fix(release): prepare v0.5.3 with managed benchmark tooling

CHANGELOG.md

@@ -5,6 +5,173 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.3] - 2026-11-11
+
+### Merged Pull Requests
+
+- Adopt research-repo-tools v0.2.8 and parallelize native CI [#343](https://github.com/acgetchell/la-stack/pull/343)
+- Enforce release state invariants and macro hygiene [#342](https://github.com/acgetchell/la-stack/pull/342)
+- Resume and reuse verified release benchmark acquisitions [#335](https://github.com/acgetchell/la-stack/pull/335)
+- Separate benchmark timing from routine CI [#334](https://github.com/acgetchell/la-stack/pull/334)
+- Bump the github-actions group with 5 updates [#332](https://github.com/acgetchell/la-stack/pull/332)
+
+### Added
+
+- Resume and reuse verified release benchmark acquisitions [#335](https://github.com/acgetchell/la-stack/pull/335)
+  [`7c3a362`](https://github.com/acgetchell/la-stack/commit/7c3a3625220773369c089e64e568a979abc0bb7f)
+
+#### feat: resume and reuse verified release benchmark acquisitions
+
+- Adopt declared API availability and shared progress while retaining the full
+  scientific workload catalog and paired LU peer context.
+- Add explicit checkpoint recovery and independent owner records so reports,
+  README publication, and release archives reuse the original acquisition.
+- Require owner-selected candidate evidence before tagging and preserve its
+  full acceptance across hosted attachment and Cargo deployment approval.
+- Allow explicitly reviewed native-CI renewal without replacing immutable
+  benchmark assets, and keep README outside current compiler inputs.
+- Pin research-repo-tools at 055353c630604b1ae3438c1eaf534ba85e067a7e for
+  downstream rehearsal while enforcing published tooling at release gates.
+- Automate release evidence reuse and parallelize CI [`4f57700`](https://github.com/acgetchell/la-stack/commit/4f577007e9753f3b0624a48525e70f05f21717be)
+
+  - Discover the original acquisition owner and authenticated tag-push draft
+    receipt automatically while retaining explicit recovery inputs.
+  - Align release commands and documentation around pre-tag evidence review,
+    automatic draft preparation, and retained-evidence publication dispatch.
+  - Require an existing reviewed acceptance before tagging, staging, or
+    publishing, and preserve exact release and artifact identities on retries.
+  - Overlap independent Rust and Python validation after policy checks, retain
+    a serial fallback, and cache managed Cargo compilation separately from
+    verified tool installations.
+  - Adopt research-repo-tools at the authorized cd8594f development revision.
+
+### Changed
+
+- Separate benchmark timing from routine CI [#334](https://github.com/acgetchell/la-stack/pull/334)
+  [`f520e2f`](https://github.com/acgetchell/la-stack/commit/f520e2f59574774454a739c7dfa810f3d1845420)
+
+  - Run full exact Criterion timing on demand and retain untimed benchmark
+    validation in routine CI.
+  - Use research-repo-tools v0.2.6 for setup, Semgrep fixtures, and release
+    tooling, and remove the temporary scanner adapter.
+  - Refresh the managed tools and dependency locks while retaining the
+    Intel macOS Semgrep wheel.
+
+### Dependencies
+
+- Bump the github-actions group with 5 updates [#332](https://github.com/acgetchell/la-stack/pull/332)
+  [`ab3b8a0`](https://github.com/acgetchell/la-stack/commit/ab3b8a0f0381e239b5c89f69664584e6a0c5c217)
+
+#### chore(deps): bump the github-actions group with 5 updates
+
+  Bumps the github-actions group with 5 updates:
+
+  | Package | From | To |
+  | --- | --- | --- |
+  | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` |
+  | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.3.0` | `10.3.2` |
+  | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` |
+  | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` |
+  | [rust-lang/crates-io-auth-action](https://github.com/rust-lang/crates-io-auth-action) | `1.0.5` | `1.0.6` |
+
+  Updates `github/codeql-action/upload-sarif` from 4.39.0 to 4.39.1
+
+- [Release notes](https://github.com/github/codeql-action/releases)
+- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
+- [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)
+
+Updates `astral-sh/setup-uv` from 10.3.0 to 10.3.2
+
+- [Release notes](https://github.com/astral-sh/setup-uv/releases)
+- [Commits](https://github.com/astral-sh/setup-uv/compare/1c37ad07a6a961277cf70c0d37d6f313000f5884...07a047e608db84b3d8c06cd9a7c7dcc9c355c18e)
+
+Updates `github/codeql-action/init` from 4.39.0 to 4.39.1
+
+- [Release notes](https://github.com/github/codeql-action/releases)
+- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
+- [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)
+
+Updates `github/codeql-action/analyze` from 4.39.0 to 4.39.1
+
+- [Release notes](https://github.com/github/codeql-action/releases)
+- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
+- [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)
+
+Updates `rust-lang/crates-io-auth-action` from 1.0.5 to 1.0.6
+
+- [Release notes](https://github.com/rust-lang/crates-io-auth-action/releases)
+- [Commits](https://github.com/rust-lang/crates-io-auth-action/compare/c6f97d42243bad5fab37ca0427f495c86d5b1a18...3268eb413133e2960fa4ae0e963ca76380c54cd9)
+- Bump the github-actions group with 2 updates [`3323040`](https://github.com/acgetchell/la-stack/commit/3323040a8d9125ad0c8cd72b2a4a91f8bfef1411)
+
+  Bumps the github-actions group with 2 updates: [actions-rust-lang/setup-rust-toolchain](https://github.com/actions-rust-lang/setup-rust-toolchain) and
+  [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).
+
+  Updates `actions-rust-lang/setup-rust-toolchain` from 2.0.0 to 2.0.1
+
+  - [Release notes](https://github.com/actions-rust-lang/setup-rust-toolchain/releases)
+  - [Changelog](https://github.com/actions-rust-lang/setup-rust-toolchain/blob/main/CHANGELOG.md)
+  - [Commits](https://github.com/actions-rust-lang/setup-rust-toolchain/compare/ecabd13d1c56bd1345c230e542e9144811ad706f...a188e68d0fd2bd36ad51dccb2b07ba6e75105f30)
+
+  Updates `astral-sh/setup-uv` from 10.3.2 to 10.3.3
+  - [Release notes](https://github.com/astral-sh/setup-uv/releases)
+  - [Commits](https://github.com/astral-sh/setup-uv/compare/07a047e608db84b3d8c06cd9a7c7dcc9c355c18e...68559e99cc807c1eb7e9238fd43a15bba460eec2)
+
+### Documentation
+
+- Assign release validation to the release tracker [`6cb4fbc`](https://github.com/acgetchell/la-stack/commit/6cb4fbca6fa4429b0a45d90b53403a774fc80ef5)
+
+  - Close the completed release-flow and validation-graph implementation issues
+    on merge and keep remaining release validation and readiness under #333.
+- Add runnable examples and link interval proofs [`647184f`](https://github.com/acgetchell/la-stack/commit/647184f5782575620f1d8128b36fd6ee2cfc2248)
+
+  - Show provisional column selection, interval solution enclosures and
+    fallback, and exact rational objective evaluation in runnable examples.
+  - Link interval and rounding rustdoc to the scientific references and
+    proofs, and update the README link inventory.
+  - Include the staged itoa 1.0.19 lockfile refresh.
+
+### Fixed
+
+- Avoid Windows actionlint deadlock in release preparation [`6d77e15`](https://github.com/acgetchell/la-stack/commit/6d77e15be3eb3e2b3281baaf98cf56d8837037fa)
+
+  - Execute the draft writer from a runner-owned script through isolated Python,
+    preserving the exact tag, attempt, artifact and draft identity checks.
+  - Parse workflow scripts as Bash only for the applicable shell steps while
+    retaining managed Zizmor execution enforcement.
+  - Document automatic owner-record transfer selection and the completed
+    workstream handoff to the release-validation tracker.
+  - Refresh the locked bracex dependency to 3.2.2.
+- Authenticate tool setup and allow Zizmor cleanup [`261bee3`](https://github.com/acgetchell/la-stack/commit/261bee3b5a8b7db2f9fff8820066a669b0e4031d)
+
+  - Use the job token for managed binary release lookups so cold setup
+    can finish when the anonymous GitHub API quota is exhausted.
+  - Give Zizmor 45 minutes for cold tool installation, scanning and cache
+    cleanup while preserving the existing findings gate.
+- Enforce release state invariants and macro hygiene [#342](https://github.com/acgetchell/la-stack/pull/342)
+  [`88d2d25`](https://github.com/acgetchell/la-stack/commit/88d2d257c185a5f1cdeb1dae06b5a0b3c8fd9c7c)
+
+  - Represent scaled determinant products with explicit empty, nonzero,
+    zero, and non-finite states while preserving arithmetic order.
+  - Parse release handoffs into draft and publication variants with
+    validated asset identities and fixed local transport paths.
+  - Reject mismatched handoffs and malformed owner digests before effects.
+  - Keep matrix dispatch error arms independent of caller-defined names.
+  - Consolidate Rust imports and shorten repeated implementation paths.
+- Adopt research-repo-tools v0.2.8 and parallelize native CI [#343](https://github.com/acgetchell/la-stack/pull/343)
+  [`be9277b`](https://github.com/acgetchell/la-stack/commit/be9277bf04400dccbe1115da69c7fda2141c4a39)
+
+#### fix: unblock release provenance with research-repo-tools v0.2.8
+
+- Adopt the published supplier in the manifest, lockfile, source policy,
+  isolated recipes, and release workflows; remove the development Git pin.
+- Prepare authenticated native dependency builds and require their
+  provenance in CI, signed release evidence, and publication workflows.
+- Delegate release runtime isolation to shared RRT APIs while preserving
+  consumer-owned benchmark acquisition and approval records.
+- Expose the shared dependency-source transition command and document
+  deliberate supplier adoption, pin-preserving updates, and release setup.
+- Refresh managed tool, GitHub Action, and Cargo dependency pins.
+
 ## [0.5.2] - 2026-10-29
 
 ### Merged Pull Requests
@@ -113,6 +280,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
   - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)
 
+### Documentation
+
+- Clarify measured working-tree provenance [`95d66b9`](https://github.com/acgetchell/la-stack/commit/95d66b9220b76f1a7d88055e8a25f2fa833e245f)
+
+  Identify the v0.5.2 measurement as a working-tree snapshot based on b5156e2 and retain its measured source SHA-256.
+
 ### Fixed
 
 - Preserve CI evidence for crates.io publishing [`2702cb7`](https://github.com/acgetchell/la-stack/commit/2702cb7a27e0d3ec72551a042274b5849b111ada)
@@ -777,6 +950,7 @@ Older releases are archived by minor series:
 - [0.2.x](docs/archives/changelog/0.2.md)
 - [0.1.x](docs/archives/changelog/0.1.md)
 
+[0.5.3]: https://github.com/acgetchell/la-stack/compare/v0.5.2...v0.5.3
 [0.5.2]: https://github.com/acgetchell/la-stack/compare/v0.5.1...v0.5.2
 [0.5.1]: https://github.com/acgetchell/la-stack/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/acgetchell/la-stack/compare/v0.4.6...v0.5.0

CITATION.cff

@@ -2,8 +2,8 @@ cff-version: 1.2.0
 message: "If you use this software, please cite it as below."
 type: software
 title: "la-stack: Fast, stack-allocated linear algebra for fixed dimensions in Rust"
-version: 0.5.2
-date-released: 2026-10-29
+version: 0.5.3
+date-released: 2026-11-11
 url: "https://github.com/acgetchell/la-stack"
 repository-code: "https://github.com/acgetchell/la-stack"
 doi: "10.5281/zenodo.18158926"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "la-stack"
-version = "0.5.2"
+version = "0.5.3"
 edition = "2024"
 rust-version = "1.99.1"
 autobenches = false

README.md

@@ -119,7 +119,7 @@ Add this to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-la-stack = "0.5.2"
+la-stack = "0.5.3"
 ```
 
 ### Solve a 5×5 system
@@ -298,7 +298,7 @@ Enable exact determinant signs, determinant values, and solves:
 
 ```toml
 [dependencies]
-la-stack = { version = "0.5.2", features = ["exact"] }
+la-stack = { version = "0.5.3", features = ["exact"] }
 ```
 
 `Matrix` / `Vector` exact methods preserve stored `f64` values;
@@ -506,41 +506,55 @@ cargo run --locked --example vector_angles
 
 <!-- BENCHMARKS:BEGIN -->
 
-![LU solve (factor + solve): median time vs dimension](https://raw.githubusercontent.com/acgetchell/la-stack/v0.5.2/docs/assets/bench/vs_linalg_lu_solve_median_log.svg)
+![LU solve (factor + solve): median time vs dimension][rrt-performance-link-3]
 
-Run: `5af2e5bf8a3aa22f12f45efad18280cebd2b4be31a0612901374306d4a7eb652`. Statistic: median. Unit: ns. Confidence level: 95%.
+Complete run: `2e55909621d0aacbfa7670f678574ae750311ba29353e6e9ebb11461414876a2`.
 
-- la-stack v0.5.2: current phase, v0.5.2 working-tree snapshot based on commit
-  `b5156e222add90fc62191db55dcccb40875a5e41`; measured source SHA-256
-  `80e684f9e40f0b89417aa4a8317b22e37e0f594aef8043b250656f2c6cb3990f`.
-- nalgebra 0.35.0: baseline phase, v0.5.1, revision 80a67d598b8f5788c2c8ffc12a0e8677c306909e.
-- faer 0.24.4: baseline phase, v0.5.1, revision 80a67d598b8f5788c2c8ffc12a0e8677c306909e.
+Trial 1 of this complete run (separate trial; no pooled significance claim).
 
-| Dimension | la-stack v0.5.2 | nalgebra 0.35.0 | faer 0.24.4 | Speedup vs nalgebra | Speedup vs faer |
+Selected trial run (CSV/plot identity): `86e075e0edc375bfe6e42aaf5c97d8085a0407bdcadc75531fc7abf8a19de0c9`. Statistic: median. Unit: ns. Confidence level: 95%.
+
+- la-stack v0.5.3: current phase, v0.5.3 working-tree snapshot based on commit be9277bf04400dccbe1115da69c7fda2141c4a39; measured source SHA-256
+  793169b4c5085624d7c0e773f1d28504c017e9b78332f250150d19df87391a32.
+- nalgebra 0.35.0: current phase, v0.5.3 working-tree snapshot based on commit be9277bf04400dccbe1115da69c7fda2141c4a39; measured source SHA-256
+  793169b4c5085624d7c0e773f1d28504c017e9b78332f250150d19df87391a32.
+- faer 0.24.4: current phase, v0.5.3 working-tree snapshot based on commit be9277bf04400dccbe1115da69c7fda2141c4a39; measured source SHA-256
+  793169b4c5085624d7c0e773f1d28504c017e9b78332f250150d19df87391a32.
+
+| Dimension | la-stack v0.5.3 | nalgebra 0.35.0 | faer 0.24.4 | Speedup vs nalgebra | Speedup vs faer |
 | --- | --- | --- | --- | --- | --- |
-| 2 | 2.06256<br>[2.04953, 2.09431] | 4.52663<br>[4.51758, 4.53267] | 128.125<br>[127.445, 128.545] | 2.19467× | 62.1194× |
-| 3 | 9.98278<br>[9.96279, 10.0083] | 32.5058<br>[32.3949, 32.6237] | 156.551<br>[156.195, 157.093] | 3.25619× | 15.6821× |
-| 4 | 23.7355<br>[23.6905, 23.7801] | 52.8361<br>[52.7137, 52.9963] | 183.09<br>[182.58, 183.503] | 2.22603× | 7.71373× |
-| 5 | 47.0332<br>[46.9411, 47.2694] | 74.3705<br>[74.1427, 74.7764] | 250.816<br>[250.442, 251.241] | 1.58123× | 5.33275× |
-| 8 | 132.096<br>[131.87, 132.513] | 166.8<br>[166.498, 167.23] | 342.479<br>[340.695, 343.771] | 1.26272× | 2.59266× |
-| 16 | 631.9<br>[628.777, 638.18] | 589.967<br>[588.536, 591.405] | 900.746<br>[897.01, 902.971] | 0.933639× | 1.42546× |
-| 32 | 2772.06<br>[2766.99, 2779.6] | 2499.64<br>[2493.29, 2506.42] | 2998.91<br>[2995.26, 3003.01] | 0.901726× | 1.08183× |
-| 64 | 17505.6<br>[17263.4, 17749.8] | 14495.6<br>[14481, 14519.4] | 12840.2<br>[12828.6, 12881.9] | 0.828057× | 0.733493× |
+| 2 | 2.06884<br>[2.0664, 2.07466] | 4.5918<br>[4.58866, 4.59692] | 130.897<br>[130.436, 131.469] | 2.21951× | 63.2706× |
+| 3 | 10.1094<br>[10.0641, 10.135] | 35.0464<br>[35.0098, 35.1322] | 163.46<br>[162.918, 164.545] | 3.46673× | 16.1691× |
+| 4 | 24.0133<br>[24.0048, 24.0359] | 55.4432<br>[55.2079, 55.6073] | 189.329<br>[189.14, 189.77] | 2.30885× | 7.88434× |
+| 5 | 47.8723<br>[47.6686, 48.1696] | 78.1378<br>[77.9205, 78.4518] | 252.753<br>[252.337, 253.319] | 1.63221× | 5.27973× |
+| 8 | 133.256<br>[133.148, 133.486] | 168.299<br>[168.089, 168.876] | 338.191<br>[337.146, 338.919] | 1.26297× | 2.5379× |
+| 16 | 631.082<br>[627.847, 636.268] | 581.252<br>[580.272, 582.309] | 889.228<br>[885.972, 894.046] | 0.921041× | 1.40905× |
+| 32 | 2787.86<br>[2781.93, 2792.44] | 2729.77<br>[2726.39, 2731.83] | 2974.82<br>[2969.33, 2979.13] | 0.979166× | 1.06706× |
+| 64 | 18063.6<br>[18036.7, 18106.7] | 14343.6<br>[14332.8, 14361.8] | 13017.3<br>[12958.9, 13039] | 0.794058× | 0.720637× |
 
 Intervals are recorded marginal timing intervals; ratios are point estimates, with no ratio intervals or significance claims.
 Ratio is numerator time / denominator time; greater than one means less denominator time.
 
-- Speedup vs nalgebra: ratio; numerator = nalgebra 0.35.0; denominator = la-stack v0.5.2.
-- Speedup vs faer: ratio; numerator = faer 0.24.4; denominator = la-stack v0.5.2.
+- Speedup vs nalgebra: ratio; numerator = nalgebra 0.35.0; denominator = la-stack v0.5.3.
+- Speedup vs faer: ratio; numerator = faer 0.24.4; denominator = la-stack v0.5.3.
 
 Selection coverage:
 
-- la-stack v0.5.2: 8 selected; 0 unavailable rows; 1395 phase cases omitted. Complete evidence is retained independently.
-- nalgebra 0.35.0: 8 selected; 0 unavailable rows; 1262 phase cases omitted. Complete evidence is retained independently.
-- faer 0.24.4: 8 selected; 0 unavailable rows; 1262 phase cases omitted. Complete evidence is retained independently.
-- [Complete run evidence](https://github.com/acgetchell/la-stack/blob/v0.5.2/docs/performance-runs/runs/5af2e5bf8a3aa22f12f45efad18280cebd2b4be31a0612901374306d4a7eb652/run.json)
-- [Evidence envelope](https://github.com/acgetchell/la-stack/blob/v0.5.2/docs/performance-runs/runs/5af2e5bf8a3aa22f12f45efad18280cebd2b4be31a0612901374306d4a7eb652/evidence.json)
-- [Selected timings CSV](https://github.com/acgetchell/la-stack/blob/v0.5.2/docs/assets/bench/vs_linalg_lu_solve_median_log.csv)
+- la-stack v0.5.3: 8 selected; 0 unavailable rows; 1411 phase cases omitted. Complete evidence is retained independently.
+- nalgebra 0.35.0: 8 selected; 0 unavailable rows; 1411 phase cases omitted. Complete evidence is retained independently.
+- faer 0.24.4: 8 selected; 0 unavailable rows; 1411 phase cases omitted. Complete evidence is retained independently.
+- [Complete run evidence][rrt-performance-link-1]
+- [Evidence envelope][rrt-performance-link-2]
+- [Selected timings CSV](https://github.com/acgetchell/la-stack/blob/v0.5.3/docs/assets/bench/vs_linalg_lu_solve_median_log.csv)
+
+[rrt-performance-link-1]:
+  <https://github.com/acgetchell/la-stack/blob/v0.5.3/docs/performance-runs/runs/2e55909621d0aacbfa7670f678574ae750311ba29353e6e9ebb11461414876a2/run.json>
+
+[rrt-performance-link-2]:
+  <https://github.com/acgetchell/la-stack/blob/v0.5.3/docs/performance-runs/runs/2e55909621d0aacbfa7670f678574ae750311ba29353e6e9ebb11461414876a2/evidence.json>
+
+[rrt-performance-link-3]:
+  <https://raw.githubusercontent.com/acgetchell/la-stack/v0.5.3/docs/assets/bench/vs_linalg_lu_solve_median_log.svg>
 
 <!-- BENCHMARKS:END -->