groupoid 0.1.0.dev4__tar.gz → 0.1.0.dev5__tar.gz

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev5}/.github/dependabot.yml

@@ -28,6 +28,15 @@ updates:
     # updates patch vulnerable dependencies regardless of this allow filter.
     allow:
       - dependency-type: "direct"
+    # numpy 2.x is a verified runtime incompatibility, not a routine bump:
+    # geomstats (a required runtime dependency) fails at import under
+    # numpy>=2.0 because `numpy.trapz` was removed, so the tested
+    # numpy>=1.24,<2.0 contract in pyproject.toml cannot widen (see closed
+    # PR #57). Scoped by version, not a blanket numpy ignore: compatible
+    # numpy 1.x version updates and 1.x security updates still flow.
+    ignore:
+      - dependency-name: "numpy"
+        versions: [">=2.0.0"]
     groups:
       # Batch updates by area into a single PR per group to limit noise instead
       # of one PR per package.

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev5}/.github/workflows/auto-tag-release.yml

@@ -1,18 +1,27 @@
 name: Auto Tag Release
 
-# Creates the tag for a release-cut merge to main; it does nothing else.
+# Creates the tag for a release-cut merge to main, then explicitly dispatches
 # release.yml (build, attestations, PyPI publish, signing, GitHub Release)
-# is triggered solely by that tag push, exactly as it would be from a
-# manual `git tag vX.Y.Z && git push origin vX.Y.Z`. Keeping tag creation
-# and publishing in two separate, single-purpose workflows means the
-# actual publish path has exactly one trigger (a tag push) to reason
-# about, instead of depending on GitHub's anti-recursion behavior for
-# GITHUB_TOKEN-authored pushes not re-triggering the same push event.
+# against that tag.
 #
-# If a version needs a tag this workflow's format check rejects (see
-# below), tag it manually -- this automation only ever creates a tag
-# when one is missing, so a pre-existing manual tag always takes
-# precedence and this workflow becomes a no-op for that version.
+# The dispatch is explicit, not a tag-push trigger, because GitHub suppresses
+# push-triggered workflow runs caused by a GITHUB_TOKEN-authored push: pushing
+# the tag here does NOT cause release.yml's `on.push.tags` trigger to fire.
+# workflow_dispatch is the documented exception to that suppression, which is
+# why this workflow calls `gh workflow run` instead of relying on the tag
+# push itself. (An earlier version of this workflow assumed the tag push
+# alone would trigger release.yml; it did not, and no release was produced
+# for v0.1.0.dev4 until this was fixed and the release re-run manually.)
+#
+# release.yml's own `push.tags` trigger remains as a fallback/manual path
+# (a human pushing a tag with their own credentials is not subject to this
+# suppression), alongside its `workflow_dispatch` trigger for republishing an
+# existing tag to PyPI only.
+#
+# If a version needs a tag this workflow's format check rejects (see below),
+# tag it manually -- this automation only ever creates a tag when one is
+# missing, so a pre-existing manual tag always takes precedence and this
+# workflow becomes a no-op for that version.
 
 on:
   push:
@@ -27,13 +36,16 @@ jobs:
   tag:
     runs-on: ubuntu-latest
     permissions:
-      contents: write   # push the tag; nothing else in this workflow needs it
+      contents: write   # push the tag
+      actions: write    # dispatch release.yml via `gh workflow run`
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0   # need full tag history to check for an existing tag
 
-      - name: Create the release tag if this version doesn't have one yet
+      - name: Create the release tag if this version doesn't have one yet, and dispatch the release
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
 
@@ -70,3 +82,10 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git tag -a "${tag}" -m "Release ${tag}"
           git push origin "refs/tags/${tag}"
+
+          echo "Dispatching release.yml for ${tag}."
+          gh workflow run release.yml \
+            --repo "${GITHUB_REPOSITORY}" \
+            --ref "${tag}" \
+            -f "ref=${tag}" \
+            -f "create_github_release=true"

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev5}/.github/workflows/ci.yml

@@ -13,8 +13,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -40,8 +40,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
@@ -58,8 +58,8 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -83,20 +83,27 @@ jobs:
       - name: Audit dependencies for known vulnerabilities (pip-audit)
         # pip-audit (OSV-backed, maintained) replaces the deprecated `safety check`
         # (deprecated in safety 3.x in favour of the account-gated `safety scan`).
-        # HARD gate: any advisory with a fix version fails the job. The single
-        # documented exception is CVE-2025-3000 (torch): no fixed release exists
-        # upstream, and OSV expresses the affected range (listed versions up to
-        # v2.6.0) as a Git/commit boundary pip-audit cannot version-resolve, so it
-        # conservatively flags the installed torch. Disclosed in SECURITY.md; the
-        # torch.load / JIT deserialization path is not exercised by GROUPOID. Revisit
-        # the ignore once upstream publishes a fixed release.
-        run: pip-audit --ignore-vuln CVE-2025-3000
+        # HARD gate: any advisory with a fix version fails the job. Two documented
+        # exceptions, both disclosed in SECURITY.md:
+        # - CVE-2025-3000 (torch): no fixed release exists upstream, and OSV
+        #   expresses the affected range (listed versions up to v2.6.0) as a
+        #   Git/commit boundary pip-audit cannot version-resolve, so it
+        #   conservatively flags the installed torch. The torch.load / JIT
+        #   deserialization path is not exercised by GROUPOID. Revisit the ignore
+        #   once upstream publishes a fixed release.
+        # - PYSEC-2026-3447 (CVE-2026-59890, setuptools <83): the fix (83.0.0) is
+        #   unreachable while torch requires setuptools<82 (see the install step
+        #   above). The flaw is a macOS-only (APFS/HFS+) Unicode-normalization
+        #   bypass of MANIFEST.in exclude rules when building sdists; all CI and
+        #   release builds run on ubuntu-latest. Drop the ignore once torch
+        #   permits setuptools>=83.
+        run: pip-audit --ignore-vuln CVE-2025-3000 --ignore-vuln PYSEC-2026-3447
 
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -107,8 +114,8 @@ jobs:
   benchmark:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -137,8 +144,8 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev5}/.github/workflows/docs-deploy.yml

@@ -16,8 +16,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies

groupoid-0.1.0.dev5/.github/workflows/release.yml

@@ -0,0 +1,222 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]*"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Existing tag/ref to build and publish (e.g. v0.1.0.dev1). Leave blank for a normal tag-triggered release."
+        required: false
+        default: ""
+      create_github_release:
+        description: "Also sign with Sigstore and create a GitHub Release (which triggers the Zenodo deposit) for this tag. Default false: PyPI publish only, for republishing an already-released tag without creating a duplicate GitHub Release. auto-tag-release.yml sets this true when it dispatches a new version's first release."
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  # Privilege separation: this job holds the attestation credentials, so it
+  # must never install the built wheel or resolve its runtime dependency
+  # graph. SBOM generation (which does both) runs in the unprivileged `sbom`
+  # job; the SBOM attestation runs in `attest-sbom`, which installs nothing.
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # provenance OIDC
+      attestations: write   # actions/attest-build-provenance
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install build tooling
+        run: python -m pip install --upgrade pip build
+      - name: Build sdist + wheel
+        run: python -m build
+      - name: Assert exactly one release wheel
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if (( ${#wheels[@]} != 1 )); then
+            echo "::error::expected exactly one release wheel, found ${#wheels[@]}"
+            exit 1
+          fi
+      - name: Provenance attestation (dist)
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
+        with:
+          subject-path: "dist/*"
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: release-dist
+          path: dist/
+
+  # Unprivileged by design: installing the wheel resolves and executes
+  # third-party package installs, so this job gets no id-token, no
+  # attestations, no write access of any kind.
+  sbom:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - name: Generate CycloneDX SBOM from exact release wheel
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if (( ${#wheels[@]} != 1 )); then
+            echo "::error::expected exactly one release wheel, found ${#wheels[@]}"
+            exit 1
+          fi
+          wheel="${wheels[0]}"
+
+          python -m pip install --upgrade pip cyclonedx-bom
+
+          # Keep build tooling out of the analyzed environment. pip's --python
+          # option installs the exact wheel and its resolved runtime graph into
+          # a venv that was created without pip.
+          python -m venv --without-pip .sbom-runtime
+          python -m pip --python .sbom-runtime install "$wheel"
+
+          cyclonedx-py environment .sbom-runtime/bin/python \
+            --pyproject pyproject.toml \
+            --mc-type library \
+            --output-reproducible \
+            --output-format JSON \
+            --output-file sbom.cdx.json
+          python scripts/bind_release_sbom.py --sbom sbom.cdx.json --wheel "$wheel"
+      - name: Independently verify SBOM root against exact wheel
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if (( ${#wheels[@]} != 1 )); then
+            echo "::error::expected exactly one release wheel, found ${#wheels[@]}"
+            exit 1
+          fi
+          python scripts/bind_release_sbom.py --verify-only --sbom sbom.cdx.json --wheel "${wheels[0]}"
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: release-sbom
+          path: sbom.cdx.json
+
+  # The only privileged SBOM step. It consumes the already-built wheel and the
+  # already-verified SBOM; it installs no packages, resolves no dependencies,
+  # and executes no project code. The SBOM describes the installed wheel's
+  # runtime closure, so it is attested to the wheel subject only — never the
+  # sdist.
+  attest-sbom:
+    needs: [build, sbom]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # attestation OIDC
+      attestations: write   # actions/attest-sbom
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-sbom
+          path: .
+      - uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e  # v4.1.0
+        with:
+          subject-path: "dist/*.whl"
+          sbom-path: "sbom.cdx.json"
+
+  publish-pypi:
+    # Publication waits for the full integrity chain: build provenance
+    # (build), SBOM generation + verification (sbom), and the wheel-bound
+    # SBOM attestation (attest-sbom).
+    needs: [build, sbom, attest-sbom]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # PyPI Trusted Publishing OIDC
+    environment:
+      name: pypi
+      url: https://pypi.org/project/groupoid/
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - name: Publish to PyPI (Trusted Publishing, OIDC)
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1
+        with:
+          packages-dir: dist
+          print-hash: true
+          # Idempotent: a re-dispatch or an out-of-band manual republish of a
+          # version already on PyPI should not fail the job.
+          skip-existing: true
+
+  sign-and-release:
+    needs: [build, sbom, attest-sbom]
+    # On a real tag push, or an explicit request via create_github_release=true
+    # (see auto-tag-release.yml, which dispatches this workflow with that flag
+    # set for a version's first release, since GitHub suppresses push-triggered
+    # workflow runs caused by its own GITHUB_TOKEN). A plain workflow_dispatch
+    # republish (create_github_release left at its false default) must NOT
+    # create a duplicate GitHub Release or trigger a second Zenodo deposit.
+    if: github.event_name == 'push' || github.event.inputs.create_github_release == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write       # create GitHub Release
+      id-token: write       # Sigstore signing OIDC
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-sbom
+          path: .
+      - name: Sign artifacts with Sigstore
+        uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9  # v3.5.0
+        with:
+          inputs: |
+            dist/*.tar.gz
+            dist/*.whl
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
+        with:
+          # Explicit rather than relying on ref inference: on a tag push
+          # github.ref_name is already the tag, but being explicit keeps this
+          # correct regardless of trigger type.
+          tag_name: ${{ github.event.inputs.ref || github.ref_name }}
+          generate_release_notes: true
+          files: |
+            dist/*
+            sbom.cdx.json
+            *.sigstore.json

groupoid-0.1.0.dev5/.zenodo.json

@@ -0,0 +1,39 @@
+{
+  "upload_type": "software",
+  "title": "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds",
+  "version": "0.1.0.dev5",
+  "description": "<p>Pre-alpha research prototype exploring groupoid-based aggregation for federated learning on Riemannian manifolds. The supported point-valued aggregation path uses explicit invertible point actions, a cycle-basis holonomy defect diagnostic, the cellular sheaf Laplacian, and Karcher mean aggregation via geomstats. Tangent-vector parallel transport is provided separately through Schild and pole ladder utilities.</p><p><strong>Scientific correction in v0.1.0.dev5:</strong> earlier releases described the cycle-basis holonomy statistic as a first-cohomology (H^1) norm. The implementation actually computes the maximum Frobenius deviation of holonomy from identity over the particular NetworkX cycle basis. Exact zero has a flatness interpretation under explicit connectedness, completeness, invertibility, reciprocal opposite-edge registration when both directions are supplied, and complete evaluation of every cycle emitted by the NetworkX cycle-basis routine (an argument specific to the NetworkX Paton implementation exercised here, not to arbitrary cycle bases), but the nonzero magnitude is basis-dependent and is not invariant under arbitrary invertible changes of frame. The stored preregistered benchmark values are unchanged; the historical H2 rho and permutation p-value are reinterpreted as statistics for this fixed cycle-basis defect, not for a canonical H^1 norm. This version also withdraws register_transport_from_points from the supported point-valued aggregation path: its ambient square operator is assembled from transported tangent vectors and does not generally define the invertible manifold point action that aggregation requires. Tangent-vector ladder validation remains supported. The ambient tangent-matrix helper is restricted to vector-shaped point representations. Direct registered matrices are supported only under the explicit point-action contract documented in the repository, including reciprocal opposite arrows when both orientations are stored. See CORRECTION_NOTICE.md for the full correction record.</p><p>The earlier v0.1.0.dev0 version DOI 10.5281/zenodo.20563975 remains superseded and must not be cited for results. Exact historical versions should be cited by their version-specific DOI; project-level DOI metadata is maintained through the Zenodo version family.</p>",
+  "creators": [
+    {
+      "name": "Maniches, Santiago",
+      "affiliation": "TOPOLOGICA LLC",
+      "orcid": "0009-0005-6480-1987"
+    }
+  ],
+  "license": "Apache-2.0",
+  "keywords": [
+    "federated learning",
+    "Riemannian geometry",
+    "groupoid",
+    "sheaf theory",
+    "holonomy",
+    "topological data analysis"
+  ],
+  "related_identifiers": [
+    {
+      "identifier": "10.5281/zenodo.20563974",
+      "relation": "isVersionOf",
+      "scheme": "doi"
+    },
+    {
+      "identifier": "10.5281/zenodo.21230068",
+      "relation": "isNewVersionOf",
+      "scheme": "doi"
+    },
+    {
+      "identifier": "https://github.com/smaniches/GROUPOID",
+      "relation": "isSupplementTo",
+      "scheme": "url"
+    }
+  ]
+}

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev5}/CHANGELOG.md

@@ -8,7 +8,53 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
-Nothing yet.
+## [0.1.0.dev5]
+
+Scientific correction release. See `CORRECTION_NOTICE.md` for the evidence and
+scope. Historical preregistration and result artifacts are preserved unchanged.
+
+### Fixed
+- **The former `H^1` scalar is now identified by the quantity actually
+  computed.** `cycle_basis_holonomy_defect` returns
+  `max_{gamma in B} ||Hol(gamma) - I||_F` over the NetworkX cycle basis. The
+  historical `compute_h1` name remains as a deprecated compatibility alias.
+  The exact zero set has a flatness interpretation under explicit connected,
+  complete, invertible edge-transport assumptions with every cycle emitted by
+  `networkx.cycle_basis` evaluated -- an argument specific to the emission
+  order of the NetworkX Paton implementation exercised here, not to arbitrary
+  cycle bases -- but the nonzero magnitude is cycle-basis-dependent and is not
+  invariant under arbitrary invertible changes of frame. Finite threshold
+  decisions are therefore representation-dependent diagnostics, not canonical
+  cohomological verdicts.
+- **Tangent-vector transport is no longer promoted into an unsupported
+  point-valued morphism.** `compute_tangent_transport_matrix` now names the
+  ambient-coordinate tangent operator explicitly. The old
+  `compute_transport_matrix` name remains as a deprecated alias.
+  `register_transport_from_points` is retained only as a compatibility stub
+  and fails closed because tangent parallel transport does not by itself define
+  the invertible point action required by the current aggregator.
+- **Direct transport registration now states and checks the point-action
+  contract exercised by aggregation.** Registered matrices must be finite,
+  square and invertible, and actual forward and return images must remain on
+  the configured manifold. This validates exercised point actions, not
+  arbitrary matrices as generic geometric transports. The supported S^2
+  evidence continues to use explicit SO(3) rotations.
+- **Benchmark H2 interpretation corrected without changing its historical
+  numerical result.** The committed rho=0.587 and permutation p=0.00010 are
+  retained as the association between aggregation error and the fixed
+  cycle-basis holonomy-defect statistic across pooled corruption levels; the
+  near-zero within-level correlations remain an explicit caveat.
+- **Preregistration provenance language calibrated.** Current explanatory
+  documentation distinguishes Git commit-order evidence from the separate
+  project-record assertion that the preregistration was pushed before local
+  benchmark execution. The locked preregistration is unchanged.
+- **Release automation now explicitly dispatches the release workflow after
+  creating a tag.** The initial 0.1.0.dev4 auto-tag path used the workflow
+  `GITHUB_TOKEN`; the resulting tag push did not trigger the tag-push release
+  workflow. The 0.1.0.dev4 GitHub Release was subsequently produced after a
+  manual workflow run. The current auto-tag workflow explicitly dispatches
+  `release.yml` so future automated release cuts do not rely on a suppressed
+  bot-authored push event.
 
 ## [0.1.0.dev4] - 2026-07-06
 
@@ -154,7 +200,8 @@ Date shown is the tag commit (`v0.1.0.dev0` -> 2a02954). `CITATION.cff` records
 `date-released: 2026-05-25`, when the core implementation landed; the tag was
 later placed on the metadata commit.
 
-[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev4...HEAD
+[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev5...HEAD
+[0.1.0.dev5]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev4...v0.1.0.dev5
 [0.1.0.dev4]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev2...v0.1.0.dev4
 [0.1.0.dev3]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev2...af42cb4
 [0.1.0.dev2]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev1...v0.1.0.dev2

groupoid-0.1.0.dev5/CITATION.cff

@@ -0,0 +1,35 @@
+cff-version: 1.2.0
+message: "If you use this software, please cite the Concept DOI below so the citation resolves to the latest version."
+type: software
+title: "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds"
+version: 0.1.0.dev5
+license: Apache-2.0
+repository-code: "https://github.com/smaniches/GROUPOID"
+doi: 10.5281/zenodo.20563974
+identifiers:
+  - type: doi
+    value: 10.5281/zenodo.20563974
+    description: "Concept DOI (all versions)."
+  - type: doi
+    value: 10.5281/zenodo.20563975
+    description: "Version DOI (v0.1.0.dev0) - SUPERSEDED. Do not cite this historical snapshot for current results."
+authors:
+  - family-names: Maniches
+    given-names: Santiago
+    email: santiago.maniches@gmail.com
+    affiliation: TOPOLOGICA LLC
+    orcid: "https://orcid.org/0009-0005-6480-1987"
+keywords:
+  - federated learning
+  - Riemannian geometry
+  - groupoid
+  - sheaf theory
+  - holonomy
+  - topological data analysis
+abstract: >-
+  Pre-alpha research prototype for groupoid-based aggregation on Riemannian
+  manifolds. The supported point-valued path uses explicit invertible point
+  actions, a basis-dependent cycle-holonomy defect diagnostic, the cellular
+  sheaf Laplacian, and Karcher mean aggregation. Tangent-vector parallel
+  transport utilities are provided separately. Earlier H^1-norm terminology
+  is superseded by the construct definition in CORRECTION_NOTICE.md.

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev5}/CONTRIBUTING.md

@@ -88,8 +88,7 @@ please open an issue using the "Mathematical Correction" template.
 2. Merge the PR to `main`.
 
 That's it — merging is the release trigger, split across two workflows
-with one job each so the actual publish path has exactly one trigger to
-reason about:
+with one job each:
 
 - `.github/workflows/auto-tag-release.yml` runs on every push to `main`
   that touches `pyproject.toml`. It reads the version out of
@@ -97,13 +96,23 @@ reason about:
   pushes one (as `github-actions[bot]`) after checking the version has a
   recognized format and that `CHANGELOG.md` documents it. A push with no
   version change, or whose tag already exists, is a no-op.
-- That tag push triggers `.github/workflows/release.yml` exactly as a
-  manual `git tag vX.Y.Z && git push origin vX.Y.Z` would: build,
+- It then explicitly dispatches `.github/workflows/release.yml` against
+  that tag with `create_github_release: true`, rather than relying on the
+  tag push itself to trigger it. This is necessary, not a stylistic
+  choice: GitHub suppresses push-triggered workflow runs caused by a
+  `GITHUB_TOKEN`-authored push, so the tag push from
+  `auto-tag-release.yml` does *not* fire `release.yml`'s own
+  `push.tags` trigger (`workflow_dispatch` is the documented exception to
+  that suppression). `release.yml` then does what it always did: build,
   provenance and SBOM attestation, publish to PyPI via Trusted
   Publishing, Sigstore signing, and a GitHub Release (which in turn
-  triggers the Zenodo deposit for the new version DOI). `release.yml`
-  itself is unchanged from before this automation existed — it only
-  ever runs from a tag push or a manual `workflow_dispatch`.
+  triggers the Zenodo deposit for the new version DOI).
+- `release.yml`'s `push.tags` trigger remains as a fallback/manual path —
+  a human pushing a tag with their own credentials is not subject to the
+  `GITHUB_TOKEN` suppression above, so that still works normally. Its
+  `workflow_dispatch` trigger (`create_github_release` left at its default
+  `false`) republishes an existing tag to PyPI only, without creating a
+  duplicate GitHub Release or Zenodo deposit.
 
 The actual PyPI publish step still runs under the `pypi` GitHub
 Environment; if that environment has required reviewers configured, the