ASRQuant 1.0.0rc3 — final local validation report
Generated: 2026-08-01
Environment: Linux x86_64, Python 3.13.5

VERDICT
-------
ASRQuant 1.0.0rc3 is an installable, CI-corrected RELEASE CANDIDATE. The
scientific API, universal Monte Carlo layer, approximation and sensitivity
layer, surfaces and animations, backtesting system, distribution artifacts,
and fail-closed production controls passed the local checks available in this
offline environment.

This report does not certify the GitHub-hosted checks as green: the exact
GitHub commit must still rerun Ruff, mypy, Bandit, pip-audit, detect-secrets,
CycloneDX, CodeQL, the operating-system matrix, and distribution attestation.
It also does not authorize deployment with real capital.

CORRECTIONS APPLIED
-------------------
1. Surface compatibility
   - Added a Matplotlib compatibility wrapper for the boxplot keyword transition.
   - Matplotlib versions that accept tick_labels use it; older supported versions
     fall back to labels.
   - Both box/violin and seasonality visualizations use the wrapper.

2. Quality and coverage
   - Explicitly load pytest-cov with `-p pytest_cov` while
     PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 is active.
   - Retained the blocking 90% coverage requirement.
   - Removed unused imports and kept Ruff focused on correctness rules E4, E7,
     E9 and F for this release candidate.

3. Security and supply chain
   - Added requirements/runtime.txt synchronized with project.dependencies.
   - pip-audit now evaluates shipped runtime requirements rather than the entire
     development-tool environment.
   - The workflow creates an isolated runtime virtual environment, installs the
     package and runtime dependencies, runs pip check, and generates the
     CycloneDX SBOM from that exact environment.
   - Bandit and detect-secrets remain separate blocking checks.

4. Domain coverage
   - Added the rc2 universal Monte Carlo tests to the quant domain group.
   - Added the rc2 approximation and sensitivity tests to the surfaces group.

AUTOMATED TEST RESULTS
----------------------
- Core domain: 27 passed.
- Quant domain: 28 passed.
- Surfaces and visualizations: 15 passed.
- One-import API: 4 passed.
- Production and guarded-live boundary: 62 passed.
- Total: 136 passed.

COVERAGE
--------
- Production-boundary tests: 62 passed.
- Measured statements: 783.
- Missed statements: 56.
- Total coverage: 92.85%.
- Required threshold: 90%.
- Result: PASSED.

BUILD AND INSTALLATION
----------------------
- Python compileall: passed for src, tests, examples and scripts.
- GitHub Actions YAML parse: passed.
- Runtime dependency manifest synchronization: passed.
- Wheel built: dist/asrquant-1.0.0rc3-py3-none-any.whl.
- Source distribution built: dist/asrquant-1.0.0rc3.tar.gz.
- Wheel metadata and embedded corrected visualization code: verified.
- Source distribution contains requirements/runtime.txt: verified.
- Wheel installed with --no-deps into an isolated target: passed.
- Source distribution installed with --no-build-isolation and --no-deps into an
  isolated target: passed.
- Isolated imports report version 1.0.0rc3.
- Isolated seasonality and box/violin Matplotlib smoke tests: passed.
- Isolated CLI `python -m asrquant.cli --version`: passed.

DEPENDENCY POLICY
-----------------
The runtime lower bounds remain documented and major-version upper bounds were
added to prevent unreviewed breaking upgrades. The canonical runtime audit file
is requirements/runtime.txt and is checked against pyproject.toml.

NOT EXECUTED LOCALLY
--------------------
The following tools were not installed in the offline execution environment and
therefore were not claimed as locally passing:
- Ruff
- mypy
- Bandit
- pip-audit
- detect-secrets
- CycloneDX CLI
- CodeQL
- twine strict metadata check

Their corrected commands remain blocking in GitHub Actions. A successful CI
rerun on the exact uploaded commit is required before promotion to stable
1.0.0.

PROMOTION RULE
--------------
Do not rename this release to 1.0.0 stable until all required GitHub checks pass
on the exact release commit and the release artifacts are independently
reviewed and attested.
