Skip to content

eyetrajectoriespy 1.0.0rc1

Release candidate — published 4 October 2026

1.0.0rc1 is the first candidate over the explicitly frozen 1.0 public API boundary. It does not add a new estimator, numerical method, analytical default, dependency, deprecation, removal, or public API expansion.

Frozen compatibility candidate

The machine-readable ONE_DOT_ZERO_API_STABILITY.json boundary contains 458 public exports: 455 stable candidates and three explicitly experimental APIs (conditional_transfer_entropy, discrete_transfer_entropy, and return_map_stability). fit_sparse_fpca_fdapy() remains an intentional stable compatibility route.

Completed qualification

Exact-version qualification PR #150 merged as protected-main commit deb61a1b4f2f5e4c8da44d3f2b75ac09fa99430a. Its complete pull-request matrix passed, and the post-merge exact-main matrix then finished 17/17 workflow groups green with zero failures.

On that exact commit, package-wide performance run 37149050366, package/test run 37149050402, the frozen 1.0 API-stability run 37149050398, and sparse-MFPCA comparator-sensitivity run 37149050450 all completed successfully. The external comparator job installed the exact mGSFPCA dependency, ran the external comparison, evaluated invariant sensitivity, verified the contract, and uploaded its evidence.

Fresh 1.0.0rc1 performance evidence is retained separately from historical 0.12 evidence; no historical release artifact was relabelled.

Publication governance

Governance-only PR #152 produced exact protected-main arming commit ef80b8680de7a4adf6ab498fa3edb8ad1522defa. That commit reran the frozen 1.0 API boundary and completed the full exact-main matrix successfully before production dispatch.

Production release workflow #17 (run 37158769400) completed successfully from that exact arming commit. It built the wheel and sdist exactly once, passed production governance and unpublished-version preflight, created annotated tag and GitHub prerelease v1.0.0rc1, published the checksum-verified distributions to production PyPI through OIDC Trusted Publishing with digital attestations, and passed a fresh exact eyetrajectoriespy==1.0.0rc1 production-PyPI installation smoke test.

Published GitHub Release asset digests are:

  • wheel: sha256:555277d9328fa9b0a3f1f445d2dd2f85d192f3f634e95293789c1bf37c4fa118;
  • sdist: sha256:03ea7851e81507ef00c9c7da309d2d1951992b23548a51dab4b5a46c9f694a24;
  • SHA256SUMS: sha256:ba57041afc1e3057c89057f4d12d064e5bdebd0f9e1edca9557930b9ee4f8baf.

The retained workflow build artifact release-dist has digest sha256:691527789e9b8a9d54c670b41353bc7d4afc550b6bbfda2416fd1a7dc5f790e8.

The release tag and distributions are immutable. Post-publication GitHub/PyPI readiness is jointly disarmed again. The installed-RC qualification workflow is retargeted to production-PyPI 1.0.0rc1 so Python 3.11–3.13, installed recovery/stress, portability, determinism, sparse-MFPCA/joint-PACE behavior, and external-consumer behavior can be observed before any final 1.0.0 promotion decision.