morphtree 2.1.0__tar.gz

morphtree-2.1.0/.gitattributes

@@ -0,0 +1,4 @@
+# Preserve the exact qualified snapshot,including historical research hashes.
+# No automatic LF/CRLF conversion during a future Git add/checkout.
+# New source should use LF deliberately;review/update manifests after edits.
+* -text

morphtree-2.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,50 @@
+name: Bug report
+description: Report a reproducible MorphTree issue.
+title: "[Bug]: "
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Use invented or public data only. Remove credentials, usernames and
+        private file paths from tracebacks. Report security issues privately
+        using the guidance in SECURITY.md rather than a public issue.
+  - type: input
+    id: version
+    attributes:
+      label: MorphTree version
+      placeholder: "2.1.0"
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Python version, Windows/Linux variant, architecture, and installation type (wheel or sdist). No local identifiers.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal synthetic reproduction
+      description: Include imports, sample rows, labels, random_state and estimator settings. Keep it small; do not upload private models.
+    validations:
+      required: true
+  - type: textarea
+    id: traceback
+    attributes:
+      label: Error or diagnostic output (redacted)
+      description: Include a traceback if there is one, or write "No exception".
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true

morphtree-2.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,31 @@
+name: Feature request
+description: Suggest an API, usability, or research improvement.
+title: "[Feature]: "
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Do not share private datasets, credentials, paths, or unpublished
+        research evidence. Structural learning changes require a separate,
+        preregistered experimental protocol and maintainer approval.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem and use case
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Suggested change
+    validations:
+      required: true
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Public API, persistence and evolution impact
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Reproduction or proposed evaluation
+      description: Comparisons should include the static-parent control where relevant; do not claim unmeasured improvements.

morphtree-2.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+## Change summary
+
+Explain the problem and the smallest justified correction.
+
+## Compatibility and scientific behavior
+
+Describe effects on public API, saved models, learning program, structural mutation
+history, acceptance/rollback, numerical outcomes, native ABI, dependencies and
+supported platforms. Write "none" where applicable.
+
+## Verification
+
+- [ ] `python -I -B tools/check_repository.py` passes **after regenerating the inventory** for this reviewed change.
+- [ ] Relevant zero-fit tests and repeat-run tests pass.
+- [ ] Native changes include bounds/ABI tests and appropriate build evidence.
+- [ ] Algorithm or performance changes include a preregistered comparison, budget and maintainer approval before LIVE fits.
+- [ ] User-visible changes update README, CHANGELOG and API/qualification docs as necessary.
+- [ ] No credentials, personal paths, private results, `.git`, compiled scratch files or datasets are included.
+- [ ] Wheel/sdist and installed-package qualification are repeated when release content changes.
+
+Git history, merges, versioning and all publication actions remain owner-controlled.

morphtree-2.1.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,198 @@
+name: MorphTree official PyPI - reviewed OIDC publication
+on:
+  workflow_dispatch:
+    inputs:
+      expected_version:
+        description: Approved version (2.1.0 only)
+        required: true
+        default: '2.1.0'
+        type: string
+      reviewed_commit:
+        description: Full SHA of this exact main-branch commit and its successful CI run
+        required: true
+        type: string
+      reviewed_build_run:
+        description: Successful manual test.yml run ID from that commit
+        required: true
+        type: string
+      reviewed_build_attempt:
+        description: Reviewed CI run attempt (use a fresh complete run)
+        required: true
+        default: '1'
+        type: string
+      windows_manifest_sha256:
+        description: Owner-reviewed SHA-256 of Windows 3.12 BUILD_PROVENANCE.json
+        required: true
+        type: string
+      linux_manifest_sha256:
+        description: Owner-reviewed SHA-256 of Linux 3.12 BUILD_PROVENANCE.json
+        required: true
+        type: string
+      publish_pypi:
+        description: Explicitly request upload AFTER preflight and environment approval
+        required: true
+        default: false
+        type: boolean
+      approval:
+        description: For upload enter exactly PUBLISH morphtree 2.1.0 TO PYPI
+        required: false
+        default: ''
+        type: string
+permissions:
+  contents: read
+concurrency:
+  group: morphtree-pypi-2.1.0
+  cancel-in-progress: false
+env:
+  PYTHONDONTWRITEBYTECODE: '1'
+jobs:
+  preflight:
+    if: ${{ github.repository == 'lucalullo/morph-tree' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      bundle_manifest_sha256: ${{ steps.review.outputs.bundle_manifest_sha256 }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - name: Validate explicit intent
+        env:
+          REQUESTED: ${{ inputs.publish_pypi }}
+          APPROVAL: ${{ inputs.approval }}
+        shell: python
+        run: |
+          import os
+          assert os.environ['REQUESTED'] == 'false' or os.environ['APPROVAL'] == 'PUBLISH morphtree 2.1.0 TO PYPI'
+      - run: python -I -B tools/check_repository.py
+      - name: Verify CI commit, six jobs, artifacts and environment protection
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.expected_version }}
+          COMMIT: ${{ inputs.reviewed_commit }}
+          BUILD_RUN: ${{ inputs.reviewed_build_run }}
+          BUILD_ATTEMPT: ${{ inputs.reviewed_build_attempt }}
+        shell: python
+        run: |
+          import os, subprocess, sys
+          subprocess.run([sys.executable, '-I', '-B', 'tools/publish_pypi_reviewed.py',
+              '--stage', 'origin', '--expected-version', os.environ['VERSION'],
+              '--reviewed-commit', os.environ['COMMIT'], '--build-run', os.environ['BUILD_RUN'],
+              '--build-attempt', os.environ['BUILD_ATTEMPT'], '--output', 'review-origin.json'], check=True)
+      - uses: actions/download-artifact@v4
+        with:
+          name: morphtree-windows-latest-3.12
+          run-id: ${{ inputs.reviewed_build_run }}
+          github-token: ${{ github.token }}
+          path: downloaded/windows
+      - uses: actions/download-artifact@v4
+        with:
+          name: morphtree-ubuntu-24.04-3.12
+          run-id: ${{ inputs.reviewed_build_run }}
+          github-token: ${{ github.token }}
+          path: downloaded/linux
+      - name: Install metadata validator only
+        run: python -m pip --isolated install twine==6.2.0
+      - name: Verify approved hashes, source, metadata and PyPI availability
+        id: review
+        env:
+          VERSION: ${{ inputs.expected_version }}
+          COMMIT: ${{ inputs.reviewed_commit }}
+          BUILD_RUN: ${{ inputs.reviewed_build_run }}
+          BUILD_ATTEMPT: ${{ inputs.reviewed_build_attempt }}
+          WINDOWS_SHA: ${{ inputs.windows_manifest_sha256 }}
+          LINUX_SHA: ${{ inputs.linux_manifest_sha256 }}
+        shell: python
+        run: |
+          import os, subprocess, sys
+          subprocess.run([sys.executable, '-I', '-B', 'tools/publish_pypi_reviewed.py',
+              '--stage', 'preflight', '--expected-version', os.environ['VERSION'],
+              '--reviewed-commit', os.environ['COMMIT'], '--build-run', os.environ['BUILD_RUN'],
+              '--build-attempt', os.environ['BUILD_ATTEMPT'], '--origin', 'review-origin.json',
+              '--windows', 'downloaded/windows', '--linux', 'downloaded/linux',
+              '--windows-manifest-sha256', os.environ['WINDOWS_SHA'],
+              '--linux-manifest-sha256', os.environ['LINUX_SHA'], '--output', 'approved-bundle'], check=True)
+      - name: Preserve verified bytes for the isolated publication job
+        uses: actions/upload-artifact@v4
+        with:
+          name: pypi-approved-${{ github.run_id }}-${{ github.run_attempt }}
+          path: approved-bundle/
+          if-no-files-found: error
+          retention-days: 7
+  publish-pypi:
+    needs: preflight
+    if: ${{ inputs.publish_pypi && inputs.approval == 'PUBLISH morphtree 2.1.0 TO PYPI' && needs.preflight.result == 'success' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/project/morphtree/
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: pypi-approved-${{ github.run_id }}-${{ github.run_attempt }}
+          path: reviewed
+      # No checkout, repository code, build or package installation in this OIDC job.
+      - name: Recheck exact bundle and index immediately before OIDC upload
+        env:
+          APPROVED_MANIFEST_SHA256: ${{ needs.preflight.outputs.bundle_manifest_sha256 }}
+          REVIEWED_COMMIT: ${{ inputs.reviewed_commit }}
+          REVIEWED_RUN: ${{ inputs.reviewed_build_run }}
+          REVIEWED_ATTEMPT: ${{ inputs.reviewed_build_attempt }}
+          REQUESTED: ${{ inputs.publish_pypi }}
+          APPROVAL: ${{ inputs.approval }}
+        shell: python
+        run: |
+          import hashlib, json, os, pathlib, re, urllib.error, urllib.request
+          def require(condition, message):
+              if not condition: raise RuntimeError(message)
+          require(os.environ['REQUESTED'] == 'true' and os.environ['APPROVAL'] == 'PUBLISH morphtree 2.1.0 TO PYPI', 'Explicit upload approval missing')
+          path = pathlib.Path('reviewed/APPROVED.json')
+          require(path.is_file() and not path.is_symlink(), 'Missing or unsafe approval receipt')
+          require(re.fullmatch('[0-9a-f]{64}', os.environ['APPROVED_MANIFEST_SHA256']), 'Invalid approval SHA-256')
+          require(hashlib.sha256(path.read_bytes()).hexdigest() == os.environ['APPROVED_MANIFEST_SHA256'], 'Approval receipt hash mismatch')
+          value = json.loads(path.read_text('utf8'))
+          require(value['schema'] == 'MORPHTREE_PYPI_APPROVAL_1', 'Wrong receipt schema')
+          require(value['repository'] == os.environ['GITHUB_REPOSITORY'] == 'lucalullo/morph-tree', 'Wrong repository')
+          require(re.fullmatch('[0-9a-f]{40}', value['commit']) and value['commit'] == os.environ['GITHUB_SHA'] == os.environ['REVIEWED_COMMIT'], 'Wrong commit')
+          require(str(value['build_run_id']) == os.environ['REVIEWED_RUN'] and str(value['build_run_attempt']) == os.environ['REVIEWED_ATTEMPT'], 'Wrong reviewed CI run or attempt')
+          require(value['target'] == 'pypi' and value['version'] == '2.1.0', 'Only PyPI version 2.1.0 allowed')
+          require(value['repository_url'] == 'https://upload.pypi.org/legacy/', 'Wrong official PyPI endpoint')
+          require(value.get('testpypi_release_verified') is True, 'TestPyPI release evidence missing')
+          require(value.get('publication_workflow') == '.github/workflows/publish-pypi.yml', 'Wrong publication workflow')
+          require(os.environ['GITHUB_WORKFLOW_REF'] == 'lucalullo/morph-tree/.github/workflows/publish-pypi.yml@refs/heads/main' and os.environ['GITHUB_REF'] == 'refs/heads/main' and os.environ['GITHUB_EVENT_NAME'] == 'workflow_dispatch', 'Dedicated manual main-branch workflow required')
+          root = pathlib.Path('reviewed/packages')
+          require(root.is_dir() and not root.is_symlink(), 'Unsafe package directory')
+          require({p.name for p in root.iterdir()} == set(value['files']) and len(value['files']) == 3, 'Unexpected package membership')
+          require(sum(name.endswith('.whl') for name in value['files']) == 2 and 'morphtree-2.1.0.tar.gz' in value['files'], 'Expected two wheels and one source archive')
+          for name, pin in value['files'].items():
+              require(pathlib.Path(name).name == name and '\\' not in name, 'Unsafe filename')
+              artifact = root / name
+              require(artifact.is_file() and not artifact.is_symlink(), 'Missing or unsafe package')
+              require(hashlib.sha256(artifact.read_bytes()).hexdigest() == pin, 'Package hash mismatch')
+          class NoRedirect(urllib.request.HTTPRedirectHandler):
+              def redirect_request(self, *args, **kwargs):
+                  raise RuntimeError('Unexpected index redirect')
+          try:
+              urllib.request.build_opener(NoRedirect).open('https://pypi.org/pypi/morphtree/2.1.0/json', timeout=20).close()
+          except urllib.error.HTTPError as error:
+              require(error.code == 404, 'Index availability not verified')
+          else:
+              raise RuntimeError('Version already present on PyPI; no retry or overwrite')
+      - name: Publish approved artifacts to PyPI using OIDC
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://upload.pypi.org/legacy/
+          packages-dir: reviewed/packages/
+          skip-existing: false
+          attestations: true

morphtree-2.1.0/.github/workflows/publish.yml

@@ -0,0 +1,195 @@
+name: MorphTree TestPyPI - reviewed OIDC publication
+on:
+  workflow_dispatch:
+    inputs:
+      expected_version:
+        description: Approved version (2.1.0 only)
+        required: true
+        default: '2.1.0'
+        type: string
+      reviewed_commit:
+        description: Full SHA of this exact main-branch commit and its successful CI run
+        required: true
+        type: string
+      reviewed_build_run:
+        description: Successful manual test.yml run ID from that commit
+        required: true
+        type: string
+      reviewed_build_attempt:
+        description: Reviewed CI run attempt (use a fresh complete run)
+        required: true
+        default: '1'
+        type: string
+      windows_manifest_sha256:
+        description: Owner-reviewed SHA-256 of Windows 3.12 BUILD_PROVENANCE.json
+        required: true
+        type: string
+      linux_manifest_sha256:
+        description: Owner-reviewed SHA-256 of Linux 3.12 BUILD_PROVENANCE.json
+        required: true
+        type: string
+      publish_testpypi:
+        description: Explicitly request upload AFTER preflight and environment approval
+        required: true
+        default: false
+        type: boolean
+      approval:
+        description: For upload enter exactly PUBLISH morphtree 2.1.0 TO TESTPYPI
+        required: false
+        default: ''
+        type: string
+permissions:
+  contents: read
+concurrency:
+  group: morphtree-testpypi-2.1.0
+  cancel-in-progress: false
+env:
+  PYTHONDONTWRITEBYTECODE: '1'
+jobs:
+  preflight:
+    if: ${{ github.repository == 'lucalullo/morph-tree' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      bundle_manifest_sha256: ${{ steps.review.outputs.bundle_manifest_sha256 }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - name: Validate explicit intent
+        env:
+          REQUESTED: ${{ inputs.publish_testpypi }}
+          APPROVAL: ${{ inputs.approval }}
+        shell: python
+        run: |
+          import os
+          assert os.environ['REQUESTED'] == 'false' or os.environ['APPROVAL'] == 'PUBLISH morphtree 2.1.0 TO TESTPYPI'
+      - run: python -I -B tools/check_repository.py
+      - name: Verify CI commit, six jobs, artifacts and environment protection
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.expected_version }}
+          COMMIT: ${{ inputs.reviewed_commit }}
+          BUILD_RUN: ${{ inputs.reviewed_build_run }}
+          BUILD_ATTEMPT: ${{ inputs.reviewed_build_attempt }}
+        shell: python
+        run: |
+          import os, subprocess, sys
+          subprocess.run([sys.executable, '-I', '-B', 'tools/publish_reviewed.py',
+              '--stage', 'origin', '--target', 'testpypi', '--expected-version', os.environ['VERSION'],
+              '--reviewed-commit', os.environ['COMMIT'], '--build-run', os.environ['BUILD_RUN'],
+              '--build-attempt', os.environ['BUILD_ATTEMPT'], '--output', 'review-origin.json'], check=True)
+      - uses: actions/download-artifact@v4
+        with:
+          name: morphtree-windows-latest-3.12
+          run-id: ${{ inputs.reviewed_build_run }}
+          github-token: ${{ github.token }}
+          path: downloaded/windows
+      - uses: actions/download-artifact@v4
+        with:
+          name: morphtree-ubuntu-24.04-3.12
+          run-id: ${{ inputs.reviewed_build_run }}
+          github-token: ${{ github.token }}
+          path: downloaded/linux
+      - name: Install metadata validator only
+        run: python -m pip --isolated install twine==6.2.0
+      - name: Verify approved hashes, source, metadata and TestPyPI availability
+        id: review
+        env:
+          VERSION: ${{ inputs.expected_version }}
+          COMMIT: ${{ inputs.reviewed_commit }}
+          BUILD_RUN: ${{ inputs.reviewed_build_run }}
+          BUILD_ATTEMPT: ${{ inputs.reviewed_build_attempt }}
+          WINDOWS_SHA: ${{ inputs.windows_manifest_sha256 }}
+          LINUX_SHA: ${{ inputs.linux_manifest_sha256 }}
+        shell: python
+        run: |
+          import os, subprocess, sys
+          subprocess.run([sys.executable, '-I', '-B', 'tools/publish_reviewed.py',
+              '--stage', 'preflight', '--target', 'testpypi', '--expected-version', os.environ['VERSION'],
+              '--reviewed-commit', os.environ['COMMIT'], '--build-run', os.environ['BUILD_RUN'],
+              '--build-attempt', os.environ['BUILD_ATTEMPT'], '--origin', 'review-origin.json',
+              '--windows', 'downloaded/windows', '--linux', 'downloaded/linux',
+              '--windows-manifest-sha256', os.environ['WINDOWS_SHA'],
+              '--linux-manifest-sha256', os.environ['LINUX_SHA'], '--output', 'approved-bundle'], check=True)
+      - name: Preserve verified bytes for the isolated publication job
+        uses: actions/upload-artifact@v4
+        with:
+          name: testpypi-approved-${{ github.run_id }}-${{ github.run_attempt }}
+          path: approved-bundle/
+          if-no-files-found: error
+          retention-days: 7
+  publish-testpypi:
+    needs: preflight
+    if: ${{ inputs.publish_testpypi && inputs.approval == 'PUBLISH morphtree 2.1.0 TO TESTPYPI' && needs.preflight.result == 'success' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/morphtree/
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: testpypi-approved-${{ github.run_id }}-${{ github.run_attempt }}
+          path: reviewed
+      # No checkout, repository code, build or package installation in this OIDC job.
+      - name: Recheck exact bundle and index immediately before OIDC upload
+        env:
+          APPROVED_MANIFEST_SHA256: ${{ needs.preflight.outputs.bundle_manifest_sha256 }}
+          REVIEWED_COMMIT: ${{ inputs.reviewed_commit }}
+          REVIEWED_RUN: ${{ inputs.reviewed_build_run }}
+          REVIEWED_ATTEMPT: ${{ inputs.reviewed_build_attempt }}
+          REQUESTED: ${{ inputs.publish_testpypi }}
+          APPROVAL: ${{ inputs.approval }}
+        shell: python
+        run: |
+          import hashlib, json, os, pathlib, re, urllib.error, urllib.request
+          def require(condition, message):
+              if not condition: raise RuntimeError(message)
+          require(os.environ['REQUESTED'] == 'true' and os.environ['APPROVAL'] == 'PUBLISH morphtree 2.1.0 TO TESTPYPI', 'Explicit upload approval missing')
+          path = pathlib.Path('reviewed/APPROVED.json')
+          require(path.is_file() and not path.is_symlink(), 'Missing or unsafe approval receipt')
+          require(re.fullmatch('[0-9a-f]{64}', os.environ['APPROVED_MANIFEST_SHA256']), 'Invalid approval SHA-256')
+          require(hashlib.sha256(path.read_bytes()).hexdigest() == os.environ['APPROVED_MANIFEST_SHA256'], 'Approval receipt hash mismatch')
+          value = json.loads(path.read_text('utf8'))
+          require(value['schema'] == 'MORPHTREE_TESTPYPI_APPROVAL_1', 'Wrong receipt schema')
+          require(value['repository'] == os.environ['GITHUB_REPOSITORY'] == 'lucalullo/morph-tree', 'Wrong repository')
+          require(re.fullmatch('[0-9a-f]{40}', value['commit']) and value['commit'] == os.environ['GITHUB_SHA'] == os.environ['REVIEWED_COMMIT'], 'Wrong commit')
+          require(str(value['build_run_id']) == os.environ['REVIEWED_RUN'] and str(value['build_run_attempt']) == os.environ['REVIEWED_ATTEMPT'], 'Wrong reviewed CI run or attempt')
+          require(value['target'] == 'testpypi' and value['version'] == '2.1.0', 'Only TestPyPI version 2.1.0 allowed')
+          require(value['repository_url'] == 'https://test.pypi.org/legacy/', 'Official PyPI is blocked')
+          root = pathlib.Path('reviewed/packages')
+          require(root.is_dir() and not root.is_symlink(), 'Unsafe package directory')
+          require({p.name for p in root.iterdir()} == set(value['files']) and len(value['files']) == 3, 'Unexpected package membership')
+          require(sum(name.endswith('.whl') for name in value['files']) == 2 and 'morphtree-2.1.0.tar.gz' in value['files'], 'Expected two wheels and one source archive')
+          for name, pin in value['files'].items():
+              require(pathlib.Path(name).name == name and '\\' not in name, 'Unsafe filename')
+              artifact = root / name
+              require(artifact.is_file() and not artifact.is_symlink(), 'Missing or unsafe package')
+              require(hashlib.sha256(artifact.read_bytes()).hexdigest() == pin, 'Package hash mismatch')
+          class NoRedirect(urllib.request.HTTPRedirectHandler):
+              def redirect_request(self, *args, **kwargs):
+                  raise RuntimeError('Unexpected index redirect')
+          try:
+              urllib.request.build_opener(NoRedirect).open('https://test.pypi.org/pypi/morphtree/2.1.0/json', timeout=20).close()
+          except urllib.error.HTTPError as error:
+              require(error.code == 404, 'Index availability not verified')
+          else:
+              raise RuntimeError('Version already present on TestPyPI; no retry or overwrite')
+      - name: Publish approved artifacts to TestPyPI using OIDC
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: reviewed/packages/
+          skip-existing: false
+          attestations: true

morphtree-2.1.0/.github/workflows/test.yml

@@ -0,0 +1,86 @@
+name: MorphTree native candidate - manual zero-fit build
+on:
+  workflow_dispatch:
+    inputs:
+      confirm_zero_fit_scope:
+        description: Build and test six installed profiles without training or publication
+        required: true
+        type: boolean
+        default: false
+permissions:
+  contents: read
+concurrency:
+  group: morphtree-native-qualification
+  cancel-in-progress: false
+env:
+  PYTHONDONTWRITEBYTECODE: '1'
+  PYTHONUTF8: '1'
+  SOURCE_DATE_EPOCH: '1792022400'
+  PIP_NO_INPUT: '1'
+jobs:
+  scoped-zero-fit:
+    name: zero-fit-${{ matrix.os }}-${{ matrix.python }}
+    if: ${{ inputs.confirm_zero_fit_scope }}
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        os: [windows-latest, ubuntu-24.04]
+        python: ['3.12', '3.13', '3.14']
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Verify reviewed sources
+        run: python -I -B tools/check_repository.py
+      - name: Install isolated build tools
+        run: python -m pip --isolated install build==1.3.0 hatchling==1.27.0 twine==6.2.0 PyYAML==6.0.3
+      - name: Verify publication protocol without network or upload
+        run: python -I -B -m unittest discover -s tools/tests -v
+      - name: Install Linux audit tools in the CI environment
+        if: runner.os == 'Linux'
+        run: python -m pip --isolated install auditwheel==6.8.2 pyelftools==0.33 packaging==26.3 patchelf==0.19.1.0
+      - name: Build in separate source copy
+        if: runner.os == 'Windows'
+        run: python -I -B tools/build_artifacts.py
+      - name: Build and audit Linux wheel without changing native payload
+        if: runner.os == 'Linux'
+        run: python -I -B tools/build_artifacts.py --manylinux
+      - name: Check wheel and sdist installations
+        shell: python
+        run: |
+          import os,pathlib,subprocess,sys
+          root=pathlib.Path.cwd()
+          for artifact in sorted((root/'dist').iterdir()):
+              kind='wheel' if artifact.suffix=='.whl' else 'sdist'
+              prefix=pathlib.Path(os.environ['RUNNER_TEMP'])/('morphtree-'+kind)
+              assert not prefix.exists()
+              def run(args):
+                  subprocess.run(list(map(str,args)),check=True,timeout=240,cwd=os.environ['RUNNER_TEMP'])
+              run([sys.executable,'-I','-B','-m','venv',prefix])
+              py=prefix/('Scripts/python.exe' if os.name=='nt' else 'bin/python')
+              run([py,'-I','-B','-m','pip','--isolated','install',artifact])
+              run([py,'-I','-B','-m','pip','check'])
+              run([py,'-I','-B',root/'tools/check_installed.py'])
+      - name: Verify approved README in distribution metadata
+        run: python -I -B tools/check_distribution.py dist
+      - name: Validate distributions with Twine
+        shell: python
+        run: |
+          import pathlib,subprocess,sys
+          artifacts=sorted(pathlib.Path('dist').glob('*.whl'))+sorted(pathlib.Path('dist').glob('*.tar.gz'))
+          assert artifacts
+          subprocess.run([sys.executable,'-I','-B','-m','twine','check','--strict',*map(str,artifacts)],check=True,timeout=120)
+      - name: Record exact commit and distribution SHA-256 after all checks pass
+        run: python -I -B tools/write_build_provenance.py
+      - name: Preserve verified build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: morphtree-${{ matrix.os }}-${{ matrix.python }}
+          path: dist/*
+          if-no-files-found: error

morphtree-2.1.0/.gitignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.py[cod]
+.venv/
+env/
+dist/
+build/
+.native-builds/
+python/morphtree/_native/bin/
+*.egg-info/
+.pytest_cache/

morphtree-2.1.0/AGENTS.md

@@ -0,0 +1,11 @@
+# Contributor contract
+Preserve Python API, model compatibility and mathematical/evolutionary behavior.
+C accelerates verified primitives; Python retains mutable learning rules. No
+vendor learner, silent sampling, forced acceptance or disabled default Optuna.
+Capacity8 is explicit; do not change the default without separate qualification.
+Read docs/QUALIFICATION.md and docs/ARCHITECTURE.md before making support claims.
+New training requires a finite approved scope; historical budgets are closed.
+No accounts, remote actions, Git writes, hosted workflow or publication by the
+agent. The owner handles transfer and release. Preserve opaque .git and backups.
+
+Owner directive30October2026:the agent must not access github.com or GitHub APIs,including read-only requests.No further online checks.Remote tag/release/commit/CI/publication steps belong exclusively to the owner;links/workflow files are instructions for that owner,not execution authority.

morphtree-2.1.0/BENCHMARKS.md

@@ -0,0 +1,17 @@
+# Measured comparisons and limits
+The scalar-conversion engineering change in the frozen native engine produced
+1.55–2.23× inference speedups in recorded profiles. This is not a universal
+training or inference speedup. Historical native whole-fit comparisons remain
+scoped to their datasets/environments; no new RC timing is implied by a rebuild.
+
+Stellar VALIDATION:2round BA0.879211;8round BA0.920422,log-loss0.144333,
+STARrecall85.03%,STARinM48.11%. Equal-capacity static/evolutionary packets were
+identical; all four proposals rolled back. HGB reference BA0.947921,log-loss
+0.289208. Metrics rank models differently. More capacity is not a mutation gain;
+no general competitiveness claim or fresh independent realTEST confirmation.
+
+OBSERVATION112:two OOFfits/48trees,exact old per-row loss,21.609/21.344s fit;
+worker peakWS496.96MiB. This isolated acquisition is not a whole-fit benchmark.
+STARmean probability inM matches prevalence closely despite poor recall; this
+does not prove full calibration or irreducibility. Feature interactions remain
+hypotheses; diagnostic/planner/local mutation prototypes are not distributed.