ResearchAuditKit v0.1.0-rc.3

ResearchAuditKit v0.1.0-rc.3

Overview

RC3 is an experimental GitHub prerelease of a local-first release-engineering
and integrity toolkit for ML research repositories. It introduces the unified
AUDIT → FREEZE → VERIFY → GATE product workflow while preserving the existing
command surface. There is no stable release and no PyPI, TestPyPI, or GitHub
Marketplace publication.

Highlights

• Add zero-configuration rak audit [PATH] with optional explicit project
  policy support.
• Emit deterministic human output and canonical
  researchauditkit.audit/v1 JSON without timestamps or host-absolute target
  paths.
• Reject absolute, traversing, non-canonical, and symlink-escaping
  policy.required_files entries before inventory or hashing, without
  disclosing rejected values.
• Add a self-bootstrapping composite GitHub Action at the exact versioned ref
  ernestoleo777-dotcom/ResearchAuditKit@v0.1.0-rc.3.
• Preserve every existing command, policy, schema, and valid-policy output
  contract.

GitHub Action boundary

The Action provisions SHA-pinned actions/setup-python, fixed Python 3.12.14,
and hash-locked PyYAML 6.0.3. Bootstrap therefore requires GitHub Action and
Python package infrastructure. Repository analysis then runs locally on the
runner: repository contents are not uploaded, target-project dependencies are
not installed, and target-project code is not executed. No hosted
ResearchAuditKit service is required.

No mutable v0, v0.1, main, or latest Action alias is published. Users
seeking maximum immutability may pin the annotated tag's resolved commit SHA.

Compatibility evidence

The release commit is gated by the complete test suite on Ubuntu with Python
3.10, 3.11, and 3.12, plus end-to-end execution of all eight composite-Action
scenarios. Existing Node.js runtime and punycode deprecation warnings from
upstream Actions remain known warnings; they are not functional failures and
were not changed for RC3.

Installation

Install the verified wheel from this GitHub prerelease and check it against the
published SHA256SUMS and RC3_RELEASE_MANIFEST.json:

python -m pip install \
  "https://github.com/ernestoleo777-dotcom/ResearchAuditKit/releases/download/v0.1.0-rc.3/research_audit_kit-0.1.0rc3-py3-none-any.whl"
rak --version

Adoption and non-claims

CoordCap remains the one verified, self-owned public consumer through its RC2
CLI integration. It is not independent adoption and is not evidence of RC3
Action consumption. The independent external consumer count remains zero.

ResearchAuditKit makes mechanical observations over local files and declared
policies. It does not certify scientific correctness, reproducibility,
replicability, paper validity, peer-review acceptance, or claim truth.

Release assets

The prerelease attaches exactly four custom assets: the wheel, sdist,
SHA256SUMS, and RC3_RELEASE_MANIFEST.json. The manifest binds the merge
commit, tree, CI evidence, build environment, filenames, sizes, and SHA-256
values. No cross-build byte-reproducibility claim is made.

ResearchAuditKit v0.1.0-rc.2

ResearchAuditKit v0.1.0-rc.2

Overview

RC2 is an experimental release candidate for an offline repository-integrity and
evidence-accounting toolkit. GitHub prereleases are its distribution channel.
There is no stable release and no PyPI or TestPyPI distribution.

RC1 to RC2 changes

• Add prediction-seal and prediction-verify for local consistency records over
  opaque declarations.
• Add isolation-audit for declared workspace structure, overlap, path, and
  escaping-symlink checks.
• Add evidence-index for deterministic role-labelled evidence inventories.
• Reject duplicate keys and unsafe portable references in the new closed JSON
  contracts.
• Add machine-readable outputs and documented exit semantics for the four commands.
• Add a tested three-minute synthetic demo, command/use-case/limitation/architecture
  documentation, and minimal issue/pull-request templates.
• Include curated public documentation and the synthetic demo in the sdist while
  keeping the wheel runtime-focused.
• Declare hermetic build-test dependencies and retain the Python 3.10-3.12 Ubuntu
  CI matrix.
• Narrow public positioning to mechanical repository checks with explicit
  scientific, publication, and project-decision nonclaims.

The detailed classification is in RC1 to RC2 Delta.

Installation

Install from a reviewed source checkout:

python -m pip install .
rak --version

Or install the verified wheel from the GitHub prerelease:

python -m pip install "https://github.com/ernestoleo777-dotcom/ResearchAuditKit/releases/download/v0.1.0-rc.2/research_audit_kit-0.1.0rc2-py3-none-any.whl"

The GitHub prerelease is the distribution channel. No PyPI or TestPyPI
publication is claimed.

Quick Start

Use the single maintained three-minute Quick Start. Its source
installation, help/version check, PASS inventory, intentional exit-2 inventory,
and stable summary projections are executed by the automated productization test.

Compatibility

• Python 3.10 / Ubuntu: tagged-release-commit CI pass.
• Python 3.11 / Ubuntu: tagged-release-commit CI pass.
• Python 3.12 / Ubuntu: tagged-release-commit CI pass.
• Python 3.13 / macOS arm64: local candidate acceptance evidence.
• macOS arm64: local build, installation, CLI, and demo evidence.
• Windows: unverified. The Quick Start uses POSIX shell syntax, and Windows path,
  activation, symlink, and permission behavior has not received full acceptance.

The tagged release commit passed the repository's Ubuntu CI matrix on Python
3.10, 3.11, and 3.12 before the annotated tag and prerelease were created. The
release asset manifest binds the exact commit and CI run identifiers.

Public CLI compatibility

Area	RC1 to RC2 result
Added commands	prediction-seal, prediction-verify, isolation-audit, evidence-index
Changed shared commands	None found in parser/handler diff for the ten RC1 commands
Removed or renamed commands	None
New output schemas	Seal JSON, isolation audit JSON, evidence index JSON/CSV, and summaries for the new commands
Existing output/schema changes	None found for RC1 commands
New overwrite behavior	prediction-seal refuses replacement unless --force
Existing overwrite changes	None found
New exit behavior	Verification/isolation findings return 2; valid evidence indexing returns 0
Existing exit-code changes	None found

No intentional public CLI breaking change was found for the ten commands shared
with RC1. The version output changes to 0.1.0rc2, and the API remains experimental.

Limitations

• Mechanical verification only; supplied policies and metadata can be incomplete.
• No scientific-validity, causal-validity, claim-truth, novelty, or correctness
  judgment.
• No project scoring, publication prediction, acceptance estimate, or continue/stop
  decision.
• No general reproducibility guarantee.
• Local hashes and seals do not establish authorship or an external timestamp.
• Filesystem case, symlink, permission, special-file, and platform behavior can
  affect results; Windows is unverified.
• No external adoption, effectiveness, or performance evidence is claimed.

Security and privacy

Runtime commands are local/offline and package source does not import network
clients. The toolkit does not execute audited repository code. Portable-reference
checks reject absolute and escaping paths where those closed contracts apply, but
not every user-supplied string is a sanitized publication field. Reports can expose
filenames, paths, sizes, hashes, timestamps, and supplied metadata. Users must
review policies, inputs, output directories, permissions, and reports before
sharing them.

Artifact integrity

The GitHub prerelease includes SHA256SUMS and
RC2_RELEASE_MANIFEST.json. The manifest binds the tag target, source tree, CI
evidence, build environment, artifact names, sizes, and SHA-256 values. Verify the
downloaded assets with the published checksum file. The checksums apply to those
release assets only; no cross-build byte-reproducibility claim is made.

Upgrade notes

Existing RC1 commands require no documented argument migration. New commands are
opt-in. Consumers that assert the CLI version must update the expected value from
0.1.0rc1 to 0.1.0rc2. Consumers adopting the new JSON contracts should account
for their closed-field, duplicate-key, identifier, and portable-reference checks.

ResearchAuditKit v0.1.0-rc.1

ResearchAuditKit v0.1.0-rc.1

This pre-release provides local repository-integrity inventory and verification, versioned baselines, empirical marginal, joint, and conditional support audits, Pareto contamination diagnostics, split/leakage metadata audits, governance gates, claim matrices, protocol-deviation records, negative-result preservation, a local CLI, and synthetic examples.

It includes Apache-2.0 licensing and packaging metadata, plus Python 3.10-compatible TOML parsing for release-metadata tests. CI covers Python 3.10, 3.11, and 3.12.

This is a pre-release engineering utility, not a scientific method or benchmark. It does not establish scientific correctness or physical feasibility; empirical support is not physical feasibility; metadata leakage checks can remain unverified; and local manifests can contain filenames and hashes that should be reviewed before sharing. It does not guarantee complete leakage detection or publication acceptance.