views-datafactory 1.11.0

Governance repair. src/ is untouched — the wheel is byte-identical to v1.10.0 apart from metadata.

Upgrading

pip install --upgrade views-datafactory

One thing changes for you: the views-frames floor moves from >=1.0 to >=1.10.2. If your environment pins views-frames below 1.10.2, resolution will now fail. That is deliberate.

Why the floor moved

views-frames changed how the summary statistics are computed, three times, all shipped MINOR so none of it reads as breaking:

Version	Change
1.2.0	outside-in HDI tower + mass-aware tip — "fixes a silent" error
1.3.0	no magnitude-based zeroing by default
1.9.0	tower-tip MAP: tip_mass 0.5 → 0.25 — "Behavior change to tower_point/summarize_tower outputs"

A floor of >=1.0 admitted all three semantics. Worse, it froze one: uv lock keeps an existing pin while it still satisfies the constraint, so our lockfile held views-frames 1.0.0 from June until 2026-08-02, and six weeks of CI ran against pre-amendment MAP/HDI.

This package does not import the estimators — and that is irrelevant. A floor constrains the resolver, not the import list. Registered as C-337; views-frames#237 filed upstream, because CONFORMANCE_FLOOR = "1.0.0" reads as a safe dependency floor and is not one.

Also in this release

Release procedure (#402). Two guides described contradictory rituals and the more detailed one prescribed git merge development --ff-only and git push origin development — both forbidden by branch protection since July. Consolidated into publishing_to_pypi.md, with the post-release back-merge that had been silently skipped after every release before v1.10.0. release-topology.yml now detects the divergence daily.

Monitoring. C-335 closed — the serving path is now watched from outside the host and verified live. Previously, if the web server stopped while the machine stayed up, the pipeline kept succeeding, kept pinging, and nothing ever noticed. The freshness half is serving-freshness.yml rather than a paid vendor feature — and the drill found ADR-051's specification of that check was itself wrong (it would have matched the page's own legend), so buying it would not have helped.

Documentation. validate_docs.sh now runs in CI as a required check, having previously run nowhere at all. Full audit of 54 ADRs and 34 CICs: ten line-number citations replaced with symbol names, references to a package another repo deleted annotated rather than erased, and a contract written for load_dataset — the public consumer entry point, which had none while 32 config dataclasses did.

Operational. C-330 resolved on the server: logrotate had been pointing at a path the pipeline left months earlier, and missingok made it exit successfully every night for four months. C-339 registered — the pipeline log was destroyed by a badly-formed command during that fix.

Full changelog: v1.10.0...v1.11.0

views-datafactory 1.10.0

Dependency hygiene and governance repair. Minor, not patch — the dependency set changed for consumers.

Upgrading

pip install --upgrade views-datafactory        # or: views-datafactory[pandas]

Nothing breaks. pandas is now declared as an optional extra rather than a required dependency, but you will still get pandas either way — xarray requires it. See the caveat below.

Packaging

• pandas moved to a [pandas] extra. Honest caveat: this gates nothing today. xarray is a required dependency and xarray requires pandas, so no installable configuration of this package lacks it — verified per-package in a clean venv. The change makes pandas not imported, not not installed. #381 asks whether the remote zarr reader can drop xarray; that is what would make the extra real.
• Import purity is enforced by subprocess probes. In-process assertions are worthless once pytest has loaded the module.
• matplotlib is still a required dependency, deliberately. It was demoted, then restored: views-hydranet imports it at module level without declaring it, and four views-models environments receive it through us. Removing it would break clean builds while leaving upgraded local environments green, because pip never prunes orphaned transitive dependencies. Tracked as views-hydranet#215.
• Adapters split so legacy and frame-native outputs no longer share a file.

Consumer surface

• load_dataset(storage_options=...) — a new data source can supply its own credentials instead of waiting on a netrc entry on our server. Local paths are unaffected.

Security and governance

• Branch protection on main and development with enforce_admins: true. No bypass, including for the owner.
• All GitHub Actions pinned to commit SHAs.
• Credential redaction at the shared HTTP layer — API tokens no longer reach logs or tracebacks via request URLs.
• ADR-026 gained a credential ownership table with named roles and review dates, and its incorrect "Public GitHub is safe" claim was corrected.
• C-330 retracted. It claimed no log rotation existed; rotation had been configured on the server since 2026-03-31. The entry inferred world state from repository contents.
• C-164 re-audited: half its deferred inventory was already complete, and its "9 sources" unit counted no artifact in the repo. Corrected in eight places.

Verification

ruff clean · full suite 2320 passed · twine check 2 PASSED · wheel contains only the nine datafactory_* packages · sdist contains no reports/, docs/, or data/.

Full changelog: v1.9.0...v1.10.0

views-datafactory 1.9.0

First public release — now on PyPI: pip install views-datafactory.

Highlights

• Repository is now public and the package is published to PyPI via Trusted Publishing (OIDC, no stored tokens)
• First-time-user guide: docs/guides/model_consumer_quickstart.md — from nothing to running a datafactory-backed views-models model
• Guides index: docs/guides/README.md; credential guide now covers all tokens (UCDP, ACLED, GDL) and the data-server netrc setup
• House install convention: views-datafactory>=X.Y.Z from PyPI (replaces git+...@development pins)
• Docs convention: code examples use DEFAULT_REMOTE, never a hardcoded server address

Fixes

• C-319: test-suite lock contamination (42 errors per full run since v1.8.1)
• C-320: deploy-gate tests red in CI on every branch — CI is green again
• C-321: credential-less remote queries now raise the documented PermissionError with a netrc hint (was a raw aiohttp 401)

Security

• Server SSH hardened to key-only (password auth disabled, verified live)
• C-318: HTTP cleartext-auth trade-off consciously recorded in the risk register

Data access remains credential-gated: the package contains code only; the served data requires ~/.netrc credentials from the data factory administrator.