Skip to content

chore(release): cut v0.9.0 - #1349

Merged
seonghobae merged 1 commit into
mainfrom
release/0.9.0-version-bump
Aug 24, 2026
Merged

seonghobae merged 1 commit into
mainfrom
release/0.9.0-version-bump

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Summary

Bumps the project version from the never-tagged 0.8.0 straight to 0.9.0 (minor, since Unreleased's ### Added contains genuinely new features, not just fixes) and cuts a fresh, honest changelog release covering everything that has accumulated in Unreleased since the (unpublished) 0.8.0 attempt.

Background: 0.8.0 was bumped in pyproject.toml/Cargo.toml by #966 (676ed7e) on 2026-08-17, but the corresponding Release Tag workflow_dispatch was never successfully run — both attempts failed on a changelog-fragment-drift check (since fixed) — so v0.8.0 was never actually tagged or published to PyPI. Rather than retroactively tag current main HEAD as the stale "0.8.0", this PR cuts fresh at 0.9.0 covering the ~714 lines of real merged work.

Version bump

File Old New
pyproject.toml 0.8.0 0.9.0
crates/mlsirm-core/Cargo.toml 0.8.0 0.9.0
crates/fast-mlsirm-py/Cargo.toml 0.8.0 0.9.0
Cargo.lock (root, mlsirm-core entry) 0.8.0 0.9.0
crates/fast-mlsirm-py/Cargo.lock (fast-mlsirm-py + mlsirm-core entries) 0.8.0 0.9.0
uv.lock (fast-mlsirm entry) 0.8.0 0.9.0
SECURITY.md / SUPPORT.md supported-line 0.8.x 0.9.x

Third-party bit-set/bit-vec crate pins (also 0.8.0 in Cargo.lock) and package_version="0.8.0" test fixtures in tests/test_cross_engine_*.py (arbitrary example strings for an isolated external engine's version in the cross-engine conformance contract, unrelated to this package) are intentionally left untouched. docs/product-technical-gap-baseline.md is an explicitly non-authoritative, commit-pinned point-in-time snapshot and is also left untouched.

Changelog cut

Followed the exact pattern established by the actual merged 0.8.0 cut (676ed7e, chore(release): cut v0.8.0 (#966)): added docs/changelog.d/release-0.9.0-cut.md, rendered it in isolation as the new small ## Unreleased managed block, inserted ## [0.9.0] - 2026-08-24, and moved the rest of the prior managed block below it as flat historical content. scripts/render_changelog_fragments.py --check CHANGELOG.md passes.

This PR also removes the stale, never-rendered docs/changelog.d/release-0.8.0-cut.md fragment left over from the abandoned 0.8.0 attempt — its content is not folded into 0.9.0's notes since it's already permanently recorded at the existing ## [0.8.0] - 2026-08-17 section, which is left untouched as history.

What's newly released in 0.9.0 (highlights)

Added:

  • Cross-engine conformance inventory/provenance/manifest-replay contracts for independent numerical conformance coverage against isolated external engines, without adding them as runtime dependencies.
  • A Rust-owned MAP estimator for crossed/weighted multiple-membership person effects u_h (Fox & Glas, 2001; Browne, Goldstein, & Rasbash, 2001), with CPU-multithreaded and optional GPU kernels.
  • A governed structural-model pair-decision gate (keeps factor retention separate from structure choice; routes to the relation-appropriate LR/bootstrap/Vuong procedure).
  • Reproducible, release-tag-bound PyPI sdist/wheel publishing with a project-version provenance check and pinned publisher revisions.
  • Buyer-facing item-bank lifecycle JSON/HTML reports.

Changed:

  • Production FitConfig/CLI backend selection is now restricted to Rust (rust or fail-closed auto); NumPy parity moved behind an explicit fit_reference API.
  • Rust toolchain pinned to exact 1.97.1 across all verification jobs (was a floating stable channel).

Fixed / Security:

  • A broad continuation of the hostile-callback/conversion-protocol hardening sweep across dozens of public entry points (CAT, ATA, DIF, equating, scaling, reliability, multilevel, response-time, fit-statistics, inference, linking, LLM-judge orchestration, parallel-analysis, rotation/loader concurrency, and more) that reject caller-defined subclasses and conversion providers before native dispatch.

Full detail is in the [0.9.0] - 2026-08-24 section of CHANGELOG.md.

Verification

All run locally against a fresh Python 3.12 venv (python3.12 -m venv .venv312 && .venv312/bin/python -m pip install -e ".[dev]", builds the Rust extension via maturin) and cleaned up afterward:

  • pytest5862 passed, 1 skipped (pre-existing, unrelated skip)
  • python -c "... resolve_backend(FitConfig().backend) == 'rust'" — rust backend confirmed default
  • cargo test --workspace — all suites ok, 0 failed
  • cargo test --manifest-path crates/fast-mlsirm-py/Cargo.toml — 9 passed, 0 failed
  • python scripts/release_acceptance.py --out acceptance_check --require-rust"status": "ok" across simulate/fit(auto+rust)/diagnostics/report steps
  • python scripts/render_changelog_fragments.py --check CHANGELOG.md — passes

Scope note

This PR only prepares the version bump and changelog cut, ready to merge. It does not trigger the Release Tag workflow, PyPI publish, or any workflow_dispatch — that is a separate, later step gated on this PR merging to main.

Co-authored-by: Claude noreply@anthropic.com


Generated by Claude Code


Open in Devin Review

Bump the project version from the never-tagged 0.8.0 to 0.9.0 (minor, since
Unreleased contains genuinely new features, not just fixes) in pyproject.toml,
crates/mlsirm-core, crates/fast-mlsirm-py, their lockfiles, and uv.lock, and
fold the accumulated Unreleased notes into a new [0.9.0] - 2026-08-24 release
section following the exact pattern established by 676ed7e (the actual
merged 0.8.0 cut): add a release-0.9.0-cut.md fragment, re-render it in
isolation as the new small Unreleased managed block, insert the version
heading, and move the rest of the prior managed block to become flat
historical content under it.

Also removes the stale, never-rendered docs/changelog.d/release-0.8.0-cut.md
fragment left over from the 0.8.0 release attempt that was never actually
tagged or published (its two workflow_dispatch attempts failed on a
changelog-fragment-drift check, since fixed). Its content is not folded into
0.9.0's notes since it is already permanently recorded at the existing
[0.8.0] - 2026-08-17 section, which is left untouched as history.

SECURITY.md and SUPPORT.md now advertise the 0.9.x support line, matching the
same precedent commit's treatment of the supported pre-1.0 minor line.

Verified: full pytest suite (5862 passed, 1 pre-existing skip), cargo test
--workspace, cargo test --manifest-path crates/fast-mlsirm-py/Cargo.toml, the
rust-backend-is-default assertion, and scripts/release_acceptance.py
--require-rust all pass against the bumped version.

Co-authored-by: Claude <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Too many files!

This PR contains 135 files, which is 35 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 65fdeb05-9d6d-4d54-bf40-03f72d6da102

📥 Commits

Reviewing files that changed from the base of the PR and between c26dac4 and c60dab7.

⛔ Files ignored due to path filters (3)
  • Cargo.lock is excluded by !**/*.lock
  • crates/fast-mlsirm-py/Cargo.lock is excluded by !**/*.lock
  • uv.lock is excluded by !**/*.lock
📒 Files selected for processing (135)
  • CHANGELOG.md
  • SECURITY.md
  • SUPPORT.md
  • crates/fast-mlsirm-py/Cargo.toml
  • crates/mlsirm-core/Cargo.toml
  • docs/changelog.d/1015-bounded-subprocess-integrity.md
  • docs/changelog.d/1019-judge-runtime-assertion-safety.md
  • docs/changelog.d/1030-item-bank-transition-replay-callback-safety.md
  • docs/changelog.d/1034-classification-cutscore-preflight.md
  • docs/changelog.d/1040-enterprise-request-record-callback-safety.md
  • docs/changelog.d/1042-enterprise-observation-callback-safety.md
  • docs/changelog.d/1044-enterprise-explicit-value-integer-safety.md
  • docs/changelog.d/1045-scoring-authorization-record-admission.md
  • docs/changelog.d/1049-ata-content-string-callback-safety.md
  • docs/changelog.d/1051-assessment-aggregate-record-admission.md
  • docs/changelog.d/1053-bifactor-control-boundary.md
  • docs/changelog.d/1057-rubric-generation-text-callback-safety.md
  • docs/changelog.d/1059-scoring-shared-enum-callback-safety.md
  • docs/changelog.d/1063-model-spec-record-admission.md
  • docs/changelog.d/1071-mokken-skew-recovery-contract.md
  • docs/changelog.d/1075-bounded-json-control-callback-safety.md
  • docs/changelog.d/1077-cross-engine-conformance-inventory.md
  • docs/changelog.d/1077-cross-engine-conformance-provenance.md
  • docs/changelog.d/1078-external-validation-profile.md
  • docs/changelog.d/1083-factor-retention-callback-safety.md
  • docs/changelog.d/1087-multilevel-text-callback-safety.md
  • docs/changelog.d/1090-pytest-repository-path.md
  • docs/changelog.d/1092-conformance-execution-provenance.md
  • docs/changelog.d/1094-conformance-runtime-provenance.md
  • docs/changelog.d/1096-conformance-manifest-replay.md
  • docs/changelog.d/1098-release-source-identity.md
  • docs/changelog.d/1101-buyer-source-identity.md
  • docs/changelog.d/1103-benchmark-source-identity.md
  • docs/changelog.d/1105-figma-source-provenance.md
  • docs/changelog.d/1107-workflow-registry-transport.md
  • docs/changelog.d/1109-commercial-release-source-identity.md
  • docs/changelog.d/1113-enterprise-gate-source-provenance.md
  • docs/changelog.d/1115-enterprise-gate-control-callbacks.md
  • docs/changelog.d/1117-changelog-fragment-marker-integrity.md
  • docs/changelog.d/1119-scoring-fingerprint-text-admission.md
  • docs/changelog.d/1121-io-duplicate-json-members.md
  • docs/changelog.d/1124-io-nonfinite-json.md
  • docs/changelog.d/1125-bounded-json-interoperability.md
  • docs/changelog.d/1128-subprocess-command-admission.md
  • docs/changelog.d/1131-population-label-int64-roundtrip.md
  • docs/changelog.d/1133-bratt-control-boundary.md
  • docs/changelog.d/1135-rag-evidence-replay-integrity.md
  • docs/changelog.d/1137-rt-semantic-control-safety.md
  • docs/changelog.d/1139-polytomous-fit-control-safety.md
  • docs/changelog.d/1143-essay-pointer-focus.md
  • docs/changelog.d/1148-twopl-control-callback-safety.md
  • docs/changelog.d/1150-polytomous-group-id-narrowing.md
  • docs/changelog.d/1152-cross-engine-conformance-report.md
  • docs/changelog.d/1153-cat-lossless-administration.md
  • docs/changelog.d/1154-polytomous-complex-response.md
  • docs/changelog.d/1155-crm-complex-response-admission.md
  • docs/changelog.d/1159-irtree-complex-admission.md
  • docs/changelog.d/1161-inference-complex-curvature.md
  • docs/changelog.d/1163-oakes-complex-admission.md
  • docs/changelog.d/1166-oakes-factor-id-int64.md
  • docs/changelog.d/1167-wle-complex-admission.md
  • docs/changelog.d/1169-lltm-admission.md
  • docs/changelog.d/1173-nominal-admission.md
  • docs/changelog.d/1175-gpcm-admission.md
  • docs/changelog.d/1177-mixture-response-admission.md
  • docs/changelog.d/1179-ksirt-input-admission.md
  • docs/changelog.d/1185-testlet-input-admission.md
  • docs/changelog.d/1187-mixed-response-admission.md
  • docs/changelog.d/1189-subscore-complex-admission.md
  • docs/changelog.d/1190-figma-adr-boundary.md
  • docs/changelog.d/1191-detect-evidence-admission.md
  • docs/changelog.d/1197-grm-evidence-admission.md
  • docs/changelog.d/1199-linking-evidence-admission.md
  • docs/changelog.d/1201-factor-input-admission.md
  • docs/changelog.d/1203-parallel-analysis-data-admission.md
  • docs/changelog.d/1205-hofstee-control-ordering.md
  • docs/changelog.d/1207-pypi-release-publishing.md
  • docs/changelog.d/1208-exposure-item-evidence.md
  • docs/changelog.d/1210-exposure-kl-evidence.md
  • docs/changelog.d/1212-deltaplot-group-admission.md
  • docs/changelog.d/1214-owen-admission.md
  • docs/changelog.d/1216-exposure-epv-admission.md
  • docs/changelog.d/1218-exposure-sympson-controls.md
  • docs/changelog.d/1220-exposure-sprt-admission.md
  • docs/changelog.d/1222-exposure-ci-admission.md
  • docs/changelog.d/1224-flexilevel-admission.md
  • docs/changelog.d/1225-equating-evidence-admission.md
  • docs/changelog.d/1227-test-design-admission.md
  • docs/changelog.d/1231-exposure-ccat-admission.md
  • docs/changelog.d/1235-1238-judge-weighted-score-boundary.md
  • docs/changelog.d/1240-rt-evidence-admission.md
  • docs/changelog.d/1241-rt-person-fit-control-safety.md
  • docs/changelog.d/1242-ebdif-evidence-admission.md
  • docs/changelog.d/1244-personfit-response-admission.md
  • docs/changelog.d/1245-dimtest-evidence-admission.md
  • docs/changelog.d/1246-rating-range-evidence-admission.md
  • docs/changelog.d/1249-reliability-evidence-admission.md
  • docs/changelog.d/1251-pairwise-reliability-evidence.md
  • docs/changelog.d/1252-icc-ratings-evidence.md
  • docs/changelog.d/1260-reliability-rater-evidence-admission.md
  • docs/changelog.d/1261-security-evidence-admission.md
  • docs/changelog.d/1274-rater-installer-recovery.md
  • docs/changelog.d/1300-ci-contract-drift.md
  • docs/changelog.d/565-crossed-multiple-membership-uh.md
  • docs/changelog.d/565-multilevel-finite-context-effects.md
  • docs/changelog.d/607-rag-request-replay-callback-safety.md
  • docs/changelog.d/608-model-comparison-casewise-trust-boundary.md
  • docs/changelog.d/608-structural-selection-governor.md
  • docs/changelog.d/609-item-bank-buyer-report.md
  • docs/changelog.d/609-item-bank-suspension-concerns.md
  • docs/changelog.d/626-reference-backend-boundary.md
  • docs/changelog.d/627-multilevel-m2-moment-covariance-rust.md
  • docs/changelog.d/627-multilevel-m2-rust-projection.md
  • docs/changelog.d/627-structured-m2-rust-ownership.md
  • docs/changelog.d/809-workflow-registry-transport-retry.md
  • docs/changelog.d/844-rag-metadata-callback-safety.md
  • docs/changelog.d/860-exposure-control-callback-safety.md
  • docs/changelog.d/868-scoring-policy-integer-callback-safety.md
  • docs/changelog.d/870-ata-integer-callback-safety.md
  • docs/changelog.d/879-parallel-analysis-control-safety.md
  • docs/changelog.d/901-equating-remaining-control-safety.md
  • docs/changelog.d/961-fleiss-control-boundary.md
  • docs/changelog.d/974-utility-control-boundary.md
  • docs/changelog.d/980-essay-report-title-trust-boundary.md
  • docs/changelog.d/983-rotation-control-boundary.md
  • docs/changelog.d/991-rubric-text-trust-boundary.md
  • docs/changelog.d/995-essay-row-header-accessibility.md
  • docs/changelog.d/999-report-title-callback-safety.md
  • docs/changelog.d/gpu-smoke-apt-deadline.md
  • docs/changelog.d/grm-recovery-evidence-retention.md
  • docs/changelog.d/release-0.8.0-cut.md
  • docs/changelog.d/release-0.9.0-cut.md
  • docs/changelog.d/rust-toolchain-1.97.1.md
  • docs/changelog.d/validation-policy-callback-safety.md
  • pyproject.toml

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Open in Devin Review

@seonghobae
seonghobae merged commit 79ef88f into main Aug 24, 2026
39 checks passed
@seonghobae
seonghobae deleted the release/0.9.0-version-bump branch August 24, 2026 20:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants