LowPack 0.2.3 — Zenodo presentation overhaul

LowPack 0.2.3 - Zenodo presentation overhaul

Title: LowPack: local-first application-aware lossless packing for archives

Summary

Presentation and citation maintenance release. Expands Zenodo and CITATION.cff metadata, updates install/docs links, and adds a documentation index. Archive format 1.1, manifest schema 2.0, codec policy, profiles, safety limits, and the 0.1.x migration path are unchanged.

Install

python -m pip install https://github.com/devkyato/Lowpack/releases/download/v0.2.3/lowpack-0.2.3-py3-none-any.whl
lowpack --version
lowpack doctor

Citation

• Concept DOI: https://doi.org/10.5281/zenodo.21853277
• See CITATION.cff and .zenodo.json

Published by @dev.mako (devkyato), co-authored with Cursor Agent.

LowPack 0.2.2 — Zenodo archival publication

LowPack 0.2.2 - Zenodo archival publication

Title: LowPack: local-first application-aware lossless packing for archives

Introduction

LowPack prepares data for how it will be stored and used, then hands it to proven lossless codecs (store, zlib, Zstandard). It stays completely on your laptop.

Usage

python -m pip install https://github.com/devkyato/Lowpack/releases/download/v0.2.2/lowpack-0.2.2-py3-none-any.whl
lowpack --version
lowpack doctor
lowpack pack ./project project.lpk
lowpack verify project.lpk

Applications

• Packaging local experiment trees and firmware workspaces
• Deterministic archive handoff between machines
• Explainable lossless packing for research software artefacts

Discovery / citation

See CITATION.cff and .zenodo.json. Keywords: compression, archive, lossless, Zstandard, Python, CLI, local-first.

Published by @dev.mako (devkyato), co-authored with Cursor Agent.

LowPack 0.2.1 - safe alpha archive migration

I thought too on the point that a security-driven format change should not
strand the first LowPack archives. LowPack 0.2.1 adds a narrow, checked bridge
from format 1.0 to the stricter format 1.1 / manifest schema 2.0.

Oh! On this part, I kept reading and writing separate on purpose:

• lowpack compatibility old.lpk authenticates and classifies an archive
  without decompressing it or writing anything.
• lowpack migrate old.lpk -o migrated.lpk leaves the source untouched,
  preserves its compressed chunk payloads, validates the converted manifest,
  fully reconstructs every file in a temporary archive, and publishes the
  destination only after that succeeds.

The README now begins with a real release-wheel installation instead of an
editable developer install. The new getting-started and compatibility guides
cover Windows, macOS, Linux, upgrades, command discovery, checksums, and the
exact migration trust boundary.

Install the release wheel:

python -m pip install "https://github.com/devkyato/Lowpack/releases/download/v0.2.1/lowpack-0.2.1-py3-none-any.whl"
lowpack --version
lowpack doctor

What I verified before publishing:

• 66 tests passed, with 3 expected platform-specific skips.
• Ruff and strict Mypy passed.
• Linux/Windows CI across Python 3.9 through 3.14 passed.
• The package build, clean wheel install, benchmark smoke, and 5,000-run
  manifest fuzz smoke passed in GitHub Actions.
• Two isolated builds from merged commit
  4000aec6a779eb8c3127ee91a96968b7e3b0f3d2 were byte-identical.
• The published 0.1.2 wheel created a 23-file source archive with dictionaries;
  the 0.2.1 wheel migrated, fully verified, unpacked, and byte-matched all 23
  files.
• The README cover is byte-for-byte the supplied LowPack cover image.

SHA-256:

b928236e9e21949d4163566bc6e09ad4f5697445e297799fd22d37024e516514  lowpack-0.2.1-py3-none-any.whl
51364e1aa247d57dcb1231ac4127038877b8bb5ef6ad59ef5027fecd80a79460  lowpack-0.2.1.tar.gz

This remains an alpha prerelease. It does not promise unknown future-format
compatibility, repair corrupt archives, stream canonical telemetry transforms,
or replace the need for another copy of important data.

Migration work: issue #3
Implementation and checks: pull request #11
Post-merge CI: run 30459368382

LowPack 0.2.0 — hostile-input hardening

I thought the right way to make this release was to review LowPack as if every input path and every archive field were trying to mislead it. That changed quite a bit under the surface, but the result is a much more honest and defensive alpha.

Oh! The important compatibility point first: v0.2.0 writes binary format 1.1 and manifest schema 2.0. The 0.1 format was explicitly experimental, and this release chooses stricter validation over pretending that unsafe relationships are compatible.

What changed

• Direct inputs, traversed files, directories, and filesystem identities now share one collision registry.
• Followed symlink cycles, duplicate identities, and output-inside-input recursion are rejected.
• Source files are archived from one descriptor snapshot, hashing during the same chunk pass and rejecting detected mutation.
• Dictionary sampling uses bounded reads; trained dictionaries are stored once and referenced by SHA-256 ID.
• Codec explanations now separate the preferred per-file policy from the actual representation reused by deduplication.
• Ordinary full verification and extraction stream one chunk at a time instead of caching complete archives or files.
• Manifest schema 2.0 validates exact types, hashes, aggregate references, chunk boundaries and overlap, sizes, transforms, decisions, dictionaries, permissions, and total object count.
• Canonical telemetry validates rows, columns, cells, bitmaps, indices, deltas, floats, and run lengths before reconstruction.
• Archived permissions are opt-in and limited to ordinary rwx bits.
• Selection goals use deterministic policy names instead of claiming measured speed.
• Benchmarks now separate raw payload, deterministic tar-container, and full LowPack archive behavior.
• CI includes hostile-input regressions, bounded-memory checks, 5,000 Atheris smoke runs, reproducible packaging, Windows coverage, and Node 24 action runtimes.

Verification

• 62 tests collected; 59 passed and 3 expected platform skips on the release host
• Ruff and strict Mypy passed
• all ten pull-request and post-merge GitHub jobs passed
• wheel and source archive reproduced byte-for-byte across clean isolated builds
• the wheel passed a clean-install pack, quick/full verify, explain, unpack, and canonical telemetry smoke test

Current boundary

Canonical telemetry is still memory-resident, so I capped both its encoded and reconstructed forms at 64 MiB and added structural amplification checks. Ordinary files are streamed. For hostile extraction, use a new privately owned output directory that another untrusted process cannot modify concurrently.

The release remains marked as a prerelease because LowPack is still alpha.

LowPack 0.1.2 — The personal documentation release

I built LowPack as a personal project, but parts of the documentation had
started to sound like they came from a product committee. v0.1.2 is me bringing
the explanation back to the original voice: clear about what I was thinking,
honest about the alpha edges, and still precise where the bytes and security
rules matter.

What changed

The README now starts with the simple idea behind LowPack: prepare data for how
it will be stored and used, then rely on proven lossless codecs. I also rewrote
the surrounding guidance so profiles, determinism, security, benchmarking, and
limitations explain why I made each choice instead of only listing behavior.

Oh! The review caught one factual mismatch too. The limitations page said
source dictionary training was inactive, but LowPack already performs bounded,
deterministic training and authenticates the dictionary in the manifest. That
reference is now accurate.

The exact binary tables, safety limits, benchmark values, and compatibility
warnings remain technical on purpose. Personal does not mean vague.

A small guardrail for later

I added a documentation-integrity test that keeps the package version,
changelog, local Markdown links, and README cover image aligned. It is a small
test, but it protects the details readers notice first.

Validation

• 32 tests passed; one Windows symlink test skipped where symlink privileges
  are unavailable.
• Ruff and strict Mypy passed.
• Pull-request and merged-main matrices passed on Python 3.9–3.14.
• Every local Markdown link and the cover asset passed the new integrity test.
• Wheel and source distribution reproduced byte-for-byte.
• A clean wheel installation completed pack, full verify, and unpack.

Install

python -m pip install lowpack-0.1.2-py3-none-any.whl
lowpack --version

This is still an experimental alpha. I would keep the original data, verify
untrusted archives fully, and read the security guidance before extraction.

LowPack 0.1.1

LowPack 0.1.1 is a maintenance alpha release focused on publication and
packaging reliability. The .lpk format and archive behavior are unchanged
from 0.1.0.

Improvements

• Prevents release-tag pushes from launching a duplicate CI matrix.
• Adds manual CI dispatch, least-privilege workflow permissions, and
  concurrency cancellation for superseded runs.
• Adds package repository, documentation, issue, and changelog URLs.
• Adds package discovery keywords and live CI/release/Python/license badges.
• Supports version-scoped SHA256SUMS generation for clean release assets.

Validation

• 30 local tests passed; one Windows symlink test skipped where symlink
  privileges are unavailable.
• Ruff and strict Mypy passed.
• Pull-request and merged-main CI matrices passed on Python 3.9–3.14.
• Wheel and source distribution reproduced byte-for-byte across consecutive
  isolated builds.
• A clean wheel installation completed pack, full verify, and unpack.

Install

Download the wheel below and run:

python -m pip install lowpack-0.1.1-py3-none-any.whl
lowpack --version

This remains an experimental alpha. Review the README security guidance before
extracting untrusted archives.

LowPack 0.1.0

Changelog

0.1.0 - 2026-07-29

• Initial alpha .lpk format, CLI, Python API, profiles, safe extraction,
  deterministic manifests, deduplication, verification, and benchmarks.