PanorAi 3.3.1 release checklist

This patch release repairs the cross-platform fixture gate that stopped the 3.3.0 workflow before TestPyPI. The signed v3.3.0 tag and GitHub Release stay immutable, and no 3.3.0 package files are promoted or uploaded manually.

Patch identity and incident boundary

  • [ ] The candidate is based on the exact reviewed 3.3.0 merge commit and contains no runtime API, numerical, native-kernel or dependency change.

  • [ ] The changelog records the failed 3.3.0 publication boundary and confirms that neither TestPyPI nor PyPI received 3.3.0 package files.

  • [ ] The release version, workflow selector, recovery workflow, documentation and fallback metadata all identify 3.3.1.

  • [ ] The complete patch diff receives review and protected PR plus post-merge CI pass for the exact trees they name.

Windows fixture correction

  • [ ] .gitattributes forces LF for every checksum-pinned geometry-v1 JSON fixture on all checkout platforms.

  • [ ] The standalone integrity verifier reads raw bytes and reproduces the manifest check used by installed-wheel conformance.

  • [ ] Tests prove the canonical fixture set passes and an otherwise identical CRLF-mutated analytic.json is rejected.

  • [ ] A hosted windows-latest job verifies fixture integrity directly after checkout, independently of package build and wheel smoke tests.

  • [ ] Linux, macOS and Windows installed-wheel conformance all consume the same manifest and byte-identical canonical fixtures.

Inherited stable-release gates

  • [ ] The full source suite passes with warnings as errors on Python 3.11-3.14, including NumPy, Torch, conformance, oracle, gradcheck and multimodal flows.

  • [ ] Strict Sphinx and executable documentation examples pass from source, installed wheel and extracted sdist where applicable.

  • [ ] Both native extensions build and execute on the full supported Linux, macOS and Windows wheel matrix.

  • [ ] A clean build produces exactly 20 wheels and one normalized sdist for version 3.3.1; all artifacts pass metadata, content, license and provenance audits plus twine check.

  • [ ] The hosted aggregate is downloaded, independently inventoried and its stored checksums match the release workflow output.

  • [ ] Stable/Experimental boundaries and all public geometry-v1 semantics are unchanged from the reviewed 3.3.0 candidate.

Authorized publication sequence

  1. Read back the three protected environment policies and change only their exact tag selector from v3.3.0 to v3.3.1.

  2. Create a signed annotated v3.3.1 tag on the exact GO-CANDIDATE commit.

  3. Publish one GitHub Release, the sole trigger of python-publish.yml.

  4. Verify the workflow-built 20-wheel/one-sdist identities and provenance.

  5. Verify TestPyPI serves byte-identical files and installed validation passes.

  6. Allow the workflow to promote those same files to PyPI and deploy Pages.

  7. Install panorai==3.3.1 from production PyPI in a new environment and repeat the public smoke, native-extension and conformance validation.

The 3.3.0 tag must never be moved or deleted, and no manual upload may bypass the release workflow or any protected environment.