scientific-computing-system 2.2.15__tar.gz → 2.2.18__tar.gz

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/.github/workflows/codeql.yml

@@ -45,13 +45,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
       - name: Autobuild
-        uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           category: "/language:${{ matrix.language }}"

scientific_computing_system-2.2.18/.github/workflows/determinism-matrix.yml

@@ -0,0 +1,151 @@
+name: Determinism matrix
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: determinism-matrix-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  matrix:
+    name: ${{ matrix.os }} determinism matrix
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+          cache: 'pip'
+          cache-dependency-path: |
+            pyproject.toml
+            requirements.lock
+            requirements-dev.lock
+      - name: Install package
+        run: |
+          python -m pip install --upgrade pip
+          pip install ".[test]"
+      - name: Run determinism matrix
+        run: >
+          python scripts/determinism_matrix.py run
+          --workload scripts/determinism_workload.py
+          --out determinism-manifest-${{ matrix.os }}.json
+          --seeds 0 12345 random
+          --threads 1 4
+          --locales inherit C
+          --timezones UTC Europe/Istanbul
+          --gate within-host
+      - name: Upload manifest
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: determinism-manifest-${{ matrix.os }}
+          path: determinism-manifest-${{ matrix.os }}.json
+          if-no-files-found: error
+          retention-days: 14
+
+  compare:
+    name: Cross-OS digest comparison
+    needs: matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      - name: Download manifests
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: determinism-manifest-*
+          merge-multiple: true
+          path: manifests
+      - name: Compare manifests
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          files=(manifests/*.json)
+          failures=0
+          printf 'manifest files: %s\n' "${#files[@]}"
+          if [ "${#files[@]}" -lt 2 ]; then
+            echo "::error::expected a manifest from every operating system, found ${#files[@]}"
+            exit 1
+          fi
+          for ((i = 0; i < ${#files[@]}; i++)); do
+            for ((j = i + 1; j < ${#files[@]}; j++)); do
+              left=$(basename "${files[$i]}" .json)
+              right=$(basename "${files[$j]}" .json)
+              echo "=== ${left} vs ${right} ==="
+              if ! python scripts/determinism_matrix.py compare \
+                "${files[$i]}" "${files[$j]}" --gate > "compare-${left}-${right}.json"; then
+                failures=$((failures + 1))
+                echo "::error::cross-OS determinism failed or could not be compared: ${left} vs ${right}"
+              fi
+            done
+          done
+          if [ "$failures" -ne 0 ]; then
+            echo "::error::${failures} manifest pair(s) mismatched or could not be compared"
+            exit 1
+          fi
+      - name: Write comparison summary
+        if: always()
+        shell: bash
+        run: |
+          python - <<'PY'
+          import glob
+          import json
+          import os
+
+          rows = [
+              "| baseline | candidate | shared | identical | mismatches | errors |",
+              "| --- | --- | --- | --- | --- | --- |",
+          ]
+          for path in sorted(glob.glob("compare-*.json")):
+              try:
+                  with open(path, encoding="utf-8") as handle:
+                      data = json.load(handle)
+                  if not isinstance(data, dict):
+                      raise ValueError("compare report is not an object")
+              except (OSError, ValueError) as error:
+                  rows.append(f"| {path} | unreadable | - | False | - | {error} |")
+                  continue
+              baseline = (data.get("baseline_host") or {}).get("system", "unknown")
+              candidate = (data.get("candidate_host") or {}).get("system", "unknown")
+              mismatches = data.get("mismatches") or []
+              errors = data.get("errors") or []
+              rows.append(
+                  f"| {baseline} | {candidate} | {data.get('shared_variants', 0)} | "
+                  f"{data.get('identical', False)} | {len(mismatches)} | {len(errors)} |"
+              )
+          if len(rows) == 2:
+              rows.append("| no comparison reports | - | 0 | False | 0 | 1 |")
+          with open(
+              os.environ.get("GITHUB_STEP_SUMMARY", os.devnull),
+              "a",
+              encoding="utf-8",
+          ) as handle:
+              handle.write("## Cross-OS determinism\n\n" + "\n".join(rows) + "\n")
+          print("\n".join(rows))
+          PY

scientific_computing_system-2.2.18/.github/workflows/fuzz.yml

@@ -0,0 +1,38 @@
+name: Fuzz
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - "src/cds/**"
+      - "tests/fuzz/**"
+      - "pyproject.toml"
+      - ".github/workflows/fuzz.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-scientific-computing-system
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Atheris
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      - name: Install Atheris
+        run: python -m pip install atheris==3.1.0
+      - name: Install scientific-computing-system
+        run: python -m pip install -e .
+      - name: Fuzz the BPE merge validator
+        run: python tests/fuzz/fuzz_bpe_merge.py -max_total_time=60 -rss_limit_mb=2048 -print_final_stats=1

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/.github/workflows/npm-publish.yml

@@ -109,15 +109,46 @@ jobs:
           RUN_ID: ${{ github.event.workflow_run.id }}
         run: |
           set -euo pipefail
+          # The trigger is the Release workflow, which normally is itself a
+          # workflow_run consumer: its event is `workflow_run`. The Release
+          # recovery path is dispatched manually and never publishes to PyPI,
+          # so a `workflow_dispatch` run is accepted too; its publish job is
+          # declared workflow_run-only, so it cannot set published=true.
+          # Release already verified its upstream CI run through the Actions
+          # API, so trust the head SHA only after proving the run belongs to
+          # this repository's release.yml on the default branch.
           data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
-            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
-          IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name, .path] | @tsv')"
+          IFS=$'\t' read -r sha event branch conclusion repo path <<<"${data}"
           echo "head_sha=${sha}" >> "$GITHUB_OUTPUT"
-          if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
-             [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
-            echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+          case "${event}" in
+            workflow_run|workflow_dispatch) ;;
+            *)
+              echo "::error::Run ${RUN_ID} has unsupported event ${event}."
+              exit 1
+              ;;
+          esac
+          if [ "${path}" != ".github/workflows/release.yml" ] || \
+             [ "${branch}" != "main" ] || \
+             [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+            echo "::error::Run ${RUN_ID} is not a Release run on ${GITHUB_REPOSITORY} main."
             exit 1
           fi
+          # A Release run whose jobs all skip (the version is already released)
+          # concludes `skipped`. That is an ordinary push, not a release, so the
+          # npm job must skip too. A failed or cancelled release stays loud.
+          case "${conclusion}" in
+            success|skipped) ;;
+            *)
+              echo "::error::Release run ${RUN_ID} concluded ${conclusion}."
+              exit 1
+              ;;
+          esac
+          if [ "${conclusion}" != "success" ]; then
+            echo "Release run was ${conclusion}; no release was published."
+            echo "published=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           publish_conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
             --jq '[.jobs[] | select(.name == "Build + verify + publish to PyPI + metadata-only GitHub Release") | .conclusion] | first // "missing"')"
           echo "Release publish job: ${publish_conclusion}"

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/.github/workflows/pypi-release-policy.yml

@@ -49,12 +49,28 @@ jobs:
         run: |
           set -euo pipefail
           if [ "${EVENT_NAME}" = "workflow_run" ]; then
+            # This workflow triggers on the Release workflow, which normally is
+            # itself a workflow_run consumer, so the triggering run's event is
+            # `workflow_run`. The Release recovery path is dispatched manually
+            # and never publishes to PyPI, so a `workflow_dispatch` run is
+            # accepted too. The Release gate already verified its own upstream
+            # CI run through the Actions API; here we only need to prove the
+            # trigger came from this repository's Release workflow on the
+            # default branch before trusting its head SHA.
             data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
-              --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
-            IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
-            if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+              --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name, .path] | @tsv')"
+            IFS=$'\t' read -r sha event branch conclusion repo path <<<"${data}"
+            case "${event}" in
+              workflow_run|workflow_dispatch) ;;
+              *)
+                echo "::error::Run ${RUN_ID} has unsupported event ${event}."
+                exit 1
+                ;;
+            esac
+            if [ "${path}" != ".github/workflows/release.yml" ] || \
+               [ "${branch}" != "main" ] || \
                [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
-              echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+              echo "::error::Run ${RUN_ID} is not a successful Release run on ${GITHUB_REPOSITORY} main."
               exit 1
             fi
           else

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/.github/workflows/release.yml

@@ -420,7 +420,7 @@ jobs:
 
       - name: Publish to PyPI (Trusted Publishing)
         if: steps.pypi_state.outputs.already_published != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
 
       - name: Create or verify release tag after successful PyPI state
         # The tag is created only after PyPI accepted the upload. An existing tag

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/.github/workflows/scorecard.yml

@@ -32,6 +32,6 @@ jobs:
           name: scorecard-sarif
           path: results.sarif
           retention-days: 5
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif

scientific_computing_system-2.2.18/.github/workflows/sign-release.yml

@@ -0,0 +1,170 @@
+name: Sign release
+
+# Attach a signed source archive plus a cosign keyless signature bundle to the
+# GitHub Release that the publish workflows already created. OpenSSF Scorecard's
+# Signed-Releases check looks for a release asset whose name ends in
+# `.sigstore`, and this workflow is the only producer of one.
+#
+# Security: the workflow_run payload is untrusted input. The run is re-read from
+# the Actions API, validated against this repository, the allowed event types
+# and the exact release workflow paths, and only then is its head_sha checked
+# out. The checkout never consumes a raw event expression.
+on:
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to sign (e.g. v1.2.3)"
+        required: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sign-release-${{ github.event.workflow_run.head_sha || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  sign:
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository)
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Resolve the trusted release commit
+        id: resolve
+        shell: bash
+        env:
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "sha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .conclusion, .repository.full_name, .path] | @tsv')"
+          IFS=$'\t' read -r sha event conclusion repo path <<<"${data}"
+          # The Release workflow here is itself a workflow_run consumer that
+          # waits for CI, so the run this workflow follows has event
+          # `workflow_run`. All of these are accepted; the path, repository and
+          # conclusion checks below still have to pass.
+          case "${event}" in
+            push|release|workflow_run|workflow_dispatch) ;;
+            *) echo "::error::Run ${RUN_ID} has unsupported event ${event}."; exit 1 ;;
+          esac
+          case "${path}" in
+            .github/workflows/release.yml) ;;
+            *) echo "::error::Run ${RUN_ID} is not a release workflow (${path})."; exit 1 ;;
+          esac
+          if [[ "${conclusion}" != "success" || "${repo}" != "${GITHUB_REPOSITORY}" ]]; then
+            echo "::error::Run ${RUN_ID} is not a successful release run on ${GITHUB_REPOSITORY}."
+            exit 1
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
+      - name: Check out the released commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          ref: ${{ steps.resolve.outputs.sha }}
+
+      - name: Resolve the release tag
+        id: tag
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+          HEAD_SHA: ${{ steps.resolve.outputs.sha }}
+        run: |
+          set -euo pipefail
+          if [[ "$EVENT_NAME" == "workflow_dispatch" && -n "$INPUT_TAG" ]]; then
+            TAG="$INPUT_TAG"
+          else
+            git fetch --tags --force origin
+            refs="$(git for-each-ref --format='%(refname:short) %(objectname) %(*objectname)' refs/tags)"
+            TAG="$(printf '%s\n' "$refs" | awk -v sha="$HEAD_SHA" '$2==sha || $3==sha {print $1; exit}')"
+          fi
+          if [[ -z "$TAG" ]]; then
+            echo "::notice::No tag points at ${HEAD_SHA}; nothing to sign."
+            exit 0
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "Resolved tag: $TAG"
+
+      - name: Check the GitHub Release exists
+        id: release
+        if: steps.tag.outputs.tag != ''
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::GitHub Release $TAG does not exist; nothing to sign."
+          fi
+
+      - name: Check the release is not signed yet
+        id: signature
+        if: steps.release.outputs.exists == 'true'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          names="$(gh release view "$TAG" --json assets --jq '.assets[].name')"
+          if grep -q '\.sigstore$' <<<"$names"; then
+            echo "signed=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::Release $TAG already has a .sigstore asset; skipping."
+          else
+            echo "signed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build the source archive
+        id: archive
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          git fetch --tags --force origin
+          repo="${GITHUB_REPOSITORY##*/}"
+          asset="${repo}-${TAG}.tar.gz"
+          git archive --format=tar.gz --prefix="${repo}-${TAG}/" -o "$asset" "$TAG"
+          echo "asset=$asset" >> "$GITHUB_OUTPUT"
+          echo "Built $asset from $TAG"
+
+      - name: Install cosign
+        if: steps.signature.outputs.signed == 'false'
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign the archive with a keyless identity
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          ASSET: ${{ steps.archive.outputs.asset }}
+        run: |
+          set -euo pipefail
+          cosign sign-blob --yes --bundle "${ASSET}.sigstore" "$ASSET"
+
+      - name: Upload the archive and the signature bundle
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+          ASSET: ${{ steps.archive.outputs.asset }}
+        run: |
+          set -euo pipefail
+          gh release upload "$TAG" "$ASSET" "${ASSET}.sigstore" --clobber

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/CHANGELOG.md

@@ -19,6 +19,25 @@ a git tag in this repository or on `origin` (checked with `git ls-remote --tags`
 Any retroactive `v2.2.6` or `v2.2.7` tag should point at those commits. This note records
 what the history supports; it does not claim that a tag exists.
 
+## [v2.2.18] - 2026-10-25
+
+### Deterministic ML initialisation
+
+- Give `cds.ml.Layer` an optional `seed`, so weight initialisation draws from a private RNG stream that no other caller can perturb. The default (`seed=None`) keeps the historical behaviour, so `random.seed(...)` still makes a whole model reproducible.
+- Add regression coverage for same-seed reproducibility under different global RNG states, independence of the global stream, and end-to-end MLP training reproducibility.
+- Bump synchronized package metadata to 2.2.18 as required by the version-discipline gate for the `src/cds/` change.
+
+## [v2.2.17] - 2026-10-24
+
+### Dependency hygiene
+
+- Update the locked `ruff` development pin from 0.15.17 to 0.17.1 (Dependabot routine update), in both `pyproject.toml` and `requirements-dev.lock`.
+- Refresh `requirements-dev.lock` to `filelock==4.2.4` on Python 3.11+, clearing CVE-2026-112940 reported by the `pip-audit` lock gate. No fixed release supports Python 3.10, so the dev-only 3.10 pin stays at 3.29.4 (marker split).
+- Refresh `requirements-dev.lock` to `virtualenv==21.14.13`, clearing CVE-2026-113713 and CVE-2026-115586 reported by the `pip-audit` lock gate.
+- Bump synchronized package metadata to 2.2.17 as required by the version-discipline gate for the `[project]` dev-extra change.
+
+> 2.2.16 was staged on `main` but never published: its CI run failed on advisories disclosed after the bump, so these changes ship in 2.2.17.
+
 ## [v2.2.15] - 2026-10-23
 
 ### Dependency security floors

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/CITATION.cff

@@ -5,7 +5,7 @@ title: "scientific-computing-system"
 # Keep `version` in lockstep with pyproject.toml [project].version and
 # src/cds/_version.py. scripts/check_version_discipline.py and
 # scripts/check_version_lockstep.py enforce this.
-version: 2.2.15
+version: 2.2.18
 authors:
   - name: "Furox-Art"
     email: "furkanarkn1451@gmail.com"
@@ -50,5 +50,5 @@ preferred-citation:
   authors:
     - name: "Furox-Art"
   year: 2026
-  version: 2.2.15
+  version: 2.2.18
   url: "https://github.com/Furox-Art/scientific-computing-system"

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scientific-computing-system
-Version: 2.2.15
+Version: 2.2.18
 Summary: A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies.
 Project-URL: Homepage, https://github.com/Furox-Art/scientific-computing-system
 Project-URL: Repository, https://github.com/Furox-Art/scientific-computing-system
@@ -45,7 +45,7 @@ Requires-Dist: pandas>=2.0; extra == 'all'
 Requires-Dist: pre-commit; extra == 'all'
 Requires-Dist: pytest-cov; extra == 'all'
 Requires-Dist: pytest>=9.0.3; extra == 'all'
-Requires-Dist: ruff==0.15.17; extra == 'all'
+Requires-Dist: ruff==0.17.1; extra == 'all'
 Requires-Dist: scikit-learn>=1.4; extra == 'all'
 Requires-Dist: scipy>=1.11; extra == 'all'
 Requires-Dist: statsmodels>=0.14; extra == 'all'
@@ -63,7 +63,7 @@ Requires-Dist: notebook; extra == 'dev'
 Requires-Dist: numpy<2.5,>=2.0; extra == 'dev'
 Requires-Dist: pandas-stubs>=2.0; extra == 'dev'
 Requires-Dist: pre-commit; extra == 'dev'
-Requires-Dist: ruff==0.15.17; extra == 'dev'
+Requires-Dist: ruff==0.17.1; extra == 'dev'
 Provides-Extra: docs
 Requires-Dist: mkdocs-material>=9.7.7; extra == 'docs'
 Requires-Dist: mkdocs>=1.5.0; extra == 'docs'
@@ -145,23 +145,25 @@ The import name is **`cds`** (the distribution is `scientific-computing-system`)
 | **PyPI** (the library) | `pip install scientific-computing-system` | The actual Python package. Zero runtime dependencies. This is what you want. |
 | **npm** (a launcher shim) | `npm i -g scientific-computing-system` | A thin Node wrapper that runs `python -m cds`. It ships no Python and needs the Python distribution installed so that `python -m cds` resolves. |
 
-At the time of writing (2026-10-22), both registries' latest versions are 2.2.13,
+At the time of writing (2026-10-25), both registries' latest versions are 2.2.17,
 but they are not published in lockstep and are **not** equally verifiable:
 
 - **PyPI** — carries a **PEP 740 provenance attestation** (Sigstore-signed,
   binding the file digest to the publishing workflow). Verified on 2.2.3,
-  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13. The 2.2.7 wheel and
-  sdist return 404 from the per-file provenance endpoint, so "every release
-  since attestations were enabled" would be false.
+  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15 and
+  2.2.17. The 2.2.7 wheel and sdist return 404 from the per-file provenance
+  endpoint, so "every release since attestations were enabled" would be false;
+  2.2.16 was never published.
 - **npm** — carries a **Sigstore attestation as of 2.2.3**, minted by npm's
   OIDC trusted publisher (the registry serves both an npm publish attestation
   and a SLSA provenance v1 bundle for that tarball). 1.0.0 through 2.2.2
   predate the publisher registration and have none, so pin 2.2.3 or newer. npm
-  has no 2.2.7, 2.2.8 or 2.2.11 at all: its 2.2.x line is 2.2.0 through 2.2.6
-  plus 2.2.12 and 2.2.13, which is how the latest versions can match while the
-  histories do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
-  not proof of origin, and `dist.signatures`, which is npm's registry transport
-  signature, not build provenance.
+  has no 2.2.7, 2.2.8, 2.2.11 or 2.2.16 at all: its 2.2.x line is 2.2.0
+  through 2.2.6, 2.2.12 through 2.2.15, and 2.2.17, which is how the latest
+  versions can match while the histories do not. npm also exposes
+  `dist.integrity` (sha512), which is a content pin, not proof of origin, and
+  `dist.signatures`, which is npm's registry transport signature, not build
+  provenance.
 
 Prefer PyPI if you need an attestation for a version older than 2.2.3.
 [SECURITY.md](SECURITY.md#distribution-channels-and-provenance) has the
@@ -277,7 +279,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.15
+System version 2.2.18
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/README.md

@@ -49,23 +49,25 @@ The import name is **`cds`** (the distribution is `scientific-computing-system`)
 | **PyPI** (the library) | `pip install scientific-computing-system` | The actual Python package. Zero runtime dependencies. This is what you want. |
 | **npm** (a launcher shim) | `npm i -g scientific-computing-system` | A thin Node wrapper that runs `python -m cds`. It ships no Python and needs the Python distribution installed so that `python -m cds` resolves. |
 
-At the time of writing (2026-10-22), both registries' latest versions are 2.2.13,
+At the time of writing (2026-10-25), both registries' latest versions are 2.2.17,
 but they are not published in lockstep and are **not** equally verifiable:
 
 - **PyPI** — carries a **PEP 740 provenance attestation** (Sigstore-signed,
   binding the file digest to the publishing workflow). Verified on 2.2.3,
-  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13. The 2.2.7 wheel and
-  sdist return 404 from the per-file provenance endpoint, so "every release
-  since attestations were enabled" would be false.
+  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15 and
+  2.2.17. The 2.2.7 wheel and sdist return 404 from the per-file provenance
+  endpoint, so "every release since attestations were enabled" would be false;
+  2.2.16 was never published.
 - **npm** — carries a **Sigstore attestation as of 2.2.3**, minted by npm's
   OIDC trusted publisher (the registry serves both an npm publish attestation
   and a SLSA provenance v1 bundle for that tarball). 1.0.0 through 2.2.2
   predate the publisher registration and have none, so pin 2.2.3 or newer. npm
-  has no 2.2.7, 2.2.8 or 2.2.11 at all: its 2.2.x line is 2.2.0 through 2.2.6
-  plus 2.2.12 and 2.2.13, which is how the latest versions can match while the
-  histories do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
-  not proof of origin, and `dist.signatures`, which is npm's registry transport
-  signature, not build provenance.
+  has no 2.2.7, 2.2.8, 2.2.11 or 2.2.16 at all: its 2.2.x line is 2.2.0
+  through 2.2.6, 2.2.12 through 2.2.15, and 2.2.17, which is how the latest
+  versions can match while the histories do not. npm also exposes
+  `dist.integrity` (sha512), which is a content pin, not proof of origin, and
+  `dist.signatures`, which is npm's registry transport signature, not build
+  provenance.
 
 Prefer PyPI if you need an attestation for a version older than 2.2.3.
 [SECURITY.md](SECURITY.md#distribution-channels-and-provenance) has the
@@ -181,7 +183,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.15
+System version 2.2.18
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.18}/SECURITY.md

@@ -129,7 +129,8 @@ repository's publish workflows mints an attestation on each channel:
   `scientific-computing-system`, workflow `release.yml`, environment `pypi`.
   Exercised since 2.2.1. The per-file provenance endpoint returned 200 for the
   published files of 2.2.1–2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13 on 2026-10-22;
-  2.2.7 returns 404 for both its wheel and sdist.
+  2.2.7 returns 404 for both its wheel and sdist. Re-checked on 2026-10-25:
+  2.2.14, 2.2.15 and 2.2.17 also return 200, and 2.2.16 was never published.
 - **npm** — Trusted Publisher: owner `Furox-Art`, repository
   `scientific-computing-system`, workflow `npm-publish.yml`, environment `npm`.
   Registered before 2.2.3, which is the first npm release published through it