millwright 2.2.0__tar.gz → 2.2.1__tar.gz

millwright-2.2.1/.github/dependabot.yml

@@ -0,0 +1,59 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      rust-infrastructure:
+        patterns: ["*"]
+        exclude-patterns:
+          # These crates form type/serialization boundaries with the exact-pinned
+          # ML engines. Upgrade them deliberately, with the full feature matrix.
+          - "ndarray"
+          - "prost"
+          - "sha2"
+          - "criterion"
+    ignore:
+      # Engine versions are exact by design. Dependabot PRs cannot safely infer
+      # coordinated upgrades across their ndarray and ONNX type boundaries.
+      - dependency-name: "ndarray"
+      - dependency-name: "prost"
+      - dependency-name: "sha2"
+      - dependency-name: "criterion"
+      - dependency-name: "smartcore"
+      - dependency-name: "imbalance-rs"
+      - dependency-name: "model-selection-rs"
+      - dependency-name: "linfa*"
+      - dependency-name: "hyperopt-rs"
+      - dependency-name: "regression-diagnostics"
+      - dependency-name: "shap-rs"
+      - dependency-name: "plotters-statistical"
+      - dependency-name: "onnx-export-rs"
+      - dependency-name: "driftwatch"
+      - dependency-name: "chronos-ts"
+      - dependency-name: "incremental-rs"
+      - dependency-name: "polars"
+    labels: ["dependencies", "rust"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+        exclude-patterns: ["dtolnay/rust-toolchain"]
+    ignore:
+      # @1.95 is a Rust toolchain selector, not an action release. It is also
+      # expressed as an input in CI, but keep this guard against regressions.
+      - dependency-name: "dtolnay/rust-toolchain"
+    labels: ["dependencies", "github-actions"]
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "python"]

{millwright-2.2.0 → millwright-2.2.1}/.github/workflows/ci.yml

@@ -20,11 +20,31 @@ env:
   RUSTFLAGS: "-D warnings"
 
 jobs:
+  consistency:
+    name: version & links
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.x"
+      - name: verify every public version marker
+        run: python scripts/sync-version.py --check
+      - name: check local and external HTML links
+        uses: lycheeverse/lychee-action@v2
+        with:
+          args: >-
+            --no-progress
+            --accept 200,204,206,429
+            --retry-wait-time 2
+            index.html guide.html docs/*.html README.md CONTRIBUTING.md RELEASING.md
+          fail: true
+
   fmt:
     name: rustfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
@@ -41,7 +61,7 @@ jobs:
           - features: "" # default features
           - features: "--features full"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -54,7 +74,7 @@ jobs:
     env:
       RUSTDOCFLAGS: "-D warnings"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       # `full` is every Rust-facing feature (python is a cdylib, doc'd separately
@@ -93,7 +113,7 @@ jobs:
           # Everything at once — the superset build, including both ndarray worlds.
           - { name: "full", features: "--features full" }
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
@@ -110,7 +130,7 @@ jobs:
       matrix:
         os: [windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --locked
@@ -119,8 +139,10 @@ jobs:
     name: minimum Rust 1.95
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.95
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.95"
       - uses: Swatinem/rust-cache@v2
       - run: cargo check --locked --all-targets --features full
 
@@ -128,30 +150,83 @@ jobs:
     name: advisories
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo install cargo-audit --locked
       - run: cargo audit
 
+  dependency-policy:
+    name: dependency policy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: taiki-e/install-action@cargo-deny
+      - run: cargo deny check
+
+  coverage:
+    name: coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - uses: Swatinem/rust-cache@v2
+      - name: measure full-feature Rust coverage
+        run: cargo llvm-cov --locked --features full --workspace --lcov --output-path lcov.info
+      - name: enforce coverage floor
+        run: >-
+          cargo llvm-cov report --summary-only
+          --fail-under-lines 82
+          --fail-under-functions 75
+          --fail-under-regions 84
+      - uses: actions/upload-artifact@v7
+        with:
+          name: rust-coverage
+          path: lcov.info
+          if-no-files-found: error
+
+  branch-coverage:
+    name: branch coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      # LLVM branch instrumentation remains a nightly-only cargo-llvm-cov mode.
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: llvm-tools-preview
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: branch-coverage
+      - name: measure decision coverage
+        run: >-
+          cargo +nightly llvm-cov --locked --features full --workspace --branch
+          --cobertura --output-path branch-coverage.xml
+      - uses: actions/upload-artifact@v7
+        with:
+          name: rust-branch-coverage
+          path: branch-coverage.xml
+          if-no-files-found: error
+
   semver:
     name: public API compatibility
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo install cargo-semver-checks --locked
       - run: cargo semver-checks check-release
 
   # Compile and *run* the examples (the `test` jobs only build the library and
-  # its tests), plus a compile-check of the benchmarks. The declared MSRV
-  # (`rust-version` in Cargo.toml) is enforced by cargo for consumers; we do not
-  # run a dedicated old-toolchain job, since the floor is dictated entirely by
-  # transitive engine deps and would otherwise break on every one of their bumps.
+  # its tests), plus a compile-check of the benchmarks. The dedicated `msrv`
+  # job above proves the declared Rust 1.95 floor independently.
   examples:
     name: examples & benches
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: run every example
@@ -168,7 +243,7 @@ jobs:
     name: package (publish dry-run)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       # No rust-cache here: `cargo publish` builds a copy under target/package,
       # which the cache action's post-step chokes on.
@@ -180,16 +255,16 @@ jobs:
     name: python wheel
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.9"
       - uses: Swatinem/rust-cache@v2
       # The `python` feature can't be linked by `cargo test` (pyo3's
       # extension-module defers libpython), so it is built the way it ships:
       # as an abi3 wheel via maturin, then smoke-imported.
-      - run: pip install maturin
+      - run: pip install maturin pytest
       - run: maturin build --locked --release
       - run: pip install --find-links target/wheels millwright
-      - run: python tests/python_smoke.py
+      - run: pytest -q tests/python

{millwright-2.2.0 → millwright-2.2.1}/.github/workflows/release-crate.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
       id-token: write # required for crates.io Trusted Publishing (OIDC)
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
 

{millwright-2.2.0 → millwright-2.2.1}/.github/workflows/release-python.yml

@@ -15,7 +15,7 @@ jobs:
   verify-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: check Cargo, Python, and tag versions agree
         shell: bash
@@ -36,8 +36,8 @@ jobs:
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
       - name: build wheel (${{ matrix.target }})
@@ -48,7 +48,7 @@ jobs:
           # `[tool.maturin] features = ["python"]` in pyproject.toml selects the
           # feature; abi3-py39 means one wheel covers Python 3.9+.
           args: --release --locked --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-linux-${{ matrix.target }}
           path: dist
@@ -61,8 +61,8 @@ jobs:
       matrix:
         target: [x64]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
           architecture: ${{ matrix.target }}
@@ -71,7 +71,7 @@ jobs:
         with:
           target: ${{ matrix.target }}
           args: --release --locked --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-windows-${{ matrix.target }}
           path: dist
@@ -84,8 +84,8 @@ jobs:
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
       - name: build wheel (${{ matrix.target }})
@@ -93,7 +93,7 @@ jobs:
         with:
           target: ${{ matrix.target }}
           args: --release --locked --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-macos-${{ matrix.target }}
           path: dist
@@ -102,13 +102,13 @@ jobs:
     needs: verify-version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: build sdist
         uses: PyO3/maturin-action@v1
         with:
           command: sdist
           args: --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-sdist
           path: dist
@@ -122,7 +122,7 @@ jobs:
     permissions:
       id-token: write # PyPI Trusted Publishing (OIDC) — no stored token
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: wheels-*
           merge-multiple: true

{millwright-2.2.0 → millwright-2.2.1}/CHANGELOG.md

@@ -6,8 +6,48 @@ All notable changes to Millwright are recorded here. The format follows
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-08-24
+
+### Added
+- Enforced line, function, and region coverage floors, plus nightly LLVM branch
+  coverage artifacts.
+- Expanded the installed-wheel Python suite to cover validation, classification,
+  regression, search, explainability, profiling, and ONNX round trips.
+- Added protected MSRV, branch-coverage, Windows, and macOS checks on `main`.
+
+### Changed
+- Isolated ONNX native execution, profile rendering, advanced transforms, and
+  Python data/EDA bindings into focused production modules.
+- Hardened Dependabot so compatibility-boundary and exact-pinned engine upgrades
+  remain deliberate, while safe GitHub Actions updates stay automated.
+- Updated GitHub Actions and kept release publishing on trusted OIDC workflows.
+
+### Fixed
+- Version synchronization now includes the root `Cargo.lock` package entry and
+  the maintained Python version assertion.
+- Removed the obsolete standalone Python smoke script after migrating CI to the
+  pytest behavioral suite.
+- Corrected the MSRV workflow selector so dependency automation cannot rewrite
+  Rust 1.95 as an action version.
+
 ## [2.2.0] - 2026-08-24
 
+### Added
+- Complete Rust and Python ML lifecycle: typed ingest and EDA, preprocessing,
+  model selection and HPO, ensembles, diagnostics and explainability, ONNX
+  portability, serving, registry, drift monitoring, specialized estimators, and
+  AutoML.
+- Cross-platform Python abi3 wheels and synchronized crates.io/PyPI releases.
+
+### Changed
+- Hardened feature isolation, packaging, MSRV, SemVer, advisory, example, and
+  benchmark checks across the full CI matrix.
+- Updated the Python extension to PyO3 0.29 and documented the stable 2.2 API.
+
+### Security
+- Added explicit dependency advisory handling and removed vulnerable PyO3
+  releases from the resolved graph.
+
 ## [0.2.1] - 2026-08-23
 
 ### Added

{millwright-2.2.0 → millwright-2.2.1}/CONTRIBUTING.md

@@ -45,7 +45,8 @@ cargo doc --no-deps --features full         # with RUSTDOCFLAGS="-D warnings"
 
 Maintainers: bump `Cargo.toml` + `pyproject.toml`, roll `CHANGELOG.md`, and tag
 `vX.Y.Z` — the workflows publish to crates.io and PyPI via OIDC. The helper
-`scripts/release.sh X.Y.Z` does the mechanical steps. See
+`scripts/release.sh X.Y.Z` (Linux/macOS) or `scripts/release.ps1 X.Y.Z`
+(Windows) does the mechanical steps. See
 [`RELEASING.md`](RELEASING.md).
 
 ## Scope & conduct

{millwright-2.2.0 → millwright-2.2.1}/Cargo.lock

@@ -1975,7 +1975,7 @@ checksum = "38d1115007560874e373613744c6fba374c17688327a71c1476d1a5954cc857b"
 
 [[package]]
 name = "millwright"
-version = "2.2.0"
+version = "2.2.1"
 dependencies = [
  "axum",
  "chronos-ts",

{millwright-2.2.0 → millwright-2.2.1}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "millwright"
-version = "2.2.0"
+version = "2.2.1"
 edition = "2021"
 rust-version = "1.95"
 description = "A unified ML framework for Rust — proven Rust crates, assembled into one machine."

{millwright-2.2.0 → millwright-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: millwright
-Version: 2.2.0
+Version: 2.2.1
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: 3
 Classifier: Intended Audience :: Science/Research

{millwright-2.2.0 → millwright-2.2.1}/RELEASING.md

@@ -8,18 +8,23 @@ the same source.
 With `main` green and `CHANGELOG.md`'s `[Unreleased]` section filled in, run:
 
 ```bash
-bash scripts/release.sh 0.1.2
+# Linux/macOS
+bash scripts/release.sh 2.2.1
+
+# Windows PowerShell
+powershell -File scripts/release.ps1 2.2.1
 ```
 
-It bumps both manifests, rolls the changelog, syncs `Cargo.lock`, verifies the
-package, commits, tags `v0.1.2`, and (after a prompt) pushes — which triggers the
+It synchronizes both manifests and every public HTML version marker, rolls the
+changelog, syncs `Cargo.lock`, verifies the package, commits, tags `v2.2.1`, and
+(after a prompt) pushes — which triggers the
 publish workflows below. The rest of this file is the manual equivalent.
 
 ## Preflight (manual)
 
 1. `main` is green in CI and `CHANGELOG.md`'s `[Unreleased]` section is current.
-2. Bump the version in **both** `Cargo.toml` and `pyproject.toml`, move the
-   changelog's `[Unreleased]` entries under the new version, and commit.
+2. Run `python scripts/sync-version.py X.Y.Z`, move the changelog's
+   `[Unreleased]` entries under the new version, and commit.
 3. Prove the packaged crate builds exactly as crates.io will build it:
 
    ```bash

millwright-2.2.1/deny.toml

@@ -0,0 +1,34 @@
+[advisories]
+# Retained only by an inactive optional dependency; absent from every resolved
+# target/feature graph. Keep aligned with .cargo/audit.toml until upstream drops it.
+ignore = ["RUSTSEC-2026-0194", "RUSTSEC-2026-0195"]
+yanked = "deny"
+unused-ignored-advisory = "allow"
+
+[licenses]
+confidence-threshold = 0.8
+unused-allowed-license = "allow"
+allow = [
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "BSL-1.0",
+  "CC0-1.0",
+  "ISC",
+  "MIT",
+  "MPL-2.0",
+  "OpenSSL",
+  "Unicode-3.0",
+  "Zlib",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+highlight = "simplest-path"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]

{millwright-2.2.0 → millwright-2.2.1}/docs/index.html

@@ -104,10 +104,10 @@ pipe.fit(&train)?;
         <p class="muted">Every capability is a feature over one crate. A serving binary never compiles SHAP; a notebook never compiles <code class="inl">axum</code>. <code class="inl">full</code> lights up everything Rust-facing.</p>
       </div>
 <pre><span class="c"># just the spine</span>
-millwright = { version = <span class="s">"0.1"</span>, default-features = <span class="k">false</span>, features = [<span class="s">"smartcore-backend"</span>] }
+millwright = { version = <span class="s">"2.2.1"</span>, default-features = <span class="k">false</span>, features = [<span class="s">"smartcore-backend"</span>] }
 
 <span class="c"># the whole lifecycle</span>
-millwright = { version = <span class="s">"0.1"</span>, features = [<span class="s">"full"</span>] }</pre>
+millwright = { version = <span class="s">"2.2.1"</span>, features = [<span class="s">"full"</span>] }</pre>
       <div class="tablewrap">
         <table>
           <thead><tr><th>Feature</th><th>Adds</th></tr></thead>

{millwright-2.2.0 → millwright-2.2.1}/guide.html

@@ -1,10 +1,10 @@
 <!doctype html><html><head><meta charset="utf-8">
-<title>Millwright v2.2.0 · Guide</title>
-<meta name="millwright-version" content="2.2.0">
+<title>Millwright v2.2.1 · Guide</title>
+<meta name="millwright-version" content="2.2.1">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta http-equiv="refresh" content="0; url=docs/index.html">
 <link rel="canonical" href="docs/index.html">
 <style>body{margin:0;background:#EEF1F3;color:#556069;font:16px/1.6 system-ui,sans-serif;display:grid;place-items:center;height:100vh}a{color:#94380F}</style>
 </head><body>
-<p>Millwright v2.2.0 guide has moved to <a href="docs/index.html">the docs</a>…</p>
+<p>Millwright v2.2.1 guide has moved to <a href="docs/index.html">the docs</a>…</p>
 </body></html>

{millwright-2.2.0 → millwright-2.2.1}/index.html

@@ -216,7 +216,7 @@
 
 </head><body><header class="top">
   <div class="wrap">
-    <div class="brand"><span class="mark">⚙</span>millwright<span class="ver">v2.2.0</span></div>
+    <div class="brand"><span class="mark">⚙</span>millwright<span class="ver">v2.2.1</span></div>
     <nav>
       <a href="#arch">arch</a>
       <a href="#api">api</a>

{millwright-2.2.0 → millwright-2.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "millwright"
-version = "2.2.0"
+version = "2.2.1"
 description = "A unified ML framework for Rust — Python bindings over the Rust core."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -24,3 +24,7 @@ Repository = "https://github.com/mi7plus/millwright"
 # Build the pyo3 extension behind the `python` feature; the module is `millwright`.
 features = ["python"]
 module-name = "millwright"
+
+[tool.pytest.ini_options]
+testpaths = ["tests/python"]
+addopts = "--strict-markers --strict-config"

millwright-2.2.1/scripts/release.ps1

@@ -0,0 +1,64 @@
+param(
+    [Parameter(Mandatory = $true, Position = 0)]
+    [ValidatePattern('^\d+\.\d+\.\d+$')]
+    [string]$Version
+)
+
+$ErrorActionPreference = 'Stop'
+$root = (git rev-parse --show-toplevel).Trim()
+Set-Location -LiteralPath $root
+
+# Codex, Git Bash, and other Unix-flavoured Windows shells can put GNU
+# `link.exe` ahead of Microsoft's linker. Import the official developer-shell
+# environment before invoking Cargo so both link.exe and cl.exe are correct.
+$vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+if (Test-Path -LiteralPath $vswhere) {
+    $installation = (& $vswhere -latest -products * -property installationPath).Trim()
+    if ($installation) {
+        $vsDevCmd = Join-Path $installation 'Common7\Tools\VsDevCmd.bat'
+        if (Test-Path -LiteralPath $vsDevCmd) {
+            & cmd.exe /d /s /c "`"$vsDevCmd`" -no_logo -arch=x64 && set" |
+                ForEach-Object {
+                    if ($_ -match '^([^=]+)=(.*)$') {
+                        [Environment]::SetEnvironmentVariable($matches[1], $matches[2], 'Process')
+                    }
+                }
+        }
+    }
+}
+
+if (git status --porcelain) { throw 'working tree is not clean' }
+if ((git branch --show-current).Trim() -ne 'main') { throw 'not on main' }
+$tag = "v$Version"
+git rev-parse --verify --quiet "refs/tags/$tag" 2>$null
+if ($LASTEXITCODE -eq 0) { throw "tag $tag already exists" }
+
+$releaseFiles = @('Cargo.toml', 'Cargo.lock', 'pyproject.toml', 'CHANGELOG.md', 'index.html', 'guide.html', 'docs/index.html', 'tests/python_smoke.py')
+$committed = $false
+try {
+    python scripts/sync-version.py $Version
+    $date = Get-Date -Format 'yyyy-MM-dd'
+    $changelog = Get-Content -Raw CHANGELOG.md
+    $changelog = $changelog -replace '## \[Unreleased\]', "## [Unreleased]`n`n## [$Version] - $date"
+    [IO.File]::WriteAllText((Join-Path $root 'CHANGELOG.md'), $changelog.Replace("`r`n", "`n"))
+
+    cargo build --locked
+    if ($LASTEXITCODE) { throw 'cargo build failed' }
+    cargo publish --dry-run --locked --allow-dirty
+    if ($LASTEXITCODE) { throw 'cargo publish dry-run failed' }
+
+    git add -- $releaseFiles
+    git commit -m "Release $Version"
+    $committed = $true
+    git tag $tag
+
+    $reply = Read-Host "Push main + $tag now? This publishes to crates.io and PyPI. [y/N]"
+    if ($reply -in @('y', 'Y')) {
+        git push origin main $tag
+    } else {
+        Write-Host "Not pushed. When ready: git push origin main $tag"
+    }
+} catch {
+    if (-not $committed) { git restore --staged --worktree -- $releaseFiles 2>$null }
+    throw
+}