Release audit

Audit date: October 19, 2026. Candidate version: 0.1.0.

The release-preparation work was merged in PR #5, at commit e31367aec2f0f1af3578353bc6f96d4068e31407. The repository is public. The distribution and import names are both randaba, and the license is MIT.

Validation

Check	Result
Native Python 3.13 and Docker Python 3.12/3.14	95 tests pass; 100% line coverage
Installed wheel on all three Python versions	95 tests pass
Minimum runtime dependencies: NumPy 2.0.0, SciPy 1.13.0, Python 3.12	95 installed-wheel tests pass
Ruff lint/format, Pyright, Pydoclint, pre-commit	Pass
Sphinx with warnings treated as errors	Pass
Wheel built from source distribution; strict Twine metadata checks	Pass
Preen strict release audit	All 27 checks pass
actionlint and Zizmor	Pass
Gitleaks scan of all local Git history and release changes	No secrets detected
Research note built with latexmk	Pass

The merged-commit CI run checks the package, wheel, dependency lock, and workflow security. The release rehearsal passed with publishing disabled, producing the wheel and source distribution through the release workflow.

The vulnerability audit cannot assess py-canon against PyPI advisories because it is a Git-sourced documentation dependency. Its commit is pinned in uv.lock. The full research simulation campaigns were not rerun; the package tests include the checked-in R anticlust parity fixtures.

Publication status

The GitHub repository is public. PyPI publication has not been attempted. The GitHub environment pypi exists. Before pushing a release tag, configure the matching PyPI pending trusted publisher and finalize the dated changelog. See Releasing randaba for the exact publisher settings and release procedure. A successful build rehearsal does not validate PyPI credentials or reserve the package name.