scientific-computing-system 2.2.17__tar.gz → 2.2.18__tar.gz

scientific_computing_system-2.2.18/.github/workflows/determinism-matrix.yml

@@ -0,0 +1,151 @@
+name: Determinism matrix
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: determinism-matrix-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  matrix:
+    name: ${{ matrix.os }} determinism matrix
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+          cache: 'pip'
+          cache-dependency-path: |
+            pyproject.toml
+            requirements.lock
+            requirements-dev.lock
+      - name: Install package
+        run: |
+          python -m pip install --upgrade pip
+          pip install ".[test]"
+      - name: Run determinism matrix
+        run: >
+          python scripts/determinism_matrix.py run
+          --workload scripts/determinism_workload.py
+          --out determinism-manifest-${{ matrix.os }}.json
+          --seeds 0 12345 random
+          --threads 1 4
+          --locales inherit C
+          --timezones UTC Europe/Istanbul
+          --gate within-host
+      - name: Upload manifest
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: determinism-manifest-${{ matrix.os }}
+          path: determinism-manifest-${{ matrix.os }}.json
+          if-no-files-found: error
+          retention-days: 14
+
+  compare:
+    name: Cross-OS digest comparison
+    needs: matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      - name: Download manifests
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: determinism-manifest-*
+          merge-multiple: true
+          path: manifests
+      - name: Compare manifests
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          files=(manifests/*.json)
+          failures=0
+          printf 'manifest files: %s\n' "${#files[@]}"
+          if [ "${#files[@]}" -lt 2 ]; then
+            echo "::error::expected a manifest from every operating system, found ${#files[@]}"
+            exit 1
+          fi
+          for ((i = 0; i < ${#files[@]}; i++)); do
+            for ((j = i + 1; j < ${#files[@]}; j++)); do
+              left=$(basename "${files[$i]}" .json)
+              right=$(basename "${files[$j]}" .json)
+              echo "=== ${left} vs ${right} ==="
+              if ! python scripts/determinism_matrix.py compare \
+                "${files[$i]}" "${files[$j]}" --gate > "compare-${left}-${right}.json"; then
+                failures=$((failures + 1))
+                echo "::error::cross-OS determinism failed or could not be compared: ${left} vs ${right}"
+              fi
+            done
+          done
+          if [ "$failures" -ne 0 ]; then
+            echo "::error::${failures} manifest pair(s) mismatched or could not be compared"
+            exit 1
+          fi
+      - name: Write comparison summary
+        if: always()
+        shell: bash
+        run: |
+          python - <<'PY'
+          import glob
+          import json
+          import os
+
+          rows = [
+              "| baseline | candidate | shared | identical | mismatches | errors |",
+              "| --- | --- | --- | --- | --- | --- |",
+          ]
+          for path in sorted(glob.glob("compare-*.json")):
+              try:
+                  with open(path, encoding="utf-8") as handle:
+                      data = json.load(handle)
+                  if not isinstance(data, dict):
+                      raise ValueError("compare report is not an object")
+              except (OSError, ValueError) as error:
+                  rows.append(f"| {path} | unreadable | - | False | - | {error} |")
+                  continue
+              baseline = (data.get("baseline_host") or {}).get("system", "unknown")
+              candidate = (data.get("candidate_host") or {}).get("system", "unknown")
+              mismatches = data.get("mismatches") or []
+              errors = data.get("errors") or []
+              rows.append(
+                  f"| {baseline} | {candidate} | {data.get('shared_variants', 0)} | "
+                  f"{data.get('identical', False)} | {len(mismatches)} | {len(errors)} |"
+              )
+          if len(rows) == 2:
+              rows.append("| no comparison reports | - | 0 | False | 0 | 1 |")
+          with open(
+              os.environ.get("GITHUB_STEP_SUMMARY", os.devnull),
+              "a",
+              encoding="utf-8",
+          ) as handle:
+              handle.write("## Cross-OS determinism\n\n" + "\n".join(rows) + "\n")
+          print("\n".join(rows))
+          PY

{scientific_computing_system-2.2.17 → scientific_computing_system-2.2.18}/CHANGELOG.md

@@ -19,6 +19,14 @@ a git tag in this repository or on `origin` (checked with `git ls-remote --tags`
 Any retroactive `v2.2.6` or `v2.2.7` tag should point at those commits. This note records
 what the history supports; it does not claim that a tag exists.
 
+## [v2.2.18] - 2026-10-25
+
+### Deterministic ML initialisation
+
+- Give `cds.ml.Layer` an optional `seed`, so weight initialisation draws from a private RNG stream that no other caller can perturb. The default (`seed=None`) keeps the historical behaviour, so `random.seed(...)` still makes a whole model reproducible.
+- Add regression coverage for same-seed reproducibility under different global RNG states, independence of the global stream, and end-to-end MLP training reproducibility.
+- Bump synchronized package metadata to 2.2.18 as required by the version-discipline gate for the `src/cds/` change.
+
 ## [v2.2.17] - 2026-10-24
 
 ### Dependency hygiene

{scientific_computing_system-2.2.17 → scientific_computing_system-2.2.18}/CITATION.cff

@@ -5,7 +5,7 @@ title: "scientific-computing-system"
 # Keep `version` in lockstep with pyproject.toml [project].version and
 # src/cds/_version.py. scripts/check_version_discipline.py and
 # scripts/check_version_lockstep.py enforce this.
-version: 2.2.17
+version: 2.2.18
 authors:
   - name: "Furox-Art"
     email: "furkanarkn1451@gmail.com"
@@ -50,5 +50,5 @@ preferred-citation:
   authors:
     - name: "Furox-Art"
   year: 2026
-  version: 2.2.17
+  version: 2.2.18
   url: "https://github.com/Furox-Art/scientific-computing-system"

{scientific_computing_system-2.2.17 → scientific_computing_system-2.2.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scientific-computing-system
-Version: 2.2.17
+Version: 2.2.18
 Summary: A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies.
 Project-URL: Homepage, https://github.com/Furox-Art/scientific-computing-system
 Project-URL: Repository, https://github.com/Furox-Art/scientific-computing-system
@@ -145,23 +145,25 @@ The import name is **`cds`** (the distribution is `scientific-computing-system`)
 | **PyPI** (the library) | `pip install scientific-computing-system` | The actual Python package. Zero runtime dependencies. This is what you want. |
 | **npm** (a launcher shim) | `npm i -g scientific-computing-system` | A thin Node wrapper that runs `python -m cds`. It ships no Python and needs the Python distribution installed so that `python -m cds` resolves. |
 
-At the time of writing (2026-10-22), both registries' latest versions are 2.2.13,
+At the time of writing (2026-10-25), both registries' latest versions are 2.2.17,
 but they are not published in lockstep and are **not** equally verifiable:
 
 - **PyPI** — carries a **PEP 740 provenance attestation** (Sigstore-signed,
   binding the file digest to the publishing workflow). Verified on 2.2.3,
-  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13. The 2.2.7 wheel and
-  sdist return 404 from the per-file provenance endpoint, so "every release
-  since attestations were enabled" would be false.
+  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15 and
+  2.2.17. The 2.2.7 wheel and sdist return 404 from the per-file provenance
+  endpoint, so "every release since attestations were enabled" would be false;
+  2.2.16 was never published.
 - **npm** — carries a **Sigstore attestation as of 2.2.3**, minted by npm's
   OIDC trusted publisher (the registry serves both an npm publish attestation
   and a SLSA provenance v1 bundle for that tarball). 1.0.0 through 2.2.2
   predate the publisher registration and have none, so pin 2.2.3 or newer. npm
-  has no 2.2.7, 2.2.8 or 2.2.11 at all: its 2.2.x line is 2.2.0 through 2.2.6
-  plus 2.2.12 and 2.2.13, which is how the latest versions can match while the
-  histories do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
-  not proof of origin, and `dist.signatures`, which is npm's registry transport
-  signature, not build provenance.
+  has no 2.2.7, 2.2.8, 2.2.11 or 2.2.16 at all: its 2.2.x line is 2.2.0
+  through 2.2.6, 2.2.12 through 2.2.15, and 2.2.17, which is how the latest
+  versions can match while the histories do not. npm also exposes
+  `dist.integrity` (sha512), which is a content pin, not proof of origin, and
+  `dist.signatures`, which is npm's registry transport signature, not build
+  provenance.
 
 Prefer PyPI if you need an attestation for a version older than 2.2.3.
 [SECURITY.md](SECURITY.md#distribution-channels-and-provenance) has the
@@ -277,7 +279,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.17
+System version 2.2.18
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.17 → scientific_computing_system-2.2.18}/README.md

@@ -49,23 +49,25 @@ The import name is **`cds`** (the distribution is `scientific-computing-system`)
 | **PyPI** (the library) | `pip install scientific-computing-system` | The actual Python package. Zero runtime dependencies. This is what you want. |
 | **npm** (a launcher shim) | `npm i -g scientific-computing-system` | A thin Node wrapper that runs `python -m cds`. It ships no Python and needs the Python distribution installed so that `python -m cds` resolves. |
 
-At the time of writing (2026-10-22), both registries' latest versions are 2.2.13,
+At the time of writing (2026-10-25), both registries' latest versions are 2.2.17,
 but they are not published in lockstep and are **not** equally verifiable:
 
 - **PyPI** — carries a **PEP 740 provenance attestation** (Sigstore-signed,
   binding the file digest to the publishing workflow). Verified on 2.2.3,
-  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13. The 2.2.7 wheel and
-  sdist return 404 from the per-file provenance endpoint, so "every release
-  since attestations were enabled" would be false.
+  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15 and
+  2.2.17. The 2.2.7 wheel and sdist return 404 from the per-file provenance
+  endpoint, so "every release since attestations were enabled" would be false;
+  2.2.16 was never published.
 - **npm** — carries a **Sigstore attestation as of 2.2.3**, minted by npm's
   OIDC trusted publisher (the registry serves both an npm publish attestation
   and a SLSA provenance v1 bundle for that tarball). 1.0.0 through 2.2.2
   predate the publisher registration and have none, so pin 2.2.3 or newer. npm
-  has no 2.2.7, 2.2.8 or 2.2.11 at all: its 2.2.x line is 2.2.0 through 2.2.6
-  plus 2.2.12 and 2.2.13, which is how the latest versions can match while the
-  histories do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
-  not proof of origin, and `dist.signatures`, which is npm's registry transport
-  signature, not build provenance.
+  has no 2.2.7, 2.2.8, 2.2.11 or 2.2.16 at all: its 2.2.x line is 2.2.0
+  through 2.2.6, 2.2.12 through 2.2.15, and 2.2.17, which is how the latest
+  versions can match while the histories do not. npm also exposes
+  `dist.integrity` (sha512), which is a content pin, not proof of origin, and
+  `dist.signatures`, which is npm's registry transport signature, not build
+  provenance.
 
 Prefer PyPI if you need an attestation for a version older than 2.2.3.
 [SECURITY.md](SECURITY.md#distribution-channels-and-provenance) has the
@@ -181,7 +183,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.17
+System version 2.2.18
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.17 → scientific_computing_system-2.2.18}/SECURITY.md

@@ -129,7 +129,8 @@ repository's publish workflows mints an attestation on each channel:
   `scientific-computing-system`, workflow `release.yml`, environment `pypi`.
   Exercised since 2.2.1. The per-file provenance endpoint returned 200 for the
   published files of 2.2.1–2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13 on 2026-10-22;
-  2.2.7 returns 404 for both its wheel and sdist.
+  2.2.7 returns 404 for both its wheel and sdist. Re-checked on 2026-10-25:
+  2.2.14, 2.2.15 and 2.2.17 also return 200, and 2.2.16 was never published.
 - **npm** — Trusted Publisher: owner `Furox-Art`, repository
   `scientific-computing-system`, workflow `npm-publish.yml`, environment `npm`.
   Registered before 2.2.3, which is the first npm release published through it

{scientific_computing_system-2.2.17 → scientific_computing_system-2.2.18}/codemeta.json

@@ -2,7 +2,7 @@
   "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
   "@type": "SoftwareSourceCode",
   "name": "scientific-computing-system",
-  "version": "2.2.17",
+  "version": "2.2.18",
   "description": "Pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, and scientific workflows. Zero runtime dependencies. This is the front door; scientific-computing-system-2.0 is the NumPy build of the same work.",
   "license": "https://spdx.org/licenses/MIT",
   "codeRepository": "https://github.com/Furox-Art/scientific-computing-system",

{scientific_computing_system-2.2.17 → scientific_computing_system-2.2.18}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scientific-computing-system",
-  "version": "2.2.17",
+  "version": "2.2.18",
   "description": "Scientific Computing System launcher - a thin Node wrapper that forwards to the pure-Python `cds` CLI. This npm package ships NO Python code: it requires the Python distribution to be installed (`pip install scientific-computing-system`), otherwise `scs` exits non-zero with an actionable message.",
   "main": "index.js",
   "bin": {

{scientific_computing_system-2.2.17 → scientific_computing_system-2.2.18}/pyproject.toml

@@ -2,7 +2,7 @@
 # Distribution name. Formerly published as "cognitive-discovery-system";
 # the import name stays `cds`. Keep the old PyPI project alive as an alias.
 name = "scientific-computing-system"
-version = "2.2.17"
+version = "2.2.18"
 description = "A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies."
 readme = "README.md"
 license = "MIT"
@@ -187,6 +187,11 @@ only-include = [
   # in the sdist the suite fails to *collect* when run from an unpacked sdist,
   # which is the same class of failure codemeta.json above was added for.
   "scripts/check_release_toolchain.py",
+  # tests/test_determinism_matrix.py executes both files by path, and the
+  # sdist-check CI job runs the whole suite from an unpacked sdist. Shipping
+  # them keeps the determinism matrix reproducible from the source artifact.
+  "scripts/determinism_matrix.py",
+  "scripts/determinism_workload.py",
   # tests/test_release_contract.py asserts the release/CI workflow contracts
   # and tests/test_hardening_privacy_provenance.py hashes the lock files. Both
   # used to fail with FileNotFoundError when the suite ran from an unpacked sdist