millwright 0.2.1__tar.gz → 2.2.1__tar.gz

millwright-2.2.1/.cargo/audit.toml

@@ -0,0 +1,5 @@
+[advisories]
+# quick-xml 0.39.4 is retained in Cargo.lock by an inactive optional dependency
+# and does not appear in Cargo's resolved graph for any target or feature set.
+# Keep these explicit until the upstream package drops that stale lock edge.
+ignore = ["RUSTSEC-2026-0194", "RUSTSEC-2026-0195"]

millwright-2.2.1/.github/dependabot.yml

@@ -0,0 +1,59 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      rust-infrastructure:
+        patterns: ["*"]
+        exclude-patterns:
+          # These crates form type/serialization boundaries with the exact-pinned
+          # ML engines. Upgrade them deliberately, with the full feature matrix.
+          - "ndarray"
+          - "prost"
+          - "sha2"
+          - "criterion"
+    ignore:
+      # Engine versions are exact by design. Dependabot PRs cannot safely infer
+      # coordinated upgrades across their ndarray and ONNX type boundaries.
+      - dependency-name: "ndarray"
+      - dependency-name: "prost"
+      - dependency-name: "sha2"
+      - dependency-name: "criterion"
+      - dependency-name: "smartcore"
+      - dependency-name: "imbalance-rs"
+      - dependency-name: "model-selection-rs"
+      - dependency-name: "linfa*"
+      - dependency-name: "hyperopt-rs"
+      - dependency-name: "regression-diagnostics"
+      - dependency-name: "shap-rs"
+      - dependency-name: "plotters-statistical"
+      - dependency-name: "onnx-export-rs"
+      - dependency-name: "driftwatch"
+      - dependency-name: "chronos-ts"
+      - dependency-name: "incremental-rs"
+      - dependency-name: "polars"
+    labels: ["dependencies", "rust"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+        exclude-patterns: ["dtolnay/rust-toolchain"]
+    ignore:
+      # @1.95 is a Rust toolchain selector, not an action release. It is also
+      # expressed as an input in CI, but keep this guard against regressions.
+      - dependency-name: "dtolnay/rust-toolchain"
+    labels: ["dependencies", "github-actions"]
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "python"]

millwright-2.2.1/.github/workflows/ci.yml

@@ -0,0 +1,270 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+# One in-flight run per ref; a new push cancels the previous.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  # Every job builds against the committed Cargo.lock. `--locked` turns a stale
+  # or drifted lockfile into a hard error — the reproducibility guarantee that
+  # pairs with the exact-version engine pins in Cargo.toml.
+  CARGO_NET_RETRY: "3"
+  RUSTFLAGS: "-D warnings"
+
+jobs:
+  consistency:
+    name: version & links
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.x"
+      - name: verify every public version marker
+        run: python scripts/sync-version.py --check
+      - name: check local and external HTML links
+        uses: lycheeverse/lychee-action@v2
+        with:
+          args: >-
+            --no-progress
+            --accept 200,204,206,429
+            --retry-wait-time 2
+            index.html guide.html docs/*.html README.md CONTRIBUTING.md RELEASING.md
+          fail: true
+
+  fmt:
+    name: rustfmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all --check
+
+  clippy:
+    name: clippy (${{ matrix.features }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - features: "--no-default-features"
+          - features: "" # default features
+          - features: "--features full"
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --locked --all-targets ${{ matrix.features }}
+
+  docs:
+    name: doc
+    runs-on: ubuntu-latest
+    env:
+      RUSTDOCFLAGS: "-D warnings"
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      # `full` is every Rust-facing feature (python is a cdylib, doc'd separately
+      # by maturin/pyo3), so this exercises the whole documented surface.
+      - run: cargo doc --locked --no-deps --features full
+
+  test:
+    name: test (${{ matrix.name }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # The spine, minimal: no backend at all, then the smartcore spine.
+          - { name: "core-only", features: "--no-default-features" }
+          - { name: "spine", features: "--no-default-features --features smartcore-backend" }
+          # The default install.
+          - { name: "default", features: "" }
+          # Each feature in isolation. Dependencies declared by that feature are
+          # enabled transitively; unrelated defaults cannot hide a bad edge.
+          - { name: "eda", features: "--no-default-features --features eda" }
+          - { name: "calibration", features: "--no-default-features --features calibration" }
+          - { name: "anomaly", features: "--no-default-features --features anomaly" }
+          - { name: "linfa", features: "--no-default-features --features linfa-backend" }
+          - { name: "hpo", features: "--no-default-features --features hpo" }
+          - { name: "diagnostics", features: "--no-default-features --features diagnostics" }
+          - { name: "explain", features: "--no-default-features --features explain" }
+          - { name: "viz", features: "--no-default-features --features viz" }
+          - { name: "onnx", features: "--no-default-features --features onnx" }
+          - { name: "registry", features: "--no-default-features --features registry" }
+          - { name: "monitor", features: "--no-default-features --features monitor" }
+          - { name: "serve", features: "--no-default-features --features serve" }
+          - { name: "timeseries", features: "--no-default-features --features timeseries" }
+          - { name: "incremental", features: "--no-default-features --features incremental" }
+          - { name: "automl", features: "--no-default-features --features automl" }
+          # Everything at once — the superset build, including both ndarray worlds.
+          - { name: "full", features: "--features full" }
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.name }}
+      - run: cargo test --locked ${{ matrix.features }}
+
+  # Cross-platform confidence on the default install, without multiplying the
+  # whole feature matrix across three operating systems.
+  os:
+    name: test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --locked
+
+  msrv:
+    name: minimum Rust 1.95
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.95"
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo check --locked --all-targets --features full
+
+  supply-chain:
+    name: advisories
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo install cargo-audit --locked
+      - run: cargo audit
+
+  dependency-policy:
+    name: dependency policy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: taiki-e/install-action@cargo-deny
+      - run: cargo deny check
+
+  coverage:
+    name: coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - uses: Swatinem/rust-cache@v2
+      - name: measure full-feature Rust coverage
+        run: cargo llvm-cov --locked --features full --workspace --lcov --output-path lcov.info
+      - name: enforce coverage floor
+        run: >-
+          cargo llvm-cov report --summary-only
+          --fail-under-lines 82
+          --fail-under-functions 75
+          --fail-under-regions 84
+      - uses: actions/upload-artifact@v7
+        with:
+          name: rust-coverage
+          path: lcov.info
+          if-no-files-found: error
+
+  branch-coverage:
+    name: branch coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      # LLVM branch instrumentation remains a nightly-only cargo-llvm-cov mode.
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: llvm-tools-preview
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: branch-coverage
+      - name: measure decision coverage
+        run: >-
+          cargo +nightly llvm-cov --locked --features full --workspace --branch
+          --cobertura --output-path branch-coverage.xml
+      - uses: actions/upload-artifact@v7
+        with:
+          name: rust-branch-coverage
+          path: branch-coverage.xml
+          if-no-files-found: error
+
+  semver:
+    name: public API compatibility
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo install cargo-semver-checks --locked
+      - run: cargo semver-checks check-release
+
+  # Compile and *run* the examples (the `test` jobs only build the library and
+  # its tests), plus a compile-check of the benchmarks. The dedicated `msrv`
+  # job above proves the declared Rust 1.95 floor independently.
+  examples:
+    name: examples & benches
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: run every example
+        run: |
+          for ex in spine explore trust workflow backends insight portability operations specialized automl; do
+            echo "::group::$ex"
+            cargo run --locked --features full --example "$ex"
+            echo "::endgroup::"
+          done
+      - name: compile benchmarks
+        run: cargo bench --locked --features full --no-run
+
+  package:
+    name: package (publish dry-run)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      # No rust-cache here: `cargo publish` builds a copy under target/package,
+      # which the cache action's post-step chokes on.
+      # Prove the crate packages and builds from its packaged form as it would on
+      # crates.io — catches missing files, bad metadata, and path/dev-dep leaks.
+      - run: cargo publish --dry-run --locked
+
+  python:
+    name: python wheel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.9"
+      - uses: Swatinem/rust-cache@v2
+      # The `python` feature can't be linked by `cargo test` (pyo3's
+      # extension-module defers libpython), so it is built the way it ships:
+      # as an abi3 wheel via maturin, then smoke-imported.
+      - run: pip install maturin pytest
+      - run: maturin build --locked --release
+      - run: pip install --find-links target/wheels millwright
+      - run: pytest -q tests/python

{millwright-0.2.1 → millwright-2.2.1}/.github/workflows/release-crate.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
       id-token: write # required for crates.io Trusted Publishing (OIDC)
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
 

{millwright-0.2.1 → millwright-2.2.1}/.github/workflows/release-python.yml

@@ -12,15 +12,32 @@ permissions:
   contents: read
 
 jobs:
+  verify-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - name: check Cargo, Python, and tag versions agree
+        shell: bash
+        run: |
+          cargo_version="$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')"
+          python_version="$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
+          test "$cargo_version" = "$python_version" || { echo "::error::Cargo $cargo_version != Python $python_version"; exit 1; }
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            tag="${GITHUB_REF_NAME#v}"
+            test "$tag" = "$cargo_version" || { echo "::error::tag $tag != package $cargo_version"; exit 1; }
+          fi
+
   linux:
+    needs: verify-version
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
       - name: build wheel (${{ matrix.target }})
@@ -31,20 +48,21 @@ jobs:
           # `[tool.maturin] features = ["python"]` in pyproject.toml selects the
           # feature; abi3-py39 means one wheel covers Python 3.9+.
           args: --release --locked --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-linux-${{ matrix.target }}
           path: dist
 
   windows:
+    needs: verify-version
     runs-on: windows-latest
     strategy:
       fail-fast: false
       matrix:
         target: [x64]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
           architecture: ${{ matrix.target }}
@@ -53,20 +71,21 @@ jobs:
         with:
           target: ${{ matrix.target }}
           args: --release --locked --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-windows-${{ matrix.target }}
           path: dist
 
   macos:
+    needs: verify-version
     runs-on: macos-latest
     strategy:
       fail-fast: false
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
       - name: build wheel (${{ matrix.target }})
@@ -74,21 +93,22 @@ jobs:
         with:
           target: ${{ matrix.target }}
           args: --release --locked --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-macos-${{ matrix.target }}
           path: dist
 
   sdist:
+    needs: verify-version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: build sdist
         uses: PyO3/maturin-action@v1
         with:
           command: sdist
           args: --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-sdist
           path: dist
@@ -102,7 +122,7 @@ jobs:
     permissions:
       id-token: write # PyPI Trusted Publishing (OIDC) — no stored token
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: wheels-*
           merge-multiple: true
@@ -111,4 +131,3 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist
-          skip-existing: true

{millwright-0.2.1 → millwright-2.2.1}/CHANGELOG.md

@@ -6,6 +6,48 @@ All notable changes to Millwright are recorded here. The format follows
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-08-24
+
+### Added
+- Enforced line, function, and region coverage floors, plus nightly LLVM branch
+  coverage artifacts.
+- Expanded the installed-wheel Python suite to cover validation, classification,
+  regression, search, explainability, profiling, and ONNX round trips.
+- Added protected MSRV, branch-coverage, Windows, and macOS checks on `main`.
+
+### Changed
+- Isolated ONNX native execution, profile rendering, advanced transforms, and
+  Python data/EDA bindings into focused production modules.
+- Hardened Dependabot so compatibility-boundary and exact-pinned engine upgrades
+  remain deliberate, while safe GitHub Actions updates stay automated.
+- Updated GitHub Actions and kept release publishing on trusted OIDC workflows.
+
+### Fixed
+- Version synchronization now includes the root `Cargo.lock` package entry and
+  the maintained Python version assertion.
+- Removed the obsolete standalone Python smoke script after migrating CI to the
+  pytest behavioral suite.
+- Corrected the MSRV workflow selector so dependency automation cannot rewrite
+  Rust 1.95 as an action version.
+
+## [2.2.0] - 2026-08-24
+
+### Added
+- Complete Rust and Python ML lifecycle: typed ingest and EDA, preprocessing,
+  model selection and HPO, ensembles, diagnostics and explainability, ONNX
+  portability, serving, registry, drift monitoring, specialized estimators, and
+  AutoML.
+- Cross-platform Python abi3 wheels and synchronized crates.io/PyPI releases.
+
+### Changed
+- Hardened feature isolation, packaging, MSRV, SemVer, advisory, example, and
+  benchmark checks across the full CI matrix.
+- Updated the Python extension to PyO3 0.29 and documented the stable 2.2 API.
+
+### Security
+- Added explicit dependency advisory handling and removed vulnerable PyO3
+  releases from the resolved graph.
+
 ## [0.2.1] - 2026-08-23
 
 ### Added
@@ -125,9 +167,8 @@ All notable changes to Millwright are recorded here. The format follows
   feature-matrix CI (fmt, clippy `-D warnings`, docs, matrix, OS, examples,
   benches, publish dry-run, wheel).
 - `selection.rs` split into `selection/{scoring,cv,search}`.
-- MSRV is **1.95** (dep-dictated — `sysinfo` via tract, and polars); enforced by
-  cargo via `rust-version` rather than a dedicated CI job (which would break on
-  every transitive bump). The default install needs 1.85.
+- MSRV is **1.95** (dep-dictated — `sysinfo` via tract, and polars), declared
+  through `rust-version` and exercised by a dedicated CI job.
 - De-staled the crate and module docs (no more "Phase 0 · the spine").
 
 ### Fixed

{millwright-0.2.1 → millwright-2.2.1}/CONTRIBUTING.md

@@ -45,7 +45,8 @@ cargo doc --no-deps --features full         # with RUSTDOCFLAGS="-D warnings"
 
 Maintainers: bump `Cargo.toml` + `pyproject.toml`, roll `CHANGELOG.md`, and tag
 `vX.Y.Z` — the workflows publish to crates.io and PyPI via OIDC. The helper
-`scripts/release.sh X.Y.Z` does the mechanical steps. See
+`scripts/release.sh X.Y.Z` (Linux/macOS) or `scripts/release.ps1 X.Y.Z`
+(Windows) does the mechanical steps. See
 [`RELEASING.md`](RELEASING.md).
 
 ## Scope & conduct