groupoid 0.1.0.dev6__tar.gz → 0.1.0.dev8__tar.gz

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/.github/dependabot.yml

@@ -42,7 +42,6 @@ updates:
       # of one PR per package.
       runtime:
         patterns:
-          - "torch"
           - "geomstats"
           - "pymanopt"
           - "ripser"

groupoid-0.1.0.dev8/.github/workflows/artifact-transfer.yml

@@ -0,0 +1,46 @@
+name: Artifact transfer integrity
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/workflows/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/workflows/**"]
+
+permissions:
+  contents: read
+
+jobs:
+  round-trip:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Create fixture and independent expected checksum
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p payload/nested
+          printf '%s\n' "$GITHUB_SHA" > payload/nested/fixture.txt
+          (cd payload && sha256sum nested/fixture.txt) > expected.sha256
+      - name: Upload fixture
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: artifact-transfer-proof
+          path: payload/
+          if-no-files-found: error
+          retention-days: 1
+      - name: Remove original fixture before downloading
+        run: rm -r payload
+      - name: Download fixture
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: artifact-transfer-proof
+          path: restored/
+      - name: Verify restored bytes and directory layout
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd restored
+          test "$(find . -type f | wc -l)" -eq 1
+          sha256sum --check ../expected.sha256

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -24,8 +24,8 @@ jobs:
           # numpy / pydantic stubs (NDArray dtype args, the BaseModel base class).
           # Linting only against `ruff black mypy` left numpy/pydantic uninstalled,
           # so --strict raised disallow_subclassing_any on the BaseModel subclass.
-          # Consistent with the test / security / docs jobs. CPU torch keeps it lean.
-          .github/scripts/install_torch_cpu.sh
+          # All jobs now install the declared runtime dependencies, without
+          # the unused optional PyTorch backend.
           pip install -e ".[dev]"
       - name: Run ruff
         run: ruff check .
@@ -34,20 +34,44 @@ jobs:
       - name: Run mypy (strict)
         run: mypy --strict groupoid/ --ignore-missing-imports
 
+  # Retain the protected-main historical check name while making its semantics
+  # a negative compatibility test. It proves that Python 3.10 is REJECTED;
+  # supported functional tests run only on Python 3.11 and 3.12 above.
+  unsupported-python310:
+    name: test (3.10)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.10"
+      - name: Verify unsupported interpreter is rejected by package metadata
+        run: |
+          set -euo pipefail
+          if python -m pip install --no-deps . > /tmp/unsupported-python.log 2>&1; then
+            cat /tmp/unsupported-python.log
+            echo "::error::Python 3.10 installation unexpectedly succeeded"
+            exit 1
+          fi
+          if ! grep -Eqi "requires a different Python|requires-python|requires Python" /tmp/unsupported-python.log; then
+            cat /tmp/unsupported-python.log
+            echo "::error::Installation failed for an unexpected reason"
+            exit 1
+          fi
+
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.11", "3.12"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       - name: Run tests with coverage gate
         run: >-
@@ -59,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -68,42 +92,25 @@ jobs:
           # Install the project's real runtime closure so pip-audit scans the
           # packages GROUPOID actually depends on. The previous `safety` step
           # installed only the tools and never the project, so it audited the
-          # wrong environment. CPU torch keeps the install lean.
-          .github/scripts/install_torch_cpu.sh
+          # wrong environment. No unused PyTorch install is injected.
           pip install -e .
           pip install bandit pip-audit
-          # Pin setuptools LAST. torch requires setuptools<82 and pulls in a
-          # runner-bundled setuptools that can predate the PYSEC-2025-49 fix
-          # (78.1.1); upgrading before `pip install -e .` is simply undone by torch.
-          # The window >=78.1.1,<82 clears the advisory while staying
-          # dependency-consistent with torch (verified: pip check clean).
-          python -m pip install --upgrade "setuptools>=78.1.1,<82"
+          # Setuptools is build tooling, but remains in the audited CI environment.
+          # No torch<82 constraint remains; require the patched release.
+          python -m pip install --upgrade "setuptools>=84.1.0"
+          python -m pip check
       - name: Run bandit
         run: bandit -r groupoid/ -c pyproject.toml
       - name: Audit dependencies for known vulnerabilities (pip-audit)
-        # pip-audit (OSV-backed, maintained) replaces the deprecated `safety check`
-        # (deprecated in safety 3.x in favour of the account-gated `safety scan`).
-        # HARD gate: any advisory with a fix version fails the job. Two documented
-        # exceptions, both disclosed in SECURITY.md:
-        # - CVE-2025-3000 (torch): no fixed release exists upstream, and OSV
-        #   expresses the affected range (listed versions up to v2.6.0) as a
-        #   Git/commit boundary pip-audit cannot version-resolve, so it
-        #   conservatively flags the installed torch. The torch.load / JIT
-        #   deserialization path is not exercised by GROUPOID. Revisit the ignore
-        #   once upstream publishes a fixed release.
-        # - PYSEC-2026-3447 (CVE-2026-59890, setuptools <83): the fix (83.0.0) is
-        #   unreachable while torch requires setuptools<82 (see the install step
-        #   above). The flaw is a macOS-only (APFS/HFS+) Unicode-normalization
-        #   bypass of MANIFEST.in exclude rules when building sdists; all CI and
-        #   release builds run on ubuntu-latest. Drop the ignore once torch
-        #   permits setuptools>=83.
-        run: pip-audit --ignore-vuln CVE-2025-3000 --ignore-vuln PYSEC-2026-3447
+        # Hard gate on the installed runtime and audit-tool closure.
+        # No CVE/PYSEC ignore flags or waived vulnerable packages.
+        run: pip-audit
 
   pre-commit:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -115,13 +122,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       # Benchmarks run for information only. There is no regression gate:
       # timing baselines recorded on one machine are not comparable to a
@@ -135,7 +141,7 @@ jobs:
           pytest benchmarks/ -v --benchmark-json=benchmark_results.json || true
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: benchmark-results
           path: benchmark_results.json
@@ -145,13 +151,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/.github/workflows/docs-deploy.yml

@@ -17,13 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/.github/workflows/release.yml

@@ -145,7 +145,7 @@ jobs:
             exit 1
           fi
           echo "release target ${RELEASE_TARGET} matches pyproject version ${version}"
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
         with:
           python-version: "3.12"
           cache: pip
@@ -283,7 +283,7 @@ jobs:
         with:
           subject-path: "dist/*"
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: release-dist
           path: dist/
@@ -300,11 +300,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
         with:
           python-version: "3.12"
           cache: pip
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
@@ -347,7 +347,7 @@ jobs:
           fi
           python scripts/bind_release_sbom.py --verify-only --sbom sbom.cdx.json --wheel "${wheels[0]}"
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: release-sbom
           path: sbom.cdx.json
@@ -365,11 +365,11 @@ jobs:
       id-token: write       # attestation OIDC
       attestations: write   # actions/attest
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-sbom
           path: .
@@ -407,7 +407,7 @@ jobs:
       name: pypi
       url: https://pypi.org/project/groupoid/
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
@@ -479,7 +479,7 @@ jobs:
       # step below still runs, so COMPLETE still proves PyPI is correct.
       - name: Publish to PyPI (Trusted Publishing, OIDC)
         if: needs.build.outputs.adopted != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # release/v1
         with:
           packages-dir: dist
           print-hash: true
@@ -501,8 +501,14 @@ jobs:
           import hashlib, json, pathlib, sys, time, urllib.error, urllib.request
 
           dist = pathlib.Path("dist")
+          # PEP 740 .publish.attestation sidecars may be written to dist/ by
+          # the PyPI publishing action. They are attestations attached to the
+          # distributions, not separate package files in PyPI JSON urls.
+          # Compare every actual wheel/sdist byte without treating sidecars
+          # as missing distributions.
           local = {p.name: hashlib.sha256(p.read_bytes()).hexdigest()
-                   for p in sorted(dist.iterdir()) if p.is_file()}
+                   for p in sorted(dist.iterdir())
+                   if p.is_file() and p.name.endswith((".whl", ".tar.gz"))}
           wheel = next(n for n in local if n.endswith(".whl"))
           project, version = wheel.split("-")[0], wheel.split("-")[1]
           url = f"https://pypi.org/pypi/{project}/{version}/json"
@@ -565,11 +571,11 @@ jobs:
       id-token: write       # Sigstore signing OIDC
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-sbom
           path: .

groupoid-0.1.0.dev8/.zenodo.json

@@ -0,0 +1,34 @@
+{
+  "upload_type": "software",
+  "title": "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds",
+  "version": "0.1.0.dev8",
+  "description": "<p>Pre-alpha research prototype exploring groupoid-based aggregation for federated learning on Riemannian manifolds. The supported point-valued aggregation path uses explicit invertible point actions, a cycle-basis holonomy defect diagnostic, the cellular sheaf Laplacian, and Karcher mean aggregation via geomstats. Tangent-vector parallel transport is provided separately through Schild and pole ladder utilities.</p><p><strong>Compatibility release v0.1.0.dev8:</strong> Python 3.10 support retired following upstream EOL on 2026-10-01. The supported runtime is Python 3.11-3.12; installation on 3.10 now fails closed via Requires-Python. No scientific algorithm or historical benchmark changes.</p><p><strong>Corrective release v0.1.0.dev7:</strong> the finite H0 bottleneck distance to an empty diagram is now half the longest unmatched interval, rather than an incorrect zero (both comparison directions tested). The unused mandatory PyTorch dependency was removed, reducing installation and audit complexity, and CI dependency scanning now runs without vulnerability exceptions. Pre-alpha research maturity, known limits on the H0-only diagnostic, and historical experiment results are unchanged. Existing environments may retain PyTorch after an upgrade.</p><p><strong>Library correction in v0.1.0.dev6:</strong> in v0.1.0.dev5 and earlier, the pole ladder used a step schedule that did not reach the endpoint for more than one rung, and the function named schild_ladder was a pole-ladder variant rather than Schild's construction; tangent-vector transport results from those versions with n_rungs greater than 1, including the default two-rung tangent transport operator, are incorrect. v0.1.0.dev6 corrects both ladders and adds input validation for unknown transport methods, n_rungs below 1, negative, non-finite or zero-sum aggregation weights, and non-finite holonomy maps. The preregistered benchmark uses explicit transport maps, not the ladders; its stored results are unchanged and were reproduced bit-for-bit under the dev6 candidate. The project remains a pre-alpha research prototype.</p><p><strong>Scientific correction in v0.1.0.dev5:</strong> earlier releases described the cycle-basis holonomy statistic as a first-cohomology (H^1) norm. The implementation actually computes the maximum Frobenius deviation of holonomy from identity over the particular NetworkX cycle basis. Exact zero has a flatness interpretation under explicit connectedness, completeness, invertibility, reciprocal opposite-edge registration when both directions are supplied, and complete evaluation of every cycle emitted by the NetworkX cycle-basis routine (an argument specific to the NetworkX Paton implementation exercised here, not to arbitrary cycle bases), but the nonzero magnitude is basis-dependent and is not invariant under arbitrary invertible changes of frame. The stored preregistered benchmark values are unchanged; the historical H2 rho and permutation p-value are reinterpreted as statistics for this fixed cycle-basis defect, not for a canonical H^1 norm. This version also withdraws register_transport_from_points from the supported point-valued aggregation path: its ambient square operator is assembled from transported tangent vectors and does not generally define the invertible manifold point action that aggregation requires. Tangent-vector ladder validation remains supported. The ambient tangent-matrix helper is restricted to vector-shaped point representations. Direct registered matrices are supported only under the explicit point-action contract documented in the repository, including reciprocal opposite arrows when both orientations are stored. See CORRECTION_NOTICE.md for the full correction record.</p><p>The earlier v0.1.0.dev0 version DOI 10.5281/zenodo.20563975 remains superseded and must not be cited for results. Exact historical versions should be cited by their version-specific DOI; project-level DOI metadata is maintained through the Zenodo version family.</p>",
+  "creators": [
+    {
+      "name": "Maniches, Santiago",
+      "affiliation": "TOPOLOGICA LLC",
+      "orcid": "0009-0005-6480-1987"
+    }
+  ],
+  "license": "Apache-2.0",
+  "keywords": [
+    "federated learning",
+    "Riemannian geometry",
+    "groupoid",
+    "sheaf theory",
+    "holonomy",
+    "topological data analysis"
+  ],
+  "related_identifiers": [
+    {
+      "identifier": "10.5281/zenodo.20563974",
+      "relation": "isVersionOf",
+      "scheme": "doi"
+    },
+    {
+      "identifier": "https://github.com/smaniches/GROUPOID",
+      "relation": "isSupplementTo",
+      "scheme": "url"
+    }
+  ]
+}

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/CHANGELOG.md

@@ -8,6 +8,53 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.1.0.dev8] - 2026-10-30
+
+### Changed
+
+- **Retired end-of-life Python 3.10 support.** Python 3.11 and 3.12 are the
+  supported and tested interpreter versions; `Requires-Python`, package
+  classifiers, installation instructions, test matrix, and citation metadata
+  now agree. Python 3.10 reached upstream end of life on October 1, 2026.
+  Existing users of Python 3.10 should migrate to 3.11 or 3.12 before
+  upgrading this package. Python 3.13+ remains excluded for the separately
+  documented numerical dependency constraints.
+- This release contains no algorithm or scientific-method changes; historical
+  experimental artifacts and scientific qualification statements are unchanged.
+
+## [0.1.0.dev7] - 2026-10-29
+
+Pre-alpha corrective release distributing the October 29 fixes already merged
+on `main` (#77, #78 and #81). No new experiments, measured federated-learning
+performance gains, or general convergence claims are introduced. Archived
+preregistration and historical benchmark outputs remain unchanged.
+
+### Fixed
+
+- **Finite H0 bottleneck versus an empty diagram (#77).** The previous
+  `track_divergence` fallback returned `0.0` when either finite H0 diagram
+  was empty. The mathematically correct cost is half the largest unmatched
+  persistence interval. For a two-point cloud separated by 4 versus a
+  singleton, the result is now **2.0** in either direction, not zero;
+  empty-versus-empty remains zero. Regression tests cover both directions.
+  The metric remains an H0-only geometric diagnostic, **not** a certificate
+  of federated model convergence or predictive stability.
+
+### Changed
+
+- **Removed an unused mandatory dependency (#81).** `torch` was declared as
+  required but is not imported by the implemented library. New installations
+  no longer require PyTorch or its dependency graph. The security CI installs
+  the actual supported runtime closure, requires patched `setuptools`, checks
+  `pip check`, and runs `pip-audit` without advisory ignores. The full
+  Python 3.10–3.12 tests, docs, and code-quality checks passed on `main`.
+  **Compatibility note:** PyTorch is no longer installed automatically;
+  callers requiring it for their own workflows must install it separately.
+  Upgrading an existing environment does not uninstall previously installed
+  PyTorch or other packages; independently audit those environments.
+- Updated SHA-pinned `actions/setup-python` and PyPI publishing action (#78).
+  No algorithmic behavior was changed by this CI maintenance.
+
 ## [0.1.0.dev6]
 
 Pre-alpha development release distributing the transport and validation fixes
@@ -268,7 +315,8 @@ Date shown is the tag commit (`v0.1.0.dev0` -> 2a02954). `CITATION.cff` records
 `date-released: 2026-05-25`, when the core implementation landed; the tag was
 later placed on the metadata commit.
 
-[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev6...HEAD
+[Unreleased]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev7...HEAD
+[0.1.0.dev7]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev6...v0.1.0.dev7
 [0.1.0.dev6]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev5...v0.1.0.dev6
 [0.1.0.dev5]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev4...v0.1.0.dev5
 [0.1.0.dev4]: https://github.com/smaniches/GROUPOID/compare/v0.1.0.dev2...v0.1.0.dev4

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/CITATION.cff

@@ -2,7 +2,8 @@ cff-version: 1.2.0
 message: "If you use this software, please cite the Concept DOI below so the citation resolves to the latest version."
 type: software
 title: "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds"
-version: 0.1.0.dev6
+version: 0.1.0.dev8
+date-released: 2026-10-30
 license: Apache-2.0
 repository-code: "https://github.com/smaniches/GROUPOID"
 doi: 10.5281/zenodo.20563974

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/CONTRIBUTING.md

@@ -80,18 +80,20 @@ please open an issue using the "Mathematical Correction" template.
 1. Open a release-cut PR that bumps the version across every metadata
    file that carries it: `pyproject.toml`, `groupoid/__init__.py`,
    `codemeta.json`, `CITATION.cff` (version and `date-released`),
-   `STATUS.md` (both mentions), and `.zenodo.json` (version, the erratum
-   description, and `isNewVersionOf` advanced to the prior version's
-   Zenodo DOI). Roll `CHANGELOG.md`'s `Unreleased` section into a new
-   version heading with compare links. See PRs #40 or #48 for the
+   `STATUS.md` (version), and `.zenodo.json` (version, the correction
+   description, and its concept DOI `isVersionOf` relationship). Only include
+   `isNewVersionOf` when the immediately preceding record DOI has been
+   independently verified; never inherit a stale predecessor. Roll
+   `CHANGELOG.md`'s `Unreleased` section into a new version heading with
+   compare links. See PRs #40 or #48 for the
    template.
 2. Merge the PR to `main`.
 
 That's it — merging is the release trigger, split across two workflows
 with one job each:
 
-- `.github/workflows/auto-tag-release.yml` runs on every push to `main`
-  that touches `pyproject.toml`. It reads the version out of
+- `.github/workflows/auto-tag-release.yml` runs after successful CI for a
+  push to the **current** `main` commit. It reads the version out of
   `pyproject.toml`, and if no `v<version>` tag exists yet, it creates and
   pushes one (as `github-actions[bot]`) after checking the version has a
   recognized format and that `CHANGELOG.md` documents it. A push with no

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/LIMITATIONS.md

@@ -89,6 +89,15 @@ system. The following limitations apply.
   The informative loop signal lives in `max_persistence` / the finite
   bars; meaningful component counts require passing a finite
   `max_edge_length` between the intra- and inter-cluster scales.
+- The opt-in `track_divergence` metric measures only changes in the
+  **finite H0** persistence diagram. It is invariant under translations,
+  rotations, and other pairwise-distance-preserving changes, and ignores
+  changes confined to H1 or higher homology. Thus a zero bottleneck
+  does **not** demonstrate client-model convergence or predictive
+  stability. If one diagram has no finite H0 bars, its distance to a
+  nonempty diagram is half the longest unmatched interval's lifetime,
+  not zero. Validation against model optimization would require
+  independent parameter-space or task-loss evidence.
 - No formal convergence rate analysis exists for the groupoid
   aggregation method.
 
@@ -98,17 +107,19 @@ system. The following limitations apply.
 - Requires `scipy < 1.16` for the same reason.
 - The `ripser` and `persim` packages may have build issues on
   some platforms (C++ compilation required).
-- `torch`, `pymanopt`, `POT`, and `einops` are declared as required
-  runtime dependencies but are not imported by any current code path (the full
-  test suite passes with all four uninstalled). Installing `groupoid` therefore
-  pulls in packages, most notably `torch`, that the current code does not use.
-  The `torch` advisory tracked in SECURITY.md applies to the installed
-  dependency, not to any code path GROUPOID exercises.
+- The former required `torch` dependency was removed because the current
+  implementation and entire documented test suite do not import it. It had
+  constrained `filelock` and `setuptools` to vulnerable versions; no current
+  GROUPOID code requires PyTorch. Future PyTorch functionality requires
+  a new separately tested dependency contract.
+- `pymanopt`, `POT`, and `einops` are still declared as required runtime
+  dependencies but not imported in the current implementation. Their removal
+  is a separate compatibility change, not part of this security correction.
 
 ## Test coverage
 
 - Releases are gated on the repository's hard line and branch coverage checks
-  on Python 3.10-3.12. Coverage is not validation: the scientific correction
+  on Python 3.11-3.12. Coverage is not validation: the scientific correction
   adds explicit tests for basis dependence, general non-orthogonal gauge
   dependence of the defect magnitude, the tangent/point representation
   boundary, and the supported SO(3) point-action round trip.

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: groupoid
-Version: 0.1.0.dev6
+Version: 0.1.0.dev8
 Summary: Research prototype: groupoid-based aggregation for federated learning on Riemannian manifolds
 Author-email: Santiago Maniches <santiago.maniches@gmail.com>
 License-Expression: Apache-2.0
@@ -13,12 +13,11 @@ Keywords: federated-learning,riemannian-geometry,groupoid,topology,sheaf-theory,
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Intended Audience :: Science/Research
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Scientific/Engineering :: Mathematics
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
-Requires-Python: <3.13,>=3.10
+Requires-Python: <3.13,>=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: geomstats>=0.7
@@ -30,7 +29,6 @@ Requires-Dist: networkx>=3.0
 Requires-Dist: einops>=0.7
 Requires-Dist: numpy<2.0,>=1.24
 Requires-Dist: scipy<1.16,>=1.10
-Requires-Dist: torch>=2.0
 Requires-Dist: pydantic>=2.0
 Requires-Dist: loguru>=0.7
 Provides-Extra: privacy
@@ -68,7 +66,7 @@ Dynamic: license-file
 [![CI](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml/badge.svg)](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/groupoid.svg)](https://pypi.org/project/groupoid/)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
-[![Python 3.10-3.12](https://img.shields.io/badge/python-3.10--3.12-blue.svg)](https://www.python.org/downloads/)
+[![Python 3.11-3.12](https://img.shields.io/badge/python-3.11--3.12-blue.svg)](https://www.python.org/downloads/)
 [![Status](https://img.shields.io/badge/status-pre--alpha-orange.svg)](#status)
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.20563974.svg)](https://doi.org/10.5281/zenodo.20563974)
 
@@ -139,8 +137,12 @@ integration tests:
   retains a homology-dimension label, and `track_divergence` compares H0
   against H0 only (it does not pool features across dimensions); this is
   verified against an independent minimum-spanning-tree reconstruction of
-  the H0 diagram. The Betti numbers are degenerate under the default
-  `thresh=inf` filtration; see [LIMITATIONS.md](LIMITATIONS.md).
+  the H0 diagram. A zero value is a geometric diagnostic, **not** a
+  certificate of client-model convergence: translations and H1-only
+  changes can leave it unchanged. A finite H0 diagram compared with
+  an empty one incurs the nonzero bottleneck-to-diagonal cost.
+  The Betti numbers are degenerate under the default `thresh=inf`
+  filtration; see [LIMITATIONS.md](LIMITATIONS.md).
 
 ## Implemented and validated, not yet integrated
 
@@ -201,7 +203,8 @@ hypothesis remains **unvalidated on real federated learning tasks** (see
 
 ## Installation
 
-Requires **Python 3.10, 3.11, or 3.12**. Python 3.13+ is not supported: the
+Requires **Python 3.11 or 3.12**. Python 3.10 reached end of life on
+October 1, 2026 and is no longer supported. Python 3.13+ is not supported: the
 `numpy<2.0` / `scipy<1.16` pins (needed for geomstats compatibility, see
 [LIMITATIONS.md](LIMITATIONS.md)) have no wheels there, so `pip` will refuse
 with a `Requires-Python` message rather than attempt a source build.
@@ -266,7 +269,7 @@ pytest tests/ -v
 ```
 
 The suite reaches 100% line and branch coverage of the `groupoid` package
-on Python 3.10-3.12, enforced in CI:
+on Python 3.11-3.12, enforced in CI:
 
 ```bash
 pytest tests/ --cov=groupoid --cov-branch --cov-fail-under=100

{groupoid-0.1.0.dev6 → groupoid-0.1.0.dev8}/README.md

@@ -3,7 +3,7 @@
 [![CI](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml/badge.svg)](https://github.com/smaniches/GROUPOID/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/groupoid.svg)](https://pypi.org/project/groupoid/)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
-[![Python 3.10-3.12](https://img.shields.io/badge/python-3.10--3.12-blue.svg)](https://www.python.org/downloads/)
+[![Python 3.11-3.12](https://img.shields.io/badge/python-3.11--3.12-blue.svg)](https://www.python.org/downloads/)
 [![Status](https://img.shields.io/badge/status-pre--alpha-orange.svg)](#status)
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.20563974.svg)](https://doi.org/10.5281/zenodo.20563974)
 
@@ -74,8 +74,12 @@ integration tests:
   retains a homology-dimension label, and `track_divergence` compares H0
   against H0 only (it does not pool features across dimensions); this is
   verified against an independent minimum-spanning-tree reconstruction of
-  the H0 diagram. The Betti numbers are degenerate under the default
-  `thresh=inf` filtration; see [LIMITATIONS.md](LIMITATIONS.md).
+  the H0 diagram. A zero value is a geometric diagnostic, **not** a
+  certificate of client-model convergence: translations and H1-only
+  changes can leave it unchanged. A finite H0 diagram compared with
+  an empty one incurs the nonzero bottleneck-to-diagonal cost.
+  The Betti numbers are degenerate under the default `thresh=inf`
+  filtration; see [LIMITATIONS.md](LIMITATIONS.md).
 
 ## Implemented and validated, not yet integrated
 
@@ -136,7 +140,8 @@ hypothesis remains **unvalidated on real federated learning tasks** (see
 
 ## Installation
 
-Requires **Python 3.10, 3.11, or 3.12**. Python 3.13+ is not supported: the
+Requires **Python 3.11 or 3.12**. Python 3.10 reached end of life on
+October 1, 2026 and is no longer supported. Python 3.13+ is not supported: the
 `numpy<2.0` / `scipy<1.16` pins (needed for geomstats compatibility, see
 [LIMITATIONS.md](LIMITATIONS.md)) have no wheels there, so `pip` will refuse
 with a `Requires-Python` message rather than attempt a source build.
@@ -201,7 +206,7 @@ pytest tests/ -v
 ```
 
 The suite reaches 100% line and branch coverage of the `groupoid` package
-on Python 3.10-3.12, enforced in CI:
+on Python 3.11-3.12, enforced in CI:
 
 ```bash
 pytest tests/ --cov=groupoid --cov-branch --cov-fail-under=100