feat(checkpoint)!: add verified scientific checkpoint manifests

.config/nextest.toml

@@ -70,6 +70,16 @@ binary(=proptest_delaunay_triangulation)
 '''
 slow-timeout = { period = "60s", terminate-after = 1 }
 
+[[profile.ci.overrides]]
+# The 5D local-neighbor repair guardrail can cross the integration-suite
+# watchdog on Windows runners. Keep the normal budget for every other case.
+platform = 'cfg(windows)'
+filter = '''
+binary(=delaunay_incremental_insertion)
+& test(=test_local_neighbor_repair_guardrails_5d)
+'''
+slow-timeout = { period = "60s", terminate-after = 1 }
+
 [[profile.ci.overrides]]
 # This cospherical 3D OnSuspicion property can cross the integration-suite
 # watchdog on hosted runners.
@@ -79,6 +89,17 @@ binary(=proptest_delaunay_triangulation)
 '''
 slow-timeout = { period = "60s", terminate-after = 1 }
 
+[[profile.ci.overrides]]
+# This regression deliberately compiles and runs a standalone downstream crate
+# in a separate target directory so Cargo feature unification cannot mask the
+# serde_json configuration under test. A clean dependency build can cross the
+# normal per-test watchdog even though the fixture itself is small.
+filter = '''
+binary(=checkpoint_downstream)
+& test(=downstream_json_without_float_roundtrip_preserves_checkpoint_bits)
+'''
+slow-timeout = { period = "120s", terminate-after = 1 }
+
 [[profile.ci.overrides]]
 # Complete 5D exact SoS expansion can cross the default budget on hosted
 # runners. Keep the exception limited to the deterministic co-spherical

.github/actions/setup-just/action.yml

@@ -14,31 +14,7 @@ runs:
       shell: bash
       run: |
         set -euo pipefail
-        shopt -s extglob
-
-        version=""
-        declaration_re='^[[:space:]]*just_version[[:space:]]*:=[[:space:]]*(.*)$'
-        while IFS= read -r line; do
-          if [[ "$line" =~ $declaration_re ]]; then
-            value="${BASH_REMATCH[1]}"
-            value="${value%%#*}"
-            value="${value##+([[:space:]])}"
-            value="${value%%+([[:space:]])}"
-
-            if [[ ${#value} -ge 2 ]]; then
-              first="${value:0:1}"
-              last="${value: -1}"
-              if [[ "$first" == "$last" && ( "$first" == '"' || "$first" == "'" ) ]]; then
-                value="${value:1:${#value}-2}"
-              fi
-            fi
-
-            version="$value"
-            break
-          fi
-        done < justfile
-
-        if [[ -z "$version" ]]; then
+        if ! version="$(bash .github/actions/setup-just/resolve-version.sh)"; then
           echo "::error::Could not resolve just_version from justfile"
           exit 1
         fi

.github/actions/setup-just/resolve-version.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+shopt -s extglob
+
+justfile_path="${1:-justfile}"
+declaration_re='^[[:space:]]*just_version[[:space:]]*:=[[:space:]]*(.*)$'
+versions=()
+
+while IFS= read -r line; do
+	if [[ "$line" =~ $declaration_re ]]; then
+		value="${BASH_REMATCH[1]}"
+		value="${value%%#*}"
+		value="${value##+([[:space:]])}"
+		value="${value%%+([[:space:]])}"
+
+		if [[ ${#value} -ge 2 ]]; then
+			first="${value:0:1}"
+			last="${value: -1}"
+			if [[ "$first" == "$last" && ("$first" == '"' || "$first" == "'") ]]; then
+				value="${value:1:${#value}-2}"
+			fi
+		fi
+		versions+=("$value")
+	fi
+done <"$justfile_path"
+
+if [[ ${#versions[@]} -ne 1 || -z "${versions[0]}" ]]; then
+	echo "Could not resolve exactly one non-empty just_version from $justfile_path" >&2
+	exit 1
+fi
+if [[ ! "${versions[0]}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]; then
+	echo "Resolved invalid just_version from $justfile_path: ${versions[0]}" >&2
+	exit 1
+fi
+
+printf '%s\n' "${versions[0]}"

.github/workflows/audit.yml

@@ -4,7 +4,7 @@ on:
     paths:
       # Run if workflow changes
       - .github/workflows/audit.yml
-      - .github/actions/setup-just/action.yml
+      - .github/actions/setup-just/**
       # Run if tool-version source changes
       - justfile
       # Run on changed dependencies
@@ -14,7 +14,7 @@ on:
     paths:
       # Run if workflow changes
       - .github/workflows/audit.yml
-      - .github/actions/setup-just/action.yml
+      - .github/actions/setup-just/**
       # Run if tool-version source changes
       - justfile
       # Run on changed dependencies

.github/workflows/benchmarks.yml

@@ -14,7 +14,7 @@ on:
     # Only run on changes that could affect performance
     paths:
       - ".github/workflows/benchmarks.yml"
-      - ".github/actions/setup-just/action.yml"
+      - ".github/actions/setup-just/**"
       - ".python-version"
       - "justfile"
       - "pyproject.toml"
@@ -37,7 +37,7 @@ on:
     # Only run on changes that could affect performance
     paths:
       - ".github/workflows/benchmarks.yml"
-      - ".github/actions/setup-just/action.yml"
+      - ".github/actions/setup-just/**"
       - ".python-version"
       - "justfile"
       - "pyproject.toml"

.github/workflows/papers.yml

@@ -18,7 +18,7 @@ on:
       - main
     paths:
       - ".github/workflows/papers.yml"
-      - ".github/actions/setup-just/action.yml"
+      - ".github/actions/setup-just/**"
       - ".python-version"
       - "Cargo.lock"
       - "Cargo.toml"
@@ -32,6 +32,7 @@ on:
       - "scripts/paper_check.py"
       - "scripts/paper_pdf_normalize.py"
       - "scripts/paper_source_date.py"
+      - "scripts/subprocess_utils.py"
       - "scripts/notebook_utils.py"
       - "scripts/notebook_validation.py"
       - "scripts/notebook_validation_rendering.py"
@@ -46,7 +47,7 @@ on:
       - main
     paths:
       - ".github/workflows/papers.yml"
-      - ".github/actions/setup-just/action.yml"
+      - ".github/actions/setup-just/**"
       - ".python-version"
       - "Cargo.lock"
       - "Cargo.toml"
@@ -60,6 +61,7 @@ on:
       - "scripts/paper_check.py"
       - "scripts/paper_pdf_normalize.py"
       - "scripts/paper_source_date.py"
+      - "scripts/subprocess_utils.py"
       - "scripts/notebook_utils.py"
       - "scripts/notebook_validation.py"
       - "scripts/notebook_validation_rendering.py"
@@ -223,14 +225,5 @@ jobs:
 
       - name: Build and compare papers
         run: |
-          just validation-doc-figures
+          just validation-doc-figures-check
           just paper-artifact-check
-
-      - name: Verify paper figures are current
-        run: |
-          if [[ -n "$(git status --porcelain -- docs/assets/validation)" ]]; then
-            git status --short -- docs/assets/validation
-            echo "::error::Paper figures changed after 'just validation-doc-figures'."
-            echo "Run 'just validation-doc-figures' and commit the regenerated PNG outputs."
-            exit 1
-          fi

.github/workflows/release-benchmarks.yml

@@ -78,15 +78,9 @@ jobs:
           fi
 
           mkdir -p release-benchmark-artifacts
-          cargo bench --profile perf --bench ci_performance_suite
-          cargo bench --profile perf --bench circumsphere_containment
-          cargo bench --profile perf --bench cold_path_predicates
-          cargo bench --profile perf --bench locate
-          cargo bench --profile perf --bench realization_validation
+          just bench-latest 3600
           uv run --locked benchmark-utils generate-summary \
             --strict \
-            --profile perf \
-            --bench-timeout 3600 \
             --output release-benchmark-artifacts/PERFORMANCE_RESULTS.md
           uv run --locked benchmark-utils write-baseline \
             --ref "$RELEASE_TAG" \

.github/workflows/semgrep-sarif.yml

@@ -68,20 +68,8 @@ jobs:
         id: semgrep
         run: |
           set -euo pipefail
-          semgrep_targets=(.)
-          while IFS= read -r -d '' file; do
-            semgrep_targets+=("$file")
-          done < <(git ls-files -z 'scripts/tests/*.py')
-
           set +e
-          uv run --locked semgrep \
-            --error \
-            --strict \
-            --timeout 30 \
-            --config semgrep.yaml \
-            --sarif \
-            --output semgrep-results.sarif \
-            "${semgrep_targets[@]}"
+          just semgrep-scan semgrep-results.sarif
           status=$?
           echo "exit_code=$status" >> "$GITHUB_OUTPUT"
           exit 0

AGENTS.md

@@ -68,8 +68,10 @@ workflow references do not need to be loaded preemptively.
 - **Treat paper prose as author-owned.** Agents must not add substantive
   publication prose to `papers/`; local paper maintenance rules live in
   `docs/dev/docs.md`.
-- **Keep notebook execution deliberate.** Routine notebook validation is
-  lint-only. Execute one notebook only when the task requires it; refresh
+- **Keep notebook execution deliberate.** `just notebook-check` is lint-only.
+  The canonical macOS leg of `just ci` may execute the validation notebook only
+  to compare regenerated figures with tracked artifacts; it must not publish
+  them. Execute other notebooks only when the task requires it, and refresh
   tracked notebook artifacts only through named recipes when the task includes
   that refresh. Every cell must have a unique, stable, descriptive lowercase
   kebab-case ID. Detailed policy lives in `docs/dev/notebooks.md`.
@@ -112,6 +114,11 @@ When in doubt, favor the invariant over the convenient edit.
   `Orientation::DEGENERATE`.
 - No f64 operation may silently lose sign information. Avoid patterns such as
   `unwrap_or(NaN)`, `unwrap_or(f64::INFINITY)`, or "return `true` on error."
+- Repository-owned Rust must not use `f64::algebraic_add`,
+  `f64::algebraic_sub`, `f64::algebraic_mul`, `f64::algebraic_div`, or
+  `f64::algebraic_rem`. Ordinary IEEE-754 operators and deliberate
+  `f64::mul_add` remain allowed. Any other relaxed or fast-math facility
+  requires a separate tracked scientific review before adoption.
 - Algorithms cite their source in `REFERENCES.md` and document conditioning
   behavior.
 - When two predicate implementations answer the same question, property tests
@@ -126,6 +133,11 @@ When in doubt, favor the invariant over the convenient edit.
   `DelaunayTriangulation::is_valid_delaunay` / `validate` (Level 5). An
   operation that cannot preserve them must fail explicitly rather than leave
   inconsistent state behind.
+- Every fallible topology move, mutation, and repair is failure-atomic: success
+  commits a state valid through the operation's promised validation layers;
+  failure restores the prior valid owner state. Detailed implementation and
+  test-proof requirements live in `docs/dev/rust/reference.md` and
+  `docs/dev/testing.md`.
 - PL-manifold invariants: facets have multiplicity 1 (boundary) or 2
   (interior), ridges are linked consistently, and Euler characteristic matches
   the triangulation's `TopologyGuarantee`.

CONTRIBUTING.md

@@ -34,11 +34,17 @@ Our community is built on:
 
 ## Getting Started
 
-Install [Rust via rustup][rustup], Git, Python, `uv`, and `just`. The pinned
-Rust toolchain is declared in `rust-toolchain.toml`; Python development tooling
-is described in [docs/dev/python.md][dev-python] and
+Install [Rust via rustup][rustup], Git, Python, and `uv`. The pinned Rust
+toolchain is declared in `rust-toolchain.toml`; Python development tooling is
+described in [docs/dev/python.md][dev-python] and
 [scripts/README.md][scripts-readme].
 
+From the repository root, install the same Just version used by CI:
+
+```bash
+bash scripts/bootstrap_just.sh
+```
+
 For the current command list and workflow details, use:
 
 ```bash
@@ -54,8 +60,11 @@ just check
 just test
 ```
 
-Run `just ci` before opening or updating a pull request when the change is ready
-for full validation. For command details, see [docs/dev/commands.md][dev-commands].
+Before opening or updating a pull request, run the final validator for every
+touched surface in the validation matrix. Core Rust or other broad changes
+require `just ci`; documentation, configuration, Python, notebook, test-only,
+benchmark-only, and example-only changes use their focused validators. See
+[docs/dev/commands.md][dev-commands] for the authoritative matrix.
 
 ## AI-Assisted Development