Replace duplicated maintenance tooling with research-repo-tools

[acgetchell]

Goal

Replace duplicated repository-maintenance implementation with a pinned research-repo-tools release installed directly from PyPI through uv. Keep this repository focused on Rust and its scientific work, with one correct, performant, orthogonal, and simple shared toolchain.

Consumers own version declarations, configuration, thin Just recipes, and focused integration checks. The shared package owns each common implementation and its regression tests. Use the documented CLI (or research_repo_tools.cli.main()); internal modules are not a stable library API.

Prerequisites and rollout

Adopt after PyPI publication and the clean-consumer check and the MCMC changelog pilot. These prerequisites are tracked with native GitHub issue dependencies. Shared installer verification is a publication prerequisite in acgetchell/research-repo-tools#2.

Keep this as a separate follow-up to current Rust/scientific work. Start with changelog adoption, then migrate the remaining supported capabilities in reviewable increments. Rust library dependency order does not require tooling migration to start in la-stack.

Scope

Package and toolchain

• Install and lock an exact published package version in a tooling dependency group included by dev; use Python 3.14+.
• Adopt declared uv/Python/Rust/Cargo setup and generated bootstrap.sh / bootstrap.ps1 launchers. Replace repeated installation, version-check, and PATH-selection logic with toolchain check/sync/run/bootstrap.
• Keep uv, Python, Rust, and Cargo tool declarations in their authoritative consumer files. Toolchain sync installs declared versions; upgrades are separate reviewed changes.
• Keep Git, platform compilers/linkers, and any required GitHub CLI as system prerequisites. Supported Cargo tools are installed by the shared package; other Python tools remain dependency-group entries.
• Normal developer setup and CI must resolve the package from PyPI, without a sibling checkout, editable shared-package install, or machine-specific artifact path.

Replace duplicated maintenance tooling

• Replace postprocess_changelog.py, archive_changelog.py, tag_release.py, and duplicated generation/formatting recipes with shared changelog commands and the packaged git-cliff policy.
• Replace common behavior in update_release_version.py and check_docs_version_sync.py with release update/check.
• Replace update_python_dev_pins.py and update_cargo_tool_pins.py; migrate shared fixture-configuration/checking behavior from the Semgrep helpers while retaining local rules and target decisions.
• Retain notebook validation/rendering, paper/manuscript tooling, scientific benchmarks, performance publication, and the Codacy SARIF filter unless a separately reviewed shared capability covers them. Keep subprocess_utils.py while retained scripts need it.
• CodeRabbit review-base work in Verify the live origin/main base before CodeRabbit review #614 remains independently actionable; this migration does not claim to implement that review workflow.

Preserve the shared command surface

Keep familiar thin recipes for changelog, changelog-preview, changelog-unreleased TAG DATE / changelog-release TAG DATE, changelog-archive, release-notes TAG, tag TAG, and tag-force TAG. Prospective generation uses an explicit date; metadata preparation is a separate command.

just changelog must generate, normalize, and rotate completed minor series in one shared operation. Adopt docs/archives/changelog/MAJOR.MINOR.md, retaining Unreleased and the newest minor series in the root changelog. Move any existing docs/archive/changelog/ content and repair references deliberately, preserving retained history and links. Use the packaged git-cliff policy instead of maintaining another copy unless a documented consumer requirement needs a custom configuration.

Distinguish managed TOML tool declarations from the legacy deps update-tools command, which only reconciles Just variables with user-installed tools. Do not treat it as an automatic updater for managed pins.

Consumer ownership and CI

Retain Rust builds/tests, scientific Python, notebooks, benchmark cases, performance/evidence pipelines, deployment/publication workflows, Semgrep rules and fixtures, and GitHub security/Dependabot/CodeRabbit configuration.

Port applicable common regressions upstream before deleting local implementations. Remove tests, lint/type-check targets, and helper modules only when they exclusively belong to replaced tooling and have no remaining callers. Keep checks for all remaining consumer-owned Python and notebooks, plus focused integration checks for the pinned package, configuration, generated files, and recipes.

Generic notebook infrastructure, benchmark/plotting/evidence tooling, and CodeRabbit review orchestration are not implemented shared capabilities and are outside this migration. Handle any repository-specific release behavior explicitly in the consumer; do not add repository-name profiles or compatibility flags to the shared package.

Dependency and tool update integration

Adopt the complete update workflow from research-repo-tools#22, following the recipe contract and update adoption guidance. These are consumer integration requirements to complete before deleting the old update helpers; shared synthetic tests and native wheel smoke tests do not establish successful adoption in this repository.

• Pin and lock a published PyPI release containing build(deps): bump rand from 0.8.5 to 0.9.1 in the dependencies group #22. Run focused integration checks against that installed release, the merged consumer Just recipes, and real consumer configuration; ordinary setup and CI must not depend on an editable install, sibling checkout, or local wheel override.
• Exercise just update, just update-dependencies, just update-cargo-dependencies, just update-python-dependencies (including its update-python-deps alias), and just update-tools. Verify tool updates precede dependency updates in the aggregate, dependency-only commands leave uv and Cargo tool pins unchanged, tool-only commands leave dependency requirements and lock resolutions unchanged, and failures stop later steps with useful diagnostics.
• Declare an exact cargo-edit pin, install and verify it through the current shared setup contract, and confirm cargo upgrade uses the managed executable. Check the full adopted Cargo-tool inventory and versions on supported consumer platforms, retaining necessary native build/runtime prerequisites; a system executable must not silently satisfy a managed pin.
• Verify Cargo requirement upgrades and lock refreshes, plus exact Python dev-pin upgrades, a full uv.lock refresh, and explicit dev synchronization (including default-groups = []). Preserve the pinned shared-package constraint and verify managed Rust is available during native Python builds where applicable.
• Preserve both Cargo resolution roots in the consumer-owned update-cargo-dependencies recipe: the root manifest and tests/fixtures/checkpoint_no_float_roundtrip/Cargo.toml. Exercise requirement upgrades and lock refreshes for both, verify the aggregate invokes this override, and run the checkpoint fixture checks. Retain the adopted profiling/typesetting tools and their prerequisites, including samply, tectonic, and tex-fmt.
• Document the deliberate policy changes: uv upgrades through its installation owner, Just follows the shared package's rust-just pin, and managed Cargo upgrades replace cargo-update and the legacy Just-variable pin reconciler. Adopt these policies explicitly rather than retaining duplicate implementations or compatibility switches.
• Retain focused integration checks and this repository's Rust/scientific validation. Record the shared-package version, exercised recipes, and supported-platform results in the adoption PR or CI logs; remove old helpers and their dedicated tests only after callers, applicable regressions, and these checks have migrated successfully.

Acceptance criteria

• The selected release is available on PyPI and contains every capability used by this migration.
• A clean consumer environment installs the exact locked package version from PyPI and runs the adopted recipes.
• Generated bootstrap launchers match the declarations; setup, tool checks, and managed execution are verified on the supported consumer platforms.
• Representative changelog history, minor-series rotation, archived-note lookup, Rust code/links, and prospective release dates are checked through the shared commands.
• Release metadata previews/checks and applicable dependency/fixture/documentation/coverage workflows pass with consumer inputs.
• Duplicate scripts and dedicated checks are removed only after callers and applicable regressions have been migrated; remaining scientific and Python checks still run.
• Contributor/release/setup documentation and the code-organization inventory describe the pinned package, thin wrappers, ownership boundaries, and upgrade process.
• Focused consumer integration checks, just check, final just ci, and required hosted CI pass for the migration.
• Each unavailable or consumer-specific behavior has an explicit retained implementation or separate follow-up; no capability is silently dropped.

Shared contracts

• Supported interfaces
• Changelog contract and recipes
• Release metadata
• Toolchain setup
• Adoption and CI ownership