Release ph-curves v0.3.0

[swgiacomelli]

Release

Promote the release/0.3.0 branch to main as ph-curves 0.3.0. This pull request is the mandatory aggregate release-integration gate; the branch will not be integrated directly.

This pull request is intentionally non-draft but remains open and unmerged pending the sole-maintainer current-head attestation. The aggregate review is complete, required checks are green, and every review conversation is resolved.

Current gate: the final release head is e05794c. All 20 leaf jobs plus aggregate ci are green and all 16 review conversations are resolved. During the repository's single-maintainer phase, branch protection honestly requires zero approvals because GitHub does not permit the author to approve their own pull request. Before merge, the maintainer must record the current-head attestation required by RELEASING.md. Do not merge this pull request before that attestation.

Highlights

• source-backed, device-neutral transfer families with typed selectors, explicit gaps, provenance, complete host IR, deterministic manifests, structured reports, resource budgets, and sparse no_std generation ([gen] Support source-backed discrete transfer families through host-only generation #35)
• generic observation-code guards independent of ordinary transfer boundaries
• public invertible i32 AffineTransform and shared checked affine arithmetic (Add a standalone invertible i32 AffineTransform #60)
• u32 temporal primitives plus 16-bit-pointer target hardening and an MSP430 core-only gate (Implement TemporalSample for u32 across temporal primitives #59, Harden the runtime for 16-bit pointer targets #61)
• compile-tested post-conversion calibration, filtering, stability, and hysteresis pipelines (Document post-conversion measurement pipelines #62)
• corrected tickless first-change deadlines, full-width u16 inverse interpolation, terminal Once emission, and zero-duration Repeat / PingPong termination (Fix tickless deadlines, Once terminal value, and zero-duration spin #65)
• adversarial release hardening for affine endpoint inversion, family old-reader fail-closed behavior, prefitted truth validation, selector hygiene, explicit LUT panic contracts, and release/CI safeguards (Address v0.3.0 adversarial release review #66)
• second adversarial-review corrections covering generated-rustdoc delimiters, fresh-consumer MSRV resolution, fail-closed schema and CLI behavior, incremental generator budgets, independent-oracle evidence, packaged full-u16 assets, and embedded runtime smoke coverage (fix: resolve remaining v0.3.0 adversarial review findings #68)
• HTML-safe literal angle brackets in TOML-derived generated rustdoc (Make generated rustdoc angle brackets HTML-safe #70)
• an honest single-maintainer review policy that restores independent approval when another trusted collaborator exists (Make review policy honest for solo maintenance #71)
• a frozen 0.3.0 changelog with a genuinely empty Unreleased section (Freeze the rustdoc fix into 0.3.0 #72)

Compatibility and migration

This is the required pre-1.0 minor release rather than a patch release:

• exhaustive matches on TransferError must handle the new RejectedObservation variant
• generated output now reserves and emits <NAME>_OBSERVATION_GUARD; colliding transfer names must be renamed
• standalone curve and transfer TOML documents reject formerly ignored unknown direct fields, and standalone observation-guard/provenance documents use explicit capability markers to fail closed with older readers
• every document with [transfer_families] declares transfer_families_v1, causing released 0.2.1 readers to reject the document instead of silently emitting header-only output
• the two 65,536-entry dense-LUT convenience aliases are unavailable only on 16-bit-pointer targets; earlier releases did not compile on those targets

See CHANGELOG.md and docs/compatibility.md for the complete contract and migration details. Key-level source spans for errors raised by the custom transfer/family TOML deserializers are a diagnostic-usability enhancement tracked in #67; current parsing remains fail-closed and reports the exact semantic path.

Release validation

The exact release-branch head e05794c7398acf0feef10d1e328b6bcf7cb28d98 (tree e1f24d8b66cc224a60b1681e6b9a3b39c5c3dd8e) was validated with:

• all 20 leaf GitHub checks plus aggregate ci passing on that exact head
• runtime, generator, CLI, integration, and doctest suites; formatting; clippy; and rustdoc with warnings denied
• all five stable no_std target/example pairs
• all four nightly core-only/no-allocation target/example pairs, including MSP430
• all three Xtensa target/example pairs
• a fresh Rust 1.92 resolver-2 consumer build selecting MSRV-compatible fixed 1.30.0
• cargo deny --all-features check
• cargo package and cargo publish --dry-run from a clean detached worktree
• cargo package --list reporting 55 files, including the full-u16 source asset and all three generated fixtures, with repository-only CI, scripts, and design documents excluded

Windows Application Control blocked one generated CLI test executable hash during the monolithic scripts/local-ci.ps1 run (os error 4551). The same three CLI tests passed when built and invoked directly, Unblock-File confirmed the restriction was host policy rather than a test assertion, and every remaining command from the script passed independently. Post-0.3.0 issue #73 tracks a staged/resumable local-CI design; this host-policy interruption does not weaken the exact-head GitHub matrix or the independently completed local commands.

The manifest and lockfile both resolve to 0.3.0. Unreleased is empty, the changelog is frozen for 2026-08-17 UTC, the security transition is publication-triggered, and no v0.3.0 tag currently exists. Refresh the changelog date before merge if the actual publication date changes.

Publication sequence

Merging this pull request only integrates the release into main. After it merges and the resulting main CI is green, the owner will create and push the annotated v0.3.0 tag, publish the crate, create the GitHub release, and perform post-publish verification. No tag or publication is part of this pull request.

Closes #23

[swgiacomelli]

Adversarial review disposition

Every item in the aggregate review now has an explicit ship-or-fix decision backed by reproduced behavior and regression evidence. The fixes landed through #65 and #66; refreshed release head 99675ff is 20/20 green. All 15 inline threads have claim-specific replies and are resolved.

Blockers

1. AffineCalibration invertibility — fixed in Address v0.3.0 adversarial release review #66. Recovery is wrapper-only and accepts only the exact calibrated image of the implicated signed endpoint. Genuine unrepresentable values still return Overflow; scalar AffineTransform::unapply is unchanged. Evidence: full-range increasing/decreasing and sign/orientation/offset matrix, more than 1.5 million randomized round trips, and an independent reduced-width exhaustive model.
2. Ceil/Nearest first-change deadlines — fixed in Fix tickless deadlines, Once terminal value, and zero-duration spin #65. Scheduling now finds the first quantized change instead of inverting the next grid point. Exhaustive u8/u16, increasing/decreasing, all-rounding probes passed.
3. Full-width u16 inverse interpolation — fixed in Fix tickless deadlines, Once terminal value, and zero-duration spin #65. Clamped exact wide arithmetic removes debug panic/release wrap and zero-sleep behavior.
4. Once terminal emission — fixed in Fix tickless deadlines, Once terminal value, and zero-duration spin #65. The terminal quantized value is emitted before termination.

High

5. Family-only old-reader silence — fixed in Address v0.3.0 adversarial release review #66. Every nonempty family document requires [transfers] requires = ["transfer_families_v1"]; missing and unused markers fail. A faithful released wire-shape test and the actual published 0.2.1 generator both reject the marked document rather than producing header-only output.
6. Compatibility contradiction — fixed in Address v0.3.0 adversarial release review #66. Preservation is scoped to documents using documented 0.2.1 direct fields; the intentional unknown-direct-field tightening remains explicit.
7. GitHub module-local std enforcement — fixed in Address v0.3.0 adversarial release review #66. GitHub and local CI now reject crate-root std/macro_use links, including visibility, alias/raw-alias, and named/spaced forms. Negative probes, YAML/PowerShell parsing, and both refreshed 20-check matrices passed.

Medium

• Prefitted dense truth — fixed: monotonicity and direction are validated before approximation error.
• Description-only members — explicit contract decision: structural/source-window validation remains distinct from emit-only full numerical fitting and generation; limited NTC window evaluation is documented. A pole regression proves the boundary.
• insert_transfer — explicit contract decision: insertion is transactional structural revalidation; fitting remains the generation gate. Pre-/post-validation description-stem parity and generated-byte equality are tested.
• Whitespace-only selectors — fixed: blank keys/string values reject, while nonblank whitespace remains exact identity data.
• Zero-duration Repeat/PingPong — fixed in Fix tickless deadlines, Once terminal value, and zero-duration spin #65: schedules yield once and terminate.
• Undersized dense LUTs — explicit contract decision: const/static construction remains; complete-domain cardinality and deterministic forward/inverse panic contracts are documented and covered by three regressions.
• Publish commands — fixed: instructions switch to a clean, fast-forwarded main, verify HEAD == origin/main, package version, tag absence, and exact tag target.
• Local cargo-deny — fixed: absence is now a hard failure; all-feature policy passed.
• Design dependency version — fixed: the 0.3 family/report example now requires 0.3.

Aggregate evidence

The exact #66 tree equals release merge tip 99675ff. On that tree:

• full scripts/local-ci.ps1 passed, including stable no_std, nightly core-only/MSP430, all Xtensa targets, clippy/rustdoc with warnings denied, dependency policy, and packaging;
• all 599 unit tests plus integrations and doctests passed;
• cargo publish --dry-run passed;
• cargo package --list contains the expected 54 files;
• generated family/guard fixtures remained byte-identical;
• the refreshed aggregate PR has all 20 GitHub checks green.

The original review's passed-contract list was also re-audited; no regression or new actionable finding remains. PR #64 intentionally remains open and unmerged for final release review.

[swgiacomelli]

Second adversarial-review status, with evidence:

• Fix tickless deadlines, Once terminal value, and zero-duration spin #65 and Address v0.3.0 adversarial release review #66 are already present on this release head and cover the inherited tickless, affine-endpoint, family old-reader, prefitted-truth, and related first-pass defects.
• Correction PR fix: resolve remaining v0.3.0 adversarial review findings #68 addresses the remaining confirmed findings: generated-rustdoc delimiter safety, fresh-consumer MSRV resolution, TOML/schema and programmatic parity gaps, clean CLI failures, non-finite/inverse/budget hardening, embedded smoke coverage, package/assets, and release-process safeguards.
• The corrected tree passed the full local matrix (all feature sets, stable no_std targets, nightly core-only targets including MSP430, all Xtensa targets, clippy/rustdoc with denied warnings, cargo-deny), cargo publish --dry-run, and a verified 55-file package. The fresh Rust 1.92 resolver-2 probe selected fixed v1.30.0.
• The one diagnostic-only item intentionally deferred is key-level TOML span preservation, now bounded in [gen] Preserve key-level TOML spans through fail-closed custom decoding #67. Current parsing remains fail-closed and reports exact semantic paths; a late decoder rewrite would risk the capability-marker compatibility contract.
• All existing review conversations are resolved, but there is still no human APPROVED review. Automated review, green CI, and resolved threads are not substitutes.

Do not merge #64 yet. First merge and validate #68 into release/0.3.0; then refresh this PR's head, package count, and validation evidence, wait for its new aggregate CI, and obtain a human approval on that refreshed head.

[swgiacomelli]

Release evidence refreshed after #68 merged into release/0.3.0.

• Current release head: caf86a595f48dc8466e0e829a86bbecd5b9268a2.
• Its tree (b369149dbdce26b48aa50e86cd14b35264fe9df7) exactly matches locally validated correction commit 9874cccc4caeefa15f4b35d8a421d4dbfcfbfce3.
• The full local CI matrix passed, including stable no_std, nightly core-only/no-allocation with MSP430, all three Xtensa targets, clippy, rustdoc, dependency policy, tests, and packaging.
• A fresh Rust 1.92 resolver-2 consumer selected fixed 1.30.0 and built successfully.
• cargo publish --dry-run --allow-dirty passed.
• cargo package --list --allow-dirty contains 55 files, including the full-u16 source asset and all three generated fixtures.
• On the refreshed PR head, all 20 leaf GitHub jobs and aggregate ci passed.
• GitHub reports all 15 review conversations resolved. No human APPROVED review has been submitted on this current head.

The PR body now records this evidence and the #67 diagnostic-span deferral. PR #64 remains open and unmerged. The remaining release-PR gate is a human approving review on caf86a5; the changelog date must also be refreshed if publication moves beyond 2026-08-17 UTC.

[swgiacomelli]

Mechanical release safeguards are now active in addition to the evidence recorded above:

• main requires the GitHub Actions ci check in strict/up-to-date mode, a pull request, one approving review, approval of the last reviewable push by someone other than its author, stale-review dismissal, resolved conversations, and enforcement for administrators. Force-push and deletion remain disabled.
• The active release-branch ruleset applies to release/** with no bypass actors. Updates require a pull request, strict GitHub Actions ci, and resolved conversations; force-push and deletion are blocked.
• The release-tag creation ruleset restricts v* creation to the authenticated release owner.
• The separate release-tag immutability ruleset prohibits every actor, including administrators, from updating or deleting a v* tag after creation.

PR #64 now reports REVIEW_REQUIRED / BLOCKED while all checks remain green. If release/0.3.0 changes, the PR head changes, strict CI must pass again, and any stale approval is dismissed. The release PR remains open and unmerged.

[Copilot]

Pull request overview

Promotes release/0.3.0 into main for the ph-curves v0.3.0 release, integrating the full runtime + generator feature set, updated compatibility/security/release-process documentation, and expanded CI/fixture coverage appropriate for a pre-1.0 minor release.

Changes:

• Bump crate version to 0.3.0, tighten MSRV-related dependency bounds, and update release/security/compatibility documentation and process gates.
• Expand host-side generator capabilities (transfer families, reports, fail-closed schema markers) and add/refresh fixtures + acceptance tests (including no-std/core-only compile gates).
• Add/adjust runtime APIs and behavior (standalone AffineTransform, u32 temporal support, tickless deadline correctness, observation guards, 16-bit-pointer target hardening).

Reviewed changes

Copilot reviewed 58 out of 61 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/support/family_oracle.rs	Adds an independent quadratic oracle used by family acceptance tests.
tests/post_conversion_pipelines.rs	Adds integration tests demonstrating explicit post-conversion pipelines and affine overflow boundaries.
tests/observation_guards.rs	Adds runtime tests validating observation-guard precedence and invariants.
tests/ntc_transfer.rs	Updates NTC fixture tests (including guard companion presence and calibrated setpoint example).
tests/generation_report.rs	Adds tests asserting generator report output matches emitted metadata/guards.
tests/fixtures/observation_guards_generated.rs	Adds generated fixture covering standalone + family observation guards.
tests/fixtures/ntc_generated.rs	Refreshes generated NTC fixture (including guard companion constant).
tests/fixtures/family_acceptance_generated.rs	Adds generated fixture for device-neutral transfer-family acceptance.
tests/family_acceptance.rs	Adds runtime acceptance tests for transfer families against an independent oracle.
src/tickless.rs	Fixes tickless deadline computation and termination behavior (incl. zero-duration handling).
src/tests.rs	Extends internal tests for tickless scheduling, quantization boundaries, and u16 inverse lerp edge cases.
src/stabilize.rs	Extends temporal primitives to u32, adds docs and tests, and adds Hysteresis<u32>::new.
src/round.rs	Updates crate-level rounding documentation to include AffineTransform and u32 temporal math.
src/math.rs	Hardens inv_lerp_u16 against out-of-span quantized targets; adds quantization boundary helpers for tests.
src/lib.rs	Exposes new APIs (AffineTransform, observation guards), adds docs/examples, and cfg-gates 65536 LUT aliases on 16-bit pointers.
src/gen/transfer/model.rs	Adds scaled-polynomial model support and supporting helpers for family expansion and evaluation.
src/gen/transfer/adaptive.rs	Makes measure_error available within the crate for broader generator/report usage.
src/gen/rustdoc.rs	Introduces Markdown/rustdoc-safe escaping utilities for generated documentation.
src/gen/mod.rs	Expands gen module exports (IR/report types) and documents generator/IR/report scope.
src/gen/api.rs	Adds report-producing generation APIs and makes curve LUT option validation conditional on [curves] presence.
src/curve.rs	Documents LUT invariants, adds explicit panic messages for undersized LUT lookups, and cfg-gates 65536 aliases on 16-bit pointers.
src/bin/gen/main.rs	Converts generator CLI to clean error returns with proper exit codes; adds CLI tests.
src/affine.rs	Adds the standalone invertible i32 AffineTransform runtime API with tests.
SECURITY.md	Updates supported-version policy to “newest published minor line only”, keyed to actual publication.
scripts/local-ci.ps1	Aligns local CI with stricter warning policy, packaging checks, MSRV probe, and fixture/core-only example builds.
RELEASING.md	Documents release-branch PR integration requirements, MSRV downstream validation, packaging requirements, and publish steps.
examples/no_std_generated_fixtures.rs	Adds a no_std example compiled across no-std/core-only target matrix to guard against std/alloc/float creep.
docs/README.md	Adds documentation index and authority guidance; clarifies packaging boundaries.
docs/guides/tickless-scheduling.md	Adds tickless scheduling guide covering rollover model and quantization/repeat semantics.
docs/guides/README.md	Adds user-guide index routing to topic guides.
docs/guides/physical-transfer-generation.md	Adds guide for transfer generation, boundary/guard semantics, and schema markers.
docs/guides/measurement-pipelines.md	Adds guide for composing affine + temporal primitives into caller-owned pipelines.
docs/guides/curve-generation.md	Adds guide for curve generation and notes 16-bit-pointer constraints for full-domain u16 LUTs.
docs/design/transfer-families.md	Adds design record for transfer families, selector universes, gaps, provenance, and budgets.
docs/design/README.md	Adds design-record index and reading guidance.
docs/design/host-transfer-ir.md	Adds design record for host IR layers, inspection/extension APIs, and overlays.
docs/design/gen-build-api.md	Updates generator build-API design record for 0.3.0 report/IR surface and options behavior.
docs/design/decision-primitives.md	Updates design record to reflect u32 support in temporal sample usage.
docs/design/affine-calibration.md	Updates design record to reflect AffineTransform integration and clarified affine offset semantics.
docs/compatibility.md	Adds 0.3.0 compatibility/migration policy and detailed schema/target/MSRV boundary records.
CONTRIBUTING.md	Updates contribution guidance to include release-branch integration rules.
Cargo.toml	Bumps version to 0.3.0, constrains fixed for Rust 1.92 MSRV, and registers new feature-gated tests/example.
Cargo.lock	Updates lockfile package version to 0.3.0.
assets/observation-guards.toml	Adds generator input fixture for observation-guard lowering.
assets/family-acceptance.toml	Adds device-neutral transfer-family acceptance fixture with provenance, gaps, budgets, and guards.
assets/curves-u16.toml	Adds resolution-neutral u16 curve definitions for documentation/examples.
AGENTS.md	Updates repository agent guidance to reflect new invariants and fixture regeneration paths.
.github/workflows/ci.yml	Extends CI with MSP430 core-only builds, downstream MSRV probe, packaging checks, std-link invariants, and fixture example builds.
.github/ISSUE_TEMPLATE/bug_report.yml	Updates issue template version placeholder and supported target list (incl. MSP430).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[swgiacomelli]

I reviewed the aggregate ph-curves 0.3.0 release diff at e05794c. I reviewed and dispositioned the automated and adversarial findings, confirmed all review conversations are resolved, and reviewed the exact-head CI, embedded-target, packaging, dry-run publication, compatibility, and release-checklist evidence. I accept the remaining ordinary release risk and will address discovered defects through patch releases where appropriate. I authorize this release PR to be merged into main; tagging and publication remain separate post-merge actions.