groupoid 0.1.0.dev1__tar.gz → 0.1.0.dev4__tar.gz

groupoid-0.1.0.dev4/.github/dependabot.yml

@@ -0,0 +1,78 @@
+# Dependabot configuration.
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Opens reviewable update PRs (never auto-merged) so security and version bumps
+# are surfaced proactively, rather than relying on a manual read of the CI
+# dependency-audit output. Complements the CI dependency-vulnerability scan.
+version: 2
+updates:
+  # Python dependencies declared in pyproject.toml.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      # Pin the run to a predictable local hour. With no time/timezone,
+      # Dependabot fires at its default slot in UTC, which lands in the middle
+      # of the night for the maintainer. Adjust `timezone` to your actual IANA
+      # zone if America/New_York is not yours.
+      time: "09:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    # Manage DIRECT dependencies only — the ones declared in pyproject.toml.
+    # GROUPOID ships no committed/compiled lockfile, so this is currently a
+    # no-op (Dependabot already only edits the pyproject declarations). It is
+    # kept for consistency and as a guard: should a compiled lock ever be added,
+    # its transitive pins must advance by recompiling the lock, not by standalone
+    # Dependabot line-edits. Transitive CVEs are NOT lost: Dependabot *security*
+    # updates patch vulnerable dependencies regardless of this allow filter.
+    allow:
+      - dependency-type: "direct"
+    groups:
+      # Batch updates by area into a single PR per group to limit noise instead
+      # of one PR per package.
+      runtime:
+        patterns:
+          - "torch"
+          - "geomstats"
+          - "pymanopt"
+          - "ripser"
+          - "persim"
+          - "POT"
+          - "networkx"
+          - "einops"
+          - "numpy"
+          - "scipy"
+          - "pydantic"
+          - "loguru"
+      dev:
+        patterns:
+          - "pytest*"
+          - "ruff"
+          - "black"
+          - "mypy"
+          - "hypothesis"
+          - "bandit"
+          - "pip-audit"
+          - "pre-commit"
+      docs:
+        patterns: ["mkdocs*", "mkdocstrings*"]
+      # Fallback batcher. With `allow: direct` and the groups above, this should
+      # stay empty; if a future declared dep is not matched above, this keeps it
+      # to a single PR instead of one-per-package.
+      other:
+        patterns: ["*"]
+
+  # GitHub Actions used in the workflows (keeps action versions current).
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    groups:
+      # Batch all action bumps into a single weekly PR instead of one each.
+      actions:
+        patterns: ["*"]

groupoid-0.1.0.dev4/.github/scripts/install_torch_cpu.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Installs CPU-only torch from the PyTorch index with retries.
+#
+# That index (download.pytorch.org/whl/cpu, Cloudflare R2-backed as
+# download-r2.pytorch.org) intermittently drops the TLS handshake
+# (SSLV3_ALERT_HANDSHAKE_FAILURE) from GitHub-hosted runners. pip's own
+# built-in retries reuse the same connection pool within one process and
+# do not help here; a fresh `pip install` invocation gets a fresh TLS
+# connection and has in practice succeeded where the retries within a
+# single invocation did not. Five attempts with linear backoff (10s, 20s,
+# 30s, 40s) before giving up.
+set -euo pipefail
+
+max_attempts=5
+attempt=1
+until pip install torch --index-url https://download.pytorch.org/whl/cpu; do
+  if [ "${attempt}" -ge "${max_attempts}" ]; then
+    echo "::error::torch install failed after ${max_attempts} attempts" >&2
+    exit 1
+  fi
+  sleep_seconds=$((attempt * 10))
+  echo "torch install attempt ${attempt}/${max_attempts} failed; retrying in ${sleep_seconds}s" >&2
+  sleep "${sleep_seconds}"
+  attempt=$((attempt + 1))
+done

groupoid-0.1.0.dev4/.github/workflows/auto-tag-release.yml

@@ -0,0 +1,72 @@
+name: Auto Tag Release
+
+# Creates the tag for a release-cut merge to main; it does nothing else.
+# release.yml (build, attestations, PyPI publish, signing, GitHub Release)
+# is triggered solely by that tag push, exactly as it would be from a
+# manual `git tag vX.Y.Z && git push origin vX.Y.Z`. Keeping tag creation
+# and publishing in two separate, single-purpose workflows means the
+# actual publish path has exactly one trigger (a tag push) to reason
+# about, instead of depending on GitHub's anti-recursion behavior for
+# GITHUB_TOKEN-authored pushes not re-triggering the same push event.
+#
+# If a version needs a tag this workflow's format check rejects (see
+# below), tag it manually -- this automation only ever creates a tag
+# when one is missing, so a pre-existing manual tag always takes
+# precedence and this workflow becomes a no-op for that version.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - pyproject.toml
+
+permissions:
+  contents: read
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # push the tag; nothing else in this workflow needs it
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          fetch-depth: 0   # need full tag history to check for an existing tag
+
+      - name: Create the release tag if this version doesn't have one yet
+        run: |
+          set -euo pipefail
+
+          version=$(grep -m1 '^version = "' pyproject.toml | sed -E 's/version = "(.*)"/\1/')
+          if [ -z "${version}" ]; then
+            echo "::error::could not extract a version from pyproject.toml"
+            exit 1
+          fi
+
+          # PEP 440-ish release/pre-release only: X.Y.Z, optionally with
+          # .devN / aN / bN / rcN. No local version segment (+...), no
+          # anything else. A version that doesn't match this is presumably
+          # intentional and unusual enough to want a human tagging it by
+          # hand rather than this automation guessing.
+          if ! echo "${version}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(\.dev[0-9]+|a[0-9]+|b[0-9]+|rc[0-9]+)?$'; then
+            echo "::error::version '${version}' is not a recognized release format (expected X.Y.Z, optionally with .devN/aN/bN/rcN, no local metadata); refusing to tag automatically. Tag it manually if this is intentional."
+            exit 1
+          fi
+
+          tag="v${version}"
+
+          if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "Tag ${tag} already exists; nothing to do."
+            exit 0
+          fi
+
+          if ! grep -qF "[${version}]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md has no [${version}] heading; refusing to tag an undocumented release. Add the changelog section as part of the version-bump PR."
+            exit 1
+          fi
+
+          echo "Version ${version} has no matching tag; creating ${tag}."
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${tag}" -m "Release ${tag}"
+          git push origin "refs/tags/${tag}"

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev4}/.github/workflows/ci.yml

@@ -13,8 +13,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -25,7 +25,7 @@ jobs:
           # Linting only against `ruff black mypy` left numpy/pydantic uninstalled,
           # so --strict raised disallow_subclassing_any on the BaseModel subclass.
           # Consistent with the test / security / docs jobs. CPU torch keeps it lean.
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       - name: Run ruff
         run: ruff check .
@@ -40,14 +40,14 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       - name: Run tests with coverage gate
         run: >-
@@ -58,8 +58,8 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -69,7 +69,7 @@ jobs:
           # packages GROUPOID actually depends on. The previous `safety` step
           # installed only the tools and never the project, so it audited the
           # wrong environment. CPU torch keeps the install lean.
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e .
           pip install bandit pip-audit
           # Pin setuptools LAST. torch requires setuptools<82 and pulls in a
@@ -95,8 +95,8 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -107,14 +107,14 @@ jobs:
   benchmark:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       # Benchmarks run for information only. There is no regression gate:
       # timing baselines recorded on one machine are not comparable to a
@@ -128,7 +128,7 @@ jobs:
           pytest benchmarks/ -v --benchmark-json=benchmark_results.json || true
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: benchmark-results
           path: benchmark_results.json
@@ -137,14 +137,14 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev4}/.github/workflows/docs-deploy.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -18,27 +16,30 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: site/
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

groupoid-0.1.0.dev4/.github/workflows/release.yml

@@ -0,0 +1,107 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]*"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Existing tag/ref to build and publish to PyPI (e.g. v0.1.0.dev1). PyPI only — does NOT create a GitHub Release or Zenodo deposit. Leave blank for a normal tag-triggered release."
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # provenance OIDC
+      attestations: write   # actions/attest-build-provenance + attest-sbom
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip build
+          pip install cyclonedx-bom
+      - name: Build sdist + wheel
+        run: python -m build
+      - name: Generate CycloneDX SBOM
+        run: cyclonedx-py requirements -o sbom.cdx.json <(pip freeze)
+      - name: Provenance attestation (dist)
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        with:
+          subject-path: "dist/*"
+      - name: SBOM attestation (CycloneDX)
+        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e  # v4.1.0
+        with:
+          subject-path: "dist/*"
+          sbom-path: "sbom.cdx.json"
+      - name: Upload artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: release-artifacts
+          path: |
+            dist/*
+            sbom.cdx.json
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # PyPI Trusted Publishing OIDC
+    environment:
+      name: pypi
+      url: https://pypi.org/project/groupoid/
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-artifacts
+          path: .
+      - name: Publish to PyPI (Trusted Publishing, OIDC)
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+        with:
+          packages-dir: dist
+          print-hash: true
+
+  sign-and-release:
+    needs: build
+    # Only on a real tag push — a manual workflow_dispatch (used to publish an
+    # already-released tag to PyPI) must NOT create a duplicate GitHub Release
+    # or trigger a second Zenodo deposit.
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write       # create GitHub Release
+      id-token: write       # Sigstore signing OIDC
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-artifacts
+          path: .
+      - name: Sign artifacts with Sigstore
+        uses: sigstore/gh-action-sigstore-python@5b79a39c381910c090341a2c9b0bf022c8b387e1  # v3.4.0
+        with:
+          inputs: |
+            dist/*.tar.gz
+            dist/*.whl
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+        with:
+          generate_release_notes: true
+          files: |
+            dist/*
+            sbom.cdx.json
+            *.sigstore.json

groupoid-0.1.0.dev4/.zenodo.json

@@ -0,0 +1,39 @@
+{
+  "upload_type": "software",
+  "title": "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds",
+  "version": "0.1.0.dev4",
+  "description": "<p>Pre-alpha research prototype exploring groupoid-based aggregation for federated learning on Riemannian manifolds. Implements transport groupoid morphisms, first cohomology (H^1) for consistency detection, the cellular sheaf Laplacian for spectral analysis, parallel transport (Schild's and pole ladders), Riemannian optimizers, and Karcher mean aggregation via geomstats.</p><p><strong>Erratum / supersession notice:</strong> this version (v0.1.0.dev4) carries the mathematical corrections introduced in v0.1.0.dev1 over the earlier v0.1.0.dev0 snapshot (version DOI 10.5281/zenodo.20563975): the sheaf (connection) Laplacian is a verified positive-semidefinite operator with a transport-consistent kernel; persistence diagrams retain the homology-dimension label so H0 and H1 are no longer conflated; and H^1 cohomology raises on incomplete cocycles instead of forming partial holonomy. It also carries the v0.1.0.dev2 correction of a first-step magnitude inflation in the RiemannianAdam optimizer's bias initialization, and the v0.1.0.dev3 Morphism str()/format() display fix and documentation-accuracy corrections (v0.1.0.dev3 was cut in source control but never separately tagged or deposited, so this is the first deposit carrying its changes). New in v0.1.0.dev4: the Riemannian SGD and Adam optimizers now parallel-transport their accumulated moments between iterates instead of projecting them (projection could annihilate a geodesic-aligned moment); the parallel-transport and persistent-homology modules are wired into the aggregation pipeline; and a preregistered synthetic benchmark (see the repository's experiments/ directory) tests the central transport-aggregation hypothesis, finding it supported on synthetic frame-misaligned data and still unvalidated on real federated learning tasks. The v0.1.0.dev0 version DOI must not be cited for results. Cite the concept DOI (10.5281/zenodo.20563974), which always resolves to the latest corrected version, or this version or later.</p>",
+  "creators": [
+    {
+      "name": "Maniches, Santiago",
+      "affiliation": "TOPOLOGICA LLC",
+      "orcid": "0009-0005-6480-1987"
+    }
+  ],
+  "license": "Apache-2.0",
+  "keywords": [
+    "federated learning",
+    "Riemannian geometry",
+    "groupoid",
+    "sheaf theory",
+    "cohomology",
+    "topological data analysis"
+  ],
+  "related_identifiers": [
+    {
+      "identifier": "10.5281/zenodo.20563974",
+      "relation": "isVersionOf",
+      "scheme": "doi"
+    },
+    {
+      "identifier": "10.5281/zenodo.20787126",
+      "relation": "isNewVersionOf",
+      "scheme": "doi"
+    },
+    {
+      "identifier": "https://github.com/smaniches/GROUPOID",
+      "relation": "isSupplementTo",
+      "scheme": "url"
+    }
+  ]
+}

groupoid-0.1.0.dev4/CHANGELOG.md

@@ -0,0 +1,162 @@
+# Changelog
+
+All notable changes to GROUPOID are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
+this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
+(with PEP 440 identifiers for Python pre-releases).
+
+## [Unreleased]
+
+Nothing yet.
+
+## [0.1.0.dev4] - 2026-07-06
+
+`v0.1.0.dev3` was cut in source control (below) but never tagged or
+released: no `v0.1.0.dev3` tag was ever pushed, so PyPI, the GitHub
+Release, and the Zenodo deposit all skip directly from `0.1.0.dev2` to
+this version, which carries both the `0.1.0.dev3` changes and the ones
+below. See the "Releasing" section of `CONTRIBUTING.md` for the
+automation added in this version that prevents this gap from recurring.
+
+### Fixed
+- **Optimizer moment accumulators are now parallel-transported between
+  iterates**: Adam's first moment was previously carried across steps by
+  tangent projection (which can annihilate a geodesic-aligned moment) and
+  the SGD momentum velocity was not moved at all (leaving it non-tangent
+  at the new iterate). Both now use the metric's parallel transport (the
+  Becigneul-Ganea construction), with projection kept as the fallback for
+  metrics without parallel transport. Regression tests discriminate
+  transport from projection by exact norm preservation (#49).
+
+### Added
+- `TransportGroupoidAggregator.register_transport_from_points`: computes
+  and registers the transport matrix from two client base points via the
+  pole or Schild ladder, wiring `groupoid.transport` into the pipeline
+  (#49).
+- Opt-in `track_divergence` flag on the aggregator: each round computes
+  the persistent-homology summary of the transported parameters with the
+  H0-vs-H0 bottleneck distance to the previous round, exposed as
+  `FederatedRound.divergence` (default off; existing behavior unchanged),
+  wiring `groupoid.persistence` into the pipeline (#49).
+- Descent validation for the Riemannian optimizers: SGD, momentum SGD,
+  and Adam descend to a known target on S^2; the optimizer status labels
+  in STATUS.md and the docs are upgraded accordingly (general
+  convergence-rate analysis still does not exist and is not claimed)
+  (#49).
+- A preregistered synthetic benchmark (`experiments/`): preregistration
+  pushed before execution, 600 seeded runs, 2x2 transport/mean ablation
+  against an oracle estimand, corrupted-cocycle conditions, and a
+  committed preregistered analysis (`experiments/RESULTS.md`). Supports
+  the transport benefit under frame misalignment (largely by
+  construction) and the pooled H^1-error correlation under corruption,
+  with the within-level caveat, a failed null check reported as failed,
+  and one documented seeding deviation (#49).
+- Release automation: pushing a version bump to `main` now tags and
+  releases automatically, removing the manual tag-push step.
+
+## [0.1.0.dev3] - 2026-07-06
+
+Cut in source control but never tagged or released; see `0.1.0.dev4` above.
+
+### Fixed
+- **`Morphism` `str()`/`format()` output**: pydantic's `BaseModel` defines
+  `__str__` separately from `__repr__`, so `print()`, f-strings, and loguru's
+  `{}` formatting dumped the full transport matrix instead of the compact
+  `Morphism(A -> B)` form the `__repr__` override implements. `__str__` now
+  aliases `__repr__`, with a regression test (#47).
+
+### Changed
+- Docs-site installation pages corrected to state the package is published on
+  PyPI as a development pre-release, aligning `docs/index.md` and
+  `docs/quickstart.md` with the README and `STATUS.md` corrections from #37
+  and #39 (#47).
+- `curvature_adaptive_lr` docstring corrected to describe the implemented
+  behavior: the rate is damped in positive curvature and returned unchanged
+  otherwise; no enlargement is applied in negative curvature (#47).
+- `LIMITATIONS.md` now records that `torch`, `pymanopt`, `POT`, and `einops`
+  are declared runtime dependencies with no current code path (the suite
+  passes with all four uninstalled) (#47).
+
+## [0.1.0.dev2] - 2026-06-21
+
+### Fixed
+- **RiemannianAdam first-moment bias initialization**: the first moment was
+  seeded as `grad` while the zero-init bias correction `m / (1 - beta1**t)` was
+  still applied, leaving `1/(1 - beta1)` uncancelled and inflating the first
+  optimization step ~10x (beta1 = 0.9). Now seeded as `(1 - beta1) * grad` so the
+  bias correction recovers `grad`, matching standard Adam. The optimizer is not
+  integrated into the aggregation pipeline, so no published result changes (#39).
+
+### Changed
+- `STATUS.md` corrected to state the package is published on PyPI as a development
+  pre-release (`groupoid 0.1.0.dev2`) rather than "not published on PyPI" (#39).
+
+## [0.1.0.dev1] - 2026-06-16
+
+First tag cut on mathematically corrected code. The earlier `v0.1.0.dev0` tag and
+its Zenodo version DOI (`10.5281/zenodo.20563975`) predate the correctness fixes
+below and are **superseded**; that snapshot must not be cited for results. The
+concept DOI (`10.5281/zenodo.20563974`) resolves to this version.
+
+### Fixed
+- **Sheaf (connection) Laplacian** corrected to a positive-semidefinite operator
+  `L = delta^T delta` with a transport-consistent kernel, verified against an
+  independently constructed coboundary (#13, closes #8).
+- **Persistence diagrams** now retain the homology-dimension label, so H0 and H1
+  bars are no longer conflated; `track_divergence` compares H0 against H0 only,
+  verified against an independent scipy minimum-spanning-tree reconstruction
+  (#21, closes #10).
+- **Cohomology**: `compute_h1` raises `IncompleteCocycleError` naming the missing
+  edge instead of forming a meaningless partial holonomy, and disconnected-graph
+  transport is re-raised as an explicit domain error (#20).
+- Benchmark CI regression check soft-skips on a missing JSON baseline instead of
+  failing the job (#15).
+
+### Added
+- 100% line + branch test coverage of the `groupoid` package on Python 3.10-3.12,
+  enforced in CI via `--cov-branch --cov-fail-under=100` (#18).
+- Cold-clone reproducibility: a seeded determinism receipt and reproduction guide
+  (`REPRODUCE.md`), install cap, stub clarity, and a real CI gate (#16).
+- Aggregation tests covering forward-edge traversal, weighted mean, and the
+  inconsistency flag (#17).
+- Zenodo concept-DOI badge and `CITATION.cff` DOI metadata (#11).
+- A `Documentation` project URL and keywords aligned across `pyproject.toml`,
+  `codemeta.json`, and `CITATION.cff` (#19).
+- A consolidated `PROBLEMS.md` self-audit recording corrected bugs, known
+  limitations, and deferred work (#23).
+- A `CHANGELOG.md` linked from package metadata (#24).
+- A `.zenodo.json` so archival deposits carry curated metadata, a supersession
+  note for `v0.1.0.dev0`, and version-chain links to the concept and prior DOIs.
+- Dependabot configuration for weekly `pip` and `github-actions` updates (#25).
+
+### Changed
+- Numpy array annotations parameterized to `NDArray[np.float64]`, with
+  `mypy --strict` enforced as a hard, gating CI step (#26).
+
+### Security
+- Replaced the deprecated soft `safety check` with a hard, gating `pip-audit`
+  step; the fix-less torch advisory CVE-2025-3000 is documented and explicitly
+  ignored with its rationale in `SECURITY.md` (#22).
+
+## [0.1.0.dev0] - 2026-06-05
+
+Initial pre-alpha research prototype. Core implementation of groupoid-based
+aggregation for federated learning on Riemannian manifolds: the transport groupoid
+(morphism composition and inverse), the Karcher mean via geomstats, H^1
+cohomological consistency, the sheaf Laplacian, parallel transport (Schild's and
+pole ladders), and persistence-based divergence tracking. Ships machine-readable
+citation metadata (`CITATION.cff`, `codemeta.json` with ORCID). Pre-alpha: APIs
+may change and the central hypothesis is not yet validated (see `STATUS.md` and
+`LIMITATIONS.md`).
+
+Date shown is the tag commit (`v0.1.0.dev0` -> 2a02954). `CITATION.cff` records
+`date-released: 2026-05-25`, when the core implementation landed; the tag was
+later placed on the metadata commit.
+
+[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev4...HEAD
+[0.1.0.dev4]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev2...v0.1.0.dev4
+[0.1.0.dev3]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev2...af42cb4
+[0.1.0.dev2]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev1...v0.1.0.dev2
+[0.1.0.dev1]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev0...v0.1.0.dev1
+[0.1.0.dev0]: https://github.com/smaniches/GROUPOID/releases/tag/v0.1.0.dev0

{groupoid-0.1.0.dev1 → groupoid-0.1.0.dev4}/CITATION.cff

@@ -2,8 +2,8 @@ cff-version: 1.2.0
 message: "If you use this software, please cite it as below."
 type: software
 title: "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds"
-version: 0.1.0.dev1
-date-released: 2026-06-16
+version: 0.1.0.dev4
+date-released: 2026-07-06
 license: Apache-2.0
 repository-code: "https://github.com/smaniches/GROUPOID"
 doi: 10.5281/zenodo.20563974