groupoid 0.1.0.dev6__tar.gz → 0.1.0.dev7__tar.gz

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/.github/dependabot.yml

@@ -42,7 +42,6 @@ updates:
       # of one PR per package.
       runtime:
         patterns:
-          - "torch"
           - "geomstats"
           - "pymanopt"
           - "ripser"

groupoid-0.1.0.dev7/.github/workflows/artifact-transfer.yml

@@ -0,0 +1,46 @@
+name: Artifact transfer integrity
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/workflows/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/workflows/**"]
+
+permissions:
+  contents: read
+
+jobs:
+  round-trip:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Create fixture and independent expected checksum
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p payload/nested
+          printf '%s\n' "$GITHUB_SHA" > payload/nested/fixture.txt
+          (cd payload && sha256sum nested/fixture.txt) > expected.sha256
+      - name: Upload fixture
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: artifact-transfer-proof
+          path: payload/
+          if-no-files-found: error
+          retention-days: 1
+      - name: Remove original fixture before downloading
+        run: rm -r payload
+      - name: Download fixture
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: artifact-transfer-proof
+          path: restored/
+      - name: Verify restored bytes and directory layout
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd restored
+          test "$(find . -type f | wc -l)" -eq 1
+          sha256sum --check ../expected.sha256

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -24,8 +24,8 @@ jobs:
           # numpy / pydantic stubs (NDArray dtype args, the BaseModel base class).
           # Linting only against `ruff black mypy` left numpy/pydantic uninstalled,
           # so --strict raised disallow_subclassing_any on the BaseModel subclass.
-          # Consistent with the test / security / docs jobs. CPU torch keeps it lean.
-          .github/scripts/install_torch_cpu.sh
+          # All jobs now install the declared runtime dependencies, without
+          # the unused optional PyTorch backend.
           pip install -e ".[dev]"
       - name: Run ruff
         run: ruff check .
@@ -41,13 +41,12 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       - name: Run tests with coverage gate
         run: >-
@@ -59,7 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -68,42 +67,25 @@ jobs:
           # Install the project's real runtime closure so pip-audit scans the
           # packages GROUPOID actually depends on. The previous `safety` step
           # installed only the tools and never the project, so it audited the
-          # wrong environment. CPU torch keeps the install lean.
-          .github/scripts/install_torch_cpu.sh
+          # wrong environment. No unused PyTorch install is injected.
           pip install -e .
           pip install bandit pip-audit
-          # Pin setuptools LAST. torch requires setuptools<82 and pulls in a
-          # runner-bundled setuptools that can predate the PYSEC-2025-49 fix
-          # (78.1.1); upgrading before `pip install -e .` is simply undone by torch.
-          # The window >=78.1.1,<82 clears the advisory while staying
-          # dependency-consistent with torch (verified: pip check clean).
-          python -m pip install --upgrade "setuptools>=78.1.1,<82"
+          # Setuptools is build tooling, but remains in the audited CI environment.
+          # No torch<82 constraint remains; require the patched release.
+          python -m pip install --upgrade "setuptools>=84.1.0"
+          python -m pip check
       - name: Run bandit
         run: bandit -r groupoid/ -c pyproject.toml
       - name: Audit dependencies for known vulnerabilities (pip-audit)
-        # pip-audit (OSV-backed, maintained) replaces the deprecated `safety check`
-        # (deprecated in safety 3.x in favour of the account-gated `safety scan`).
-        # HARD gate: any advisory with a fix version fails the job. Two documented
-        # exceptions, both disclosed in SECURITY.md:
-        # - CVE-2025-3000 (torch): no fixed release exists upstream, and OSV
-        #   expresses the affected range (listed versions up to v2.6.0) as a
-        #   Git/commit boundary pip-audit cannot version-resolve, so it
-        #   conservatively flags the installed torch. The torch.load / JIT
-        #   deserialization path is not exercised by GROUPOID. Revisit the ignore
-        #   once upstream publishes a fixed release.
-        # - PYSEC-2026-3447 (CVE-2026-59890, setuptools <83): the fix (83.0.0) is
-        #   unreachable while torch requires setuptools<82 (see the install step
-        #   above). The flaw is a macOS-only (APFS/HFS+) Unicode-normalization
-        #   bypass of MANIFEST.in exclude rules when building sdists; all CI and
-        #   release builds run on ubuntu-latest. Drop the ignore once torch
-        #   permits setuptools>=83.
-        run: pip-audit --ignore-vuln CVE-2025-3000 --ignore-vuln PYSEC-2026-3447
+        # Hard gate on the installed runtime and audit-tool closure.
+        # No CVE/PYSEC ignore flags or waived vulnerable packages.
+        run: pip-audit
 
   pre-commit:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -115,13 +97,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       # Benchmarks run for information only. There is no regression gate:
       # timing baselines recorded on one machine are not comparable to a
@@ -135,7 +116,7 @@ jobs:
           pytest benchmarks/ -v --benchmark-json=benchmark_results.json || true
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: benchmark-results
           path: benchmark_results.json
@@ -145,13 +126,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/.github/workflows/docs-deploy.yml

@@ -17,13 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/.github/workflows/release.yml

@@ -145,7 +145,7 @@ jobs:
             exit 1
           fi
           echo "release target ${RELEASE_TARGET} matches pyproject version ${version}"
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
         with:
           python-version: "3.12"
           cache: pip
@@ -283,7 +283,7 @@ jobs:
         with:
           subject-path: "dist/*"
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: release-dist
           path: dist/
@@ -300,11 +300,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
         with:
           python-version: "3.12"
           cache: pip
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
@@ -347,7 +347,7 @@ jobs:
           fi
           python scripts/bind_release_sbom.py --verify-only --sbom sbom.cdx.json --wheel "${wheels[0]}"
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: release-sbom
           path: sbom.cdx.json
@@ -365,11 +365,11 @@ jobs:
       id-token: write       # attestation OIDC
       attestations: write   # actions/attest
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-sbom
           path: .
@@ -407,7 +407,7 @@ jobs:
       name: pypi
       url: https://pypi.org/project/groupoid/
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
@@ -479,7 +479,7 @@ jobs:
       # step below still runs, so COMPLETE still proves PyPI is correct.
       - name: Publish to PyPI (Trusted Publishing, OIDC)
         if: needs.build.outputs.adopted != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # release/v1
         with:
           packages-dir: dist
           print-hash: true
@@ -501,8 +501,14 @@ jobs:
           import hashlib, json, pathlib, sys, time, urllib.error, urllib.request
 
           dist = pathlib.Path("dist")
+          # PEP 740 .publish.attestation sidecars may be written to dist/ by
+          # the PyPI publishing action. They are attestations attached to the
+          # distributions, not separate package files in PyPI JSON urls.
+          # Compare every actual wheel/sdist byte without treating sidecars
+          # as missing distributions.
           local = {p.name: hashlib.sha256(p.read_bytes()).hexdigest()
-                   for p in sorted(dist.iterdir()) if p.is_file()}
+                   for p in sorted(dist.iterdir())
+                   if p.is_file() and p.name.endswith((".whl", ".tar.gz"))}
           wheel = next(n for n in local if n.endswith(".whl"))
           project, version = wheel.split("-")[0], wheel.split("-")[1]
           url = f"https://pypi.org/pypi/{project}/{version}/json"
@@ -565,11 +571,11 @@ jobs:
       id-token: write       # Sigstore signing OIDC
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-sbom
           path: .

groupoid-0.1.0.dev7/.zenodo.json

@@ -0,0 +1,34 @@
+{
+  "upload_type": "software",
+  "title": "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds",
+  "version": "0.1.0.dev7",
+  "description": "<p>Pre-alpha research prototype exploring groupoid-based aggregation for federated learning on Riemannian manifolds. The supported point-valued aggregation path uses explicit invertible point actions, a cycle-basis holonomy defect diagnostic, the cellular sheaf Laplacian, and Karcher mean aggregation via geomstats. Tangent-vector parallel transport is provided separately through Schild and pole ladder utilities.</p><p><strong>Corrective release v0.1.0.dev7:</strong> the finite H0 bottleneck distance to an empty diagram is now half the longest unmatched interval, rather than an incorrect zero (both comparison directions tested). The unused mandatory PyTorch dependency was removed, reducing installation and audit complexity, and CI dependency scanning now runs without vulnerability exceptions. Pre-alpha research maturity, known limits on the H0-only diagnostic, and historical experiment results are unchanged. Existing environments may retain PyTorch after an upgrade.</p><p><strong>Library correction in v0.1.0.dev6:</strong> in v0.1.0.dev5 and earlier, the pole ladder used a step schedule that did not reach the endpoint for more than one rung, and the function named schild_ladder was a pole-ladder variant rather than Schild's construction; tangent-vector transport results from those versions with n_rungs greater than 1, including the default two-rung tangent transport operator, are incorrect. v0.1.0.dev6 corrects both ladders and adds input validation for unknown transport methods, n_rungs below 1, negative, non-finite or zero-sum aggregation weights, and non-finite holonomy maps. The preregistered benchmark uses explicit transport maps, not the ladders; its stored results are unchanged and were reproduced bit-for-bit under the dev6 candidate. The project remains a pre-alpha research prototype.</p><p><strong>Scientific correction in v0.1.0.dev5:</strong> earlier releases described the cycle-basis holonomy statistic as a first-cohomology (H^1) norm. The implementation actually computes the maximum Frobenius deviation of holonomy from identity over the particular NetworkX cycle basis. Exact zero has a flatness interpretation under explicit connectedness, completeness, invertibility, reciprocal opposite-edge registration when both directions are supplied, and complete evaluation of every cycle emitted by the NetworkX cycle-basis routine (an argument specific to the NetworkX Paton implementation exercised here, not to arbitrary cycle bases), but the nonzero magnitude is basis-dependent and is not invariant under arbitrary invertible changes of frame. The stored preregistered benchmark values are unchanged; the historical H2 rho and permutation p-value are reinterpreted as statistics for this fixed cycle-basis defect, not for a canonical H^1 norm. This version also withdraws register_transport_from_points from the supported point-valued aggregation path: its ambient square operator is assembled from transported tangent vectors and does not generally define the invertible manifold point action that aggregation requires. Tangent-vector ladder validation remains supported. The ambient tangent-matrix helper is restricted to vector-shaped point representations. Direct registered matrices are supported only under the explicit point-action contract documented in the repository, including reciprocal opposite arrows when both orientations are stored. See CORRECTION_NOTICE.md for the full correction record.</p><p>The earlier v0.1.0.dev0 version DOI 10.5281/zenodo.20563975 remains superseded and must not be cited for results. Exact historical versions should be cited by their version-specific DOI; project-level DOI metadata is maintained through the Zenodo version family.</p>",
+  "creators": [
+    {
+      "name": "Maniches, Santiago",
+      "affiliation": "TOPOLOGICA LLC",
+      "orcid": "0009-0005-6480-1987"
+    }
+  ],
+  "license": "Apache-2.0",
+  "keywords": [
+    "federated learning",
+    "Riemannian geometry",
+    "groupoid",
+    "sheaf theory",
+    "holonomy",
+    "topological data analysis"
+  ],
+  "related_identifiers": [
+    {
+      "identifier": "10.5281/zenodo.20563974",
+      "relation": "isVersionOf",
+      "scheme": "doi"
+    },
+    {
+      "identifier": "https://github.com/smaniches/GROUPOID",
+      "relation": "isSupplementTo",
+      "scheme": "url"
+    }
+  ]
+}

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/CHANGELOG.md

@@ -8,6 +8,39 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.1.0.dev7] - 2026-10-29
+
+Pre-alpha corrective release distributing the October 29 fixes already merged
+on `main` (#77, #78 and #81). No new experiments, measured federated-learning
+performance gains, or general convergence claims are introduced. Archived
+preregistration and historical benchmark outputs remain unchanged.
+
+### Fixed
+
+- **Finite H0 bottleneck versus an empty diagram (#77).** The previous
+  `track_divergence` fallback returned `0.0` when either finite H0 diagram
+  was empty. The mathematically correct cost is half the largest unmatched
+  persistence interval. For a two-point cloud separated by 4 versus a
+  singleton, the result is now **2.0** in either direction, not zero;
+  empty-versus-empty remains zero. Regression tests cover both directions.
+  The metric remains an H0-only geometric diagnostic, **not** a certificate
+  of federated model convergence or predictive stability.
+
+### Changed
+
+- **Removed an unused mandatory dependency (#81).** `torch` was declared as
+  required but is not imported by the implemented library. New installations
+  no longer require PyTorch or its dependency graph. The security CI installs
+  the actual supported runtime closure, requires patched `setuptools`, checks
+  `pip check`, and runs `pip-audit` without advisory ignores. The full
+  Python 3.10–3.12 tests, docs, and code-quality checks passed on `main`.
+  **Compatibility note:** PyTorch is no longer installed automatically;
+  callers requiring it for their own workflows must install it separately.
+  Upgrading an existing environment does not uninstall previously installed
+  PyTorch or other packages; independently audit those environments.
+- Updated SHA-pinned `actions/setup-python` and PyPI publishing action (#78).
+  No algorithmic behavior was changed by this CI maintenance.
+
 ## [0.1.0.dev6]
 
 Pre-alpha development release distributing the transport and validation fixes
@@ -268,7 +301,8 @@ Date shown is the tag commit (`v0.1.0.dev0` -> 2a02954). `CITATION.cff` records
 `date-released: 2026-05-25`, when the core implementation landed; the tag was
 later placed on the metadata commit.
 
-[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev6...HEAD
+[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev7...HEAD
+[0.1.0.dev7]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev6...v0.1.0.dev7
 [0.1.0.dev6]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev5...v0.1.0.dev6
 [0.1.0.dev5]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev4...v0.1.0.dev5
 [0.1.0.dev4]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev2...v0.1.0.dev4

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/CITATION.cff

@@ -2,7 +2,8 @@ cff-version: 1.2.0
 message: "If you use this software, please cite the Concept DOI below so the citation resolves to the latest version."
 type: software
 title: "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds"
-version: 0.1.0.dev6
+version: 0.1.0.dev7
+date-released: 2026-10-29
 license: Apache-2.0
 repository-code: "https://github.com/smaniches/GROUPOID"
 doi: 10.5281/zenodo.20563974

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/CONTRIBUTING.md

@@ -80,18 +80,20 @@ please open an issue using the "Mathematical Correction" template.
 1. Open a release-cut PR that bumps the version across every metadata
    file that carries it: `pyproject.toml`, `groupoid/__init__.py`,
    `codemeta.json`, `CITATION.cff` (version and `date-released`),
-   `STATUS.md` (both mentions), and `.zenodo.json` (version, the erratum
-   description, and `isNewVersionOf` advanced to the prior version's
-   Zenodo DOI). Roll `CHANGELOG.md`'s `Unreleased` section into a new
-   version heading with compare links. See PRs #40 or #48 for the
+   `STATUS.md` (version), and `.zenodo.json` (version, the correction
+   description, and its concept DOI `isVersionOf` relationship). Only include
+   `isNewVersionOf` when the immediately preceding record DOI has been
+   independently verified; never inherit a stale predecessor. Roll
+   `CHANGELOG.md`'s `Unreleased` section into a new version heading with
+   compare links. See PRs #40 or #48 for the
    template.
 2. Merge the PR to `main`.
 
 That's it — merging is the release trigger, split across two workflows
 with one job each:
 
-- `.github/workflows/auto-tag-release.yml` runs on every push to `main`
-  that touches `pyproject.toml`. It reads the version out of
+- `.github/workflows/auto-tag-release.yml` runs after successful CI for a
+  push to the **current** `main` commit. It reads the version out of
   `pyproject.toml`, and if no `v<version>` tag exists yet, it creates and
   pushes one (as `github-actions[bot]`) after checking the version has a
   recognized format and that `CHANGELOG.md` documents it. A push with no

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/LIMITATIONS.md

@@ -89,6 +89,15 @@ system. The following limitations apply.
   The informative loop signal lives in `max_persistence` / the finite
   bars; meaningful component counts require passing a finite
   `max_edge_length` between the intra- and inter-cluster scales.
+- The opt-in `track_divergence` metric measures only changes in the
+  **finite H0** persistence diagram. It is invariant under translations,
+  rotations, and other pairwise-distance-preserving changes, and ignores
+  changes confined to H1 or higher homology. Thus a zero bottleneck
+  does **not** demonstrate client-model convergence or predictive
+  stability. If one diagram has no finite H0 bars, its distance to a
+  nonempty diagram is half the longest unmatched interval's lifetime,
+  not zero. Validation against model optimization would require
+  independent parameter-space or task-loss evidence.
 - No formal convergence rate analysis exists for the groupoid
   aggregation method.
 
@@ -98,12 +107,14 @@ system. The following limitations apply.
 - Requires `scipy < 1.16` for the same reason.
 - The `ripser` and `persim` packages may have build issues on
   some platforms (C++ compilation required).
-- `torch`, `pymanopt`, `POT`, and `einops` are declared as required
-  runtime dependencies but are not imported by any current code path (the full
-  test suite passes with all four uninstalled). Installing `groupoid` therefore
-  pulls in packages, most notably `torch`, that the current code does not use.
-  The `torch` advisory tracked in SECURITY.md applies to the installed
-  dependency, not to any code path GROUPOID exercises.
+- The former required `torch` dependency was removed because the current
+  implementation and entire documented test suite do not import it. It had
+  constrained `filelock` and `setuptools` to vulnerable versions; no current
+  GROUPOID code requires PyTorch. Future PyTorch functionality requires
+  a new separately tested dependency contract.
+- `pymanopt`, `POT`, and `einops` are still declared as required runtime
+  dependencies but not imported in the current implementation. Their removal
+  is a separate compatibility change, not part of this security correction.
 
 ## Test coverage
 

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: groupoid
-Version: 0.1.0.dev6
+Version: 0.1.0.dev7
 Summary: Research prototype: groupoid-based aggregation for federated learning on Riemannian manifolds
 Author-email: Santiago Maniches <santiago.maniches@gmail.com>
 License-Expression: Apache-2.0
@@ -30,7 +30,6 @@ Requires-Dist: networkx>=3.0
 Requires-Dist: einops>=0.7
 Requires-Dist: numpy<2.0,>=1.24
 Requires-Dist: scipy<1.16,>=1.10
-Requires-Dist: torch>=2.0
 Requires-Dist: pydantic>=2.0
 Requires-Dist: loguru>=0.7
 Provides-Extra: privacy
@@ -139,8 +138,12 @@ integration tests:
   retains a homology-dimension label, and `track_divergence` compares H0
   against H0 only (it does not pool features across dimensions); this is
   verified against an independent minimum-spanning-tree reconstruction of
-  the H0 diagram. The Betti numbers are degenerate under the default
-  `thresh=inf` filtration; see [LIMITATIONS.md](LIMITATIONS.md).
+  the H0 diagram. A zero value is a geometric diagnostic, **not** a
+  certificate of client-model convergence: translations and H1-only
+  changes can leave it unchanged. A finite H0 diagram compared with
+  an empty one incurs the nonzero bottleneck-to-diagonal cost.
+  The Betti numbers are degenerate under the default `thresh=inf`
+  filtration; see [LIMITATIONS.md](LIMITATIONS.md).
 
 ## Implemented and validated, not yet integrated
 

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/README.md

@@ -74,8 +74,12 @@ integration tests:
   retains a homology-dimension label, and `track_divergence` compares H0
   against H0 only (it does not pool features across dimensions); this is
   verified against an independent minimum-spanning-tree reconstruction of
-  the H0 diagram. The Betti numbers are degenerate under the default
-  `thresh=inf` filtration; see [LIMITATIONS.md](LIMITATIONS.md).
+  the H0 diagram. A zero value is a geometric diagnostic, **not** a
+  certificate of client-model convergence: translations and H1-only
+  changes can leave it unchanged. A finite H0 diagram compared with
+  an empty one incurs the nonzero bottleneck-to-diagonal cost.
+  The Betti numbers are degenerate under the default `thresh=inf`
+  filtration; see [LIMITATIONS.md](LIMITATIONS.md).
 
 ## Implemented and validated, not yet integrated
 

groupoid-0.1.0.dev7/SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+## Scope
+
+GROUPOID is a research prototype. It is not designed for deployment in
+security-sensitive environments.
+
+## Reporting a vulnerability
+
+If you discover a security issue, please report it by emailing
+santiago.maniches@gmail.com. Do not open a public issue.
+
+## Supported versions
+
+Only the latest commit on `main` is supported. There are no stable
+releases.
+
+## Known limitations
+
+- No differential privacy is implemented despite optional dependencies
+  being listed. Do not rely on this software for privacy guarantees.
+- Input validation is minimal. The library assumes trusted inputs from
+  the caller.
+- The older dependency closure required `torch` despite no implemented code
+  path importing it. This pulled in vulnerable `filelock` and constrained
+  `setuptools` below patched releases. The current source dependency closure
+  removes that unused requirement and the corresponding CI installer. CI
+  verifies the actual installed environment using `pip check` and a hard
+  `pip-audit` gate without CVE/PYSEC ignore flags. This does not retroactively
+  change any published package version, and it does not establish that other
+  environments or future dependency updates are vulnerability-free.

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/STATUS.md

@@ -25,9 +25,11 @@
   against H0 only; this is verified against an independent
   minimum-spanning-tree reconstruction of the H0 diagram (the finite H0
   death times equal the MST edge weights), and an H1-only change is shown
-  not to leak into the H0 divergence. It is wired into the aggregation
-  pipeline via the aggregator's opt-in `track_divergence` flag. See the
-  Betti-degeneracy caveat in LIMITATIONS.md.
+  not to leak into the H0 divergence. Degenerate one-empty-diagram
+  comparisons use the nonzero bottleneck-to-diagonal distance.
+  It is wired into the aggregator via the opt-in `track_divergence`
+  flag but cannot establish model convergence. See the Betti-degeneracy
+  caveat in LIMITATIONS.md.
 - The optimizer module is validated against known-correct references:
   Riemannian SGD (with and without momentum) and Adam descend to a known
   target on S^2 (geodesic-distance objective), and the momentum/first-
@@ -88,5 +90,5 @@ not capture.
 
 ## Versioning
 
-This project uses `0.1.0.dev6` to indicate pre-release development.
+This project uses `0.1.0.dev7` to indicate pre-release development.
 The API is unstable and will change without notice.

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/codemeta.json

@@ -6,7 +6,7 @@
   "codeRepository": "https://github.com/smaniches/GROUPOID",
   "programmingLanguage": "Python",
   "license": "Apache-2.0",
-  "version": "0.1.0.dev6",
+  "version": "0.1.0.dev7",
   "author": [
     {
       "@type": "Person",

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/groupoid/__init__.py

@@ -1,6 +1,6 @@
 """GROUPOID: Groupoid-based federated learning with Riemannian geometry."""
 
-__version__ = "0.1.0.dev6"
+__version__ = "0.1.0.dev7"
 
 from groupoid.aggregation import (
     DisconnectedClientGraphError,

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/groupoid/persistence.py

@@ -1,14 +1,17 @@
 """Persistent homology for federated model divergence detection.
 
 Applies topological data analysis to track how the distribution of
-client model parameters evolves across federated rounds. The key
-invariant: if the persistence diagram is stable across rounds, the
-federation is converging; if new topological features appear, clients
-are diverging into distinct clusters.
-
-Uses Vietoris-Rips filtration on the space of model parameters to
-compute persistence diagrams, then measures stability via bottleneck
-and Wasserstein distances.
+client model parameters evolves across federated rounds. A stable
+persistence diagram is not a convergence certificate:
+pairwise-distance-preserving translations/rotations and some genuine
+model-configuration changes can have unchanged diagrams. The tool
+reports a dimension-specific geometric diagnostic, not convergence or
+model-performance evidence.
+
+Uses Vietoris-Rips filtration on point clouds of model parameters
+and compares finite H0 diagrams across rounds with bottleneck distance.
+It does not calculate Wasserstein distance or test higher-dimensional
+changes in the inter-round comparison.
 """
 
 from __future__ import annotations
@@ -160,9 +163,9 @@ def track_divergence(
 ) -> PersistenceSummary:
     """Track federation divergence across rounds.
 
-    Computes persistence of current parameter distribution and, if a
-    previous summary exists, computes the bottleneck distance to
-    measure how much the topological structure has changed.
+    Computes persistence of a point cloud and, with a prior summary,
+    compares its finite H0 diagrams by bottleneck distance. A zero
+    value does not imply convergence of the underlying client models.
 
     Parameters
     ----------
@@ -198,6 +201,16 @@ def track_divergence(
             summary.bottleneck_to_previous = float(dist)
             logger.info("Bottleneck distance to previous round: {:.4f}", dist)
         else:
-            summary.bottleneck_to_previous = 0.0
+            # The bottleneck distance to the empty diagram is NOT zero:
+            # every unmatched finite interval must match the diagonal,
+            # costing half its lifetime in L-infinity. This applies in
+            # either direction. Only two empty diagrams have distance 0.
+            unmatched = current_h0 if len(current_h0) > 0 else prev_h0
+            if len(unmatched) > 0:
+                summary.bottleneck_to_previous = float(
+                    np.max(unmatched[:, 1] - unmatched[:, 0]) / 2.0
+                )
+            else:
+                summary.bottleneck_to_previous = 0.0
 
     return summary

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/groupoid.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: groupoid
-Version: 0.1.0.dev6
+Version: 0.1.0.dev7
 Summary: Research prototype: groupoid-based aggregation for federated learning on Riemannian manifolds
 Author-email: Santiago Maniches <santiago.maniches@gmail.com>
 License-Expression: Apache-2.0
@@ -30,7 +30,6 @@ Requires-Dist: networkx>=3.0
 Requires-Dist: einops>=0.7
 Requires-Dist: numpy<2.0,>=1.24
 Requires-Dist: scipy<1.16,>=1.10
-Requires-Dist: torch>=2.0
 Requires-Dist: pydantic>=2.0
 Requires-Dist: loguru>=0.7
 Provides-Extra: privacy
@@ -139,8 +138,12 @@ integration tests:
   retains a homology-dimension label, and `track_divergence` compares H0
   against H0 only (it does not pool features across dimensions); this is
   verified against an independent minimum-spanning-tree reconstruction of
-  the H0 diagram. The Betti numbers are degenerate under the default
-  `thresh=inf` filtration; see [LIMITATIONS.md](LIMITATIONS.md).
+  the H0 diagram. A zero value is a geometric diagnostic, **not** a
+  certificate of client-model convergence: translations and H1-only
+  changes can leave it unchanged. A finite H0 diagram compared with
+  an empty one incurs the nonzero bottleneck-to-diagonal cost.
+  The Betti numbers are degenerate under the default `thresh=inf`
+  filtration; see [LIMITATIONS.md](LIMITATIONS.md).
 
 ## Implemented and validated, not yet integrated
 

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/groupoid.egg-info/SOURCES.txt

@@ -19,7 +19,7 @@ pyproject.toml
 .github/ISSUE_TEMPLATE/bug_report.md
 .github/ISSUE_TEMPLATE/feature_request.md
 .github/ISSUE_TEMPLATE/mathematical_correction.md
-.github/scripts/install_torch_cpu.sh
+.github/workflows/artifact-transfer.yml
 .github/workflows/auto-tag-release.yml
 .github/workflows/ci.yml
 .github/workflows/docs-deploy.yml

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/groupoid.egg-info/requires.txt

@@ -7,7 +7,6 @@ networkx>=3.0
 einops>=0.7
 numpy<2.0,>=1.24
 scipy<1.16,>=1.10
-torch>=2.0
 pydantic>=2.0
 loguru>=0.7
 

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "groupoid"
-version = "0.1.0.dev6"
+version = "0.1.0.dev7"
 description = "Research prototype: groupoid-based aggregation for federated learning on Riemannian manifolds"
 readme = "README.md"
 license = "Apache-2.0"
@@ -45,7 +45,6 @@ dependencies = [
     "einops>=0.7",
     "numpy>=1.24,<2.0",
     "scipy>=1.10,<1.16",
-    "torch>=2.0",
     "pydantic>=2.0",
     "loguru>=0.7",
 ]

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev7}/tests/test_persistence.py

@@ -11,7 +11,8 @@ against point clouds with known structure, not just line execution:
   scales -- this validates component counting.
 - ``track_divergence`` is exercised across all three of its branches: no
   previous summary, a previous summary with non-empty H0 diagrams (bottleneck
-  computed), and the degenerate empty-diagram fallback.
+  computed), and mathematically correct empty-to-nonempty and
+  empty-to-empty bottleneck distances.
 
 Caveat validated and documented: with the default ``thresh=inf`` filtration,
 ``betti_0``/``betti_1`` count only bars that die at infinity, so on a single
@@ -126,12 +127,23 @@ class TestTrackDivergence:
         assert shifted.bottleneck_to_previous == pytest.approx(0.0, abs=1e-6)
 
     @pytest.mark.filterwarnings("ignore:The input point cloud has more columns:UserWarning")
-    def test_empty_finite_diagram_falls_back_to_zero(self):
-        """When the current cloud has no finite H0 bars (a single point has
-        only the infinite component), the empty-diagram branch sets the
-        bottleneck distance to 0.0 rather than calling persim. (ripser emits a
-        benign columns>rows warning for the degenerate single-point input.)"""
-        prev = track_divergence(_two_clusters(seed=4))
-        single_point = np.array([[0.0, 0.0]])
-        result = track_divergence(single_point, previous_summary=prev)
-        assert result.bottleneck_to_previous == 0.0
+    def test_single_empty_diagram_has_nonzero_bottleneck(self):
+        """A finite H0 bar [0, 4] must match the diagonal at cost 2."""
+        pair = np.array([[0.0, 0.0], [4.0, 0.0]])
+        singleton = np.array([[0.0, 0.0]])
+        pair_summary = track_divergence(pair, max_dim=0)
+        single_summary = track_divergence(singleton, max_dim=0)
+
+        # Both orders use the same symmetric bottleneck metric.
+        going_to_empty = track_divergence(singleton, previous_summary=pair_summary, max_dim=0)
+        coming_from_empty = track_divergence(pair, previous_summary=single_summary, max_dim=0)
+        assert going_to_empty.bottleneck_to_previous == pytest.approx(2.0, abs=1e-6)
+        assert coming_from_empty.bottleneck_to_previous == pytest.approx(2.0, abs=1e-6)
+
+    @pytest.mark.filterwarnings("ignore:The input point cloud has more columns:UserWarning")
+    def test_two_empty_finite_h0_diagrams_have_zero_bottleneck(self):
+        """Two singleton point clouds have no finite H0 bars at all."""
+        singleton = np.array([[0.0, 0.0]])
+        prior = track_divergence(singleton, max_dim=0)
+        current = track_divergence(singleton + 100.0, previous_summary=prior, max_dim=0)
+        assert current.bottleneck_to_previous == 0.0

groupoid-0.1.0.dev6/.github/scripts/install_torch_cpu.sh

@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-# Installs CPU-only torch from the PyTorch index with retries.
-#
-# That index (download.pytorch.org/whl/cpu, Cloudflare R2-backed as
-# download-r2.pytorch.org) intermittently drops the TLS handshake
-# (SSLV3_ALERT_HANDSHAKE_FAILURE) from GitHub-hosted runners. pip's own
-# built-in retries reuse the same connection pool within one process and
-# do not help here; a fresh `pip install` invocation gets a fresh TLS
-# connection and has in practice succeeded where the retries within a
-# single invocation did not. Five attempts with linear backoff (10s, 20s,
-# 30s, 40s) before giving up.
-set -euo pipefail
-
-max_attempts=5
-attempt=1
-until pip install torch --index-url https://download.pytorch.org/whl/cpu; do
-  if [ "${attempt}" -ge "${max_attempts}" ]; then
-    echo "::error::torch install failed after ${max_attempts} attempts" >&2
-    exit 1
-  fi
-  sleep_seconds=$((attempt * 10))
-  echo "torch install attempt ${attempt}/${max_attempts} failed; retrying in ${sleep_seconds}s" >&2
-  sleep "${sleep_seconds}"
-  attempt=$((attempt + 1))
-done

groupoid-0.1.0.dev6/.zenodo.json

@@ -1,39 +0,0 @@
-{
-  "upload_type": "software",
-  "title": "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds",
-  "version": "0.1.0.dev6",
-  "description": "<p>Pre-alpha research prototype exploring groupoid-based aggregation for federated learning on Riemannian manifolds. The supported point-valued aggregation path uses explicit invertible point actions, a cycle-basis holonomy defect diagnostic, the cellular sheaf Laplacian, and Karcher mean aggregation via geomstats. Tangent-vector parallel transport is provided separately through Schild and pole ladder utilities.</p><p><strong>Library correction in v0.1.0.dev6:</strong> in v0.1.0.dev5 and earlier, the pole ladder used a step schedule that did not reach the endpoint for more than one rung, and the function named schild_ladder was a pole-ladder variant rather than Schild's construction; tangent-vector transport results from those versions with n_rungs greater than 1, including the default two-rung tangent transport operator, are incorrect. v0.1.0.dev6 corrects both ladders and adds input validation for unknown transport methods, n_rungs below 1, negative, non-finite or zero-sum aggregation weights, and non-finite holonomy maps. The preregistered benchmark uses explicit transport maps, not the ladders; its stored results are unchanged and were reproduced bit-for-bit under the dev6 candidate. The project remains a pre-alpha research prototype.</p><p><strong>Scientific correction in v0.1.0.dev5:</strong> earlier releases described the cycle-basis holonomy statistic as a first-cohomology (H^1) norm. The implementation actually computes the maximum Frobenius deviation of holonomy from identity over the particular NetworkX cycle basis. Exact zero has a flatness interpretation under explicit connectedness, completeness, invertibility, reciprocal opposite-edge registration when both directions are supplied, and complete evaluation of every cycle emitted by the NetworkX cycle-basis routine (an argument specific to the NetworkX Paton implementation exercised here, not to arbitrary cycle bases), but the nonzero magnitude is basis-dependent and is not invariant under arbitrary invertible changes of frame. The stored preregistered benchmark values are unchanged; the historical H2 rho and permutation p-value are reinterpreted as statistics for this fixed cycle-basis defect, not for a canonical H^1 norm. This version also withdraws register_transport_from_points from the supported point-valued aggregation path: its ambient square operator is assembled from transported tangent vectors and does not generally define the invertible manifold point action that aggregation requires. Tangent-vector ladder validation remains supported. The ambient tangent-matrix helper is restricted to vector-shaped point representations. Direct registered matrices are supported only under the explicit point-action contract documented in the repository, including reciprocal opposite arrows when both orientations are stored. See CORRECTION_NOTICE.md for the full correction record.</p><p>The earlier v0.1.0.dev0 version DOI 10.5281/zenodo.20563975 remains superseded and must not be cited for results. Exact historical versions should be cited by their version-specific DOI; project-level DOI metadata is maintained through the Zenodo version family.</p>",
-  "creators": [
-    {
-      "name": "Maniches, Santiago",
-      "affiliation": "TOPOLOGICA LLC",
-      "orcid": "0009-0005-6480-1987"
-    }
-  ],
-  "license": "Apache-2.0",
-  "keywords": [
-    "federated learning",
-    "Riemannian geometry",
-    "groupoid",
-    "sheaf theory",
-    "holonomy",
-    "topological data analysis"
-  ],
-  "related_identifiers": [
-    {
-      "identifier": "10.5281/zenodo.20563974",
-      "relation": "isVersionOf",
-      "scheme": "doi"
-    },
-    {
-      "identifier": "10.5281/zenodo.21963047",
-      "relation": "isNewVersionOf",
-      "scheme": "doi"
-    },
-    {
-      "identifier": "https://github.com/smaniches/GROUPOID",
-      "relation": "isSupplementTo",
-      "scheme": "url"
-    }
-  ]
-}

groupoid-0.1.0.dev6/SECURITY.md

@@ -1,43 +0,0 @@
-# Security Policy
-
-## Scope
-
-GROUPOID is a research prototype. It is not designed for deployment in
-security-sensitive environments.
-
-## Reporting a vulnerability
-
-If you discover a security issue, please report it by emailing
-santiago.maniches@gmail.com. Do not open a public issue.
-
-## Supported versions
-
-Only the latest commit on `main` is supported. There are no stable
-releases.
-
-## Known limitations
-
-- No differential privacy is implemented despite optional dependencies
-  being listed. Do not rely on this software for privacy guarantees.
-- Input validation is minimal. The library assumes trusted inputs from
-  the caller.
-- The `torch` runtime dependency is flagged by `pip-audit` for advisory
-  CVE-2025-3000. OSV expresses its affected range as a Git/commit range whose
-  listed versions run up to v2.6.0, with no published `fixed` release. Because
-  that upper bound is a source commit rather than a resolvable version,
-  `pip-audit` conservatively flags the installed `torch` (currently 2.12.0, past
-  the listed v2.6.0 affected range) instead of clearing it. CI tracks the
-  advisory via a documented `--ignore-vuln`; there is no fixed release to
-  upgrade to, and the ignore is revisited when upstream publishes one. The
-  advisory concerns crafted-checkpoint / JIT deserialization (`torch.load` and
-  related paths), which GROUPOID's own code does not exercise.
-- The CI-pinned `setuptools` (held to `>=78.1.1,<82` because `torch` requires
-  `setuptools<82`) is flagged by `pip-audit` for advisory PYSEC-2026-3447
-  (CVE-2026-59890): prior to setuptools 83.0.0, `MANIFEST.in` exclude,
-  `global-exclude`, `recursive-exclude`, and `prune` directives could be
-  bypassed on macOS APFS/HFS+ by NFD-normalized file names, packing excluded
-  files into source distributions. The fixed release (83.0.0) is outside the
-  window torch permits, and the affected code path requires building an sdist
-  on a macOS filesystem — all GROUPOID CI and release builds run on
-  `ubuntu-latest`. CI tracks the advisory via a documented `--ignore-vuln`;
-  the ignore is revisited once torch allows `setuptools>=83`.