fix(fitstats): require Rust for infit/outfit

[seonghobae]

Buyer-visible numerical-ownership defect

Issue #627 requires ordinary public fit-statistics arithmetic to have one Rust/PyO3 production owner. After #771, s_x2() and person_fit() fail closed, but infit_outfit() still selected a substantial Python/NumPy probability, variance, residual, infit-denominator, and outfit-reduction path when the compiled core or entrypoint was absent.

GREEN contract

• Public infit_outfit() requires infit_outfit_stat and fails closed with RuntimeError("fit statistics require the compiled Rust core") when the core is missing or incomplete.
• NumPy residual arithmetic retained as _infit_outfit_python_reference for parity/allocation contracts only.
• Retargeted legacy NumPy-fallback suites (test_cov_c_fitstats, allocation contracts) to the fail-closed ownership contract.

Evidence

• Local: pytest ownership + allocation + cov_c + fitstats suites → 71 passed (Python 3.14)
• Changelog fragment docs/changelog.d/775-fitstats-infit-outfit-rust-required.md rendered into Unreleased

Product gates

Merge when python (aggregate + 3.12/3.14) + rust + package + fuzz are green.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e88c6a41-f83a-4474-b505-0a93c16928d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Bounded single-writer GREEN handoff for Draft #775. Immediately before any write, refetch exact source head 92440b82d29d889083d5fa9827dfb1638764b74d, protected main c91ae210bc8e0340a5b0587cf5289b82a2e8ab92, reviews/comments, and branch writer state; abort if either ref moved incompatibly or another source writer is active. Preserve the fail-first commit and non-destructive current-main merge ancestry.

First run tests/test_fitstats_infit_outfit_rust_ownership_failclosed.py and confirm the two missing/incomplete-core cases fail at the forbidden Python np.exp probability boundary while the compatible-core sentinel case passes. Then implement the smallest GREEN in python/fast_mlsirm/fitstats.py: require a compatible infit_outfit_stat compiled entrypoint and raise the established RuntimeError("fit statistics require the compiled Rust core") before any Python probability/residual/infit/outfit arithmetic when absent. Preserve the existing native call, inputs, missingness, factor/model semantics, result keys/shapes, and caller immutability. Remove the implicit production NumPy fallback rather than suppressing the RED; if a reference implementation is still scientifically useful, isolate it behind an explicitly reference/test-only name that public production execution cannot select.

Re-run focused ownership + existing infit/outfit parity/coverage tests, Ruff/format checks, then the complete applicable Python/Rust/PyO3/package/fuzz/security gates on one unchanged head. Add bounded APA-linked doctoring/changelog material only after GREEN and render/check the managed CHANGELOG through the repository renderer. Do not widen to S-X²/person-fit (already protected-main via #771), another statistic, estimator, dependency, provider, workflow, version/release, or GPU path. Keep Draft until exact-head evidence is complete, then stop writing this branch for independent review/merge.

[seonghobae]

Superseded by GREEN fail-closed implementation.