eyetrajectoriespy 1.1.0rc1¶

Published release candidate — exact-version qualified and production-verified

1.1.0rc1 is the published release-candidate identity for the integrated post-1.0 sparse/irregular surface qualified through R1-R5. It introduces no new estimator, scientific default, dependency, deprecation, removal, or root-namespace expansion relative to the completed 1.1.0.dev0 surface.

1.0.0 remains the stable/default release. 1.1.0rc1 is an immutable prerelease intended for production-installed observation before any final 1.1.0 promotion decision.

Qualification evidence¶

Literal-RC qualification PR #197 passed its complete 26-workflow pull-request matrix and merged through protected main as exact commit 909f7cd493fc21f643e1f923ed503e6128dc750c. The complete post-merge exact-main push matrix then finished 25/25 workflow groups successfully with zero failures. This includes fresh 1.1.0rc1 package-wide performance evidence, the frozen 1.0 API boundary, platform/package tests, documentation/examples, the complete 1.1 sparse/irregular validation programme, product analyses, reproducibility evidence, and the exact external mGSFPCA comparator.

The R4 development-readiness ledger and frozen 1.0 evidence remain immutable historical inputs and are not relabelled as RC evidence.

Publication governance¶

Governance-only PR #198 armed GitHub and production-PyPI publication only after completed exact-version qualification. The resulting protected-main arming commit was:

f4405897e2a7a2392c03523cc7fa18e43df00e5e

That exact commit then passed the complete 24/24 exact-main arming matrix with zero failures, including the external mGSFPCA comparator, before publication was manually dispatched.

Ordinary pushes and merges remained non-publishing throughout.

Production publication¶

Production workflow #19 (37511987332) completed successfully on 6 October 2026 from exact protected-main arming commit f4405897e2a7a2392c03523cc7fa18e43df00e5e.

The workflow:

• built the wheel and sdist exactly once;
• passed exact-main production governance;
• passed the unpublished GitHub/PyPI version preflight;
• created annotated tag v1.1.0rc1 targeting exact commit f4405897e2a7a2392c03523cc7fa18e43df00e5e;
• created GitHub prerelease v1.1.0rc1;
• downloaded and checksum-verified the exact GitHub Release distributions before publication;
• published the wheel and sdist to production PyPI through OIDC Trusted Publishing;
• generated and uploaded digital attestations for both distributions; and
• installed eyetrajectoriespy==1.1.0rc1 from production PyPI successfully on the first visibility attempt, followed by a passing release smoke test.

The annotated tag object is 3a00c7011feb58db3b64c82e133b2701d37ef273 and resolves to the exact publication commit above.

Published artifacts¶

Retained workflow artifact 11435448783 (release-dist) has digest:

sha256:3572f75c8339f73a2a77845cc01072097309a3b32f5207e0dcffcdf777c99e83

The PyPI publishing job reported 200 OK for both distributions and produced Sigstore-backed PyPI publication attestations matching the wheel and sdist SHA256 digests above.

Production install verification¶

The final verify-pypi-install job used Python 3.12 and installed the exact prerelease from production PyPI with --no-cache-dir.

The package became visible on attempt 1/30, installed successfully as eyetrajectoriespy-1.1.0rc1, and completed the repository release smoke test successfully.

Post-publication state¶

GitHub and production-PyPI readiness are jointly disarmed again after publication:

• production_release_ready = false
• github_release_ready = false

This prevents accidental republication of the immutable RC. A final 1.1.0 release, if justified after production-installed observation, must receive fresh literal-final qualification and a new governance-only publication-arming decision rather than reusing RC release authority.

The next programme is therefore production-installed RC observation and final-1.1 readiness, not further 1.1 feature expansion.