Skip to content

fix: include the service extra in release and installation audits - #100

Merged
ma2za merged 1 commit into
mainfrom
review/service-extra-contract
Oct 11, 2026
Merged

fix: include the service extra in release and installation audits#100
ma2za merged 1 commit into
mainfrom
review/service-extra-contract

Conversation

@ma2za

@ma2za ma2za commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

The new service extra is declared in package metadata, but release verification still expects only the previous six extras. Every current PR therefore fails package verification after incorporating main.

Add the service extra to the explicit release contract and isolated install audits. Base imports continue to reject service frameworks; the service audit permits those frameworks while rejecting optional ML imports and blocking network access. A regression check compares all declared extras with both audit inventories.

Validation: 11 release-verifier tests, Ruff and mypy passed; wheel and sdist built and release verification passed. All seven extras passed clean isolated installation audits, including service import with network access blocked. This is a prerequisite packaging correction; no detector, model, threshold or base dependency changes.

This was referenced Oct 10, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
@ma2za
ma2za merged commit 0cedbd3 into main Oct 11, 2026
19 checks passed
@ma2za
ma2za deleted the review/service-extra-contract branch October 11, 2026 07:39
ma2za added a commit that referenced this pull request Oct 11, 2026
@mazzasaverio @ma2za
fix(quality): reject incomplete release evidence and approvals (#95)
b0edb97 
The quality gate returned SHIP with absent external evaluation, a
missing critical entity or infinite external F1. Reject
incomplete/invalid evidence, compare critical annotation support and
report which entities actually have observations. The release verifier
now requires all five criteria to pass explicitly and rejects legacy
skipped external evaluations. Count-based F1 avoids division by zero for
zero-TP entities.

Validation: three tests reproduced false approval; 40 focused tests
passed after correction. Full CI passed 545 tests per matrix job with
95.00% to 95.06% coverage, plus quality, docs, performance, property,
packaging and installed-wheel checks:
https://github.com/ma2za/pseudonymize/actions/runs/36973630305 .
Detector behavior and quality tolerances are unchanged. Reconciling the
roadmap's stricter exact-boundary improvement protocol remains separate
work, explicitly documented here.


### Current review status

Review priority: 2 of 9; PR #100 is the packaging prerequisite. Updated
against main `17e8fcc` while preserving development version 1.37.0 and
the hosted-service changes. Includes the shared service-extra audit
correction from #100. No PR has been merged.

Current branch validation: 41 focused tests passed; Ruff
formatting/lint, mypy, wheel/sdist builds and release verification
passed. Fresh CI on the current head completed with 18 successful
checks, one skipped check, and no failures.

---------

Co-authored-by: Paolo Mazza <mazzapaolo2019@gmail.com>
ma2za added a commit that referenced this pull request Oct 11, 2026
@mazzasaverio @ma2za
fix(bench): count matches correctly and keep diagnostics value-safe (#94
d5efa91 
)

The local benchmark updated matched truth outside the matching loop,
producing incorrect one-to-one accounting and UnboundLocalError for
empty/disjoint inputs. Correct the loop and verify exact TP/FP/FN,
precision, recall and F1. Explanation logs now emit row/type/offsets
without source values; optional ML imports are lazy and importing the
module no longer configures the root logger.

Validation: six new cases failed before the fix; 13 focused tests passed
afterwards. Full CI passed 531 tests per matrix job with 95.15% to
95.22% coverage, plus quality, docs, performance, property, packaging
and installed-wheel checks:
https://github.com/ma2za/pseudonymize/actions/runs/36973067973 . This
repairs the local harness and does not revise the separate published
quality baseline.


### Current review status

Review priority: 3 of 9; PR #100 is the packaging prerequisite. Updated
against main `17e8fcc` while preserving development version 1.37.0 and
the hosted-service changes. Includes the shared service-extra audit
correction from #100. No PR has been merged.

Current branch validation: 24 focused tests passed; Ruff
formatting/lint, mypy, wheel/sdist builds and release verification
passed. Fresh CI on the current head completed with 18 successful
checks, one skipped check, and no failures.

---------

Co-authored-by: Paolo Mazza <mazzapaolo2019@gmail.com>
ma2za added a commit that referenced this pull request Oct 11, 2026
@mazzasaverio @ma2za
fix(memory): keep Bloom membership correct after insertion (#91)
82bb39a 
A negative Bloom filter lookup remained cached after insertion, hiding
newly added entries. Clear membership caches after add(), validate
parameters and allocate at least one bit. Regression tests cover cached
misses, Unicode, repeated additions, existing members and invalid
sizing.

Validation: 11 focused tests passed. Full CI passed 528 tests per
test-matrix job with 95.15% coverage, plus quality, docs, performance,
property, packaging and installed-wheel checks. Local full-suite
execution ended with exit 137 during ONNX, so CI supplies that evidence:
https://github.com/ma2za/pseudonymize/actions/runs/36972349695 . No
detector thresholds or dependencies change.


### Current review status

Review priority: 4 of 9; PR #100 is the packaging prerequisite. Updated
against main `17e8fcc` while preserving development version 1.37.0 and
the hosted-service changes. Includes the shared service-extra audit
correction from #100. No PR has been merged.

Current branch validation: 20 focused tests passed; Ruff
formatting/lint, mypy, wheel/sdist builds and release verification
passed. Fresh CI on the current head completed with 18 successful
checks, one skipped check, and no failures.

---------

Co-authored-by: Paolo Mazza <mazzapaolo2019@gmail.com>
ma2za added a commit that referenced this pull request Oct 11, 2026
@mazzasaverio @ma2za
docs: make the README quickstart executable and accurate (#93)
8f74bc5 
The first README quickstart failed because it expected <EMAIL_1> while
the package emits <EML_1>. Align aliases and execute all Python examples
in an integration test, providing the file example's input in a
temporary directory. Also label the historical benchmark as overlap
scoring and document the heuristic streaming boundary limitation.
Library behavior and token formats do not change.

Validation: 11 focused README/stream/session tests passed. Full CI
passed 525 tests per matrix job with 95.00% to 95.06% coverage, plus
quality, docs, performance, property, packaging and installed-wheel
checks: https://github.com/ma2za/pseudonymize/actions/runs/36972876550 .
The README async function is compiled by the new test; existing
integration tests exercise asynchronous streaming.


### Current review status

Review priority: 5 of 9; PR #100 is the packaging prerequisite. Updated
against main `17e8fcc` while preserving development version 1.37.0 and
the hosted-service changes. Includes the shared service-extra audit
correction from #100. No PR has been merged.

Current branch validation: 12 focused tests passed; Ruff
formatting/lint, mypy, wheel/sdist builds and release verification
passed. Fresh CI on the current head completed with 18 successful
checks, one skipped check, and no failures.

---------

Co-authored-by: Paolo Mazza <mazzapaolo2019@gmail.com>
ma2za added a commit that referenced this pull request Oct 11, 2026
@mazzasaverio @ma2za
perf(coreference): avoid rebuilding growing regex alternations (#92)
a2e030e 
Coreference detection rebuilt a regex alternation containing every
learned token for every block. Replace that with a Unicode word scan and
exact dictionary lookup, preserving offsets, case, confidence and
boundaries. Add generated equivalence tests and a comparative benchmark
at 100, 1,000 and 10,000 tokens. Large scopes improve locally; small
scopes can be slightly slower.

Validation: 6 focused tests and 6 benchmark cases passed. Full CI passed
527 tests per matrix job with 95.00% to 95.07% coverage, plus quality,
docs, performance, property, packaging and installed-wheel checks:
https://github.com/ma2za/pseudonymize/actions/runs/36972557134 . No
detection-quality improvement is claimed.


### Current review status

Review priority: 6 of 9; PR #100 is the packaging prerequisite. Updated
against main `17e8fcc` while preserving development version 1.37.0 and
the hosted-service changes. Includes the shared service-extra audit
correction from #100. No PR has been merged.

Current branch validation: 17 focused tests passed; Ruff
formatting/lint, mypy, wheel/sdist builds and release verification
passed. All six comparative coreference benchmark cases passed; these
measure lookup cost and do not establish a detection-quality
improvement. Fresh CI on the current head completed with 18 successful
checks, one skipped check, and no failures.

---------

Co-authored-by: Paolo Mazza <mazzapaolo2019@gmail.com>
ma2za added a commit that referenced this pull request Oct 11, 2026
@mazzasaverio @ma2za
docs: prioritize product improvements from implementation evidence (#96)
6c6ac13 
The roadmap mixes historical release inventory with current priorities
and names extras that are not declared by the package. Add a
source-backed product review, link it from VISION/ROADMAP and
documentation navigation, and align the current extra list with
pyproject.toml.

The review connects five implemented PRs (#91 through #95) to their
product value, then prioritizes remaining contract, resource,
integration and measurement work with explicit acceptance conditions. It
retains the local-first dependency-free vision and distinguishes
source-grounded privacy proposals from dynamically validated findings.
It makes no new model-quality, certification or release-publication
claim.

Validation: pre-commit, strict mypy, strict docs build, package build,
release verifier and git diff --check passed. Full CI, including the
Linux/Windows test matrix, property tests and installed-wheel checks,
passed: https://github.com/ma2za/pseudonymize/actions/runs/36974122837 .
Documentation and performance workflows also passed. The additional
isolated privacy harness could not start because namespace setup was
denied, which is recorded as a validation limit. No production service
was probed or changed.


### Current review status

Review priority: 7 of 9; PR #100 is the packaging prerequisite. Updated
against main `17e8fcc` while preserving development version 1.37.0 and
the hosted-service changes. Includes the shared service-extra audit
correction from #100. No PR has been merged.

Current branch validation: 11 focused tests passed; Ruff
formatting/lint, mypy, wheel/sdist builds and release verification
passed. Strict documentation build passed. Fresh CI on the current head
completed with 18 successful checks, one skipped check, and no failures.

---------

Co-authored-by: Paolo Mazza <mazzapaolo2019@gmail.com>
ma2za added a commit that referenced this pull request Oct 11, 2026
@dependabot @ma2za
chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.2.0 (#90)
9629a8f 
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from
10.0.1 to 10.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's
releases</a>.</em></p>
<blockquote>
<h2>v10.2.0 🌈 Disable automatic cache saves for merge queues</h2>
<h2>Changes</h2>
<p>This release contains the known-checksum of the most recent uv
releases and also disabled the uploading(saving) of the cache when in a
merge queue since theses caches would almost never be used.</p>
<h2>🚀 Enhancements</h2>
<ul>
<li>Disable automatic cache saves for merge queues <a
href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1056">#1056</a>)</li>
</ul>
<h2>🧰 Maintenance</h2>
<ul>
<li>chore: update known checksums for 0.12.17 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1058">#1058</a>)</li>
<li>chore: update known checksums for 0.12.16 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1057">#1057</a>)</li>
<li>chore: update known checksums for 0.12.15 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1054">#1054</a>)</li>
<li>chore: update known checksums for 0.12.14 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1053">#1053</a>)</li>
<li>chore: update known checksums for 0.12.13 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1045">#1045</a>)</li>
</ul>
<h2>📚 Documentation</h2>
<ul>
<li>docs: update version references to v10.1.0 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1044">#1044</a>)</li>
</ul>
<h2>⬆️ Dependency updates</h2>
<ul>
<li>chore(deps): roll up Dependabot updates <a
href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1059">#1059</a>)</li>
</ul>
<h2>v10.1.0 🌈 New output <code>python-runtime-id</code>and respect
NO_PROXY</h2>
<h2>Changes</h2>
<p>This release adds more bheind the scene security improvements and
also 2 small improvements.</p>
<h3>NO_PROXY</h3>
<p>This action now respects <code>no_proxy/NO_PROXY</code> environment
variables which were previously ignored.</p>
<h3>New output <code>python-runtime-id</code></h3>
<p>The new output <code>python-runtime-id</code> can be used to know
which python version exactly was installed if you use
<code>activate-environment</code>. See <a
href="https://redirect.github.com/pyca/cryptography/pull/15572#discussion_r3913508686">pyca/cryptography#15572</a>
for details on why this can be useful.</p>
<h2>🐛 Bug fixes</h2>
<ul>
<li>fix: respect no proxy directive <a
href="https://github.com/mj0nez"><code>@​mj0nez</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1037">#1037</a>)</li>
<li>Use JSON + a typed wrapper instead of TS codegen <a
href="https://github.com/woodruffw"><code>@​woodruffw</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1025">#1025</a>)</li>
</ul>
<h2>🚀 Enhancements</h2>
<ul>
<li>Expose a Python &quot;identity&quot; output <a
href="https://github.com/woodruffw"><code>@​woodruffw</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1036">#1036</a>)</li>
<li>Verify downloads with astral-sh/versions checksums <a
href="https://github.com/zaniebot"><code>@​zaniebot</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1033">#1033</a>)</li>
</ul>
<h2>🧰 Maintenance</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/c18668ad3cf93ea998bef934396af7bb5c839dc7"><code>c18668a</code></a>
chore(deps): roll up Dependabot updates (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1059">#1059</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/ffe14763056ca34ecd158146a9fc7e144c8a2753"><code>ffe1476</code></a>
chore: update known checksums for 0.12.17 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1058">#1058</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/f5548c55522a1db0af3c84f2af3d058bc9bc2de2"><code>f5548c5</code></a>
chore: update known checksums for 0.12.16 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1057">#1057</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/a761a4e9afd7b2f353ae020bd6d3a3af34c6c4d5"><code>a761a4e</code></a>
Disable automatic cache saves for merge queues (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1056">#1056</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/3377a30666f438759955882b3eba6a92b2b29b12"><code>3377a30</code></a>
chore: update known checksums for 0.12.15 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1054">#1054</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/dfb5f386776afcea37f271f3b656318d9949b9f1"><code>dfb5f38</code></a>
chore: update known checksums for 0.12.14 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1053">#1053</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/45c121f982720f3bdf236c2ac06f126ca211949c"><code>45c121f</code></a>
chore: update known checksums for 0.12.13 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1045">#1045</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/8073452fd4b566e886f04f731bcdbd8332b0b779"><code>8073452</code></a>
docs: update version references to v10.1.0 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1044">#1044</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/bec219d24cd3e171d82865faccec33120bb574f4"><code>bec219d</code></a>
chore(deps-dev): roll up Dependabot updates (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1043">#1043</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/b90ec40d15bfa44c33c6700196eb6efcdddb4373"><code>b90ec40</code></a>
fix: respect no proxy directive (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1037">#1037</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/setup-uv/compare/20cfd1bf945f4377ade1205e4dbc17946fc9a30d...c18668ad3cf93ea998bef934396af7bb5c839dc7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/setup-uv&package-manager=github_actions&previous-version=10.0.1&new-version=10.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

### Current review status

Review priority: 8 of 9; PR #100 is the packaging prerequisite. Updated
against main `17e8fcc` while preserving development version 1.37.0 and
the hosted-service changes. Includes the shared service-extra audit
correction from #100. No PR has been merged.

Current branch validation: 11 focused tests passed; Ruff
formatting/lint, mypy, wheel/sdist builds and release verification
passed. Fresh CI on the current head completed with 18 successful
checks, one skipped check, and no failures.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Paolo Mazza <mazzapaolo2019@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
ma2za added a commit that referenced this pull request Oct 11, 2026
@dependabot @ma2za
chore(deps): update seven dependencies while retaining PyArrow compat…
b3abd0a 
…ibility (#98)

Update seven development and optional dependencies against current main:
build 1.6.1, fpdf2 2.8.9, httpx2 2.13.1, hypothesis 6.168.3, mypy 2.4.0,
onnxruntime 1.30.0, and ruff 0.16.10, plus their required transitive
dependencies.

Preserve `pyarrow>=19.0.0,<20.0.0` and locked PyArrow 19.0.1. The
previous proposed major upgrade would undo the Windows Smart App Control
compatibility cap recorded in the 1.35 changelog. Preserve development
version 1.37.0 and current hosted-service changes.

Includes the shared packaging prerequisite in PR #100 so fresh package
CI can run; review that correction separately before merging dependent
PRs.

Validation: frozen installation of all extras and groups; 597 tests
passed with 95.24% coverage on the dependency update before the
packaging-only prerequisite; Ruff formatting/lint and mypy passed. The
new packaging contract regression and artifact verification passed. No
detector tuning, model changes or benchmark-score claims.


### Current review status

Review priority: 9 of 9; PR #100 is the packaging prerequisite. Updated
against main `17e8fcc` while preserving development version 1.37.0 and
the hosted-service changes. Includes the shared service-extra audit
correction from #100. No PR has been merged.

Current branch validation: 11 focused tests passed; Ruff
formatting/lint, mypy, wheel/sdist builds and release verification
passed. Fresh CI on the current head completed with 18 successful
checks, one skipped check, and no failures.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Paolo Mazza <mazzapaolo2019@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ma2za