad.copy()
+            first_moment = (1 - self.beta1) * grad
         else:
             first_moment = self.manifold.to_tangent(
                 self.beta1 * self._m + (1 - self.beta1) * grad, point

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/groupoid.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: groupoid
-Version: 0.1.0.dev1
+Version: 0.1.0.dev2
 Summary: Research prototype: groupoid-based aggregation for federated learning on Riemannian manifolds
 Author-email: Santiago Maniches <santiago.maniches@gmail.com>
 License-Expression: Apache-2.0
@@ -29,7 +29,7 @@ Requires-Dist: POT>=0.9
 Requires-Dist: networkx>=3.0
 Requires-Dist: einops>=0.7
 Requires-Dist: numpy<2.0,>=1.24
-Requires-Dist: scipy<1.14,>=1.10
+Requires-Dist: scipy<1.16,>=1.10
 Requires-Dist: torch>=2.0
 Requires-Dist: pydantic>=2.0
 Requires-Dist: loguru>=0.7
@@ -66,6 +66,7 @@ Dynamic: license-file
 # GROUPOID
 
 [![CI](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml/badge.svg)](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/groupoid.svg)](https://pypi.org/project/groupoid/)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Python 3.10-3.12](https://img.shields.io/badge/python-3.10--3.12-blue.svg)](https://www.python.org/downloads/)
 [![Status](https://img.shields.io/badge/status-pre--alpha-orange.svg)](#status)
@@ -187,7 +188,13 @@ Requires **Python 3.10, 3.11, or 3.12**. Python 3.13+ is not supported: the
 [LIMITATIONS.md](LIMITATIONS.md)) have no wheels there, so `pip` will refuse
 with a `Requires-Python` message rather than attempt a source build.
 
-From source (not published on PyPI):
+From PyPI:
+
+```bash
+pip install groupoid
+```
+
+From source (for development):
 
 ```bash
 git clone https://github.com/smaniches/GROUPOID.git

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/groupoid.egg-info/SOURCES.txt

@@ -20,6 +20,7 @@ pyproject.toml
 .github/ISSUE_TEMPLATE/mathematical_correction.md
 .github/workflows/ci.yml
 .github/workflows/docs-deploy.yml
+.github/workflows/release.yml
 benchmarks/__init__.py
 benchmarks/conftest.py
 benchmarks/test_karcher_benchmark.py

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/groupoid.egg-info/requires.txt

@@ -6,7 +6,7 @@ POT>=0.9
 networkx>=3.0
 einops>=0.7
 numpy<2.0,>=1.24
-scipy<1.14,>=1.10
+scipy<1.16,>=1.10
 torch>=2.0
 pydantic>=2.0
 loguru>=0.7

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "groupoid"
-version = "0.1.0.dev1"
+version = "0.1.0.dev2"
 description = "Research prototype: groupoid-based aggregation for federated learning on Riemannian manifolds"
 readme = "README.md"
 license = "Apache-2.0"
@@ -44,7 +44,7 @@ dependencies = [
     "networkx>=3.0",
     "einops>=0.7",
     "numpy>=1.24,<2.0",
-    "scipy>=1.10,<1.14",
+    "scipy>=1.10,<1.16",
     "torch>=2.0",
     "pydantic>=2.0",
     "loguru>=0.7",

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev2}/tests/test_smoke.py

@@ -115,6 +115,27 @@ class TestOptimizerSmoke:
         assert new_point.shape == (3,)
         assert manifold.belongs(new_point, atol=1e-4)
 
+    def test_riemannian_adam_first_step_magnitude(self):
+        """The first step moves ~lr in geodesic distance, not lr/(1 - beta1).
+
+        Standard Adam's bias correction yields m_hat_1 = grad on step 1, so the
+        update is -lr * grad / (||grad|| + eps) and the geodesic displacement is
+        ~lr. Seeding the first moment as grad without the (1 - beta1) factor
+        leaves 1/(1 - beta1) uncancelled and inflates the first step to ~10*lr
+        (beta1 = 0.9). This test fails on that bug.
+        """
+        from geomstats.geometry.hypersphere import Hypersphere
+
+        from groupoid.optimizer import RiemannianAdam
+
+        manifold = Hypersphere(dim=2)
+        point = np.array([0.0, 0.0, 1.0])
+        grad = np.array([0.1, 0.2, 0.3])
+        lr = 0.01
+        new_point = RiemannianAdam(manifold=manifold, lr=lr).step(point, grad)
+        dist = float(manifold.metric.dist(point, new_point))
+        assert abs(dist - lr) < 0.2 * lr
+
 
 class TestAggregationSmoke:
     """Deterministic aggregation test."""