Multi-AutoML Interface v5.1.0

Multi-AutoML Interface 5.1.0

Fixed

• A flaky ONNX test, caught by the new nightly gate. The export fixture drew its
  target from an unseeded np.random.randint(0, 2, 10), which can be a single class;
  LogisticRegression then refuses to fit. It passed on Windows by luck and failed on the
  first Linux nightly where the full suite is a real gate. The feature matrix is seeded and
  the target is balanced by construction.
• The desktop app no longer needs Python installed by the user. scripts/prepare_python_runtime.js
  downloads a standalone CPython 3.12 with uv and installs requirements.txt into it;
  electron-builder ships that tree as resources/runtime, and electron/main.js starts the
  bundled interpreter through runtime/runtime-manifest.json, falling back to the system
  Python only in a source checkout. Verified by packaging the app and launching it: the
  window renders, /_stcore/health answers, and the relocated interpreter imports
  streamlit/mlflow/flaml/pandas/sklearn.
• Runs, models and the data lake were written next to the program files. The app now
  works in a per-user workspace (Electron userData, e.g.
  %APPDATA%\multi-automl-desktop\workspace), which a normal user can write to; Program
  Files is not. safe_set_experiment resolves mlruns/ against the working directory
  instead of the source tree so the change takes effect, and PYTHONPATH keeps src/
  importable from the new cwd.
• Smoke builds were self-signing every bundled executable. Without credentials
  electron-builder generated its own certificate and signed hundreds of files inside the
  runtime, which is slow and produces signatures nobody trusts. The packaging workflow now
  builds unpacked directories with signing explicitly off and asserts the packaged layout
  (resources/runtime/..., resources/app/app.py) instead of uploading 1.2 GB per OS.

Added

• Signing is wired up, and verified. release.yml signs Windows installers from
  WIN_CSC_LINK/WIN_CSC_KEY_PASSWORD and macOS from MAC_CSC_LINK/MAC_CSC_KEY_PASSWORD
  plus APPLE_ID/APPLE_APP_SPECIFIC_PASSWORD/APPLE_TEAM_ID, because electron-builder
  reads those from the environment. A build that had credentials but produced an unsigned
  artifact now fails, signature reports are uploaded as artifacts, and the release notes
  state which case applied. With no credentials the build stays unsigned and says so.
  Azure Artifact Signing is documented as an alternative but is not wired: it needs an
  explicit win.sign configuration block, and passing it on the command line
  (-c.win.sign.type=azure) is rejected by electron-builder 26's schema - as is
  -c.win.sign=false, which is what broke the first packaging runs.
• npm run runtime builds just the bundled interpreter, and the packaging scripts run it
  before electron-builder, so npm run build-win produces a working installer in one step.

What is inside

Each installer bundles a standalone CPython 3.12 with everything in
requirements.txt already installed, so no Python setup is needed on
the target machine. Runs, models and the data lake are written to the app's
per-user workspace (the Electron userData directory):

Operating system	Location
Windows	%APPDATA%\multi-automl-desktop\workspace\
macOS	~/Library/Application Support/multi-automl-desktop/workspace/
Linux	~/.config/multi-automl-desktop/workspace/

The heavy AutoML backends (AutoGluon, PyCaret, TPOT, Lale, H2O, AutoKeras,
HuggingFace) stay optional and are lazy-imported; the bundled runtime
contains the core stack, so install whichever engines you need into it.
H2O additionally requires Java 11+.

Signing

These builds are not code-signed or notarized, so SmartScreen and Gatekeeper
will warn on first launch.