scientific-computing-system 2.2.13__tar.gz → 2.2.14__tar.gz

scientific_computing_system-2.2.14/.github/workflows/dependency-review.yml

@@ -0,0 +1,19 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/.github/workflows/pypi-release-policy.yml

@@ -64,18 +64,41 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "tag=v$version" >> "$GITHUB_OUTPUT"
 
+      # The policy check also runs on a push that touches the release
+      # workflow, which can land before the version has been released (the
+      # 2.2.13 merge did exactly that). A missing release is not a policy
+      # violation: there is nothing to check yet, and the workflow_run trigger
+      # re-runs this job after the Release workflow creates it.
+      - name: Resolve matching GitHub Release
+        id: release_state
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if release_id="$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" --jq '.id' 2>&1)"; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "release_id=$release_id" >> "$GITHUB_OUTPUT"
+          elif grep -q "HTTP 404" <<<"$release_id"; then
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "GitHub Release $RELEASE_TAG does not exist yet; nothing to enforce."
+          else
+            echo "::error::Could not resolve GitHub Release $RELEASE_TAG: $release_id"
+            exit 1
+          fi
+
       - name: Remove forbidden wheel and sdist assets from matching GitHub Release
+        if: steps.release_state.outputs.exists == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          RELEASE_ID: ${{ steps.release_state.outputs.release_id }}
         shell: bash
         run: |
           set -euo pipefail
-          release_id="$(
-            gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" --jq '.id'
-          )"
           asset_ids="$(
-            gh api --paginate "repos/$GITHUB_REPOSITORY/releases/$release_id/assets" \
+            gh api --paginate "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets" \
               --jq '.[] | select((.name | endswith(".whl")) or (.name | endswith(".tar.gz"))) | .id'
           )"
           if [ -z "$asset_ids" ]; then
@@ -88,6 +111,7 @@ jobs:
           fi
 
       - name: Verify public PyPI and asset-free GitHub Release policy
+        if: steps.release_state.outputs.exists == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_VERSION: ${{ steps.release.outputs.version }}

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/.github/workflows/release.yml

@@ -167,7 +167,10 @@ jobs:
               previous_tag="$tag"
               break
             fi
-          done < <(git tag --merged HEAD --sort=-creatordate --list 'v*')
+          # Sort by version, not tag creation date: tags backfilled for older
+          # versions are created later, so -creatordate would pick e.g. v2.2.6
+          # as the base for v2.2.13 and weaken the version-discipline diff.
+          done < <(git tag --merged HEAD --sort=-v:refname --list 'v*')
           if [ -n "$previous_tag" ]; then
             base="$(git rev-list -n 1 "$previous_tag")"
             echo "Previous release: $previous_tag ($base)"

scientific_computing_system-2.2.14/.github/workflows/scorecard.yml

@@ -0,0 +1,37 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 1 * * 6"
+  push:
+    branches: [main]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: scorecard-sarif
+          path: results.sarif
+          retention-days: 5
+      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          sarif_file: results.sarif

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/.github/workflows/tests.yml

@@ -13,7 +13,9 @@ on:
       - 'CONTRIBUTING.md'
       - 'LICENSE'
       - 'SECURITY.md'
-      - 'docs/**'
+      # No 'docs/**' here: deploy-docs runs inside this workflow on main
+      # pushes, so ignoring docs-only pushes meant documentation changes
+      # merged to main were never deployed.
   pull_request:
     branches: [main]
 

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/CHANGELOG.md

@@ -19,6 +19,16 @@ a git tag in this repository or on `origin` (checked with `git ls-remote --tags`
 Any retroactive `v2.2.6` or `v2.2.7` tag should point at those commits. This note records
 what the history supports; it does not claim that a tag exists.
 
+## [v2.2.14] - 2026-10-23
+
+### Input validation and supply-chain transparency
+
+- Reject non-square and non-rectangular matrices in `determinant` with a normalised `ValueError` instead of leaking an index error from the elimination loop.
+- Report a vanishing Newton gradient as `converged=False` instead of silently returning success.
+- Require every ODE right-hand-side derivative to match the initial-state length, and report the expected and actual lengths instead of letting an implicit broadcast hide the bug.
+- Add Dependabot, OpenSSF Scorecard and dependency review workflows with SHA-pinned actions, and add a citation file so tooling can resolve package metadata.
+- Bump synchronized package metadata to 2.2.14 as required by the version-discipline gate for `src/cds/` changes.
+
 ## [v2.2.13] - 2026-10-21
 
 ### Release packaging, CI and documentation accuracy

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/CITATION.cff

@@ -5,7 +5,7 @@ title: "scientific-computing-system"
 # Keep `version` in lockstep with pyproject.toml [project].version and
 # src/cds/_version.py. scripts/check_version_discipline.py and
 # scripts/check_version_lockstep.py enforce this.
-version: 2.2.13
+version: 2.2.14
 authors:
   - name: "Furox-Art"
     email: "furkanarkn1451@gmail.com"
@@ -50,5 +50,5 @@ preferred-citation:
   authors:
     - name: "Furox-Art"
   year: 2026
-  version: 2.2.13
+  version: 2.2.14
   url: "https://github.com/Furox-Art/scientific-computing-system"

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scientific-computing-system
-Version: 2.2.13
+Version: 2.2.14
 Summary: A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies.
 Project-URL: Homepage, https://github.com/Furox-Art/scientific-computing-system
 Project-URL: Repository, https://github.com/Furox-Art/scientific-computing-system
@@ -145,21 +145,21 @@ The import name is **`cds`** (the distribution is `scientific-computing-system`)
 | **PyPI** (the library) | `pip install scientific-computing-system` | The actual Python package. Zero runtime dependencies. This is what you want. |
 | **npm** (a launcher shim) | `npm i -g scientific-computing-system` | A thin Node wrapper that runs `python -m cds`. It ships no Python and needs the Python distribution installed so that `python -m cds` resolves. |
 
-At the time of writing (2026-10-22), both registries' latest versions are 2.2.12,
+At the time of writing (2026-10-22), both registries' latest versions are 2.2.13,
 but they are not published in lockstep and are **not** equally verifiable:
 
 - **PyPI** — carries a **PEP 740 provenance attestation** (Sigstore-signed,
   binding the file digest to the publishing workflow). Verified on 2.2.3,
-  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11 and 2.2.12. The 2.2.7 wheel and sdist
-  return 404 from the per-file provenance endpoint, so "every release since
-  attestations were enabled" would be false.
+  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13. The 2.2.7 wheel and
+  sdist return 404 from the per-file provenance endpoint, so "every release
+  since attestations were enabled" would be false.
 - **npm** — carries a **Sigstore attestation as of 2.2.3**, minted by npm's
   OIDC trusted publisher (the registry serves both an npm publish attestation
   and a SLSA provenance v1 bundle for that tarball). 1.0.0 through 2.2.2
   predate the publisher registration and have none, so pin 2.2.3 or newer. npm
   has no 2.2.7, 2.2.8 or 2.2.11 at all: its 2.2.x line is 2.2.0 through 2.2.6
-  plus 2.2.12, which is how the latest versions can match while the histories
-  do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
+  plus 2.2.12 and 2.2.13, which is how the latest versions can match while the
+  histories do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
   not proof of origin, and `dist.signatures`, which is npm's registry transport
   signature, not build provenance.
 
@@ -211,7 +211,7 @@ The authoritative per-module list is the [API reference](https://furox-art.githu
 
 ### Runnable examples and the dashboard
 
-- **[`examples/`](examples/)** — 35 runnable scripts and notebooks (33 `.py`, 2
+- **[`examples/`](examples/)** — 34 runnable scripts and notebooks (32 `.py`, 2
   `.ipynb`), each self-contained and dependency-free unless noted. Every tutorial
   page in the docs has a matching example.
 - **[`dashboard/app.py`](dashboard/app.py)** — a Streamlit dashboard:
@@ -277,7 +277,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.13
+System version 2.2.14
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/README.md

@@ -49,21 +49,21 @@ The import name is **`cds`** (the distribution is `scientific-computing-system`)
 | **PyPI** (the library) | `pip install scientific-computing-system` | The actual Python package. Zero runtime dependencies. This is what you want. |
 | **npm** (a launcher shim) | `npm i -g scientific-computing-system` | A thin Node wrapper that runs `python -m cds`. It ships no Python and needs the Python distribution installed so that `python -m cds` resolves. |
 
-At the time of writing (2026-10-22), both registries' latest versions are 2.2.12,
+At the time of writing (2026-10-22), both registries' latest versions are 2.2.13,
 but they are not published in lockstep and are **not** equally verifiable:
 
 - **PyPI** — carries a **PEP 740 provenance attestation** (Sigstore-signed,
   binding the file digest to the publishing workflow). Verified on 2.2.3,
-  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11 and 2.2.12. The 2.2.7 wheel and sdist
-  return 404 from the per-file provenance endpoint, so "every release since
-  attestations were enabled" would be false.
+  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13. The 2.2.7 wheel and
+  sdist return 404 from the per-file provenance endpoint, so "every release
+  since attestations were enabled" would be false.
 - **npm** — carries a **Sigstore attestation as of 2.2.3**, minted by npm's
   OIDC trusted publisher (the registry serves both an npm publish attestation
   and a SLSA provenance v1 bundle for that tarball). 1.0.0 through 2.2.2
   predate the publisher registration and have none, so pin 2.2.3 or newer. npm
   has no 2.2.7, 2.2.8 or 2.2.11 at all: its 2.2.x line is 2.2.0 through 2.2.6
-  plus 2.2.12, which is how the latest versions can match while the histories
-  do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
+  plus 2.2.12 and 2.2.13, which is how the latest versions can match while the
+  histories do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
   not proof of origin, and `dist.signatures`, which is npm's registry transport
   signature, not build provenance.
 
@@ -115,7 +115,7 @@ The authoritative per-module list is the [API reference](https://furox-art.githu
 
 ### Runnable examples and the dashboard
 
-- **[`examples/`](examples/)** — 35 runnable scripts and notebooks (33 `.py`, 2
+- **[`examples/`](examples/)** — 34 runnable scripts and notebooks (32 `.py`, 2
   `.ipynb`), each self-contained and dependency-free unless noted. Every tutorial
   page in the docs has a matching example.
 - **[`dashboard/app.py`](dashboard/app.py)** — a Streamlit dashboard:
@@ -181,7 +181,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.13
+System version 2.2.14
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/SECURITY.md

@@ -128,7 +128,7 @@ repository's publish workflows mints an attestation on each channel:
 - **PyPI** — Trusted Publisher: owner `Furox-Art`, repository
   `scientific-computing-system`, workflow `release.yml`, environment `pypi`.
   Exercised since 2.2.1. The per-file provenance endpoint returned 200 for the
-  published files of 2.2.1–2.2.6, 2.2.8, 2.2.11 and 2.2.12 on 2026-10-22;
+  published files of 2.2.1–2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13 on 2026-10-22;
   2.2.7 returns 404 for both its wheel and sdist.
 - **npm** — Trusted Publisher: owner `Furox-Art`, repository
   `scientific-computing-system`, workflow `npm-publish.yml`, environment `npm`.
@@ -191,7 +191,7 @@ In particular, `sympy_verify_identity()` passes caller-provided symbolic strings
 
 1. **Pin the package version** in reproducible environments, for example `pip install "scientific-computing-system==X.Y.Z"` with the exact release you have evaluated, rather than an unconstrained range. Deliberately no concrete version is written here: a pinned example goes stale at the next release and readers copy it regardless, so take the number from the [release notes](https://github.com/Furox-Art/scientific-computing-system/releases) for the release you are deploying, and record it in your own lockfile or constraints file.
 2. **Install only the optional extras you need.** Fewer third-party packages reduce supply-chain and compatibility surface.
-3. **Verify provenance for high-assurance use.** For PyPI, fetch the PEP 740 bundle from `/integrity/<project>/<version>/<filename>/provenance` and confirm its `subject` digest equals the `sha256` PyPI publishes for that file. There is currently **no** attestation for the npm package; its `dist.integrity` is an integrity pin, not provenance. See [Distribution channels and provenance](#distribution-channels-and-provenance).
+3. **Verify provenance for high-assurance use.** For PyPI, fetch the PEP 740 bundle from `/integrity/<project>/<version>/<filename>/provenance` and confirm its `subject` digest equals the `sha256` PyPI publishes for that file. npm publishes are attested from `2.2.3` onward; for versions without an attestation, `dist.integrity` is an integrity pin, not provenance. See [Distribution channels and provenance](#distribution-channels-and-provenance).
 4. **Treat optional backend inputs as backend inputs.** Do not pass hostile symbolic expressions or untrusted scientific files without the validation/sandboxing appropriate to SymPy, HDF5, NetCDF, or the relevant backend.
 5. **Keep the environment current.** Review dependency updates and run vulnerability auditing against the exact environment deployed.
 6. **Do not use the library as the sole validation layer for safety-critical conclusions.** Independent domain validation remains necessary.

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/codemeta.json

@@ -2,7 +2,7 @@
   "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
   "@type": "SoftwareSourceCode",
   "name": "scientific-computing-system",
-  "version": "2.2.13",
+  "version": "2.2.14",
   "description": "Pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, and scientific workflows. Zero runtime dependencies. This is the front door; scientific-computing-system-2.0 is the NumPy build of the same work.",
   "license": "https://spdx.org/licenses/MIT",
   "codeRepository": "https://github.com/Furox-Art/scientific-computing-system",

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scientific-computing-system",
-  "version": "2.2.13",
+  "version": "2.2.14",
   "description": "Scientific Computing System launcher - a thin Node wrapper that forwards to the pure-Python `cds` CLI. This npm package ships NO Python code: it requires the Python distribution to be installed (`pip install scientific-computing-system`), otherwise `scs` exits non-zero with an actionable message.",
   "main": "index.js",
   "bin": {

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/pyproject.toml

@@ -2,7 +2,7 @@
 # Distribution name. Formerly published as "cognitive-discovery-system";
 # the import name stays `cds`. Keep the old PyPI project alive as an alias.
 name = "scientific-computing-system"
-version = "2.2.13"
+version = "2.2.14"
 description = "A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies."
 readme = "README.md"
 license = "MIT"

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/src/cds/_version.py

@@ -5,5 +5,5 @@ from __future__ import annotations
 
 __all__ = ["__version__", "version", "__version_tuple__", "version_tuple"]
 
-__version__ = version = "2.2.13"
-__version_tuple__ = version_tuple = (2, 2, 13)
+__version__ = version = "2.2.14"
+__version_tuple__ = version_tuple = (2, 2, 14)

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/src/cds/diffeq/solvers.py

@@ -267,6 +267,17 @@ def rk45(
     return ODESolution(t=t_vals, y=y_vals, method="rk45", steps=steps)
 
 
+def _checked_derivative(
+    f: Callable[[float, list[float]], list[float]], t: float, y: list[float], n: int
+) -> list[float]:
+    dy = f(t, y)
+    if len(dy) != n:
+        raise ValueError(
+            f"ODE right-hand side returned {len(dy)} derivative(s) for a state of length {n}"
+        )
+    return dy
+
+
 def solve_system(
     f: Callable[[float, list[float]], list[float]],
     t0: float,
@@ -296,13 +307,13 @@ def solve_system(
     while (t_end - t) * direction > LOOP_EPSILON:
         h = direction * min(dt, abs(t_end - t))
 
-        k1 = f(t, y)
+        k1 = _checked_derivative(f, t, y, n)
         y_tmp = [y[i] + h * k1[i] / 2 for i in range(n)]
-        k2 = f(t + h / 2, y_tmp)
+        k2 = _checked_derivative(f, t + h / 2, y_tmp, n)
         y_tmp = [y[i] + h * k2[i] / 2 for i in range(n)]
-        k3 = f(t + h / 2, y_tmp)
+        k3 = _checked_derivative(f, t + h / 2, y_tmp, n)
         y_tmp = [y[i] + h * k3[i] for i in range(n)]
-        k4 = f(t + h, y_tmp)
+        k4 = _checked_derivative(f, t + h, y_tmp, n)
 
         y = [y[i] + (h / 6) * (k1[i] + 2 * k2[i] + 2 * k3[i] + k4[i]) for i in range(n)]
         t = t + h

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/src/cds/math_utils/linalg.py

@@ -120,6 +120,9 @@ def determinant(m: Matrix) -> float:
     n = len(m)
     if n == 0:
         return 1.0
+    rows, cols = _require_rectangular(m, "matrix")
+    if rows != cols:
+        raise ValueError(f"determinant requires a square matrix (got {rows}x{cols})")
     if n == 1:
         return m[0][0]
 

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/src/cds/optimization/minimize.py

@@ -226,7 +226,12 @@ def newton_method(
         dfx = _compute_gradient(f, x, h_base)
 
         if abs(dfx) < NEAR_ZERO:
-            break
+            return OptResult(
+                x=x,
+                value=f(x),
+                iterations=i,
+                converged=False,
+            )
         x -= fx / dfx
     return OptResult(
         x=x,
@@ -401,6 +406,8 @@ def line_search(
         max_iter: iteration limit
     """
     phi = (math.sqrt(5) - 1) / 2
+    if a > b:
+        raise ValueError(f"line_search requires a <= b (got a={a}, b={b})")
     for i in range(max_iter):
         if abs(b - a) < tol:
             mid = (a + b) / 2

scientific_computing_system-2.2.14/tests/test_hardening_20261023.py

@@ -0,0 +1,40 @@
+"""Regressions for shape/iteration/length validation in numerical primitives."""
+
+from __future__ import annotations
+
+import pytest
+
+from cds.diffeq.solvers import solve_system
+from cds.math_utils.linalg import determinant
+from cds.optimization.minimize import line_search, newton_method
+
+
+def test_determinant_rejects_rectangular_matrix() -> None:
+    with pytest.raises(ValueError, match="square"):
+        determinant([[1.0, 2.0, 3.0], [4.0, 5.0, 6.0]])
+
+
+def test_determinant_rejects_ragged_matrix() -> None:
+    with pytest.raises(ValueError, match="ragged"):
+        determinant([[1.0, 2.0], [3.0]])
+
+
+def test_newton_reports_actual_iterations_when_derivative_vanishes() -> None:
+    result = newton_method(lambda x: 1.0, 0.0, max_iter=500)
+    assert result.converged is False
+    assert result.iterations == 0
+
+
+def test_line_search_rejects_inverted_bounds() -> None:
+    with pytest.raises(ValueError, match="a <= b"):
+        line_search(lambda x: x * x, 1.0, 0.0)
+
+
+def test_solve_system_rejects_short_derivative() -> None:
+    with pytest.raises(ValueError, match="state of length 2"):
+        solve_system(lambda t, y: [1.0], 0.0, [0.0, 0.0], 1.0, dt=0.5)
+
+
+def test_solve_system_rejects_long_derivative() -> None:
+    with pytest.raises(ValueError, match="state of length 1"):
+        solve_system(lambda t, y: [1.0, 2.0], 0.0, [0.0], 1.0, dt=0.5)

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.14}/tests/test_release_contract.py

@@ -131,6 +131,15 @@ def test_release_workflow_rechecks_version_discipline_before_build() -> None:
     assert "scripts/check_version_discipline.py" in release
 
 
+def test_previous_release_tag_is_selected_by_version_not_creation_date() -> None:
+    release = _text(RELEASE_WORKFLOW)
+    assert "--sort=-v:refname" in release, (
+        "the previous release must be the highest reachable version tag; "
+        "backfilled tags sort as newest by creatordate"
+    )
+    assert "--sort=-creatordate" not in release
+
+
 def test_current_public_version_metadata_is_synchronized() -> None:
     match = re.search(
         r'^version\s*=\s*["\']([^"\']+)["\']',
@@ -243,6 +252,16 @@ def test_release_policy_never_downloads_released_distributions() -> None:
     assert "verify_release_integrity.py" in policy
 
 
+def test_release_policy_noops_when_the_release_does_not_exist_yet() -> None:
+    policy = _text(REGISTRY_WORKFLOW)
+    # A push that touches the release workflow can land before the version is
+    # released. The policy job must treat that as "nothing to enforce" instead
+    # of failing on the 404, and must still run once the release exists.
+    assert "Resolve matching GitHub Release" in policy
+    assert "exists=false" in policy
+    assert policy.count("steps.release_state.outputs.exists == 'true'") == 2
+
+
 def test_release_policy_removes_forbidden_distribution_assets() -> None:
     registry = _text(REGISTRY_WORKFLOW)
     assert "Remove forbidden wheel and sdist assets from matching GitHub Release" in registry