ncarnate 2.2.2

Maintenance release: test-fixture and documentation cleanup; packaging and CI updates.

ncarnate 2.2.1

A documentation and branding patch. No functional changes to conversion, recompression, or verification behavior — the fidelity guarantee is unchanged; this release only describes it more precisely and adds branding.

Changed

• Fidelity wording now matches what the verifier enforces: the data-preservation guarantee is value-identical — bit-for-bit for integer, char, and packed data; NaN- and signed-zero-insensitive for floating-point/complex — in the README, docs, and the HDF4 module docstring, replacing blanket "bit-identical" (which overstated the guarantee for float data, since the verifiers compare with numpy.array_equal(equal_nan=True)).

Added

• Brand assets and a theme-aware README logo lockup (light/dark), plus live PyPI, conda-forge, and Read the Docs badges.

Fixed

• Read the Docs build stays green under current myst-parser (suppressed the myst.header advisory that fail_on_warning would otherwise fail on).

Full changelog: https://github.com/ErickShepherd/ncarnate/blob/main/CHANGELOG.md

ncarnate 2.2.0 — Audit & Convert

ncarnate 2.2.0 — Audit & Convert

This release adds an archive-modernization workflow: a read-only audit that plans a migration, and a converter that executes exactly what the audit blessed — with integrity checks and non-destructive defaults throughout. It is the first PyPI release to include the audit subcommand and the migration-manifest contract (developed as the internal 2.1.0 milestone), released together with the converter.

The existing single-file/single-directory form (ncarnate <path>) is unchanged.

Highlights

🔍 ncarnate audit — plan a migration without touching your data

Walk an archive and classify every file without reading its science arrays or modifying anything — a cheap, read-only pass you can run against a terabyte before deciding what to convert.

ncarnate audit /data/archive --output manifest.jsonl --checksum sha256

• Detects formats, inspects metadata only, and sorts each file into a stable status taxonomy: ready, ready_no_geolocation, already_modern, unsupported, malformed, unsafe, unknown.
• Writes a versioned migration manifest — a per-file JSONL record (path, checksum, status, issues, conversion plan) with a checked-in JSON Schema and an append-only issue-code registry. A flat CSV projection is available for triage.
• Prints a readiness summary by files and bytes. Never writes to audited files; never touches the network.
• Opt-in --checksum sha256 records per-file hashes so the manifest can later be executed safely.

✅ ncarnate convert --manifest — execute the plan, safely

Hand the converter that manifest and it modernizes exactly the granules the audit blessed — into a mirrored output tree, leaving your originals untouched by default.

ncarnate convert --manifest manifest.jsonl --out-dir ./modern --root /data/archive

• Integrity by construction: re-verifies each file's recorded sha256 before touching it, so a file that changed since the audit is skipped with an error rather than silently converted. A null hash is refused without --allow-unverified; a blocker is never converted.
• Non-destructive by default: writes to --out-dir (HDF4/HDF-EOS2 → .nc, netCDF names kept); --in-place is a separate opt-in, and --skip-existing makes an interrupted run resumable.
• Resilient at scale: per-record isolation means one bad file never aborts the run; an end-of-run summary counts converted / skipped / failed with reasons, and the exit code is non-zero iff a selected record failed.
• Trusted read base: because a manifest is untrusted input, manifest mode requires an operator-controlled base — --root DIR (anchor reads to a directory you control; the archive's current location) or --allow-manifest-root to explicitly trust the manifest's recorded root.

Security & robustness

The audit + converter were put through an independent security-and-correctness review and hardened before release, including: allocation-bomb (declared-oversize) files are correctly refused as unsafe; untrusted manifest/metadata input can no longer surface as an uncaught traceback; and the converter never trusts an attacker-controllable read base by default.

Public API

• audit_path, AuditOptions — the read-only audit.
• convert_manifest, ConvertOptions — the manifest-driven converter.
• Both are exported from the top-level ncarnate package and documented in the API reference.

Compatibility

• No breaking changes to existing usage: ncarnate <path> and ncarnate convert <path> behave exactly as before.
• New: manifest-mode conversion (convert --manifest) requires --root or --allow-manifest-root (see above).
• Python 3.10–3.13, Linux and macOS. (On Windows, the HDF4 path needs conda-forge pyhdf or WSL; the netCDF path works from PyPI wheels.)

Install

pip install --upgrade ncarnate
# or
conda install -c conda-forge ncarnate

Full changelog: see CHANGELOG.md.

ncarnate 2.0.3

Read the Docs site shipped in-tag (fixes RTD's tag-based "stable" build), Markdown README with DOI badge and Documentation URL on PyPI, and fixes adopted from an independent multi-model review: geolocation fill-value guard (interpolation-scoped, NaN-aware), a warning when swath axes are non-leading, accurate CLI --help, and a single StructMetadata parse per file.

Full details: CHANGELOG.md

v2.0.2

Citation metadata only — no code changes.

• Added .zenodo.json and an author ORCID in CITATION.cff, so this release is archived on Zenodo with a citable DOI and correct software metadata.

v2.0.1

Catches the PyPI release up to master — bundles the 2026-07-09 audit remediation with the discoverability docs.

Security

• Cap attacker-declared allocation sizes so a crafted/corrupt granule can't exhaust memory (new limits.py)
• Reject non-finite/non-positive HDF-EOS metadata; guard GCTP projection parameters — fail loud rather than compute wrong geolocation
• Bound the ODL/StructMetadata parser against pathological input

Fixed

• Auto-derived destinations refuse to clobber existing files; symlinked sources resolved before in-place replace
• HDF4 name-collision hardening; StructMetadata part ordering; CLI worklist de-duplication

Changed / Added

• "Problems this solves" README section; conversion-led description; broadened keywords; trove classifiers
• conda-forge install path

No on-disk format change; the only behavior changes are defensive. See CHANGELOG.md.

ncarnate v2.0.0

Ground-up v2 rebuild of the 2020 utility, renamed from netcdf_recompressor to ncarnate.

Read HDF4/HDF-EOS2 or netCDF/HDF5 → write recompressed, CF-annotated netCDF4. The central contract is data fidelity: converting or recompressing changes storage, never science data — every stored value is bit-identical, packed integers stay packed, and every output is verified value-for-value against the source before it replaces anything.

Highlights

• Lossless recompression of netCDF/HDF5 (raw copy — no mask-and-scale re-quantization; safe verify-then-replace overwrite).
• HDF4/HDF-EOS2 ingest with reconstructed CF geolocation: GCTP polar-stereographic, geographic, and EASE-Grid (LAMAZ) grids → CF grid mappings + x/y + 2-D lat/lon; swath geolocation attached as CF coordinates; dimension-mapped geolocation interpolated through ECEF.
• Working CLI (the 2020 build silently recompressed nothing), full type hints, magic-byte format dispatch.
• Hardened against untrusted files: allocation-size ceilings, StructMetadata input validation, fail-loud named errors.
• 96-test suite pinning the fidelity contract + the geolocation verification lattice; CI on CPython 3.10–3.13 (Linux/macOS/Windows).

See CHANGELOG.md for the full entry and docs/fidelity-notes.md for the fidelity contract.