pbcheck 0.1.0__tar.gz

pbcheck-0.1.0/.gitattributes

@@ -0,0 +1,24 @@
+# The pre-registration artifacts are hash-pinned, not read as text.
+#
+# `pilot/preregistration/` holds the frozen §1 stratum list and the CI candidate manifest it was
+# derived from. `docs/PREREGISTRATION_STRATUM_LIST.md` records their sha256 sums, and
+# `scripts/freeze_stratum_list.py` refuses to run against a source whose hash does not match —
+# so their bytes are the evidence, not a rendering of it.
+#
+# Without `-text`, git's end-of-line conversion would rewrite them per platform: the committed CSV
+# came off a Linux runner with CRLF terminators, `core.autocrlf=true` on a Windows checkout would
+# rewrite the JSON to CRLF, and either change breaks the recorded hash. The byte-identity test in
+# `tests/test_stratum_list_freeze.py` would then pass on one CI leg and fail on another, which is
+# worse than failing everywhere. Diffing these files is not how they are audited; hashing them is.
+#
+# `pilot/gate/` and `pilot/testsel/` are cited evidence too — `.pre-commit-config.yaml` excludes
+# them from the fixing hooks on exactly that ground — and they are deliberately NOT marked here.
+# They were committed with LF and are checked out with CRLF under `core.autocrlf=true`, so adding
+# `-text` would make the working tree's CRLF bytes canonical and the next `git add` would rewrite
+# all three blobs: measured, at the commit that added this line, 8909 -> 9174 bytes for
+# `pilot/gate/synthetic_gate_2026-08-15.json`, 21811 -> 21958 for `pilot/testsel/summary.csv` and
+# 63081 -> 65856 for `pilot/testsel/summary.json`. Protecting evidence by rewriting it is not
+# protecting it. The asymmetry is therefore real and intended: `pilot/preregistration/` is pinned by
+# hash and must be byte-stable across platforms; the other two are protected from the fixing hooks
+# only, and their bytes stay whatever git already stores.
+pilot/preregistration/** -text

pbcheck-0.1.0/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  # github-actions only, monthly. pip is deliberately NOT enrolled here: this is a bleeding-edge
+  # scientific stack (numpy 2.4 / pandas 3.0 / scanpy 1.12 — see docs/ENV_NOTES.md) where a weekly
+  # pip-update PR would mostly be noise a solo maintainer has to triage, not a real signal. The
+  # CI "Report the resolved scientific stack" step (.github/workflows/tests.yml, `test` job) is
+  # the drift detector by design instead: it prints what actually resolved on every push, so
+  # drift is visible without a bot filing a PR nobody asked for.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"

pbcheck-0.1.0/.github/workflows/census-candidates.yml

@@ -0,0 +1,136 @@
+# The one job in this repo that touches real data. It reads the whole pinned CELLxGENE Census
+# (~60 M cells after the §1 value_filter) and produces the CANDIDATE stratum manifest — not the
+# §1 pre-registration, and not an admission of anything: every row carries admitted_to_sweep=False.
+#
+# Manual only. It is multi-hour, it reaches the network for gigabytes, and its result is an
+# artifact rather than a commit, so there is nothing for a push or a pull request to gain from it.
+# The regular `tests` workflow deliberately does NOT install the [census] extra; this one does, and
+# it is the only place a cellxgene-census / tiledbsoma resolution is exercised at all.
+name: census candidates
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run: pass 2 reads only a handful of datasets (spread across the size range) to calibrate the full run. Uncheck for the real thing."
+        type: boolean
+        default: true
+      max_datasets:
+        description: "Cap the datasets pass 2 reads, largest first (0 = no cap)."
+        type: number
+        default: 0
+      artifact_retention_days:
+        description: "How long to keep the manifest + log artifact."
+        type: number
+        default: 30
+      reader_buffer_mb:
+        description: "Per-column Census read buffer, MiB (py./soma.init_buffer_bytes). The census default is 1024, which four string columns do not fit into a 16 GB runner. Lower this if the run is killed at exit 143."
+        type: number
+        default: 128
+
+# Deliberately NOT cancel-in-progress (the `tests` workflow is): a five-hour run that is killed
+# by a second dispatch produces nothing at all, and the Census is pinned, so two concurrent runs
+# would compute the same answer twice. Queue instead.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+# The Census is public and anonymous — no secrets, no credentials, nothing to write.
+permissions:
+  contents: read
+
+jobs:
+  candidates:
+    name: candidate manifest (dry_run=${{ inputs.dry_run }})
+    runs-on: ubuntu-latest
+    # A public runner is killed at 6 h with no artifact. Stopping at 5.5 h leaves the upload step
+    # (if: always()) time to run, so a run that hits the wall still returns its partial log — which
+    # is what makes the next dispatch's budget an informed decision rather than a guess.
+    timeout-minutes: 330
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      # cellxgene-census is unpinned in pyproject on purpose: the SDK is a client for a pinned
+      # dataset, and package_versions() records whatever actually resolved into the manifest
+      # header. The pin that matters — the Census version — is in census_select.py, not here.
+      - name: Install the package with the [census] extra
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[census]"
+
+      # The counterpart of the `tests` workflow's stack report, for the half of the stack that
+      # workflow never installs. The Census version and the value_filter are printed from the
+      # package so the log states the protocol the run was made under, not a copy of it. It is
+      # tee'd into the same log the artifact carries, so a run that dies in the driver still ships
+      # the stack it died with — the log is the post-mortem, and it starts here.
+      - name: Report the resolved Census stack and the pinned protocol
+        shell: bash
+        run: |
+          {
+            python -c "import cellxgene_census, tiledbsoma, pyarrow, pandas, numpy; [print(f'{m.__name__}=={m.__version__}') for m in (cellxgene_census, tiledbsoma, pyarrow, pandas, numpy)]"
+            python -c "from pbcheck import census_select as cs; print('census_version:', cs.CENSUS_VERSION); print('value_filter (applied):', cs.VALUE_FILTER); print('value_filter (spec text):', cs.SPEC_VALUE_FILTER); print('organism:', cs.CENSUS_ORGANISM)"
+            free -m || true
+            nproc || true
+          } 2>&1 | tee census-candidates.log
+
+      # GitHub runs `run:` as `bash -e -o pipefail`, so the driver failing anywhere in the pipe
+      # fails this step — which is what we want, and is why the job summary is NOT written here.
+      # The previous version put the summary after the pipeline in this same step: `-e` (which
+      # `set -uo pipefail` does not clear) aborted the step at the pipe, and neither the summary
+      # nor the intended exit code ever ran. Reporting belongs in a step that cannot be skipped.
+      - name: Build the candidate manifest
+        shell: bash
+        env:
+          DRY_RUN: ${{ inputs.dry_run }}
+          MAX_DATASETS: ${{ inputs.max_datasets }}
+          READER_BUFFER_MB: ${{ inputs.reader_buffer_mb }}
+          # Cell-type labels are ontology free text and carry non-ASCII ("Muller cell" is spelled
+          # with an umlaut in CL), and the driver prints them in its top-candidates summary. If the
+          # runner's stdout ever resolved to ASCII, that print would die AFTER the manifest was
+          # written — a red run, and a lost log, for a formatting reason.
+          PYTHONIOENCODING: utf-8
+        run: |
+          args=(--max-datasets "${MAX_DATASETS:-0}" --reader-buffer-mb "${READER_BUFFER_MB:-128}")
+          if [ "${DRY_RUN}" = "true" ]; then
+            args+=(--dry-run)
+          fi
+          echo "python scripts/census_candidates.py ${args[*]}" | tee -a census-candidates.log
+          python -u scripts/census_candidates.py "${args[@]}" 2>&1 | tee -a census-candidates.log
+
+      # if: always() — this is the step that reports, so it must run when the driver dies, when it
+      # times out, and when it succeeds. A memory kill (SIGTERM, exit 143) produces no traceback:
+      # the tail of this log is the entire post-mortem.
+      - name: Summarise the run log
+        if: always()
+        shell: bash
+        run: |
+          {
+            echo "### Census candidate manifest (dry_run=${{ inputs.dry_run }}, buffers ${{ inputs.reader_buffer_mb }} MiB)"
+            echo
+            echo '```'
+            tail -n 80 census-candidates.log 2>/dev/null || echo "(no log — the run died before writing one)"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      # if: always() — a partial log from a run that timed out or died mid-pass is the timing
+      # calibration for the next dispatch, and losing it costs another five hours to recover.
+      # The manifest itself is uploaded, never committed: pilot/results/ is gitignored, and a
+      # candidate list that lands in git by way of a CI job has pre-registered itself by accident.
+      - name: Upload the manifest and the run log
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: census-candidates-${{ github.run_id }}
+          path: |
+            pilot/results/census_candidates/*.json
+            pilot/results/census_candidates/*.csv
+            census-candidates.log
+          retention-days: ${{ inputs.artifact_retention_days }}
+          if-no-files-found: warn

pbcheck-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,152 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      target:
+        type: choice
+        options: [testpypi]
+        default: testpypi
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: lint + version check + tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # A tag push checks out the tag alone; tests/test_protocol_safety_check.py needs
+          # origin/main to diff against, so fetch the full history here as tests.yml does.
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install package (editable) + dev extra
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: ruff check
+        run: python -m ruff check .
+
+      - name: Check CITATION.cff / CHANGELOG.md version match the package
+        run: python scripts/check_version_consistency.py
+
+      - name: Reject malformed release tags
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+        run: |
+          if ! [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "tag '$GITHUB_REF_NAME' does not match v[0-9]+.[0-9]+.[0-9]+" >&2
+            exit 1
+          fi
+
+      - name: Check the tag matches the released version
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+        run: python scripts/check_version_consistency.py --tag "$GITHUB_REF_NAME" --require-date
+
+      - name: Run tests
+        run: python -m pytest -q -m "not slow"
+
+  build:
+    name: build sdist/wheel + twine check
+    needs: check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install packaging tools
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+
+      - name: Build sdist + wheel
+        run: python -m build
+
+      - name: twine check
+        run: python -m twine check dist/*
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: dist
+          path: dist/
+
+  publish-testpypi:
+    name: publish to TestPyPI
+    needs: build
+    if: github.event_name == 'workflow_dispatch' && inputs.target == 'testpypi'
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v6
+        with:
+          name: dist
+          path: dist/
+
+      # Pinned by commit SHA, not the release/v1 branch: a job holding id-token: write should
+      # not follow a moving ref. dc37677b2e1c63e2034f94d8a5b11f265b73ba33 == tag v1.14.2.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  publish-pypi:
+    name: publish to PyPI
+    needs: build
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v6
+        with:
+          name: dist
+          path: dist/
+
+      # Pinned by commit SHA, not the release/v1 branch: a job holding id-token: write should
+      # not follow a moving ref. dc37677b2e1c63e2034f94d8a5b11f265b73ba33 == tag v1.14.2.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+
+  github-release:
+    name: create the GitHub Release
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - uses: actions/download-artifact@v6
+        with:
+          name: dist
+          path: dist/
+
+      - name: Extract the CHANGELOG section for this release
+        run: python scripts/changelog_section.py "${GITHUB_REF_NAME#v}" > notes.md
+
+      - name: Create the GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" dist/* --title "pbcheck $GITHUB_REF_NAME" --notes-file notes.md

pbcheck-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,171 @@
+name: tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: ruff check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install dev extra (ruff only, no scientific stack needed for lint)
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      # ruff format --check is deliberately NOT run here: this is a pre-registered scientific
+      # repo, and a lot of existing code predates a formatting policy. Reformatting it wholesale
+      # in a lint-hardening commit would pollute `git blame` on files the analysis depends on.
+      # `ruff check` (real lint rules: unused imports, etc.) is enforced; formatting is not yet.
+      - name: ruff check
+        run: python -m ruff check .
+
+      # pyproject.toml's version is dynamic, read from src/pbcheck/__init__.py by hatchling
+      # (R3); CITATION.cff keeps an independent copy for tools that read it standalone (GitHub's
+      # "Cite this repository", Zenodo), which is exactly the copy that can drift unnoticed.
+      - name: Check CITATION.cff version matches the package
+        run: python scripts/check_version_consistency.py
+
+  test:
+    name: pytest (py${{ matrix.python-version }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python-version: ["3.12", "3.13"]
+        include:
+          # Developed on Windows; Linux is the untested platform, so it carries the matrix.
+          - os: windows-latest
+            python-version: "3.12"
+          # One macOS combination, on the newer interpreter, for a third-platform smoke check
+          # without tripling the whole matrix.
+          - os: macos-latest
+            python-version: "3.13"
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # tests/test_protocol_safety_check.py runs the checklist against main; a branch or
+          # pull-request checkout at the default depth 1 carries no main to diff against.
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      # The [census] extra is deliberately NOT installed: Phase-0 engine validation runs
+      # entirely on synthetic oracles, so CI never reaches the network for data.
+      - name: Install package (src-layout, editable) + dev extra
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      # Not decoration: this turns the CI log into a live counterpart of docs/ENV_NOTES.md
+      # and shows immediately if an unpinned upper bound drifts.
+      - name: Report the resolved scientific stack
+        run: |
+          python -c "import numpy, scipy, pandas, anndata, scanpy, decoupler, pydeseq2, statsmodels; [print(f'{m.__name__}=={m.__version__}') for m in (numpy, scipy, pandas, anndata, scanpy, decoupler, pydeseq2, statsmodels)]"
+
+      # Report-only: no --cov-fail-under gate. This is a bleeding-edge, pre-registered research
+      # repo mid-Phase-0 — a coverage floor would either block legitimate work or get raised by
+      # weakening it, neither of which is worth it yet. The number is surfaced so it is visible
+      # without being enforced.
+      - name: Run tests (with coverage)
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pytest -q --cov=pbcheck --cov-report=term | tee pytest-coverage.txt
+          {
+            echo "### Coverage (pbcheck) — report-only, no threshold gate"
+            echo
+            echo '```'
+            cat pytest-coverage.txt
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  lock:
+    name: pytest from requirements.lock (reproducibility)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # tests/test_protocol_safety_check.py runs the checklist against main; a branch or
+          # pull-request checkout at the default depth 1 carries no main to diff against.
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: requirements.lock
+
+      # Install FROM the frozen lock, then the package itself with --no-deps so pip cannot
+      # reach past the lock for anything. This is the reproducibility job: it answers "does the
+      # exact stack that generated requirements.lock still work?" The `test` job above answers a
+      # different question — "does a fresh resolve of pyproject.toml's unpinned bounds still
+      # work?" — and is the drift detector; this job does not replace it.
+      - name: Install from requirements.lock
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements.lock
+          python -m pip install -e . --no-deps
+
+      - name: Run tests
+        run: python -m pytest -q
+
+  build:
+    name: build sdist/wheel + twine check + install smoke test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      # build/twine are packaging tooling, not part of the [dev] test/lint extra, so they are
+      # installed directly here rather than pulled in by every contributor's dev install.
+      - name: Install packaging tools
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+
+      - name: Build sdist + wheel
+        run: python -m build
+
+      - name: twine check
+        run: python -m twine check dist/*
+
+      # The real smoke test: install the built wheel (not the editable checkout) into a clean
+      # venv and confirm the package actually imports — catches missing package-data / MANIFEST
+      # issues that `pip install -e .` can silently paper over.
+      - name: Install the built wheel into a fresh venv and import it
+        run: |
+          python -m venv wheel-venv
+          wheel-venv/bin/pip install --upgrade pip
+          wheel-venv/bin/pip install dist/*.whl
+          wheel-venv/bin/python -c "import pbcheck; print(pbcheck.__version__)"
+          wheel-venv/bin/pbcheck --version

pbcheck-0.1.0/.gitignore

@@ -0,0 +1,57 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.pytest_cache/
+.hypothesis/
+.mypy_cache/
+.ruff_cache/
+
+# Environments
+.venv/
+venv/
+env/
+.env
+
+# Data & caches (never commit downloaded datasets or the census cache)
+data/
+*.h5ad
+*.h5
+*.loom
+cellxgene_census_cache/
+*.zarr/
+*.tiledb/
+*.mtx
+*.tsv.gz
+
+# Run outputs: ignore everything, keep the directory.
+pilot/results/*
+!pilot/results/.gitkeep
+pilot/cache/
+
+# Coverage & logs
+.coverage
+htmlcov/
+*.log
+
+# Editors
+.vscode/
+.idea/
+
+# Notebooks
+.ipynb_checkpoints/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Amendment 4 Part A's upper-bound reproducer keeps a resume ledger beside its artifact. The
+# committed record is the dated JSON/CSV, which already carries every per-seed replicate; the
+# ledger is a cache, following pilot/testsel/ committing only its summary.
+pilot/upper_bound_check/replicates.jsonl
+
+# Claude Code session scratch (worktrees are ephemeral; agents and skills ARE tracked)
+.claude/worktrees/

pbcheck-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,52 @@
+# Mirrors CI (.github/workflows/tests.yml) on purpose: `ruff check` only, no `--fix` and no
+# format hooks. This is a pre-registered scientific repo and a lot of existing code predates a
+# formatting policy — see the comment on the lint job in tests.yml for why `ruff format --check`
+# is deliberately absent there too. A pre-commit hook that reformatted on commit would diverge
+# from what CI enforces and would pollute `git blame` on files the analysis depends on.
+#
+# docs/PHASE0_SPEC.md and docs/AMENDMENTS.md are the frozen protocol documents (see CLAUDE.md /
+# the R3 task brief) and are excluded from the fixing hooks below so their bytes are never
+# touched by a mechanical pass — end-of-file-fixer would otherwise add PHASE0_SPEC.md's missing
+# trailing newline.
+#
+# The committed RUN ARTIFACTS under pilot/ are excluded for the same reason, one degree stronger:
+# they are cited evidence, and pilot/preregistration/ is additionally pinned BY HASH in
+# docs/PREREGISTRATION_STRATUM_LIST.md and by scripts/freeze_stratum_list.py, which refuses to run
+# against a source whose sha256 has moved. Two of them end without a trailing newline, because
+# json.dump writes none: the CI candidate manifest, and pilot/gate/synthetic_gate_2026-08-15.json.
+# This was not hypothetical — running `pre-commit run --all-files` while adding the freeze rewrote
+# the gate artifact, whose numbers Amendment 3's addendum, the README and CHANGELOG all quote.
+# The hooks had simply never been run over it (pre-commit is configured here but not installed as
+# a git hook). A mechanical pass must not be able to edit evidence, so it no longer can.
+repos:
+  - repo: local
+    hooks:
+      - id: ruff-check
+        name: ruff check
+        entry: ruff check .
+        language: system
+        types: [python]
+        pass_filenames: false
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: end-of-file-fixer
+        exclude: ^(docs/(PHASE0_SPEC|AMENDMENTS)\.md$|pilot/(preregistration|gate|testsel)/)
+      - id: trailing-whitespace
+        exclude: ^(docs/(PHASE0_SPEC|AMENDMENTS)\.md$|pilot/(preregistration|gate|testsel)/)
+      - id: check-yaml
+      - id: check-added-large-files
+        # pilot/testsel/summary.{csv,json} are committed run artifacts (~64KB / ~22KB); the
+        # largest tracked *source* file in the repo is ~71KB (scripts/pb_calibration_probe.py).
+        # 500KB gives headroom without letting an actual accidental large-file commit through.
+        #
+        # pilot/preregistration/ is excluded rather than accommodated by raising the cap. It holds
+        # the §1 pre-registration evidence — the whole-Census candidate manifest of CI run
+        # 31910799023 (6.6 MB JSON + 4.5 MB CSV) and the frozen stratum list derived from it. Those
+        # are deliberately committed at full size: the pre-registration's claim is that a reader
+        # can re-derive every number in docs/PREREGISTRATION_STRATUM_LIST.md, and a truncated or
+        # externally hosted artifact cannot support it. Raising the cap instead would have
+        # disarmed the guard for the whole tree to admit two known files.
+        exclude: ^pilot/preregistration/
+        args: [--maxkb=500]

pbcheck-0.1.0/.zenodo.json

@@ -0,0 +1,29 @@
+{
+  "title": "pbcheck: an auditor of pseudoreplication in single-cell RNA-seq differential expression",
+  "upload_type": "software",
+  "creators": [
+    {
+      "name": "Poliakov, Alexander"
+    }
+  ],
+  "description": "pbcheck estimates how much an existing single-cell RNA-seq differential-expression analysis is inflated by pseudoreplication, treating individual cells as independent replicates when the true unit of replication is the donor. v0.1.0 is the single-stratum audit tool; Phase 0, a pre-registered measurement study, continues alongside it; its frozen protocol is in docs/PHASE0_SPEC.md and every deviation is recorded in docs/AMENDMENTS.md.",
+  "license": "bsd-3-clause",
+  "version": "0.1.0",
+  "keywords": [
+    "single-cell",
+    "scRNA-seq",
+    "differential-expression",
+    "pseudoreplication",
+    "pseudobulk",
+    "statistics",
+    "reproducibility"
+  ],
+  "access_right": "open",
+  "related_identifiers": [
+    {
+      "identifier": "https://github.com/s4s4s4s/pbcheck",
+      "relation": "isSupplementTo",
+      "resource_type": "software"
+    }
+  ]
+}