CalvinBackup/OBLITERATUS
1
0
Fork 0
mirror of https://github.com/elder-plinius/OBLITERATUS.git synced 2026-09-21 17:00:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(packaging): install and validate the Bayesian optimizer by default

Browse Source
This commit is contained in:
Joseph Magly
2026-09-07 16:23:48 -04:00
parent 40236a150e
commit 707e762904
8 changed files with 390 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SUPPLY_CHAIN_POLICY.md
+29
View File
@@ -9,6 +9,35 @@ CI uses exact Python tool versions and checksum-pinned standalone binaries.
`ci/digests.txt` records executable and GitHub Action pins; build, test, and
license-tool transitive dependencies are covered by `uv.lock`.
## Bayesian optimizer dependency
Optuna is a core dependency (`>=4.9,<5`), installed by both `pip install .`
and the documented locked development setup. The `optimized` and `heretic`
pipeline methods therefore receive their requested Bayesian optimization
without a separate manual installation. A partial environment that lacks
Optuna still reports the fallback in the pipeline log and checkpoint metadata.
The lock pins Optuna 4.9.0 and adds Alembic 1.19.2, colorlog 6.12.0,
greenlet 3.5.5, Mako 1.4.1, and SQLAlchemy 2.0.52 without upgrading existing
packages. These distributions come from PyPI, with artifact SHA-256 hashes in
`uv.lock`; the signed repository change records the reviewed lock. The package
registry and package publishers remain the source trust boundary. No hosted
Optuna service, dashboard, database connection, or integration extra is used:
the optimizer creates an in-memory study.
The package license inventory identifies MIT/MIT License for Optuna, Alembic,
colorlog, Mako, and SQLAlchemy. Optuna's bundled third-party notices cover
SciPy-derived BSD code and fdlibm's permissive notice. Greenlet's included
`LICENSE` and `LICENSE.PSF` identify MIT code and Stackless/Python-derived code
under PSF-2.0. The reviewed composite expression `MIT AND PSF-2.0` is therefore
included in the allow list; preserve both notices when redistributing it.
No vulnerability suppression is added. Dependency updates remain subject to
the same vulnerability and license gates as the rest of the lock.
`tests/test_bayesian_optimizer_optuna.py` runs real Optuna trials with tiny
local CPU tensors, verifies in-range warm starts and model restoration, and
uses no model download, network, credentials, or accelerator.
## Digest-bound release evidence
The release artifact is a deterministic ZIP snapshot of the tested repository