Changelog

SciProof 0.3.2

2026-10-23

SciProof 0.3.2 is mostly fixes: a batch of crashes on bad or unusual input now give a clear error, and a few things that did not work on Windows or through the Python API do now. Thank you to everyone who contributed.

Fixed

• update keeps the log limit of the manifest it replaces: a capture made with --max-log-bytes 0 no longer gets its stdout/stderr text back after an update (#87).
• On Windows, a command given by its bare name can be a .cmd or .bat tool on PATH (npm, mvn, your own tool.cmd), as in a terminal. The manifest still records the name as typed (#102).
• verify --save-json and export -o report an unwritable path as error: cannot write ... with exit status 3 instead of a traceback with exit status 1, which means verification failed. verify --save-json now writes the file after the verdict is printed (#73).
• Integers too large for a float no longer end in a traceback: the ~= claim operator compares them exactly, and a number that no float can carry in a validated manifest field is reported as an invalid manifest (#88).
• A manifest whose environment.hardware has no cpu_count is rejected at validation instead of passing verify and crashing inspect and diff (#89).
• created_at must be an ISO 8601 timestamp with a timezone offset; any other value is rejected instead of crashing verify --policy or export --format openlineage (#90).
• capture_experiment(base=...) accepts a string or any os.PathLike, like the rest of the Python API (#103).
• Policy files with a leading UTF-8 BOM are accepted (#74).

Added

• Numeric comparison (--output-numeric) supports tab-separated values (.tsv), compared with the declared tolerance like .csv.
• Policies can require a note (manifest.require_note) or a hardware record (manifest.require_hardware).
• A shell-pipeline tutorial for capturing and verifying non-Python experiments.

Install or upgrade: pipx install sciproof or python -m pip install -U sciproof. Full list: CHANGELOG.md.

SciProof 0.3.1

2026-10-21

Changed

• The GitHub Action’s description is short enough for the GitHub Marketplace (under 125 characters).

Added

• CITATION.cff (GitHub’s “Cite this repository”), a page on showing that results come with evidence (docs/BADGE.md), and more complete PyPI metadata (keywords, classifiers, documentation links).

SciProof 0.3.0

2026-10-21

Nothing here changes how existing manifests are read or written.

Added

• Verification policies. verify --policy FILE checks the rules of a strict TOML file against the evidence (age of the evidence, exit code, Git state, signature, minimum number of claims, tolerance ceilings, rerun and clean-environment requirements) as checks of the report; a rule whose evidence is missing is INCONCLUSIVE. sciproof check-policy FILE validates a policy. An invalid policy is rejected before any command is executed. See docs/POLICY.md.
• sciproof update MANIFEST: capture the recorded experiment again with the declarations in the manifest (command, inputs, outputs, tolerance, claims, note, hardware), after the same confirmation as a rerun, replace the manifest and print what changed. --dry-run shows what would happen. The declared outputs are removed first and restored if the capture fails. See docs/UPDATE.md.
• A GitHub Action (action.yml): uses: hayagrivai-labs/sciproof@v0.3.0 verifies a manifest, writes the Markdown report to the job summary and exposes result and report outputs. The repository tests it in its own CI. See docs/CI.md.
• JUnit XML (verify --format junit, list --check --format junit) for CI test viewers, and verify --save-json FILE to keep the JSON report next to any other format.
• sciproof.update_baseline() and the policy= argument of verify_manifest() in the Python API.

Changed

• Installed packages are listed from the dist-info directory names instead of parsing every METADATA file (about 50 times faster; a capture on an interpreter with 96 packages takes 0.50 s instead of 0.63 s). Package names are compared in their standard normal form, so jaraco.context and jaraco_context are one package; manifests recorded by 0.2.x stay comparable.

v0.2.0

2026-10-20

Fixed first

A rerun could pass without the command writing its outputs. The previous outputs stayed in place while the command ran, so a command that wrote nothing (a bug, a wrong path, an early exit) was compared with its own old files and reported as reproduced. Declared outputs are now removed before a rerun and restored afterwards; an output the command does not write is FAIL (“the rerun did not produce this file”). A command that skips work when its output already exists will now do the work again.

New

• sciproof diff OLD NEW: what changed between two recorded runs (command, note, environment and packages, hardware, Git, inputs, outputs, claims, exit code), without executing anything.
• verify --format markdown for CI job summaries, with a table of numeric differences (recorded, found, absolute and relative difference, allowed).
• capture --claim OUTPUT 'LOCATION OP VALUE': checkable statements about values in .json/.csv outputs, judged on the recorded output and on every rerun.
• sciproof sign and verify --allowed-signers FILE: OpenSSH signatures; SciProof implements no cryptography and trusts only the file you name.
• sciproof list [DIR] [-r] [--check] and sciproof export (in-toto Statement, OpenLineage events).
• capture --note, opt-in --record-hardware, directories as inputs and outputs, verify --rerun --clean-env, suggest-inputs, and a documented Python API (import sciproof).

Changed

• A repeated key in a JSON manifest or numeric output is now an error (it used to be resolved silently to the last value).
• Manifest schema 1.1 is written only when a manifest uses directories, claims, a note or a hardware record; every other manifest is still 1.0 and is read by 0.1.x.

Full list: CHANGELOG.md.

v0.1.1

2026-10-18

First release published through the automated workflow (PyPI trusted publishing).

Install: pipx install sciproof or pip install sciproof (Python 3.11+).

Alpha. SciProof records a command and the hashes of declared files, and verifies them later (PASS / FAIL / INCONCLUSIVE), optionally by re-running the command with numeric tolerances. It does not prove scientific correctness; only declared files are tracked.

Compared with the 0.1.0 files already on PyPI, 0.1.1 has the corrected package page (README, project links) and the fixes merged since, including: numeric comparison of huge integers and CSV line breaks, .npy arrays (optional NumPy extra), --timeout stopping the whole process tree, LF-only manifests on every OS, safer interpreter probing, and stale snapshot cleanup. Full list: closed pull requests since the first commit.