verirepro 0.8.1__tar.gz

verirepro-0.8.1/.gitattributes

@@ -0,0 +1,14 @@
+# Normalize line endings so release-source fingerprints and evidence
+# SHA-256 digests are stable across platforms. Release-relevant files
+# (Python sources, TOML metadata, release/measurement scripts, and all
+# benchmark evidence JSON) must stay LF in every working tree; Windows
+# checkouts otherwise rewrite them to CRLF and change read_bytes() digests.
+*.py text eol=lf
+*.toml text eol=lf
+*.json text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.cff text eol=lf
+*.md text eol=lf
+*.sh text eol=lf
+*.csv text eol=lf

verirepro-0.8.1/.github/CODEOWNERS

@@ -0,0 +1,17 @@
+# Default maintainer ownership
+* @XiantingWu
+
+# Security, trust, execution, and release boundaries
+/SECURITY.md @XiantingWu
+/docs/TRUST_MODEL.md @XiantingWu
+/docs/RELEASE_SIGNING.md @XiantingWu
+/docs/PUBLISHING.md @XiantingWu
+/.github/release-signers @XiantingWu
+/.github/dependabot.yml @XiantingWu
+/.github/workflows/ @XiantingWu
+/scripts/release_check.py @XiantingWu
+/scripts/release_checks/ @XiantingWu
+/scripts/release_source_check.py @XiantingWu
+/scripts/launch_surface_check.py @XiantingWu
+/src/reproagent/ @XiantingWu
+/src/verirepro/ @XiantingWu

verirepro-0.8.1/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,49 @@
+name: Bug report
+description: Report a reproducible VeriRepro defect
+title: "[bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please remove credentials, unpublished paper content, and sensitive dataset URLs before posting.
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: Describe the observed behavior and what you expected instead.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: VeriRepro version
+      placeholder: "verirepro --version"
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command
+      description: Redact secrets and private URLs.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Diagnostics
+      description: Paste `verirepro doctor --json` output after checking it for sensitive values.
+      render: json
+  - type: textarea
+    id: report
+    attributes:
+      label: Relevant report excerpt
+      description: Include stage names/statuses or a minimal sanitized report excerpt.
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety check
+      options:
+        - label: I removed API keys, access tokens, private repository URLs, and sensitive unpublished data.
+          required: true

verirepro-0.8.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/XiantingWu/VeriRepro/security/advisories/new
+    about: Do not disclose credentials, sandbox escapes, SSRF, or other security-sensitive findings in a public issue.

verirepro-0.8.1/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,31 @@
+name: Feature request
+description: Propose a bounded, testable VeriRepro capability
+title: "[feature] "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Reproduction problem
+      description: What concrete reproducibility workflow is blocked today?
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Desired evidence contract
+      description: What inputs, deterministic checks, and outputs should make this feature auditable?
+    validations:
+      required: true
+  - type: textarea
+    id: example
+    attributes:
+      label: Minimal example
+      description: Provide a public paper/repository example if possible.
+  - type: checkboxes
+    id: trust
+    attributes:
+      label: Trust-boundary impact
+      options:
+        - label: I considered whether this expands LLM execution authority, host networking, filesystem access, or secret exposure.
+          required: true

verirepro-0.8.1/.github/ISSUE_TEMPLATE/reproduction_help.yml

@@ -0,0 +1,81 @@
+name: Reproduction help
+description: Ask for help diagnosing a paper/repository reproduction without assuming it is a VeriRepro bug
+title: "[reproduction] "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form when a paper or repository does not plan/reproduce as expected and you are not yet sure whether the problem is a VeriRepro defect. Remove credentials, private URLs, unpublished content, and sensitive dataset/model information before posting.
+  - type: input
+    id: paper
+    attributes:
+      label: Paper reference
+      description: Public arXiv ID/URL, DOI, or public PDF URL. Do not post unpublished/private paper content.
+      placeholder: "2103.00020v1"
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: VeriRepro version
+      placeholder: "verirepro --version"
+    validations:
+      required: true
+  - type: dropdown
+    id: stage
+    attributes:
+      label: Where does the problem occur?
+      options:
+        - Paper/source resolution
+        - Repository discovery
+        - Repository inspection
+        - Environment planning/build
+        - Dataset or model artifact materialization
+        - Experiment execution
+        - Metric/artifact verification
+        - Report/evidence output
+        - ReproBench
+        - Unsure
+    validations:
+      required: true
+  - type: textarea
+    id: goal
+    attributes:
+      label: What are you trying to reproduce?
+      description: Describe the expected scientific/output target and what evidence you have for it.
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command
+      description: Paste the exact command after removing secrets and private URLs.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Diagnostics
+      description: Paste sanitized `verirepro doctor --json` output when relevant.
+      render: json
+  - type: textarea
+    id: report
+    attributes:
+      label: Relevant report or error excerpt
+      description: Include stage names/statuses or a small sanitized excerpt. Do not paste huge logs.
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Python version, Docker availability/version, and GPU only if relevant.
+      placeholder: "macOS 15, Python 3.11, Docker Desktop ..."
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety and scope
+      options:
+        - label: I removed API keys, access tokens, private repository/endpoint URLs, and sensitive unpublished data.
+          required: true
+        - label: I understand that an unavailable/underspecified upstream research artifact may remain non-reproducible rather than being filled in with guesses.
+          required: true

verirepro-0.8.1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+## Summary
+
+<!-- What changes and why? -->
+
+## Evidence / verification
+
+<!-- Tests, fixture, paper/repository case, or report artifact that verifies the change. -->
+
+## Trust-boundary checklist
+
+- [ ] This does not silently broaden model-generated shell authority.
+- [ ] Host filesystem/network access is unchanged or explicitly documented and tested.
+- [ ] Secrets are not passed into third-party experiment containers.
+- [ ] New external downloads have size/integrity/redirect controls where applicable.
+- [ ] PASS/FAIL evidence remains deterministic and auditable.
+
+## Public quality checks
+
+- [ ] `ruff check src tests scripts`
+- [ ] `mypy`
+- [ ] `pytest -q`
+- [ ] `python scripts/release_check.py`
+- [ ] `python scripts/launch_surface_check.py`
+- [ ] `verirepro doctor --json`
+
+## Release-facing changes
+
+<!-- Leave these unchecked when the change does not alter release-relevant source/policy. -->
+
+- [ ] If this changes runtime/package/measurement/release-policy/workflow bytes, I understand prior trusted release evidence becomes stale until maintainers regenerate exact-head evidence.
+- [ ] If this changes a public API/schema, compatibility and migration impact are documented and tested.

verirepro-0.8.1/.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    # Routine version updates are limited to minor and patch releases.
+    # Dependabot security updates remain eligible and are not suppressed by
+    # this version-update restriction.
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    # Workflow bytes are release-fingerprinted. Routine version updates are
+    # limited to minor and patch releases; Dependabot security updates remain
+    # eligible and are not suppressed by this version-update restriction.
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"

verirepro-0.8.1/.github/release-signers

@@ -0,0 +1 @@
+XiantingWu ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJfd2L8YpF6JsPmYTIrogGw4RYjQttQg3ipeQMpALe8

verirepro-0.8.1/.github/workflows/ci.yml

@@ -0,0 +1,144 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality-py311:
+    name: Quality (Python 3.11)
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.11'
+          cache: pip
+      - name: Install
+        run: |
+          set -euo pipefail
+          export PIP_CONSTRAINT="$GITHUB_WORKSPACE/constraints/certification.txt"
+          python -m pip install -c "$PIP_CONSTRAINT" 'pip==26.2.1'
+          python -m pip install -c "$PIP_CONSTRAINT" 'hatchling==1.32.0'
+          python -m pip install -c "$PIP_CONSTRAINT" -e '.[dev]'
+      - name: Ruff check
+        run: ruff check .
+      - name: Ruff format
+        run: ruff format --check .
+      - name: mypy
+        run: mypy
+      - name: Tests with branch coverage
+        run: |
+          python -m pytest -q --cov=reproagent --cov=verirepro --cov-branch --cov-report=json
+      - name: Coverage gate
+        run: python scripts/coverage_gate.py coverage.json --min-statement 85 --min-branch 75
+      - name: History scan
+        run: python scripts/history_scan.py --ref HEAD
+      - name: Release check
+        run: python scripts/release_check.py
+      - name: Launch surface
+        run: python scripts/launch_surface_check.py
+      - name: Build distributions
+        run: |
+          set -euo pipefail
+          rm -rf dist build
+          python -m build
+          python -m twine check dist/*
+          test "$(find dist -maxdepth 1 -type f -name '*.whl' | wc -l | tr -d ' ')" = "1"
+          test "$(find dist -maxdepth 1 -type f -name '*.tar.gz' | wc -l | tr -d ' ')" = "1"
+      - name: Clean-wheel verification
+        run: |
+          set -euo pipefail
+          CHECK_VENV="$RUNNER_TEMP/verirepro-ci-wheel-${GITHUB_RUN_ID}"
+          rm -rf "$CHECK_VENV"
+          trap 'rm -rf "$CHECK_VENV"' EXIT
+          python -m venv "$CHECK_VENV"
+          "$CHECK_VENV/bin/python" -m pip install 'pip==26.2.1'
+          WHEEL="$(find dist -maxdepth 1 -type f -name 'verirepro-*.whl' -print -quit)"
+          "$CHECK_VENV/bin/python" -m pip install "$WHEEL"
+          "$CHECK_VENV/bin/python" -m pip check
+          "$CHECK_VENV/bin/verirepro" --version
+          "$CHECK_VENV/bin/python" -m verirepro --version
+          "$CHECK_VENV/bin/verirepro-reprobench" --help >/dev/null
+          "$CHECK_VENV/bin/verirepro-reprobench-summary" --help >/dev/null
+          "$CHECK_VENV/bin/verirepro" doctor --json >/dev/null
+      - name: Clean-sdist verification
+        run: |
+          set -euo pipefail
+          CHECK_VENV="$RUNNER_TEMP/verirepro-ci-sdist-${GITHUB_RUN_ID}"
+          rm -rf "$CHECK_VENV"
+          trap 'rm -rf "$CHECK_VENV"' EXIT
+          python -m venv "$CHECK_VENV"
+          "$CHECK_VENV/bin/python" -m pip install 'pip==26.2.1'
+          SDIST="$(find dist -maxdepth 1 -type f -name 'verirepro-*.tar.gz' -print -quit)"
+          test -n "$SDIST"
+          "$CHECK_VENV/bin/python" -m pip install "$SDIST"
+          "$CHECK_VENV/bin/python" -m pip check
+          "$CHECK_VENV/bin/verirepro" --version
+          "$CHECK_VENV/bin/python" -m verirepro --version
+          "$CHECK_VENV/bin/verirepro-reprobench" --help >/dev/null
+          "$CHECK_VENV/bin/verirepro-reprobench-summary" --help >/dev/null
+          "$CHECK_VENV/bin/verirepro" doctor --json >/dev/null
+      - name: CLI surface
+        run: |
+          verirepro --version
+          python -m verirepro --version
+          verirepro-reprobench --help >/dev/null
+          verirepro-reprobench-summary --help >/dev/null
+          verirepro doctor --json >/dev/null
+
+  compatibility-py312:
+    name: Compatibility (Python 3.12)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: pip
+      - name: Install
+        run: python -m pip install -e '.[dev]'
+      - name: Full pytest suite
+        run: python -m pytest -q
+      - name: Import and CLI surface
+        run: |
+          python -c 'import verirepro, reproagent'
+          verirepro --version
+          python -m verirepro --version
+
+  compatibility-py313:
+    name: Compatibility (Python 3.13)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.13'
+          cache: pip
+      - name: Install
+        run: python -m pip install -e '.[dev]'
+      - name: Full pytest suite
+        run: python -m pytest -q
+      - name: Import and CLI surface
+        run: |
+          python -c 'import verirepro, reproagent'
+          verirepro --version
+          python -m verirepro --version

verirepro-0.8.1/.github/workflows/dependency-review.yml

@@ -0,0 +1,23 @@
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high

verirepro-0.8.1/.github/workflows/publish.yml

@@ -0,0 +1,149 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Test, build, and verify distributions
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          ref: ${{ github.event.release.tag_name }}
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.13'
+      - name: Require release tag to match pyproject version
+        run: |
+          set -euo pipefail
+          VERSION="$(python - <<'PY'
+          import tomllib
+          from pathlib import Path
+          data = tomllib.loads(Path('pyproject.toml').read_text(encoding='utf-8'))
+          print(data['project']['version'])
+          PY
+          )"
+          test "${GITHUB_REF_NAME}" = "v${VERSION}" || {
+            echo "Release tag ${GITHUB_REF_NAME} does not match pyproject version v${VERSION}" >&2
+            exit 2
+          }
+      - name: Require cryptographically signed annotated tag at current canonical main head
+        run: |
+          set -euo pipefail
+          git fetch --force origin main
+          test "$(git cat-file -t "$GITHUB_REF_NAME")" = tag || {
+            echo 'Stable publication requires a pre-created annotated tag.' >&2
+            exit 2
+          }
+          python scripts/verify_release_tag.py \
+            --tag "$GITHUB_REF_NAME" \
+            --allowed-signers .github/release-signers \
+            --expected-principal XiantingWu
+          TAG_COMMIT="$(git rev-parse "${GITHUB_REF_NAME}^{commit}")"
+          HEAD_COMMIT="$(git rev-parse HEAD)"
+          test "$TAG_COMMIT" = "$HEAD_COMMIT" || {
+            echo 'Release checkout does not match the dereferenced tag commit.' >&2
+            exit 2
+          }
+          MAIN_COMMIT="$(git rev-parse origin/main)"
+          test "$TAG_COMMIT" = "$MAIN_COMMIT" || {
+            echo 'Stable release tag must identify the current canonical main head.' >&2
+            exit 2
+          }
+          git merge-base --is-ancestor "$TAG_COMMIT" origin/main || {
+            echo 'Release tag commit is not reachable from canonical main.' >&2
+            exit 2
+          }
+      - name: Run release source and evidence gates
+        run: |
+          set -euo pipefail
+          export PIP_CONSTRAINT="$GITHUB_WORKSPACE/constraints/certification.txt"
+          echo "PIP_CONSTRAINT=$PIP_CONSTRAINT" >> "$GITHUB_ENV"
+          python -m pip install -c "$PIP_CONSTRAINT" 'pip==26.2.1'
+          python -m pip install -c "$PIP_CONSTRAINT" 'hatchling==1.32.0'
+          python -m pip install -c "$PIP_CONSTRAINT" -e '.[dev]'
+          python scripts/certification_environment_check.py --constraints "$PIP_CONSTRAINT" >/dev/null
+          python -m pytest -q
+          python scripts/history_scan.py --ref origin/main --include-tree HEAD
+          python scripts/launch_surface_check.py
+          python scripts/release_check.py --require-release-evidence
+          python scripts/release_source_check.py
+          verirepro --version
+          python -m verirepro --version
+          verirepro-reprobench --help >/dev/null
+          verirepro-reprobench-summary --help >/dev/null
+      - name: Build and check wheel and sdist
+        run: |
+          set -euo pipefail
+          rm -rf dist build
+          python -m build
+          python -m twine check dist/*
+          test "$(find dist -maxdepth 1 -type f -name '*.whl' | wc -l | tr -d ' ')" = "1"
+          test "$(find dist -maxdepth 1 -type f -name '*.tar.gz' | wc -l | tr -d ' ')" = "1"
+      - name: Install built wheel in an isolated environment
+        run: |
+          set -euo pipefail
+          CHECK_VENV="$RUNNER_TEMP/verirepro-publish-wheel-${GITHUB_RUN_ID}"
+          rm -rf "$CHECK_VENV"
+          trap 'rm -rf "$CHECK_VENV"' EXIT
+          python -m venv "$CHECK_VENV"
+          "$CHECK_VENV/bin/python" -m pip install -c "$PIP_CONSTRAINT" 'pip==26.2.1'
+          WHEEL="$(find dist -maxdepth 1 -type f -name 'verirepro-*.whl' -print -quit)"
+          "$CHECK_VENV/bin/python" -m pip install -c "$PIP_CONSTRAINT" "$WHEEL"
+          "$CHECK_VENV/bin/python" -m pip check
+          "$CHECK_VENV/bin/verirepro" --version
+          "$CHECK_VENV/bin/python" -m verirepro --version
+          "$CHECK_VENV/bin/verirepro-reprobench" --help >/dev/null
+          "$CHECK_VENV/bin/verirepro-reprobench-summary" --help >/dev/null
+          "$CHECK_VENV/bin/verirepro" doctor --json >/dev/null
+      - name: Install built sdist in an independent isolated environment
+        run: |
+          set -euo pipefail
+          CHECK_VENV="$RUNNER_TEMP/verirepro-publish-sdist-${GITHUB_RUN_ID}"
+          rm -rf "$CHECK_VENV"
+          trap 'rm -rf "$CHECK_VENV"' EXIT
+          python -m venv "$CHECK_VENV"
+          "$CHECK_VENV/bin/python" -m pip install -c "$PIP_CONSTRAINT" 'pip==26.2.1'
+          SDIST="$(find dist -maxdepth 1 -type f -name 'verirepro-*.tar.gz' -print -quit)"
+          test -n "$SDIST"
+          "$CHECK_VENV/bin/python" -m pip install -c "$PIP_CONSTRAINT" "$SDIST"
+          "$CHECK_VENV/bin/python" -m pip check
+          "$CHECK_VENV/bin/verirepro" --version
+          "$CHECK_VENV/bin/python" -m verirepro --version
+          "$CHECK_VENV/bin/verirepro-reprobench" --help >/dev/null
+          "$CHECK_VENV/bin/verirepro-reprobench-summary" --help >/dev/null
+          "$CHECK_VENV/bin/verirepro" doctor --json >/dev/null
+      - name: Upload distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: verirepro-dist-${{ github.run_id }}
+          path: dist/
+
+  publish:
+    name: Publish to PyPI via Trusted Publishing
+    needs: build
+    if: ${{ github.event.release.prerelease == false }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment:
+      name: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: verirepro-dist-${{ github.run_id }}
+          path: dist/
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 dereferenced release commit