roar-cli 0.4.2__tar.gz → 0.4.3__tar.gz

{roar_cli-0.4.2 → roar_cli-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: roar-cli
-Version: 0.4.2
+Version: 0.4.3
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Science/Research

{roar_cli-0.4.2 → roar_cli-0.4.3}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "maturin"
 
 [project]
 name = "roar-cli"
-version = "0.4.2"
+version = "0.4.3"
 description = "Reproducibility and provenance tracker for ML training pipelines"
 authors = [
     { name="TReqs Team", email="info@treqs.ai" }

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/application/publish/put_execution.py

@@ -34,6 +34,7 @@ from ...application.publish.remote_job_uids import (
 from ...application.publish.session import build_staged_lineage_counts
 from ...application.system_labels import refresh_job_system_labels
 from ...core.interfaces.registration import GitContext
+from ...core.label_origins import LABEL_ORIGIN_SYSTEM
 from ...core.logging import get_logger
 from ...db.context import DatabaseContext
 from ...db.hashing import hash_files_blake3
@@ -309,6 +310,13 @@ class PutService:
         artifact_hashes = [u.hash for u in uploads]
         artifacts_info = [(u.artifact_id, u.local_path) for u in uploads]
 
+        # Record each uploaded artifact's distribution URL as a reserved system
+        # label, scoped to this publication, so GLaaS can surface it as the
+        # AI-BOM downloadLocation (see _set_publish_distribution_labels).
+        self._set_publish_distribution_labels(
+            uploads, normalize_registration_source_type(destination_type)
+        )
+
         self._logger.debug(
             "Upload complete: %d file(s), collecting lineage for hashes: %s",
             len(uploaded_files),
@@ -538,6 +546,7 @@ class PutService:
                     job_uid=job_uid,
                     remote_job_uid=job_uid,
                     registration_errors=registration_result.errors,
+                    uploads=uploads,
                 )
 
         registration_error = (
@@ -810,6 +819,7 @@ class PutService:
                 job_uid=job_uid,
                 remote_job_uid=remote_put_job_uid,
                 registration_errors=registration_errors,
+                uploads=uploads,
             )
 
         composite_result_items = [
@@ -958,8 +968,12 @@ class PutService:
                 "size": size,
                 "source_type": source_type,
             }
-            if uploaded.remote_url:
-                entry["source_url"] = uploaded.remote_url
+            # Deliberately do NOT record the upload destination as the artifact's
+            # global ``source_url`` here. That row is content-addressed and shared
+            # across orgs, so a per-publication URL would leak between tenants.
+            # The download location is published instead as a session-scoped
+            # ``roar.distribution.url`` label (see _set_publish_distribution_labels),
+            # which both the registration-session and this legacy inline path emit.
 
             payloads.append(entry)
 
@@ -1040,6 +1054,48 @@ class PutService:
             return False
         return True
 
+    def _set_publish_distribution_labels(
+        self,
+        uploads: list[_UploadedArtifact],
+        source_type: str | None,
+    ) -> None:
+        """Record each uploaded artifact's distribution URL as a reserved system
+        label (``roar.distribution.url``), scoped to this publication.
+
+        GLaaS reads this as the artifact's AI-BOM ``downloadLocation``. Because
+        the label lives on the ``(artifact, session)`` scope rather than the
+        global content-addressed artifact row, two orgs publishing identical
+        bytes each carry their own download location — no cross-tenant bleed.
+        Gated on a recognized remote ``source_type`` so we never assert a
+        distribution URL for a non-remote destination (e.g. ``memory://``).
+        """
+        if not source_type:
+            return
+        labels_repo = getattr(self._db, "labels", None)
+        if labels_repo is None:
+            return
+        for uploaded in uploads:
+            if not uploaded.remote_url or not uploaded.artifact_id:
+                continue
+            current = labels_repo.get_current("artifact", artifact_id=uploaded.artifact_id)
+            metadata = current.get("metadata") if isinstance(current, dict) else None
+            metadata = dict(metadata) if isinstance(metadata, dict) else {}
+            roar_ns = metadata.get("roar")
+            roar_ns = dict(roar_ns) if isinstance(roar_ns, dict) else {}
+            distribution = roar_ns.get("distribution")
+            distribution = dict(distribution) if isinstance(distribution, dict) else {}
+            if distribution.get("url") == uploaded.remote_url:
+                continue  # already recorded — avoid a redundant label version
+            distribution["url"] = uploaded.remote_url
+            roar_ns["distribution"] = distribution
+            metadata["roar"] = roar_ns
+            labels_repo.create_version(
+                "artifact",
+                metadata,
+                artifact_id=uploaded.artifact_id,
+                write_origin=LABEL_ORIGIN_SYSTEM,
+            )
+
     def _sync_put_job_labels_with_glaas(
         self,
         *,
@@ -1049,15 +1105,22 @@ class PutService:
         job_uid: str,
         remote_job_uid: str,
         registration_errors: list[str],
+        uploads: list[_UploadedArtifact] | None = None,
     ) -> None:
-        """Sync the local current label document for the publish-time put job."""
+        """Sync the local current label document for the publish-time put job
+        and its published artifacts (carrying ``roar.distribution.url``)."""
+        artifacts = (
+            [{"id": u.artifact_id, "hash": u.hash} for u in uploads if u.artifact_id and u.hash]
+            if uploads
+            else []
+        )
         sync_publish_labels(
             glaas_client=glaas_client,
             db_ctx=self._db,
             session_id=None,
             session_hash=session_hash,
             jobs=[{"id": job_id, "job_uid": job_uid, "remote_job_uid": remote_job_uid}],
-            artifacts=[],
+            artifacts=artifacts,
             errors=registration_errors,
         )
 

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/application/run/execution.py

@@ -218,6 +218,7 @@ def execute_and_report(
     tracer_fallback: bool | None = None,
     block_tags: list[str] | None = None,
     add_tags: list[str] | None = None,
+    wandb_to_trackio: bool = False,
 ) -> ExecutionReport:
     """Execute command via selected backend and show the run report."""
     hash_algos = cast(list[Literal["blake3", "sha256", "sha512", "md5"]], hash_algorithms)
@@ -240,6 +241,7 @@ def execute_and_report(
         tracer_fallback=tracer_fallback,
         block_tags=block_tags or [],
         add_tags=add_tags or [],
+        wandb_to_trackio=wandb_to_trackio,
     )
 
     backend = get_execution_backend(backend_name)

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/application/run/requests.py

@@ -19,6 +19,7 @@ class RunRequest:
     hash_algorithms: tuple[str, ...] = field(default_factory=tuple)
     block_tags: tuple[str, ...] = field(default_factory=tuple)
     add_tags: tuple[str, ...] = field(default_factory=tuple)
+    wandb_to_trackio: bool = False
 
 
 @dataclass(frozen=True)

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/application/run/service.py

@@ -64,6 +64,7 @@ def run_command(request: RunRequest) -> int:
         tracer_fallback=request.tracer_fallback,
         block_tags=list(request.block_tags),
         add_tags=list(request.add_tags),
+        wandb_to_trackio=request.wandb_to_trackio,
     )
 
 
@@ -112,6 +113,7 @@ def _execute_tracked_command(
     tracer_fallback: bool | None,
     block_tags: list[str] | None = None,
     add_tags: list[str] | None = None,
+    wandb_to_trackio: bool = False,
 ) -> int:
     resolved_config_start_dir = config_start_dir or _config_start_dir(roar_dir)
     try:
@@ -139,6 +141,7 @@ def _execute_tracked_command(
                 tracer_fallback=tracer_fallback,
                 block_tags=block_tags,
                 add_tags=add_tags,
+                wandb_to_trackio=wandb_to_trackio,
             )
         )
     except Exception:

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/application/tags.py

@@ -570,20 +570,26 @@ def parse_add_tags(pairs: Iterable[str]) -> dict[str, list[str]]:
 
 
 def build_run_modifiers(
-    block_tags: Iterable[str], add_tags: Iterable[str]
-) -> dict[str, list[str]] | None:
+    block_tags: Iterable[str],
+    add_tags: Iterable[str],
+    wandb_to_trackio: bool = False,
+) -> dict[str, Any] | None:
     """Build the ``run_modifiers`` metadata block, or None if there's nothing to record.
 
     Stores the raw flag strings verbatim (e.g. ``"license=GPL-3.0"``) so reproduce
-    replays exactly what was passed.
+    replays exactly what was passed. ``wandb_to_trackio`` records that the run used
+    ``roar run --wandb-to-trackio`` so reproduce re-emits the flag (and the
+    reproduction's ``import wandb`` resolves the same way the original run's did).
     """
     blocks = [b.strip() for b in block_tags if b.strip()]
     adds = [a.strip() for a in add_tags if a.strip()]
-    modifiers: dict[str, list[str]] = {}
+    modifiers: dict[str, Any] = {}
     if blocks:
         modifiers["block_tags"] = blocks
     if adds:
         modifiers["add_tags"] = adds
+    if wandb_to_trackio:
+        modifiers["wandb_to_trackio"] = True
     return modifiers or None
 
 
@@ -602,6 +608,8 @@ def run_modifier_flags(run_modifiers: Any) -> str:
         parts.append(f"--block-tag {shlex.quote(str(item))}")
     for item in run_modifiers.get("add_tags") or []:
         parts.append(f"--add-tag {shlex.quote(str(item))}")
+    if run_modifiers.get("wandb_to_trackio"):
+        parts.append("--wandb-to-trackio")
     return " ".join(parts)
 
 

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/cli/commands/run.py

@@ -84,6 +84,18 @@ def _validate_add_tags(
     callback=_validate_add_tags,
     help="Stamp KIND=VALUE onto this run's output artifacts (repeatable).",
 )
+@click.option(
+    "--wandb-to-trackio",
+    "wandb_to_trackio",
+    is_flag=True,
+    default=False,
+    help=(
+        "Route an unmodified wandb-instrumented workload through trackio. Mirrors "
+        "to TRACKIO_SPACE_ID (with HF_TOKEN) when set, else runs wandb as a silent "
+        "no-op. Recorded so `roar reproduce` re-emits it — a reproducer needs no "
+        "wandb account or extra flags."
+    ),
+)
 @click.pass_obj
 @require_init
 def run(
@@ -97,6 +109,7 @@ def run(
     hash_algorithms: tuple[str, ...],
     block_tags: tuple[str, ...],
     add_tags: tuple[str, ...],
+    wandb_to_trackio: bool,
 ) -> None:
     """Run a command with provenance tracking.
 
@@ -138,6 +151,7 @@ def run(
                 hash_algorithms=tuple(hash_algorithms),
                 block_tags=tuple(block_tags),
                 add_tags=tuple(add_tags),
+                wandb_to_trackio=wandb_to_trackio,
             )
         )
     except ValueError as exc:
@@ -178,6 +192,8 @@ Options:
   -n, --name <name>       Set the name label for this step
   --block-tag <kind[=value]>  Stop a tag kind (or one value) from being inherited (repeatable)
   --add-tag <kind=value>  Stamp a tag onto this run's outputs (repeatable)
+  --wandb-to-trackio      Route unmodified wandb logging through trackio (mirrors to
+                          TRACKIO_SPACE_ID when set, else a silent no-op); re-emitted by reproduce
 
 Hash algorithms: blake3 (default), sha256, sha512, md5
 

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/core/models/run.py

@@ -96,6 +96,9 @@ class RunContext(RoarBaseModel):
     git_repo: str | None = None
     block_tags: list[str] = Field(default_factory=list)
     add_tags: list[str] = Field(default_factory=list)
+    # `roar run --wandb-to-trackio`: activate the bundled wandb->trackio alias in
+    # the traced child (via ROAR_WANDB_TO_TRACKIO). Recorded so reproduce re-emits it.
+    wandb_to_trackio: bool = False
 
     @field_validator("roar_dir", mode="before")
     @classmethod

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/db/services/job_recording.py

@@ -106,6 +106,7 @@ class JobRecordingService:
         hash_algorithms: list[str] | None = None,
         block_tags: tuple[str, ...] = (),
         add_tags: tuple[str, ...] = (),
+        wandb_to_trackio: bool = False,
     ) -> tuple[int, str]:
         """
         Record a job with its inputs and outputs.
@@ -173,7 +174,7 @@ class JobRecordingService:
         # Persist the roar-side run modifiers (--block-tag / --add-tag) on the job
         # metadata so `roar reproduce` can replay them; a bare re-run would
         # otherwise re-inherit blocked tags and drop stamped ones.
-        metadata = self._with_run_modifiers(metadata, block_tags, add_tags)
+        metadata = self._with_run_modifiers(metadata, block_tags, add_tags, wandb_to_trackio)
 
         # Create the job record
         job_id, job_uid = self._job_repo.create(
@@ -252,10 +253,13 @@ class JobRecordingService:
 
     @staticmethod
     def _with_run_modifiers(
-        metadata: str | None, block_tags: tuple[str, ...], add_tags: tuple[str, ...]
+        metadata: str | None,
+        block_tags: tuple[str, ...],
+        add_tags: tuple[str, ...],
+        wandb_to_trackio: bool = False,
     ) -> str | None:
         """Add a ``run_modifiers`` block to the job metadata JSON when flags were used."""
-        modifiers = build_run_modifiers(block_tags, add_tags)
+        modifiers = build_run_modifiers(block_tags, add_tags, wandb_to_trackio)
         if modifiers is None:
             return metadata
         data: dict[str, Any] = {}

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/execution/recording/job_recording.py

@@ -342,6 +342,7 @@ class ExecutionJobRecorder:
                 hash_algorithms=list(ctx.hash_algorithms),
                 block_tags=tuple(ctx.block_tags),
                 add_tags=tuple(ctx.add_tags),
+                wandb_to_trackio=ctx.wandb_to_trackio,
             )
 
             # Register proxy artifacts first so downstream output/input queries include them.

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/execution/runtime/coordinator.py

@@ -137,6 +137,10 @@ class RunCoordinator:
         extra_env: dict[str, str] = {
             ROAR_EXECUTION_BACKEND_ENV: str(ctx.execution_backend),
         }
+        if ctx.wandb_to_trackio:
+            # Consumed by the injected child sitecustomize, which activates the
+            # bundled wandb->trackio alias before the workload imports wandb.
+            extra_env["ROAR_WANDB_TO_TRACKIO"] = "1"
         runtime_observations = RuntimeObservationBundle()
         resource_env = self._runtime_resources.start_all(ctx, os.environ)
         extra_env.update(resource_env)

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/execution/runtime/inject/sitecustomize.py

@@ -131,4 +131,15 @@ if os.environ.get("ROAR_WRAP") == "1":
     )
 
 
+if os.environ.get("ROAR_WANDB_TO_TRACKIO"):
+    # `roar run --wandb-to-trackio`: alias wandb -> trackio (or a silent no-op)
+    # before the workload imports wandb. Best-effort — never break the workload.
+    try:
+        with SuppressTracking():
+            from roar.integrations import wandb_trackio
+
+            wandb_trackio.install()
+    except Exception:
+        pass
+
 atexit.register(_runtime_tracker.write_log)

roar_cli-0.4.3/roar/integrations/wandb_trackio.py

@@ -0,0 +1,233 @@
+"""Optional ``wandb`` -> ``trackio`` integration for ``roar run --wandb-to-trackio``.
+
+Opt-in and workload-agnostic. It ships *inside* roar, so anyone who reproduces a
+run gets it from ``pip install roar-cli`` — no separate package, nothing baked into
+a machine image, and it never appears as an un-installable dependency in a captured
+lineage.
+
+Activated only when the env var ``ROAR_WANDB_TO_TRACKIO`` is set. The
+``roar run --wandb-to-trackio`` flag sets it to ``"1"``, and roar re-emits that flag
+on ``roar reproduce`` (executor + ``--script``), so the toggle travels with the
+recorded command. Set the env var to ``"off"`` to force the no-op even when a Space
+is configured. roar's injected child ``sitecustomize`` calls :func:`install` before
+the workload imports ``wandb``.
+
+Two modes, chosen at run time from the environment — **no extra parameters**:
+
+* **sync** — ``ROAR_WANDB_TO_TRACKIO != "off"`` and ``TRACKIO_SPACE_ID`` is set:
+  alias ``wandb`` to trackio and mirror the run to the hosted Space (needs
+  ``HF_TOKEN``). Project / run name / config come from the workload's own
+  ``wandb.init(...)`` call — nothing is passed through roar.
+* **no-op** — ``ROAR_WANDB_TO_TRACKIO == "off"``, or no ``TRACKIO_SPACE_ID``, or
+  trackio isn't importable: alias ``wandb`` to a silent stub so an *unmodified*
+  wandb-instrumented repo imports and runs to completion with **no external
+  tracking and no credentials**. This is what a third-party reproducer gets by
+  default.
+"""
+
+from __future__ import annotations
+
+import sys
+
+# wandb.init kwargs that trackio.init does not accept (dropped in sync mode).
+_WANDB_ONLY_INIT = (
+    "entity",
+    "tags",
+    "reinit",
+    "group",
+    "job_type",
+    "notes",
+    "dir",
+    "mode",
+    "anonymous",
+    "magic",
+    "save_code",
+    "sync_tensorboard",
+    "monitor_gym",
+    "settings",
+    "id",
+    "allow_val_change",
+    "force",
+    "tensorboard",
+)
+
+# wandb surface trackio lacks; replaced with warn-once no-ops so the run completes.
+_WANDB_NOOP_NAMES = (
+    "watch",
+    "unwatch",
+    "define_metric",
+    "save",
+    "restore",
+    "sweep",
+    "agent",
+    "log_artifact",
+    "use_artifact",
+    "log_model",
+    "use_model",
+    "mark_preempting",
+    "alert",
+    "login",
+)
+# wandb data-type constructors that show up inside log() calls.
+_WANDB_TYPE_NAMES = (
+    "Image",
+    "Table",
+    "Artifact",
+    "Video",
+    "Histogram",
+    "Audio",
+    "Html",
+    "Object3D",
+    "Molecule",
+    "plot",
+    "Settings",
+)
+
+
+def _to_jsonable(v):
+    """Mirror wandb's silent coercion of tensors/numpy to JSON — trackio raises.
+
+    Reduces ``torch.Tensor`` / numpy scalars to Python scalars (and n-d arrays to
+    nested lists) by duck-typing ``.item()`` / ``.tolist()`` — no torch/numpy import.
+    """
+    if v is None or isinstance(v, (str, bytes, bool, int, float)):
+        return v
+    if isinstance(v, dict):
+        return {k: _to_jsonable(x) for k, x in v.items()}
+    if isinstance(v, (list, tuple)):
+        return [_to_jsonable(x) for x in v]
+    item = getattr(v, "item", None)
+    if callable(item):
+        try:
+            return v.item()
+        except Exception:
+            pass
+    tolist = getattr(v, "tolist", None)
+    if callable(tolist):
+        try:
+            return v.tolist()
+        except Exception:
+            pass
+    return v
+
+
+def _install_trackio_alias(space_id: str) -> bool:
+    """Alias ``wandb`` -> trackio, mirroring to ``space_id``. False if unavailable."""
+    try:
+        import trackio
+    except Exception:
+        sys.stderr.write("[wandb->trackio] trackio not importable; using no-op\n")
+        return False
+
+    _orig_init = trackio.init
+
+    def init(*args, **kwargs):
+        for k in _WANDB_ONLY_INIT:
+            kwargs.pop(k, None)
+        kwargs.setdefault("space_id", space_id)
+        run = _orig_init(*args, **kwargs)
+        try:
+            if not hasattr(run, "summary"):
+                run.summary = {}
+        except Exception:
+            pass
+        trackio.run = run
+        return run
+
+    trackio.init = init
+
+    _orig_log = trackio.log
+
+    def log(*args, **kwargs):
+        kwargs.pop("commit", None)
+        if args and isinstance(args[0], dict):
+            args = (_to_jsonable(args[0]), *args[1:])
+        try:
+            return _orig_log(*args, **kwargs)
+        except TypeError:
+            kwargs.pop("step", None)
+            return _orig_log(*args, **kwargs)
+
+    trackio.log = log
+
+    _warned: set[str] = set()
+
+    def _stub(name):
+        def _f(*a, **k):
+            if name not in _warned:
+                _warned.add(name)
+                sys.stderr.write(f"[wandb->trackio] wandb.{name}(...) is a no-op under trackio\n")
+            return None
+
+        return _f
+
+    for _name in (*_WANDB_NOOP_NAMES, *_WANDB_TYPE_NAMES):
+        if not hasattr(trackio, _name):
+            setattr(trackio, _name, _stub(_name))
+    if not hasattr(trackio, "run"):
+        trackio.run = None
+
+    sys.modules["wandb"] = trackio
+    sys.stderr.write(f"[wandb->trackio] active (wandb -> trackio, space={space_id})\n")
+    return True
+
+
+def _install_noop_wandb() -> None:
+    """Alias ``wandb`` to a silent no-op module so an unmodified repo runs untracked."""
+    import types
+
+    mod = types.ModuleType("wandb")
+
+    def _noop(*a, **k):
+        return None
+
+    class _Run:
+        def __init__(self) -> None:
+            self.summary: dict = {}
+            self.config: dict = {}
+            self.id = None
+            self.name = None
+
+        log = _noop
+        finish = _noop
+        watch = _noop
+        log_code = _noop
+
+    _run = _Run()
+
+    def init(*a, **k):
+        mod.run = _run  # type: ignore[attr-defined]
+        return _run
+
+    mod.init = init  # type: ignore[attr-defined]
+    mod.log = _noop  # type: ignore[attr-defined]
+    mod.finish = _noop  # type: ignore[attr-defined]
+    mod.config = {}  # type: ignore[attr-defined]
+    mod.run = None  # type: ignore[attr-defined]
+    for _name in (*_WANDB_NOOP_NAMES, *_WANDB_TYPE_NAMES):
+        setattr(mod, _name, _noop)
+    sys.modules["wandb"] = mod
+    sys.stderr.write("[wandb->trackio] wandb no-op (tracking disabled)\n")
+
+
+def install(environ=None) -> None:
+    """Alias ``wandb`` per ``ROAR_WANDB_TO_TRACKIO`` — a no-op if the flag is unset.
+
+    Idempotent and safe: never raises into the workload. Skips if ``wandb`` is
+    already in ``sys.modules`` (real wandb or a prior alias) so it never clobbers.
+    """
+    import os
+
+    env = os.environ if environ is None else environ
+    flag = (env.get("ROAR_WANDB_TO_TRACKIO") or "").strip().lower()
+    if not flag:
+        return
+    if "wandb" in sys.modules:
+        return
+    space_id = env.get("TRACKIO_SPACE_ID") or None
+    try:
+        if flag != "off" and space_id and _install_trackio_alias(space_id):
+            return
+        _install_noop_wandb()
+    except Exception as exc:  # never let tracking setup break the workload
+        sys.stderr.write(f"[wandb->trackio] disabled (setup error: {exc})\n")

{roar_cli-0.4.2 → roar_cli-0.4.3}/roar/publish_auth.py

@@ -158,7 +158,20 @@ def load_publish_auth_context(
             else:
                 raise PublishAuthError(str(exc)) from exc
     binding = None if allow_public_without_binding else _load_repo_binding(start_dir)
-    repo_scope = None if allow_public_without_binding else load_repo_scope(start_dir)
+    repo_scope = load_repo_scope(start_dir)
+    # `allow_public_without_binding` permits a *scopeless* public publish, but it
+    # must not discard a **public project scope** — that binding carries the org
+    # attribution (supplier/author) the AI-BOM needs, and a public project's
+    # whole point is public + attributed. Regression fix: eef6fca (0.4.1) made a
+    # public project scope resolve to public=True, which the CLI feeds into
+    # `allow_public_without_binding=request.public`; dropping repo_scope here then
+    # published those DAGs anonymous. A *non-public* project scope with an
+    # explicit `--public` still drops (the user is overriding to public), as do
+    # public/anonymous/unset scopes.
+    if allow_public_without_binding and not (
+        repo_scope and repo_scope.mode == "project" and repo_scope.visibility == "public"
+    ):
+        repo_scope = None
     if binding and not access_token and not ssh_auth_available:
         raise PublishAuthError(
             "Repo is linked to GLaaS but no global auth state is available. Run `roar login`."