pytest-gpu-proof 0.4.0__tar.gz → 0.5.0__tar.gz

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
       - uses: actions/checkout@v4

pytest_gpu_proof-0.5.0/.github/workflows/docs.yml

@@ -0,0 +1,69 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'website/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/docs.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install website dependencies
+        run: pip install -r website/requirements.txt
+
+      - name: Build and check the complete website
+        run: python website/build_site.py
+
+      - name: Test website checks
+        run: python -m unittest discover -s website -p 'test_*.py'
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: website-preview
+          path: build/website
+          include-hidden-files: true
+
+  deploy:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install -r website/requirements.txt
+      - uses: actions/download-artifact@v4
+        with:
+          name: website-preview
+          path: build/website
+      - name: Configure git author
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Deploy to gh-pages
+        run: ghp-import --no-jekyll --push --branch gh-pages build/website

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/.gitignore

@@ -299,4 +299,6 @@ Testing/
 *.fatbin
 
 # Specifics
-gpu-proof.json
+gpu-proof.json
+# Local working notes (never committed)
+docs/open-tasks/

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/CHANGELOG.md

@@ -4,6 +4,67 @@ All notable changes to pytest-gpu-proof are documented here. The format is
 based on [Keep a Changelog](https://keepachangelog.com/); versions follow
 [SemVer](https://semver.org/) (pre-1.0: minor bumps may break).
 
+## [0.5.0] — 2026-10-28
+
+### Added
+
+- Python 3.10 support with a conditional `tomli` dependency and a CI test lane.
+- Signed `environment.nvcc_version` records the stripped output of
+  `nvcc --version` from PATH, or null when unavailable. Fresh shard merges
+  require matching compiler metadata; existing receipts without the field
+  remain supported.
+
+## [0.4.1] — 2026-10-12
+
+### Fixed
+
+- Shard entries record `dirty` (the recording tree's state); merge ORs shard
+  flags into the merged `repo.dirty`, carry-forward refuses a dirty shard, and
+  verification refuses any dirty shard unless `allow_dirty` is set.
+- `gpu-proof merge --carry-from` refuses a source receipt recorded with a dirty
+  working tree. The merged `repo.dirty` is OR-ed over the fresh inputs only, so a
+  carried shard from a dirty recording was laundered into a clean-looking merged
+  receipt (found by GRiD's split driver, 2026-10-10). Carried shards now record
+  `carried.original_dirty`, and verification refuses a carried shard recorded
+  dirty unless `allow_dirty` is set.
+
+- The expected-skips mismatch names the delta (unexpected skips and stale
+  baseline entries) instead of only reporting that the sets differ.
+- The receipt's `environment.gpu_info` falls back to the same torch probe the
+  `gpu_required` marker uses when nvidia-smi is absent or fails (`source`
+  records which probe answered), so a torch-only box no longer records
+  `gpu_info: null` and then fails a `require_gpu` policy.
+
+- Verification refuses a receipt whose session started more than five
+  minutes before its commit existed (committer time): a cheap replay and
+  forgery guard that needs no nonce.
+
+- `mode: ci-gpu` is now bound to the signing key: a ci-gpu receipt verifies
+  only when the policy lists `allowed_key_fingerprints` and the receipt was
+  signed by one of them (previously the mode was an unverified label).
+- Without an explicit `carried_max_age_days`, a carried shard's original run
+  may not be older than the receipt's `max_age_days` (was a fixed 30 days).
+
+### Added
+
+- `gpu-proof merge --verify-inputs`: authenticate every input shard against
+  its signer's current GitHub keys before merging (unsigned or tampered inputs
+  are refused).
+- `gpu-proof status PATH...`: one-line summaries of receipt files or
+  directories (commit, dirty, signed, outcome, counts, shards, carried).
+- `gpu-proof durations RECEIPT... --out map.json`: fold per-test durations
+  into a JSON map for shard bin-packing.
+- Command-line equivalents for the toml-only options:
+  `--gpu-proof-no-gpu-uuid`, `--gpu-proof-require-gpu`,
+  `--gpu-proof-max-age-days N`.
+- `gpu-proof plan --receipt OLD [--repo .] [--json]`: a dry run of the
+  carry-forward conditions against the current tree, reporting per shard
+  whether it could be carried or must be re-run (and why). Drivers that plan
+  partial re-runs no longer reimplement the checks.
+- `record_gpu_uuid` (`[tool.gpu_proof]`, default `true`): set `false` to omit each GPU's
+  nvidia-smi UUID from the receipt environment while keeping name, driver, memory and
+  compute capability. Verification does not read the UUID.
+
 ## [0.4.0] — 2026-08-17
 
 ### Added

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/CONTRIBUTING.md

@@ -19,7 +19,7 @@ python -m build
 python -m twine check --strict dist/*
 ```
 
-CI runs the test suite on Python 3.11, 3.12, and 3.13, independently enforces
+CI runs the test suite on Python 3.10, 3.11, 3.12, and 3.13, independently enforces
 100% line and branch coverage, builds docs strictly, and smoke-tests the wheel.
 
 ## Change expectations

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: pytest-gpu-proof
-Version: 0.4.0
+Version: 0.5.0
 Summary: pytest plugin for GPU equivalence testing with signed receipts verified via GitHub SSH keys
-Project-URL: Homepage, https://github.com/A2R-Lab/pytest-gpu-proof
-Project-URL: Documentation, https://a2r-lab.github.io/pytest-gpu-proof/
+Project-URL: Homepage, https://a2r-lab.org/pytest-gpu-proof/
+Project-URL: Documentation, https://a2r-lab.org/pytest-gpu-proof/docs/
 Project-URL: Repository, https://github.com/A2R-Lab/pytest-gpu-proof
 Project-URL: Issues, https://github.com/A2R-Lab/pytest-gpu-proof/issues
 Project-URL: Changelog, https://github.com/A2R-Lab/pytest-gpu-proof/blob/main/CHANGELOG.md
@@ -16,14 +16,16 @@ Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security :: Cryptography
 Classifier: Topic :: Software Development :: Testing
-Requires-Python: >=3.11
+Requires-Python: >=3.10
 Requires-Dist: cryptography>=41.0
 Requires-Dist: pytest>=7.0
+Requires-Dist: tomli>=2.0; python_version < '3.11'
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
 Requires-Dist: coverage[toml]>=7.6; extra == 'dev'
@@ -39,13 +41,17 @@ Description-Content-Type: text/markdown
 # pytest-gpu-proof
 
 [![CI](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/ci.yml/badge.svg)](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/ci.yml)
-[![Docs](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/docs.yml/badge.svg)](https://a2r-lab.github.io/pytest-gpu-proof/)
+[![Docs](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/docs.yml/badge.svg)](https://a2r-lab.org/pytest-gpu-proof/docs/)
 [![PyPI](https://img.shields.io/pypi/v/pytest-gpu-proof.svg)](https://pypi.org/project/pytest-gpu-proof/)
 [![Python](https://img.shields.io/pypi/pyversions/pytest-gpu-proof.svg)](https://pypi.org/project/pytest-gpu-proof/)
 [![Coverage: 100%](https://img.shields.io/badge/coverage-100%25-brightgreen.svg)](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/ci.yml)
 
 Signed pytest receipts for local GPU runs, verified in CPU-only CI.
 
+[Project overview](https://a2r-lab.org/pytest-gpu-proof/) ·
+[Documentation](https://a2r-lab.org/pytest-gpu-proof/docs/) ·
+[Website preview instructions](website/README.md)
+
 `pytest-gpu-proof` records which marked tests ran, their outcomes, the Git
 commit and source fingerprint, the environment, and the run time. It signs
 that payload with an existing SSH key. A normal CPU runner can then verify the
@@ -86,7 +92,7 @@ cd pytest-gpu-proof
 python -m pip install -e ".[dev]"
 ```
 
-Requirements: Python 3.11+, pytest 7+, and `cryptography` 41+.
+Requirements: Python 3.10+, pytest 7+, and `cryptography` 41+.
 
 ## Quick start
 
@@ -126,15 +132,23 @@ fingerprint scope, no selected tests, or write failure makes pytest fail and
 leaves no stale receipt behind. `--gpu-proof-best-effort` is an explicit
 development-only opt-out.
 
-## Four interfaces
+## Five interfaces
 
-The project exposes four small interfaces:
+The project exposes five small interfaces:
 
 1. **Markers** select receipt tests.
-2. **`gpu_proof_check`** compares a reference callable with a candidate.
+2. **`gpu_proof_check`** compares a reference callable with a candidate
+   (optional; every current user selects tests with the marker alone).
 3. **`gpu-proof verify`** validates a receipt and repository policy.
 4. **`gpu-proof merge`** combines separately executed shards and optionally
    carries unchanged shards forward.
+5. **`gpu-proof plan`** reports, before a partial re-run, which shards of an
+   old receipt could still be carried and which must be re-run.
+
+Two maintenance helpers round it out: `gpu-proof status PATH...` summarizes
+receipt files (commit, dirty, signed, outcome, counts, shards), and
+`gpu-proof durations RECEIPT... --out map.json` folds per-test durations into
+a map that shard bin-packers can calibrate from.
 
 ### Markers
 
@@ -197,6 +211,7 @@ fingerprint_excluded_paths = ["gpu-proof.json"]
 required_marker = "gpu_proof"
 max_age_days = 30
 require_gpu = true
+record_gpu_uuid = false   # keep device name/driver/memory, omit the card's UUID
 ```
 
 By default, the fingerprint covers every tracked file in the repository,
@@ -304,6 +319,15 @@ runtime environments, duplicate tests, and duplicate shard names. It records
 input provenance but does not verify each input signature; the merger signs
 for the union. See [sharding and carry-forward](docs/sharding.md).
 
+Carry-forward (`gpu-proof merge ... --carry-from last-green.json`) grafts an
+absent old shard only when its receipt commit is an ancestor of the current
+one, both the receipt and the shard were recorded with a clean tree, its
+narrow fingerprint recomputes identically, and it introduces no duplicate
+test. `gpu-proof plan --receipt last-green.json` prints the same verdicts
+without merging. Generated inputs named through `fingerprint_extra_paths`
+should be gitignored: an untracked generated file makes the recording tree
+dirty, and dirty recordings are never carried.
+
 ## Receipt schema
 
 New receipts use schema `"3"`. Signer identity is inside the signed payload,
@@ -322,7 +346,7 @@ python -m build
 python -m twine check --strict dist/*
 ```
 
-CI tests Python 3.11–3.13 and enforces 100% line and branch coverage. See
+CI tests Python 3.10–3.13 and enforces 100% line and branch coverage. See
 [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md), and
 [RELEASING.md](RELEASING.md).
 

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/README.md

@@ -1,13 +1,17 @@
 # pytest-gpu-proof
 
 [![CI](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/ci.yml/badge.svg)](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/ci.yml)
-[![Docs](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/docs.yml/badge.svg)](https://a2r-lab.github.io/pytest-gpu-proof/)
+[![Docs](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/docs.yml/badge.svg)](https://a2r-lab.org/pytest-gpu-proof/docs/)
 [![PyPI](https://img.shields.io/pypi/v/pytest-gpu-proof.svg)](https://pypi.org/project/pytest-gpu-proof/)
 [![Python](https://img.shields.io/pypi/pyversions/pytest-gpu-proof.svg)](https://pypi.org/project/pytest-gpu-proof/)
 [![Coverage: 100%](https://img.shields.io/badge/coverage-100%25-brightgreen.svg)](https://github.com/A2R-Lab/pytest-gpu-proof/actions/workflows/ci.yml)
 
 Signed pytest receipts for local GPU runs, verified in CPU-only CI.
 
+[Project overview](https://a2r-lab.org/pytest-gpu-proof/) ·
+[Documentation](https://a2r-lab.org/pytest-gpu-proof/docs/) ·
+[Website preview instructions](website/README.md)
+
 `pytest-gpu-proof` records which marked tests ran, their outcomes, the Git
 commit and source fingerprint, the environment, and the run time. It signs
 that payload with an existing SSH key. A normal CPU runner can then verify the
@@ -48,7 +52,7 @@ cd pytest-gpu-proof
 python -m pip install -e ".[dev]"
 ```
 
-Requirements: Python 3.11+, pytest 7+, and `cryptography` 41+.
+Requirements: Python 3.10+, pytest 7+, and `cryptography` 41+.
 
 ## Quick start
 
@@ -88,15 +92,23 @@ fingerprint scope, no selected tests, or write failure makes pytest fail and
 leaves no stale receipt behind. `--gpu-proof-best-effort` is an explicit
 development-only opt-out.
 
-## Four interfaces
+## Five interfaces
 
-The project exposes four small interfaces:
+The project exposes five small interfaces:
 
 1. **Markers** select receipt tests.
-2. **`gpu_proof_check`** compares a reference callable with a candidate.
+2. **`gpu_proof_check`** compares a reference callable with a candidate
+   (optional; every current user selects tests with the marker alone).
 3. **`gpu-proof verify`** validates a receipt and repository policy.
 4. **`gpu-proof merge`** combines separately executed shards and optionally
    carries unchanged shards forward.
+5. **`gpu-proof plan`** reports, before a partial re-run, which shards of an
+   old receipt could still be carried and which must be re-run.
+
+Two maintenance helpers round it out: `gpu-proof status PATH...` summarizes
+receipt files (commit, dirty, signed, outcome, counts, shards), and
+`gpu-proof durations RECEIPT... --out map.json` folds per-test durations into
+a map that shard bin-packers can calibrate from.
 
 ### Markers
 
@@ -159,6 +171,7 @@ fingerprint_excluded_paths = ["gpu-proof.json"]
 required_marker = "gpu_proof"
 max_age_days = 30
 require_gpu = true
+record_gpu_uuid = false   # keep device name/driver/memory, omit the card's UUID
 ```
 
 By default, the fingerprint covers every tracked file in the repository,
@@ -266,6 +279,15 @@ runtime environments, duplicate tests, and duplicate shard names. It records
 input provenance but does not verify each input signature; the merger signs
 for the union. See [sharding and carry-forward](docs/sharding.md).
 
+Carry-forward (`gpu-proof merge ... --carry-from last-green.json`) grafts an
+absent old shard only when its receipt commit is an ancestor of the current
+one, both the receipt and the shard were recorded with a clean tree, its
+narrow fingerprint recomputes identically, and it introduces no duplicate
+test. `gpu-proof plan --receipt last-green.json` prints the same verdicts
+without merging. Generated inputs named through `fingerprint_extra_paths`
+should be gitignored: an untracked generated file makes the recording tree
+dirty, and dirty recordings are never carried.
+
 ## Receipt schema
 
 New receipts use schema `"3"`. Signer identity is inside the signed payload,
@@ -284,7 +306,7 @@ python -m build
 python -m twine check --strict dist/*
 ```
 
-CI tests Python 3.11–3.13 and enforces 100% line and branch coverage. See
+CI tests Python 3.10–3.13 and enforces 100% line and branch coverage. See
 [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md), and
 [RELEASING.md](RELEASING.md).
 

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/docs/architecture.md

@@ -69,6 +69,15 @@ canonical = json.dumps(
 Putting signer metadata inside this payload prevents identity or algorithm
 substitution after signing.
 
+The optional `environment.nvcc_version` field records the stripped stdout of
+`nvcc --version` resolved through PATH. It is null if the executable is missing,
+cannot run, times out after ten seconds, fails, or returns empty/undecodable output.
+This is self-reported compiler availability, not evidence that this compiler built
+the tested code. It is independent of GPU detection and requires no GPU.
+Existing schema-3 receipts without the field still verify. Fresh shard merges
+require matching values (missing and null are equivalent); carried shards retain
+their original environment metadata.
+
 ## Fingerprint manifest
 
 `sha256-manifest-v2` enumerates stage-0 Git index entries. Regular files bind

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/docs/ci_gpu_mode.md

@@ -2,7 +2,10 @@
 
 CI-GPU mode uses the same receipt and verifier but records `mode: ci-gpu`.
 Choose it when GPU tests must run on a controlled runner rather than a
-developer machine.
+developer machine. The verifier binds the mode to the runner's signing key:
+a `ci-gpu` receipt verifies only when the repository policy lists
+`allowed_key_fingerprints` and the receipt was signed by one of them, so the
+label cannot be claimed by an arbitrary developer key.
 
 ## Dedicated signing identity
 

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/docs/index.md

@@ -1,5 +1,8 @@
 # pytest-gpu-proof
 
+This is the code documentation. Use the project-overview link above for the
+workflow figure, paper, and introduction to the tool.
+
 **Signed pytest receipts for local GPU runs, verified in CPU-only CI.**
 
 The plugin turns an ordinary marked pytest run into a signed, reviewable
@@ -33,5 +36,5 @@ or exact SSH key fingerprints.
 - [Architecture](architecture.md): schema and data flow.
 - [Security model](security_model.md): exact guarantees and limits.
 
-Requirements: Python 3.11+, pytest 7+, and an SSH private-key file whose public
+Requirements: Python 3.10+, pytest 7+, and an SSH private-key file whose public
 key is registered on GitHub.

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/docs/policy.md

@@ -53,7 +53,7 @@ schema 3. Repositories that have finished migrating should pin
 | `allowed_key_fingerprints` | SSH SHA-256 fingerprints accepted in restricted mode |
 | `min_schema` | Minimum acceptable receipt schema version (1, 2, or 3) |
 | `max_age_days` | Maximum age of the merged/session receipt |
-| `require_mode` | Required receipt mode: `local` or `ci-gpu` |
+| `require_mode` | Required receipt mode: `local` or `ci-gpu` (a `ci-gpu` receipt additionally requires `allowed_key_fingerprints` and must be signed by a listed key) |
 | `allow_dirty` | Permit dirty recording or verification trees |
 | `required_fingerprint_paths` | Exact tracked path list |
 | `required_fingerprint_extra_paths` | Exact generated/ignored path list |
@@ -61,7 +61,7 @@ schema 3. Repositories that have finished migrating should pin
 | `required_test_manifest` | Repository-relative file containing exact node IDs |
 | `required_shard_fingerprints` | Exact paths/extras for every named shard |
 | `allow_carried` | Permit carry-forward shards |
-| `carried_max_age_days` | Maximum age of each carried shard's original run |
+| `carried_max_age_days` | Maximum age of each carried shard's original run (default: `max_age_days`, capped at 30) |
 
 Example shard scope:
 

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/docs/security_model.md

@@ -75,7 +75,9 @@ escaping, or unmerged inputs fail closed.
 Schema 3 rejects dirty recording and verification trees by default. A receipt
 may verify at its exact commit or a descendant only when the source manifest
 still matches. Freshness limits replay duration but no server-issued nonce is
-currently used.
+currently used; a session that started more than five minutes before its
+commit's committer time is refused, so a receipt cannot be back-dated onto a
+commit that did not yet exist.
 
 `allow_dirty: true`, long age limits, `--allow-skipped`, and
 `--allow-unsigned` weaken guarantees. Unsigned mode authenticates no signer,
@@ -98,8 +100,10 @@ each input signature. The merger's signature attests to the union. A review
 workflow that needs independent shard authentication should verify every
 input before merging.
 
-Carry-forward means a test passed at an ancestor commit and its declared shard
-inputs are byte-identical now. It does not establish that omitted dependencies
+Carry-forward means a test passed at an ancestor commit, with a clean working
+tree, and its declared shard inputs are byte-identical now. A receipt recorded
+dirty is never a carry source: the merged `repo.dirty` is computed from fresh
+inputs only, so carrying from it would launder the dirty flag. It does not establish that omitted dependencies
 or the old environment remain equivalent. Carried shards are rejected unless
 policy opts in and bounds their original age.
 

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/docs/sharding.md

@@ -38,8 +38,10 @@ session failed.
 
 The merged receipt records input source names, counts, times, and recorded
 signers, then signs the result with the merger's key. Input signatures are
-provenance, not independently verified during offline merge. The merger
-attests to the union.
+provenance, not verified during an offline merge, unless `--verify-inputs` is
+passed: then every input must verify against its signer's current GitHub keys
+(unsigned inputs are refused) before the union is formed. The merger attests
+to the union either way.
 
 ## Carry forward unchanged shards
 
@@ -55,10 +57,22 @@ An absent old shard is carried only when:
 1. its receipt commit is the current commit or an ancestor;
 2. its stored narrow manifest—including explicit extra paths—recomputes
    identically at the current tree;
-3. it does not duplicate a fresh node ID;
-4. every claimed node ID exists in the old tests list.
+3. its receipt was recorded with a clean working tree (`repo.dirty` false): a
+   dirty recording may have exercised uncommitted bytes outside the shard's
+   narrow manifest, and the merged `repo.dirty` covers fresh inputs only;
+4. it does not duplicate a fresh node ID;
+5. every claimed node ID exists in the old tests list.
+
+Every shard entry records `dirty` (the recording tree's state), merge ORs
+shard flags into the merged `repo.dirty`, carry-forward refuses a dirty shard,
+each carried shard records `carried.original_dirty`, and verification refuses
+any dirty shard unless `allow_dirty` is set.
 
 Freshly rerun shards always win. Changed or malformed scopes require a rerun.
+`gpu-proof plan --receipt old.json --repo .` applies the same conditions as a
+dry run and reports, per shard, `carryable` or `stale` with the reason (add
+`--json` for drivers), so a partial re-run can be planned without reimplementing
+the checks.
 
 Verification rejects carried shards by default:
 

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/mkdocs.yml

@@ -1,4 +1,5 @@
 site_name: pytest-gpu-proof
+site_url: https://a2r-lab.org/pytest-gpu-proof/docs/
 site_description: >-
   pytest plugin for GPU equivalence testing with signed receipts verified via
   GitHub SSH keys
@@ -7,6 +8,7 @@ repo_name: A2R-Lab/pytest-gpu-proof
 
 theme:
   name: material
+  custom_dir: website/overrides
   palette:
     - scheme: default
       primary: indigo

{pytest_gpu_proof-0.4.0 → pytest_gpu_proof-0.5.0}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pytest-gpu-proof"
-version = "0.4.0"
+version = "0.5.0"
 description = "pytest plugin for GPU equivalence testing with signed receipts verified via GitHub SSH keys"
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.10"
 license = { text = "MIT" }
 keywords = ["pytest", "gpu", "cuda", "testing", "signing", "attestation"]
 classifiers = [
@@ -17,6 +17,7 @@ classifiers = [
     "License :: OSI Approved :: MIT License",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -26,11 +27,12 @@ classifiers = [
 dependencies = [
     "pytest>=7.0",
     "cryptography>=41.0",
+    "tomli>=2.0; python_version < '3.11'",
 ]
 
 [project.urls]
-Homepage = "https://github.com/A2R-Lab/pytest-gpu-proof"
-Documentation = "https://a2r-lab.github.io/pytest-gpu-proof/"
+Homepage = "https://a2r-lab.org/pytest-gpu-proof/"
+Documentation = "https://a2r-lab.org/pytest-gpu-proof/docs/"
 Repository = "https://github.com/A2R-Lab/pytest-gpu-proof"
 Issues = "https://github.com/A2R-Lab/pytest-gpu-proof/issues"
 Changelog = "https://github.com/A2R-Lab/pytest-gpu-proof/blob/main/CHANGELOG.md"

pytest_gpu_proof-0.5.0/requirements.txt

@@ -0,0 +1,3 @@
+pytest>=7.0
+cryptography>=41.0
+tomli>=2.0; python_version < '3.11'

pytest_gpu_proof-0.5.0/src/pytest_gpu_proof/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"