tommyslate 0.4.0__tar.gz

tommyslate-0.4.0/.github/workflows/ci.yml

@@ -0,0 +1,107 @@
+name: Verify library
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+env:
+  PYTHON_VERSION: "3.15"
+  RUST_VERSION: "1.99.0"
+
+jobs:
+  verify:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Install fixed toolchains
+        run: |
+          rustup toolchain install "$RUST_VERSION" --profile minimal --component clippy
+          python -m pip install --disable-pip-version-check uv==0.13.1
+      - name: Install locked dependencies and native extension
+        run: |
+          uv sync --frozen
+          uv run maturin develop --release
+      - name: Verify Python API and types
+        run: |
+          uv run pytest
+          uv run mypy python/safe_slate --check-untyped-defs
+          uv run python -m mypy.stubtest safe_slate._core
+          uv run python -m compileall -q python/safe_slate scripts tests
+      - name: Verify Rust backend
+        run: |
+          cargo +"$RUST_VERSION" test --locked --all-targets
+          cargo +"$RUST_VERSION" clippy --locked --all-targets -- -D warnings
+          uv run python -c "import safe_slate._core as core; assert not hasattr(core, '_run_coverage_suite')"
+      - name: Verify sidecar container definition
+        run: docker build --check -f Dockerfile.sidecar .
+      - name: Verify local distributions
+        run: |
+          uv run maturin build --release --locked --compatibility pypi -i python3.15 --out dist
+          uv run maturin sdist --out dist
+          uvx --from twine==6.2.0 twine check dist/*
+          uv venv "$RUNNER_TEMP/wheel-check" --python python3.15
+          uv pip install --python "$RUNNER_TEMP/wheel-check/bin/python" --no-deps dist/*.whl
+          "$RUNNER_TEMP/wheel-check/bin/python" -c "import safe_slate._core as core; assert not hasattr(core, '_run_coverage_suite')"
+
+  coverage:
+    runs-on: ubuntu-24.04
+    env:
+      COVERAGE_FILE: coverage/.coverage
+      RUSTUP_TOOLCHAIN: "1.99.0"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Install fixed coverage toolchains
+        run: |
+          rustup toolchain install "$RUST_VERSION" --profile minimal --component clippy
+          rustup component add llvm-tools-preview --toolchain "$RUST_VERSION"
+          python -m pip install --disable-pip-version-check uv==0.13.1
+          cargo +"$RUST_VERSION" install cargo-llvm-cov --version 0.9.1 --locked
+          uv sync --frozen --no-install-project
+      - name: Collect Python and Rust coverage
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p coverage
+          cargo llvm-cov clean --workspace
+          eval "$(cargo llvm-cov show-env --sh)"
+          uv run maturin develop
+          uv run coverage run -m pytest
+          uv run python -c "import safe_slate._core as core; core._run_coverage_suite()"
+          uv run coverage report --show-missing | tee coverage/python.txt
+          uv run coverage json -o coverage/python.json
+          uv run coverage xml -o coverage/python.xml
+          uv run coverage html -d coverage/python-html
+          cargo llvm-cov report --show-missing-lines 2>&1 | tee coverage/rust.txt
+          if grep -q "mismatched data" coverage/rust.txt; then
+            echo "Rust coverage profiles are incompatible" >&2
+            exit 1
+          fi
+          cargo llvm-cov report --json --summary-only --output-path coverage/rust.json
+          cargo llvm-cov report --html --output-dir coverage/rust-html
+      - name: Enforce coverage contract
+        run: >-
+          uv run python scripts/check_coverage.py
+          --python-json coverage/python.json
+          --rust-json coverage/rust.json
+      - name: Upload coverage reports
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: coverage-reports
+          path: coverage
+          if-no-files-found: warn
+          retention-days: 14

tommyslate-0.4.0/.github/workflows/safe-slate-release.yml

@@ -0,0 +1,597 @@
+name: Qualify and publish TommySlate
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_sha:
+        description: Exact 40-character source commit SHA to build
+        required: true
+        type: string
+      publish_testpypi:
+        description: Publish the verified artifacts to TestPyPI
+        required: true
+        default: false
+        type: boolean
+      publish_pypi:
+        description: Publish the same TestPyPI-verified artifacts to production PyPI
+        required: true
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+env:
+  PYTHON_VERSION: "3.15"
+  RUST_VERSION: "1.99.0"
+  MATURIN_VERSION: "v1.16.0"
+  PACKAGE_NAME: "tommyslate"
+  PACKAGE_VERSION: "0.4.0"
+
+jobs:
+  validate-source:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Validate source SHA format
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+          PUBLISH_TESTPYPI: ${{ inputs.publish_testpypi }}
+          PUBLISH_PYPI: ${{ inputs.publish_pypi }}
+        run: |
+          if [[ ! "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "source_sha must be a lowercase 40-character commit SHA" >&2
+            exit 1
+          fi
+          if [[ "$PUBLISH_PYPI" == "true" && "$PUBLISH_TESTPYPI" != "true" ]]; then
+            echo "production PyPI publication requires the same run to publish and verify TestPyPI first" >&2
+            exit 1
+          fi
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.source_sha }}
+          fetch-depth: 1
+          persist-credentials: false
+      - name: Confirm source and package contract
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+        run: |
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+          python3 - <<'PY'
+          import tomllib
+          import os
+          from pathlib import Path
+
+          pyproject = tomllib.loads(Path("pyproject.toml").read_text())
+          cargo = tomllib.loads(Path("Cargo.toml").read_text())
+          expected = os.environ["PACKAGE_VERSION"]
+          assert pyproject["project"]["version"] == expected
+          assert cargo["package"]["version"] == expected
+          assert pyproject["project"]["name"] == os.environ["PACKAGE_NAME"]
+          assert cargo["package"]["name"] == os.environ["PACKAGE_NAME"]
+          assert pyproject["tool"]["maturin"]["module-name"] == "safe_slate._core"
+          assert pyproject["project"]["license"] == "Apache-2.0"
+          assert cargo["package"]["license"] == "Apache-2.0"
+          PY
+
+  build-wheels:
+    name: Build and smoke ${{ matrix.platform.name }}
+    needs: validate-source
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: linux-x86_64
+            os: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+            manylinux: "2_28"
+            deployment-target: ""
+          - name: linux-aarch64
+            os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            manylinux: "2_28"
+            deployment-target: ""
+          - name: macos-x86_64
+            os: macos-15-intel
+            target: x86_64-apple-darwin
+            manylinux: ""
+            deployment-target: "11.0"
+          - name: macos-arm64
+            os: macos-15
+            target: aarch64-apple-darwin
+            manylinux: ""
+            deployment-target: "11.0"
+          - name: windows-x86_64
+            os: windows-2025
+            target: x86_64-pc-windows-msvc
+            manylinux: ""
+            deployment-target: ""
+    runs-on: ${{ matrix.platform.os }}
+    env:
+      MACOSX_DEPLOYMENT_TARGET: ${{ matrix.platform.deployment-target }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.source_sha }}
+          fetch-depth: 1
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Build wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: build
+          maturin-version: ${{ env.MATURIN_VERSION }}
+          rust-toolchain: ${{ env.RUST_VERSION }}
+          target: ${{ matrix.platform.target }}
+          manylinux: ${{ matrix.platform.manylinux }}
+          args: >-
+            --release --locked --compatibility pypi
+            -i python3.15 --out dist
+      - name: Install and smoke-test local wheel
+        shell: bash
+        run: |
+          python - <<'PY'
+          import os
+          from pathlib import Path
+          import subprocess
+          import tempfile
+          import venv
+
+          wheels = list(Path("dist").resolve().glob("*.whl"))
+          assert len(wheels) == 1, wheels
+          environment = Path(tempfile.mkdtemp(prefix="tommyslate-wheel-"))
+          venv.EnvBuilder(with_pip=True).create(environment)
+          python = environment / ("Scripts/python.exe" if os.name == "nt" else "bin/python")
+          subprocess.run(
+              [python, "-m", "pip", "install", "--no-index", str(wheels[0])],
+              check=True,
+          )
+          subprocess.run([python, "-m", "pip", "check"], check=True)
+          smoke = """
+          from safe_slate import optimize_slate
+          kwargs = dict(
+              rewards=[2.0, 1.0],
+              safety_means=[1.0, 1.0],
+              safety_variances=[0.0, 0.0],
+              max_items=1,
+          )
+          first = optimize_slate(**kwargs)
+          second = optimize_slate(**kwargs)
+          assert first.selected_indices == second.selected_indices == [0]
+          assert first.rechecked and second.rechecked
+          """
+          subprocess.run([python, "-c", smoke], cwd=environment, check=True)
+          PY
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: wheel-${{ matrix.platform.name }}
+          path: dist/*.whl
+          if-no-files-found: error
+          retention-days: 14
+
+  build-sdist:
+    runs-on: ubuntu-24.04
+    needs: validate-source
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.source_sha }}
+          fetch-depth: 1
+          persist-credentials: false
+      - name: Build sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: sdist
+          maturin-version: ${{ env.MATURIN_VERSION }}
+          rust-toolchain: ${{ env.RUST_VERSION }}
+          args: --out dist
+      - name: Confirm locked Rust graph
+        run: cargo +${{ env.RUST_VERSION }} metadata --locked --format-version 1 > /dev/null
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+          if-no-files-found: error
+          retention-days: 14
+
+  aggregate:
+    name: Verify complete release set
+    needs: [build-wheels, build-sdist]
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.source_sha }}
+          fetch-depth: 1
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: wheel-*
+          path: incoming
+          merge-multiple: true
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: sdist
+          path: incoming
+      - name: Check metadata and generate immutable inventory
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+        run: |
+          python -m pip install --disable-pip-version-check twine==6.2.0
+          python -m twine check incoming/*
+          mkdir -p release/packages
+          cp incoming/*.whl incoming/*.tar.gz release/packages/
+          python scripts/verify_release_artifacts.py \
+            incoming \
+            --source-sha "$SOURCE_SHA" \
+            --version "$PACKAGE_VERSION" \
+            --output-dir release
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: qualified-release-${{ inputs.source_sha }}
+          path: release
+          if-no-files-found: error
+          retention-days: 14
+
+  testpypi-preflight:
+    name: Check TestPyPI retry safety
+    if: inputs.publish_testpypi == true
+    needs: aggregate
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: qualified-release-${{ inputs.source_sha }}
+          path: release
+      - name: Reject conflicting existing files
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+          from urllib.error import HTTPError
+          from urllib.request import urlopen
+
+          manifest = json.loads(Path("release/release-manifest.json").read_text())
+          expected = {item["filename"]: item["sha256"] for item in manifest["files"]}
+          version = os.environ["PACKAGE_VERSION"]
+          project = os.environ["PACKAGE_NAME"]
+          url = f"https://test.pypi.org/pypi/{project}/{version}/json"
+          try:
+              with urlopen(url, timeout=30) as response:
+                  payload = json.load(response)
+          except HTTPError as error:
+              if error.code != 404:
+                  raise
+              payload = {"urls": []}
+          for item in payload["urls"]:
+              filename = item["filename"]
+              remote_hash = item["digests"]["sha256"]
+              if filename not in expected or expected[filename] != remote_hash:
+                  raise SystemExit(f"conflicting TestPyPI file: {filename}")
+          print(f"preflight accepted {len(payload['urls'])} existing file(s)")
+          PY
+
+  publish-testpypi:
+    name: Publish to TestPyPI with OIDC
+    if: inputs.publish_testpypi == true
+    needs: testpypi-preflight
+    runs-on: ubuntu-24.04
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/tommyslate/
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: qualified-release-${{ inputs.source_sha }}
+          path: release
+      - name: Publish immutable packages
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: release/packages
+          skip-existing: true
+          verify-metadata: true
+          print-hash: true
+          attestations: true
+
+  verify-testpypi:
+    name: Match TestPyPI hashes
+    if: inputs.publish_testpypi == true
+    needs: publish-testpypi
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: qualified-release-${{ inputs.source_sha }}
+          path: release
+      - name: Compare remote files with manifest
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+          import time
+          from urllib.error import HTTPError
+          from urllib.request import urlopen
+
+          manifest = json.loads(Path("release/release-manifest.json").read_text())
+          expected = {item["filename"]: item["sha256"] for item in manifest["files"]}
+          version = os.environ["PACKAGE_VERSION"]
+          project = os.environ["PACKAGE_NAME"]
+          url = f"https://test.pypi.org/pypi/{project}/{version}/json"
+          remote = None
+          for attempt in range(12):
+              try:
+                  with urlopen(url, timeout=30) as response:
+                      payload = json.load(response)
+                  remote = {
+                      item["filename"]: item["digests"]["sha256"]
+                      for item in payload["urls"]
+                  }
+              except HTTPError as error:
+                  if error.code != 404:
+                      raise
+              if remote == expected:
+                  break
+              if attempt < 11:
+                  time.sleep(10)
+          if remote != expected:
+              raise SystemExit(
+                  f"TestPyPI files differ from manifest: expected={expected}, remote={remote}"
+              )
+          print("TestPyPI filenames and SHA-256 values match the release manifest")
+          PY
+
+  smoke-test-testpypi:
+    name: Install from TestPyPI on ${{ matrix.platform.name }}
+    if: inputs.publish_testpypi == true
+    needs: verify-testpypi
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: linux-x86_64
+            os: ubuntu-24.04
+          - name: linux-aarch64
+            os: ubuntu-24.04-arm
+          - name: macos-x86_64
+            os: macos-15-intel
+          - name: macos-arm64
+            os: macos-15
+          - name: windows-x86_64
+            os: windows-2025
+    runs-on: ${{ matrix.platform.os }}
+    steps:
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Install exact TestPyPI version and smoke-test
+        shell: bash
+        run: |
+          python - <<'PY'
+          import os
+          from pathlib import Path
+          import subprocess
+          import tempfile
+          import venv
+
+          environment = Path(tempfile.mkdtemp(prefix="tommyslate-testpypi-"))
+          venv.EnvBuilder(with_pip=True).create(environment)
+          python = environment / ("Scripts/python.exe" if os.name == "nt" else "bin/python")
+          subprocess.run(
+              [
+                  python,
+                  "-m",
+                  "pip",
+                  "install",
+                  "--index-url",
+                  "https://test.pypi.org/simple/",
+                  "--no-deps",
+                  f"{os.environ['PACKAGE_NAME']}=={os.environ['PACKAGE_VERSION']}",
+              ],
+              check=True,
+          )
+          subprocess.run([python, "-m", "pip", "check"], check=True)
+          smoke = """
+          from safe_slate import optimize_slate
+          kwargs = dict(
+              rewards=[2.0, 1.0],
+              safety_means=[1.0, 1.0],
+              safety_variances=[0.0, 0.0],
+              max_items=1,
+          )
+          first = optimize_slate(**kwargs)
+          second = optimize_slate(**kwargs)
+          assert first.selected_indices == second.selected_indices == [0]
+          assert first.rechecked and second.rechecked
+          """
+          subprocess.run([python, "-c", smoke], cwd=environment, check=True)
+          PY
+
+  pypi-preflight:
+    name: Check production PyPI retry safety
+    if: inputs.publish_pypi == true
+    needs: smoke-test-testpypi
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: qualified-release-${{ inputs.source_sha }}
+          path: release
+      - name: Reject conflicting existing production files
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+          from urllib.error import HTTPError
+          from urllib.request import urlopen
+
+          manifest = json.loads(Path("release/release-manifest.json").read_text())
+          expected = {item["filename"]: item["sha256"] for item in manifest["files"]}
+          version = os.environ["PACKAGE_VERSION"]
+          project = os.environ["PACKAGE_NAME"]
+          url = f"https://pypi.org/pypi/{project}/{version}/json"
+          try:
+              with urlopen(url, timeout=30) as response:
+                  payload = json.load(response)
+          except HTTPError as error:
+              if error.code != 404:
+                  raise
+              payload = {"urls": []}
+          for item in payload["urls"]:
+              filename = item["filename"]
+              remote_hash = item["digests"]["sha256"]
+              if filename not in expected or expected[filename] != remote_hash:
+                  raise SystemExit(f"conflicting production PyPI file: {filename}")
+          print(f"production preflight accepted {len(payload['urls'])} existing file(s)")
+          PY
+
+  publish-pypi:
+    name: Publish to production PyPI with OIDC
+    if: inputs.publish_pypi == true
+    needs: pypi-preflight
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/tommyslate/
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: qualified-release-${{ inputs.source_sha }}
+          path: release
+      - name: Publish immutable production packages
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          packages-dir: release/packages
+          skip-existing: true
+          verify-metadata: true
+          print-hash: true
+          attestations: true
+
+  verify-pypi:
+    name: Match production PyPI hashes
+    if: inputs.publish_pypi == true
+    needs: publish-pypi
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: qualified-release-${{ inputs.source_sha }}
+          path: release
+      - name: Compare production files with manifest
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+          import time
+          from urllib.error import HTTPError
+          from urllib.request import urlopen
+
+          manifest = json.loads(Path("release/release-manifest.json").read_text())
+          expected = {item["filename"]: item["sha256"] for item in manifest["files"]}
+          version = os.environ["PACKAGE_VERSION"]
+          project = os.environ["PACKAGE_NAME"]
+          url = f"https://pypi.org/pypi/{project}/{version}/json"
+          remote = None
+          for attempt in range(12):
+              try:
+                  with urlopen(url, timeout=30) as response:
+                      payload = json.load(response)
+                  remote = {
+                      item["filename"]: item["digests"]["sha256"]
+                      for item in payload["urls"]
+                  }
+              except HTTPError as error:
+                  if error.code != 404:
+                      raise
+              if remote == expected:
+                  break
+              if attempt < 11:
+                  time.sleep(10)
+          if remote != expected:
+              raise SystemExit(
+                  f"production PyPI files differ from manifest: expected={expected}, remote={remote}"
+              )
+          print("production PyPI filenames and SHA-256 values match the release manifest")
+          PY
+
+  smoke-test-pypi:
+    name: Install from production PyPI on ${{ matrix.platform.name }}
+    if: inputs.publish_pypi == true
+    needs: verify-pypi
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: linux-x86_64
+            os: ubuntu-24.04
+          - name: linux-aarch64
+            os: ubuntu-24.04-arm
+          - name: macos-x86_64
+            os: macos-15-intel
+          - name: macos-arm64
+            os: macos-15
+          - name: windows-x86_64
+            os: windows-2025
+    runs-on: ${{ matrix.platform.os }}
+    steps:
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Install exact production version and smoke-test
+        shell: bash
+        run: |
+          python - <<'PY'
+          import os
+          from pathlib import Path
+          import subprocess
+          import tempfile
+          import venv
+
+          environment = Path(tempfile.mkdtemp(prefix="tommyslate-pypi-"))
+          venv.EnvBuilder(with_pip=True).create(environment)
+          python = environment / ("Scripts/python.exe" if os.name == "nt" else "bin/python")
+          subprocess.run(
+              [
+                  python,
+                  "-m",
+                  "pip",
+                  "install",
+                  "--index-url",
+                  "https://pypi.org/simple/",
+                  "--retries",
+                  "10",
+                  "--no-deps",
+                  f"{os.environ['PACKAGE_NAME']}=={os.environ['PACKAGE_VERSION']}",
+              ],
+              check=True,
+          )
+          subprocess.run([python, "-m", "pip", "check"], check=True)
+          smoke = """
+          from safe_slate import optimize_slate
+          kwargs = dict(
+              rewards=[2.0, 1.0],
+              safety_means=[1.0, 1.0],
+              safety_variances=[0.0, 0.0],
+              max_items=1,
+          )
+          first = optimize_slate(**kwargs)
+          second = optimize_slate(**kwargs)
+          assert first.selected_indices == second.selected_indices == [0]
+          assert first.rechecked and second.rechecked
+          """
+          subprocess.run([python, "-c", smoke], cwd=environment, check=True)
+          PY