xarray-spatial 0.9.6__tar.gz → 0.9.7__tar.gz

{xarray_spatial-0.9.6 → xarray_spatial-0.9.7}/.claude/commands/rockout.md

@@ -14,7 +14,8 @@ through all seven steps below. The prompt is: $ARGUMENTS
 2. Pick labels from the repo's existing set. Always include the type label
    (`enhancement`, `bug`, or `proposal`). Add topical labels when they fit
    (e.g. `gpu`, `performance`, `focal tools`, `hydrology`, etc.).
-3. Draft the title and body. Use the repo's issue templates as structure guides:
+3. Draft the title and body. Use the repo's issue templates as structure guides
+   (skip the "Author of Proposal" field -- GitHub already shows the author):
    - Enhancement/proposal: follow `.github/ISSUE_TEMPLATE/feature-proposal.md`
    - Bug: follow `.github/ISSUE_TEMPLATE/bug_report.md`
 4. **Run the body text through the `/humanizer` skill** before creating the issue
@@ -70,20 +71,11 @@ through all seven steps below. The prompt is: $ARGUMENTS
 
 ## Step 6 -- Create a User Guide Notebook
 
-The project has an `examples/user_guide/` directory with numbered notebooks.
-
-1. Determine the next available notebook number by listing the directory.
-2. Create a new `.ipynb` notebook following the established pattern:
-   - Markdown cell with title and explanation of the feature
-   - Import cell
-   - Synthetic data generation with visualization
-   - Demonstrate each mode/option of the feature
-   - Show a practical use case or comparison
-3. Use `matplotlib` for plots, consistent with existing notebooks.
-4. Keep the notebook self-contained (no external data dependencies).
-
 **Skip this step** if the change is a pure bug fix with no new user-facing API.
 
+Run the `/user-guide-notebook` skill to create the notebook. It handles structure,
+plotting conventions, GIS alert boxes, preview images, and humanizer passes.
+
 ## Step 7 -- Update the README Feature Matrix
 
 1. Open `README.md` and find the appropriate category section in the feature matrix.

xarray_spatial-0.9.7/.claude/commands/sweep-accuracy.md

@@ -0,0 +1,257 @@
+# Accuracy Sweep: Dispatch subagents to audit modules for numerical accuracy issues
+
+Audit xrspatial modules for numerical accuracy issues: floating point
+precision loss, incorrect NaN propagation, off-by-one errors in neighborhood
+operations, missing or wrong Earth curvature corrections, and backend
+inconsistencies (numpy vs cupy vs dask results differ). Subagents fix
+findings via /rockout.
+
+Optional arguments: $ARGUMENTS
+(e.g. `--top 3`, `--exclude slope,aspect`, `--only-terrain`, `--reset-state`)
+
+---
+
+## Step 1 -- Gather module metadata via git
+
+Enumerate candidate modules:
+
+**Single-file modules:** Every `.py` file directly under `xrspatial/`, excluding
+`__init__.py`, `_version.py`, `__main__.py`, `utils.py`, `accessor.py`,
+`preview.py`, `dataset_support.py`, `diagnostics.py`, `analytics.py`.
+
+**Subpackage modules:** `geotiff/`, `reproject/`, and `hydro/` directories under
+`xrspatial/`. Treat each as a single audit unit. List all `.py` files within
+each (excluding `__init__.py`).
+
+For every module, collect:
+
+| Field | How |
+|-------|-----|
+| **last_modified** | `git log -1 --format=%aI -- <path>` (for subpackages, most recent file) |
+| **total_commits** | `git log --oneline -- <path> \| wc -l` |
+| **loc** | `wc -l < <path>` (for subpackages, sum all files) |
+| **recent_accuracy_commits** | `git log --oneline --grep='accuracy\|precision\|numerical\|geodesic' -- <path>` |
+
+Store results in memory -- do NOT write intermediate files.
+
+## Step 2 -- Load inspection state
+
+Read `.claude/sweep-accuracy-state.json`.
+
+If it does not exist, treat every module as never-inspected.
+
+If `$ARGUMENTS` contains `--reset-state`, delete the file and treat
+everything as never-inspected.
+
+State file schema:
+
+```json
+{
+  "inspections": {
+    "slope": {
+      "last_inspected": "2026-03-28T14:00:00Z",
+      "issue": 1042,
+      "severity_max": "HIGH",
+      "categories_found": [1, 3]
+    }
+  }
+}
+```
+
+## Step 3 -- Score each module
+
+```
+days_since_inspected = (today - last_inspected).days   # 9999 if never
+days_since_modified  = (today - last_modified).days
+has_recent_accuracy_work = 1 if recent_accuracy_commits is non-empty, else 0
+
+score = (days_since_inspected * 3)
+      + (total_commits * 0.5)
+      - (days_since_modified * 0.2)
+      - (has_recent_accuracy_work * 500)
+      + (loc * 0.05)
+```
+
+Rationale:
+- Modules never inspected dominate (9999 * 3)
+- More commits = more complex = more likely to have accuracy bugs
+- Recently modified modules slightly deprioritized (someone just touched them)
+- Modules with existing accuracy work heavily deprioritized
+- Larger files have more surface area (0.05 per line)
+
+## Step 4 -- Apply filters from $ARGUMENTS
+
+- `--top N` -- only audit the top N modules (default: 3)
+- `--exclude mod1,mod2` -- remove named modules from the list
+- `--only-terrain` -- restrict to: slope, aspect, curvature, terrain,
+  terrain_metrics, hillshade, sky_view_factor
+- `--only-focal` -- restrict to: focal, convolution, morphology, bilateral,
+  edge_detection, glcm
+- `--only-hydro` -- restrict to: flood, cost_distance, geodesic,
+  surface_distance, viewshed, erosion, diffusion, hydro (subpackage)
+- `--only-io` -- restrict to: geotiff, reproject, rasterize, polygonize
+
+## Step 5 -- Print the ranked table and launch subagents
+
+### 5a. Print the ranked table
+
+Print a markdown table showing ALL scored modules (not just selected ones),
+sorted by score descending:
+
+```
+| Rank | Module          | Score  | Last Inspected | Last Modified | Commits | LOC  |
+|------|-----------------|--------|----------------|---------------|---------|------|
+| 1    | viewshed        | 30012  | never          | 45 days ago   | 23      | 800  |
+| 2    | flood           | 29998  | never          | 120 days ago  | 18      | 600  |
+| ...  | ...             | ...    | ...            | ...           | ...     | ...  |
+```
+
+### 5b. Launch subagents for the top N modules
+
+For each of the top N modules (default 3), launch an Agent in parallel using
+`isolation: "worktree"` and `mode: "auto"`. All N agents must be dispatched
+in a single message so they run concurrently.
+
+Each agent's prompt must be self-contained and follow this template (adapt
+the module name, paths, and metadata):
+
+```
+You are auditing the xrspatial module "{module}" for numerical accuracy issues.
+
+This module has {commits} commits and {loc} lines of code.
+
+Read these files: {module_files}
+
+Also read xrspatial/utils.py to understand _validate_raster() behavior and
+xrspatial/tests/general_checks.py for the cross-backend comparison helpers.
+
+**Your task:**
+
+1. Read all listed files thoroughly, including the matching test file(s)
+   under xrspatial/tests/ so you understand expected behavior.
+
+2. Audit for these 5 accuracy categories. For each, look for the specific
+   patterns described. Only flag issues ACTUALLY present in the code.
+
+   **Cat 1 — Floating Point Precision Loss**
+   - Accumulation loops that sum many small values into a large running
+     total without Kahan summation or compensated accumulation
+   - float32 used where float64 is required for stable intermediate results
+     (e.g. large grids, long gradients, iterative solvers)
+   - Subtraction of nearly-equal large quantities (catastrophic cancellation)
+   - Division by small numbers without a stability floor
+   Severity: HIGH if the result is visibly wrong on realistic inputs;
+   MEDIUM if only observable on adversarial inputs
+
+   **Cat 2 — NaN / Inf Propagation Errors**
+   - NaN input silently produces a finite output (masked, skipped, or
+     treated as zero without being documented)
+   - NaN check using `==` instead of `!= x` for NaN detection in numba
+   - Neighborhood operations that ignore NaN pixels but do not update the
+     normalization denominator, biasing the result
+   - Inf / -Inf inputs treated as numbers in comparisons without guards
+   - Divide-by-zero producing Inf that then corrupts downstream accumulation
+   Severity: HIGH if NaN input yields a wrong but finite output;
+   MEDIUM if the behavior is documented but still surprising
+
+   **Cat 3 — Off-by-One Errors in Neighborhood Operations**
+   - Loop bounds that exclude the last row/column (e.g. `range(H-1)` where
+     `range(H)` is intended)
+   - `map_overlap` depth that is smaller than the actual stencil radius
+   - Boundary handling that duplicates or skips edge pixels
+   - Asymmetric kernel indexing (one-sided rather than centered)
+   - CUDA kernel bounds guard that is `i > H` instead of `i >= H`
+   Severity: HIGH if it causes a silent wrong result at all chunk boundaries;
+   MEDIUM if it only affects a single-pixel edge
+
+   **Cat 4 — Missing or Wrong Earth Curvature / Projection Corrections**
+   - Geodesic calculations that assume a flat projection without curvature
+     correction (see slope.py, aspect.py, geodesic.py for the reference
+     pattern: `u += (e² + n²) / (2R)`)
+   - Haversine / great-circle distance using the wrong Earth radius
+     constant, or using a spherical approximation where WGS84 is needed
+   - Mixing projected and geographic coordinates in the same calculation
+     without a transform
+   - Using cell size in degrees as if it were meters
+   Severity: HIGH if the correction is missing entirely on a public API;
+   MEDIUM if the correction is present but uses a questionable constant
+
+   **Cat 5 — Backend Inconsistency (numpy vs cupy vs dask)**
+   - numpy and cupy paths use different algorithms that can diverge on
+     identical inputs (e.g. different boundary handling, different NaN
+     semantics, different numerical precision)
+   - dask path silently falls back to materializing the full array
+   - dask `map_overlap` chunk function returns a different shape than the
+     input, corrupting the reassembled array
+   - A backend raises on valid input that another backend accepts
+   - Result dtype differs across backends without documentation
+   Severity: HIGH if numerically different results on the same input;
+   MEDIUM if only metadata (dtype, coords) differs
+
+3. For each real issue found, assign a severity (CRITICAL/HIGH/MEDIUM/LOW)
+   and note the exact file and line number.
+
+4. If any CRITICAL or HIGH issue is found, run /rockout to fix it end-to-end
+   (GitHub issue, worktree branch, fix, tests, and PR).
+   For MEDIUM/LOW issues, document them but do not fix.
+
+5. After finishing (whether you found issues or not), update the inspection
+   state file .claude/sweep-accuracy-state.json by reading its current
+   contents and adding/updating the entry for "{module}" with:
+   - "last_inspected": today's ISO date
+   - "issue": the issue number from rockout (or null if clean / MEDIUM-only)
+   - "severity_max": highest severity found (or null if clean)
+   - "categories_found": list of category numbers that had findings (e.g. [1, 3])
+
+   Then `git add .claude/sweep-accuracy-state.json` and commit it to the
+   worktree branch so the state update is included in the PR.
+
+Important:
+- Only flag real accuracy issues. False positives waste time.
+- Read the tests for this module to understand expected behavior before
+  flagging a result as wrong -- the test may codify the current behavior.
+- For backend comparisons, check that the cross-backend tests in
+  xrspatial/tests/general_checks.py actually exercise the code path you
+  are suspicious of; missing test coverage is itself a finding.
+- Do NOT flag the use of numba @jit itself as an accuracy issue. Focus on
+  what the JIT code does, not that it uses JIT.
+- For the hydro subpackage: focus on one representative variant (d8) in
+  detail, then note which dinf/mfd files share the same pattern. Do not
+  read all 29 files line by line.
+- This repo uses ArrayTypeFunctionMapping to dispatch across numpy/cupy/dask
+  backends. Check all backend paths, not just numpy.
+```
+
+### 5c. Print a status line
+
+After dispatching, print:
+
+```
+Launched {N} accuracy audit agents: {module1}, {module2}, {module3}
+```
+
+## Step 6 -- State updates
+
+State is updated by the subagents themselves (see agent prompt step 5).
+After completion, verify state with:
+
+```
+cat .claude/sweep-accuracy-state.json
+```
+
+To reset all tracking: `/sweep-accuracy --reset-state`
+
+---
+
+## General Rules
+
+- Do NOT modify any source files directly. Subagents handle fixes via /rockout.
+- Keep the output concise -- the table and agent dispatch are the deliverables.
+- If $ARGUMENTS is empty, use defaults: top 3, no category filter, no exclusions.
+- State file (`.claude/sweep-accuracy-state.json`) is tracked in git.
+  Subagents must `git add` and commit it so the state update lands in the PR.
+- For subpackage modules (geotiff, reproject, hydro), the subagent should read
+  ALL `.py` files in the subpackage directory, not just `__init__.py`.
+- Only flag patterns that are ACTUALLY present in the code. Do not report
+  hypothetical issues or patterns that "could" occur with imaginary inputs.
+- False positives are worse than missed issues. When in doubt, skip.

{xarray_spatial-0.9.6 → xarray_spatial-0.9.7}/.claude/commands/sweep-performance.md

@@ -22,7 +22,7 @@ Parse $ARGUMENTS for these flags (multiple may combine):
 | `--only-focal` | Restrict to: focal, convolution, morphology, bilateral, edge_detection, glcm |
 | `--only-hydro` | Restrict to: flood, cost_distance, geodesic, surface_distance, viewshed, erosion, diffusion |
 | `--only-io` | Restrict to: geotiff, reproject, rasterize, polygonize |
-| `--reset-state` | Delete `.claude/performance-sweep-state.json` and treat all modules as never-inspected |
+| `--reset-state` | Delete `.claude/sweep-performance-state.json` and treat all modules as never-inspected |
 | `--skip-phase1` | Skip triage; reuse last state file; go straight to ralph-loop generation for unresolved HIGH items |
 | `--report-only` | Run Phase 1 triage but do not generate a ralph-loop command |
 | `--size small` | Phase 2 benchmarks use 128x128 arrays |
@@ -64,7 +64,7 @@ For every module in scope, collect:
 
 ### Load inspection state
 
-Read `.claude/performance-sweep-state.json`. If it does not exist, treat every
+Read `.claude/sweep-performance-state.json`. If it does not exist, treat every
 module as never-inspected. If `--reset-state` was set, delete the file first.
 
 State file schema:
@@ -344,7 +344,7 @@ rockout has full context.
 
 ## Step 5 -- Update state file
 
-Write `.claude/performance-sweep-state.json` with the triage results:
+Write `.claude/sweep-performance-state.json` with the triage results:
 
 ```json
 {
@@ -395,12 +395,20 @@ If no modules qualify, print:
 `--skip-phase1` to refresh the triage."
 Then stop.
 
-### 6b. Print the ralph-loop command
+### 6b. Invoke the ralph-loop automatically
 
-Using the target list, generate and print:
+Using the target list, invoke the ralph-loop skill directly via the Skill tool.
+Do NOT print the command for manual copy-paste — execute it immediately.
 
-````
-/ralph-loop "Performance sweep Phase 2: benchmark and fix HIGH-severity findings.
+Set `--max-iterations` to the number of target modules plus 2 (buffer for
+retries).
+
+Call the Skill tool with `skill: "ralph-loop"` and pass the following as `args`
+(with `<module>`, `<N>`, `<OOM verdict>`, `<SIZE>`, and `<N+2>` substituted
+from the actual triage results):
+
+```
+"Performance sweep Phase 2: benchmark and fix HIGH-severity findings.
 
 **Target modules in priority order:**
 1. <module> (<N> HIGH findings, <OOM verdict>) -- <one-line summary of worst finding>
@@ -440,25 +448,25 @@ Using the target list, generate and print:
    | dask+numpy | peak_rss_mb | 892    | 34     | 0.04x | IMPROVED   |
    Thresholds: IMPROVED < 0.8x, REGRESSION > 1.2x, else UNCHANGED.
 
-6. Update .claude/performance-sweep-state.json with the issue number.
+6. Update .claude/sweep-performance-state.json with the issue number, then
+   `git add` and commit it to the worktree branch so the state update is
+   included in the PR.
 
 7. Output <promise>ITERATION DONE</promise>
 
 If all targets have been addressed or confirmed as false positives:
 <promise>ALL PERFORMANCE ISSUES FIXED</promise>." --max-iterations <N+2> --completion-promise "ALL PERFORMANCE ISSUES FIXED"
-````
+```
 
-Set `--max-iterations` to the number of target modules plus 2 (buffer for
-retries).
+### 6c. Print status
 
-### 6c. Print reminder text
+After invoking the ralph-loop, print:
 
 ```
-Phase 1 triage complete. To proceed with fixes:
-  Copy the ralph-loop command above and paste it.
+Phase 2 ralph-loop launched with <N> target modules.
 
 Other options:
-  Fix one manually:    copy any /rockout command from the report above
+  Fix one manually:    copy any /rockout command from the triage report above
   Rerun triage only:   /sweep-performance --report-only
   Skip Phase 1:        /sweep-performance --skip-phase1 (reuses last triage)
   Reset all tracking:  /sweep-performance --reset-state
@@ -483,8 +491,8 @@ Other options:
   on a known-numpy array), do not flag it.
 - The 30TB simulation constructs the dask task graph only; it NEVER calls
   `.compute()`.
-- State file (`.claude/performance-sweep-state.json`) is gitignored by
-  convention — do not add it to git.
+- State file (`.claude/sweep-performance-state.json`) is tracked in git.
+  Subagents must `git add` and commit it so the state update lands in the PR.
 - If $ARGUMENTS is empty, use defaults: audit all modules, benchmark at
   512x512, generate ralph-loop for HIGH items.
 - For subpackage modules (geotiff, reproject), the subagent should read ALL

xarray_spatial-0.9.7/.claude/commands/sweep-security.md

@@ -0,0 +1,253 @@
+# Security Sweep: Dispatch subagents to audit modules for security vulnerabilities
+
+Audit xrspatial modules for security issues specific to numeric/GPU raster
+libraries: unbounded allocations, integer overflow, NaN logic bombs, GPU
+kernel bounds, file path injection, and dtype confusion. Subagents fix
+CRITICAL/HIGH issues via /rockout.
+
+Optional arguments: $ARGUMENTS
+(e.g. `--top 3`, `--exclude slope,aspect`, `--only-io`, `--reset-state`)
+
+---
+
+## Step 1 -- Gather module metadata via git and grep
+
+Enumerate candidate modules:
+
+**Single-file modules:** Every `.py` file directly under `xrspatial/`, excluding
+`__init__.py`, `_version.py`, `__main__.py`, `utils.py`, `accessor.py`,
+`preview.py`, `dataset_support.py`, `diagnostics.py`, `analytics.py`.
+
+**Subpackage modules:** `geotiff/`, `reproject/`, and `hydro/` directories under
+`xrspatial/`. Treat each as a single audit unit. List all `.py` files within
+each (excluding `__init__.py`).
+
+For every module, collect:
+
+| Field | How |
+|-------|-----|
+| **last_modified** | `git log -1 --format=%aI -- <path>` (for subpackages, most recent file) |
+| **total_commits** | `git log --oneline -- <path> \| wc -l` |
+| **loc** | `wc -l < <path>` (for subpackages, sum all files) |
+| **has_cuda_kernels** | grep file(s) for `@cuda.jit` |
+| **has_file_io** | grep file(s) for `open(`, `mkstemp`, `os.path`, `pathlib` |
+| **has_numba_jit** | grep file(s) for `@ngjit`, `@njit`, `@jit`, `numba.jit` |
+| **allocates_from_dims** | grep file(s) for `np.empty(height`, `np.zeros(height`, `np.empty(H`, `np.empty(h `, `cp.empty(`, and width variants |
+| **has_shared_memory** | grep file(s) for `cuda.shared.array` |
+
+Store results in memory -- do NOT write intermediate files.
+
+## Step 2 -- Load inspection state
+
+Read `.claude/sweep-security-state.json`.
+
+If it does not exist, treat every module as never-inspected.
+
+If `$ARGUMENTS` contains `--reset-state`, delete the file and treat
+everything as never-inspected.
+
+State file schema:
+
+```json
+{
+  "inspections": {
+    "cost_distance": {
+      "last_inspected": "2026-04-10T14:00:00Z",
+      "issue": 1150,
+      "severity_max": "HIGH",
+      "categories_found": [1, 2]
+    }
+  }
+}
+```
+
+## Step 3 -- Score each module
+
+```
+days_since_inspected = (today - last_inspected).days   # 9999 if never
+days_since_modified  = (today - last_modified).days
+
+score = (days_since_inspected * 3)
+      + (has_file_io * 400)
+      + (allocates_from_dims * 300)
+      + (has_cuda_kernels * 250)
+      + (has_shared_memory * 200)
+      + (has_numba_jit * 100)
+      + (loc * 0.05)
+      - (days_since_modified * 0.2)
+```
+
+Rationale:
+- File I/O is the only external-escape vector (400)
+- Unbounded allocation is a DoS vector across all backends (300)
+- CUDA bugs cause silent memory corruption (250)
+- Shared memory overflow is a CUDA sub-risk (200)
+- Numba JIT is ubiquitous -- lower weight avoids noise (100)
+- Larger files have more surface area (0.05 per line)
+- Recently modified code slightly deprioritized
+
+## Step 4 -- Apply filters from $ARGUMENTS
+
+- `--top N` -- only audit the top N modules (default: 3)
+- `--exclude mod1,mod2` -- remove named modules from the list
+- `--only-terrain` -- restrict to: slope, aspect, curvature, terrain,
+  terrain_metrics, hillshade, sky_view_factor
+- `--only-focal` -- restrict to: focal, convolution, morphology, bilateral,
+  edge_detection, glcm
+- `--only-hydro` -- restrict to: flood, cost_distance, geodesic,
+  surface_distance, viewshed, erosion, diffusion, hydro (subpackage)
+- `--only-io` -- restrict to: geotiff, reproject, rasterize, polygonize
+
+## Step 5 -- Print the ranked table and launch subagents
+
+### 5a. Print the ranked table
+
+Print a markdown table showing ALL scored modules (not just selected ones),
+sorted by score descending:
+
+```
+| Rank | Module          | Score  | Last Inspected | CUDA | FileIO | Alloc | Numba | LOC  |
+|------|-----------------|--------|----------------|------|--------|-------|-------|------|
+| 1    | geotiff         | 30600  | never          | yes  | yes    | no    | yes   | 1400 |
+| 2    | hydro           | 30300  | never          | yes  | no     | yes   | yes   | 8200 |
+| ...  | ...             | ...    | ...            | ...  | ...    | ...   | ...   | ...  |
+```
+
+### 5b. Launch subagents for the top N modules
+
+For each of the top N modules (default 3), launch an Agent in parallel using
+`isolation: "worktree"` and `mode: "auto"`. All N agents must be dispatched
+in a single message so they run concurrently.
+
+Each agent's prompt must be self-contained and follow this template (adapt
+the module name, paths, and metadata):
+
+```
+You are auditing the xrspatial module "{module}" for security vulnerabilities.
+
+This module has {commits} commits and {loc} lines of code.
+
+Read these files: {module_files}
+
+Also read xrspatial/utils.py to understand _validate_raster() behavior.
+
+**Your task:**
+
+1. Read all listed files thoroughly.
+
+2. Audit for these 6 security categories. For each, look for the specific
+   patterns described. Only flag issues ACTUALLY present in the code.
+
+   **Cat 1 — Unbounded Allocation / Denial of Service**
+   - np.empty(), np.zeros(), np.full() where size comes from array dimensions
+     (height*width, H*W, nrows*ncols) without a configurable max or memory check
+   - CuPy equivalents (cp.empty, cp.zeros)
+   - Queue/heap arrays sized at height*width without bounds validation
+   Severity: HIGH if no memory guard exists; MEDIUM if a partial guard exists
+
+   **Cat 2 — Integer Overflow in Index Math**
+   - height*width multiplication in int32 (overflows silently at ~46340x46340)
+   - Flat index calculations (r*width + c) in numba JIT without overflow check
+   - Queue index variables in int32 that could overflow for large arrays
+   Severity: HIGH for int32 overflow in production paths; MEDIUM for int64
+   overflow only possible with unrealistic dimensions (>3 billion pixels)
+
+   **Cat 3 — NaN/Inf as Logic Errors**
+   - Division without zero-check in numba kernels
+   - log/sqrt of potentially negative values without guard
+   - Accumulation loops that could hit Inf (summing many large values)
+   - Missing NaN propagation: NaN input silently produces finite output
+   - Incorrect NaN check: using == instead of != for NaN detection in numba
+   Severity: HIGH if in flood routing, erosion, viewshed, or cost_distance
+   (safety-critical modules); MEDIUM otherwise
+
+   **Cat 4 — GPU Kernel Bounds Safety**
+   - CUDA kernels missing `if i >= H or j >= W: return` bounds guard
+   - cuda.shared.array with fixed size that could overflow with adversarial
+     input parameters
+   - Missing cuda.syncthreads() after shared memory writes before reads
+   - Thread block dimensions that could cause register spill or launch failure
+   Severity: CRITICAL if bounds guard is missing (out-of-bounds GPU write);
+   HIGH for shared memory overflow or missing syncthreads
+
+   **Cat 5 — File Path Injection**
+   - File paths constructed from user strings without os.path.realpath() or
+     os.path.abspath() canonicalization
+   - Path traversal via ../ not prevented
+   - Temporary file creation in user-controlled directories
+   Severity: CRITICAL if user-provided path is used without any
+   canonicalization; HIGH if partial canonicalization is bypassable
+
+   **Cat 6 — Dtype Confusion**
+   - Public API functions that do NOT call _validate_raster() on their inputs
+   - Numba kernels that assume float64 but could receive float32 or int arrays
+   - Operations where dtype mismatch causes silent wrong results (not an error)
+   - CuPy/NumPy backend inconsistency in dtype handling
+   Severity: HIGH if wrong results are silent; MEDIUM if an error occurs but
+   the error message is misleading
+
+3. For each real issue found, assign a severity (CRITICAL/HIGH/MEDIUM/LOW)
+   and note the exact file and line number.
+
+4. If any CRITICAL or HIGH issue is found, run /rockout to fix it end-to-end
+   (GitHub issue, worktree branch, fix, tests, and PR).
+   For MEDIUM/LOW issues, document them but do not fix.
+
+5. After finishing (whether you found issues or not), update the inspection
+   state file .claude/sweep-security-state.json by reading its current
+   contents and adding/updating the entry for "{module}" with:
+   - "last_inspected": today's ISO date
+   - "issue": the issue number from rockout (or null if clean / MEDIUM-only)
+   - "severity_max": highest severity found (or null if clean)
+   - "categories_found": list of category numbers that had findings (e.g. [1, 2])
+
+   Then `git add .claude/sweep-security-state.json` and commit it to the
+   worktree branch so the state update is included in the PR.
+
+Important:
+- Only flag real, exploitable issues. False positives waste time.
+- Read the tests for this module to understand expected behavior.
+- For CUDA code, verify bounds guards are truly missing -- many kernels already
+  have `if i >= H or j >= W: return`.
+- Do NOT flag the use of numba @jit itself as a security issue. Focus on what
+  the JIT code does, not that it uses JIT.
+- For the hydro subpackage: focus on one representative variant (d8) in detail,
+  then note which dinf/mfd files share the same pattern. Do not read all 29
+  files line by line.
+- This repo uses ArrayTypeFunctionMapping to dispatch across numpy/cupy/dask
+  backends. Check all backend paths, not just numpy.
+```
+
+### 5c. Print a status line
+
+After dispatching, print:
+
+```
+Launched {N} security audit agents: {module1}, {module2}, {module3}
+```
+
+## Step 6 -- State updates
+
+State is updated by the subagents themselves (see agent prompt step 5).
+After completion, verify state with:
+
+```
+cat .claude/sweep-security-state.json
+```
+
+To reset all tracking: `/sweep-security --reset-state`
+
+---
+
+## General Rules
+
+- Do NOT modify any source files directly. Subagents handle fixes via /rockout.
+- Keep the output concise -- the table and agent dispatch are the deliverables.
+- If $ARGUMENTS is empty, use defaults: top 3, no category filter, no exclusions.
+- State file (`.claude/sweep-security-state.json`) is tracked in git.
+  Subagents must `git add` and commit it so the state update lands in the PR.
+- For subpackage modules (geotiff, reproject, hydro), the subagent should read
+  ALL `.py` files in the subpackage directory, not just `__init__.py`.
+- Only flag patterns that are ACTUALLY present in the code. Do not report
+  hypothetical issues or patterns that "could" occur with imaginary inputs.
+- False positives are worse than missed issues. When in doubt, skip.

xarray_spatial-0.9.7/.claude/sweep-accuracy-state.json

@@ -0,0 +1,22 @@
+{
+  "inspections": {
+    "zonal": { "last_inspected": "2026-03-30T12:00:00Z", "issue": 1090 },
+    "focal": { "last_inspected": "2026-03-30T13:00:00Z", "issue": 1092 },
+    "multispectral": { "last_inspected": "2026-03-30T14:00:00Z", "issue": 1094 },
+    "proximity": { "last_inspected": "2026-03-30T15:00:00Z", "issue": null, "notes": "Direction >= boundary fragile but works due to truncated constant. Float32 truncation is design choice. No wrong-results bugs found." },
+    "curvature": { "last_inspected": "2026-03-30T15:00:00Z", "issue": null, "notes": "Formula matches ArcGIS reference. Backends consistent. No issues found." },
+    "hillshade": { "last_inspected": "2026-04-10T12:00:00Z", "issue": null, "notes": "Horn's method correct. All backends consistent. NaN propagation correct. float32 adequate for [0,1] output." },
+    "terrain": { "last_inspected": "2026-04-10T12:00:00Z", "issue": null, "notes": "Perlin/Worley/ridged noise correct. Dask chunk boundaries produce bit-identical results. No precision issues." },
+    "perlin": { "last_inspected": "2026-04-10T12:00:00Z", "issue": null, "notes": "Improved Perlin noise implementation correct. Fade/gradient functions verified. Backend-consistent. Continuous at cell boundaries." },
+    "sieve": { "last_inspected": "2026-04-13T12:00:00Z", "issue": null, "notes": "Union-find CCL correct. NaN excluded from labeling. All backends funnel through _sieve_numpy." },
+    "polygonize": { "last_inspected": "2026-04-13T12:00:00Z", "issue": 1190, "notes": "NaN pixels not masked in numpy/dask backends. Fix in PR #1194." },
+    "cost_distance": { "last_inspected": "2026-04-13T12:00:00Z", "issue": 1191, "notes": "CuPy Bellman-Ford max_iterations = h+w instead of h*w. Fix in PR #1192." },
+    "visibility": { "last_inspected": "2026-04-13T12:00:00Z", "issue": null, "notes": "Bresenham line, LOS kernel, Fresnel zone all correct. All backends converge to numpy." },
+    "kde": { "last_inspected": "2026-04-13T12:00:00Z", "issue": 1198, "notes": "kde/line_density return zeros for descending-y templates. Fix in PR #1199." },
+    "polygon_clip": { "last_inspected": "2026-04-13T12:00:00Z", "issue": 1197, "notes": "crop=True + all_touched=True drops boundary pixels. Fix in PR #1200." },
+    "resample": { "last_inspected": "2026-04-14T12:00:00Z", "issue": 1202, "notes": "Interpolation used edge-aligned coords instead of block-centered. Fix in PR #1204." },
+    "balanced_allocation": { "last_inspected": "2026-04-14T12:00:00Z", "issue": 1203, "notes": "float32 allocation array caused source ID mismatch for non-integer IDs. Fix in PR #1205." },
+    "dasymetric": { "last_inspected": "2026-04-14T12:00:00Z", "issue": null, "notes": "Mass conservation correct. Weighted/binary/limiting_variable all verified. Pycnophylactic Tobler algorithm correct." },
+    "geotiff": { "last_inspected": "2026-04-23", "issue": 1247, "severity_max": "HIGH", "categories_found": [1, 3, 4, 5], "notes": "HIGH fixed: CPU fp_predictor_decode wrong byte-lane layout for multi-sample predictor=3 (GPU was correct). MEDIUMs also fixed on same PR: eager and streaming writers emit LONG8 strip/tile offsets in BigTIFF output (were LONG); VRT read honors AREA_OR_POINT=Point; VRT nodata cast uses source dtype instead of float32. LOW fixed: duplicate LERC codec block removed from _compression.py." }
+  }
+}