fix: harden exact arithmetic and benchmark publication

- add `DeterminantWithErrorBound` for paired determinant estimates and certified bounds
- scale exact systems independently and round exact values directly to IEEE-754
- fail benchmark publication closed on invalid samples or mismatched provenance
- make release and changelog tooling transactional, path-safe, and Windows-portable
- align benchmark CI with pinned local tools and least-privilege publishing

Author: acgetchell

.github/dependabot.yml

@@ -28,3 +28,19 @@ updates:
       dependencies:
         patterns:
           - "*"
+
+  # Enable version updates for Python development dependencies locked by uv
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "python"
+    groups:
+      dependencies:
+        patterns:
+          - "*"

.github/workflows/benchmarks.yml

@@ -18,6 +18,7 @@ on:
       - "benches/**"
       - "tests/exact_bench_config.rs"
       - "tests/vs_linalg_inputs.rs"
+      - ".config/nextest.toml"
       - "Cargo.toml"
       - "Cargo.lock"
       - "justfile"
@@ -31,6 +32,7 @@ on:
       - "benches/**"
       - "tests/exact_bench_config.rs"
       - "tests/vs_linalg_inputs.rs"
+      - ".config/nextest.toml"
       - "Cargo.toml"
       - "Cargo.lock"
       - "justfile"
@@ -67,10 +69,30 @@ jobs:
           cache: true
           cache-bin: false
 
+      - name: Read just version
+        id: just_version
+        run: |
+          version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Install just
+        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
+        with:
+          tool: just@${{ steps.just_version.outputs.version }}
+
+      - name: Read cargo-nextest version
+        id: cargo_nextest_version
+        run: |
+          version="$(just --evaluate cargo_nextest_version)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Install cargo-nextest
+        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
+        with:
+          tool: cargo-nextest@${{ steps.cargo_nextest_version.outputs.version }}
+
       - name: Validate benchmark inputs
-        run: >
-          cargo test --locked --features bench,exact
-          --test vs_linalg_inputs --test exact_bench_config
+        run: just test-bench-inputs
 
       # ── PR: find and download the latest main baseline ──────────────
       - name: Find latest main baseline

.github/workflows/codeql.yml

@@ -33,14 +33,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install Rust toolchain
-        if: matrix.language == 'rust'
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
-        with:
-          cache: true
-          cache-bin: false
-          # toolchain, components, etc. are specified in rust-toolchain.toml
-
       - name: Initialize CodeQL
         if: matrix.language != 'rust'
         uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0

.github/workflows/release-benchmarks.yml

@@ -5,7 +5,7 @@ name: Release Benchmarks
 # or save dependency caches.
 
 permissions:
-  contents: write
+  contents: read
 
 on:
   release:
@@ -24,6 +24,8 @@ jobs:
   release-baseline:
     runs-on: ubuntu-latest
     timeout-minutes: 60
+    outputs:
+      release-asset: ${{ steps.package-baseline.outputs.asset }}
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -36,10 +38,17 @@ jobs:
         with:
           cache: false
 
+      - name: Install benchmark validation tools
+        run: |
+          set -euo pipefail
+
+          just_version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
+          cargo install --locked just --version "$just_version"
+          nextest_version="$(just --evaluate cargo_nextest_version)"
+          cargo install --locked cargo-nextest --version "$nextest_version"
+
       - name: Validate benchmark inputs
-        run: >
-          cargo test --locked --features bench,exact
-          --test vs_linalg_inputs --test exact_bench_config
+        run: just test-bench-inputs
 
       - name: Save release Criterion baseline
         env:
@@ -69,19 +78,32 @@ jobs:
           retention-days: 30
           if-no-files-found: error
 
+  publish-baseline:
+    needs: release-baseline
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Download release baseline
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bench-baseline-${{ github.event.release.tag_name }}
+
       - name: Attach baseline to GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
-          RELEASE_ASSET: ${{ steps.package-baseline.outputs.asset }}
+          RELEASE_ASSET: ${{ needs.release-baseline.outputs.release-asset }}
         run: |
           set -euo pipefail
 
           gh release upload "$RELEASE_TAG" "$RELEASE_ASSET" --clobber
 
       - name: Release baseline summary
         env:
-          RELEASE_ASSET: ${{ steps.package-baseline.outputs.asset }}
+          RELEASE_ASSET: ${{ needs.release-baseline.outputs.release-asset }}
         run: |
           set -euo pipefail
 

.github/workflows/rust-clippy.yml

@@ -3,6 +3,11 @@
 
 name: "Clippy Security Analysis"
 
+concurrency:
+  group: >-
+    clippy-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     branches: ["main"]

AGENTS.md

@@ -309,8 +309,8 @@ just examples         # Run all examples
 - Format: `cargo fmt` (or `just fmt`)
 - Integration tests: `just test-integration`
 - Benchmark-input smoke tests: `just test-bench-inputs`
-- Lint (Clippy): `cargo clippy --all-targets --all-features -- -D warnings` (or `just clippy`)
-- Lint (Clippy, exact feature): `cargo clippy --features exact --all-targets -- -D warnings` (or `just clippy-exact`)
+- Lint (Clippy, canonical default and all-feature passes): `just clippy`
+- Lint (Clippy, focused exact-feature pass): `just clippy-exact`
 - Lint/validate: `just check`
 - Cargo manifest/lockfile synchronization: `just cargo-lock-check`
 - Unused dependency check: `just unused-deps` (uses `cargo-machete`)

CONTRIBUTING.md

@@ -7,11 +7,11 @@ clarity, and the fixed-dimension stack-allocation model.
 ## Getting Started
 
 Install Rust through [rustup](https://rustup.rs/), Git, Python 3.14,
-[uv](https://docs.astral.sh/uv/), and `just`. Install `just` from its locked
-dependency graph:
+[`uv` 0.11.28](https://docs.astral.sh/uv/), and `jq`. Install the repository's
+pinned `just` version from its locked dependency graph:
 
 ```bash
-cargo install --locked just
+cargo install --locked just --version 1.56.0
 ```
 
 Set up the remaining development tools and validate the checkout:

README.md

@@ -3,7 +3,7 @@
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.18158926.svg)](https://doi.org/10.5281/zenodo.18158926)
 [![Crates.io](https://img.shields.io/crates/v/la-stack.svg)](https://crates.io/crates/la-stack)
 [![Downloads](https://img.shields.io/crates/d/la-stack.svg)](https://crates.io/crates/la-stack)
-[![License](https://img.shields.io/crates/l/la-stack.svg)](./LICENSE)
+[![License](https://img.shields.io/crates/l/la-stack.svg)](https://github.com/acgetchell/la-stack/blob/v0.4.3/LICENSE)
 [![Docs.rs](https://docs.rs/la-stack/badge.svg)](https://docs.rs/la-stack)
 [![CI](https://github.com/acgetchell/la-stack/actions/workflows/ci.yml/badge.svg)](https://github.com/acgetchell/la-stack/actions/workflows/ci.yml)
 [![rust-clippy analyze][clippy-badge]][clippy-workflow]
@@ -328,26 +328,25 @@ filter and uses fraction-free Bareiss elimination in `BigInt`.
 Because `Matrix` stores only finite entries, arithmetic range failures in the
 filter are inconclusive rather than errors and the exact fallback is total.
 
-### Adaptive precision with `det_errbound()`
+### Adaptive precision with `det_direct_with_errbound()`
 
-`det_errbound()` returns the conservative absolute error bound used by the fast
-filter when the relative-error analysis is valid. It returns `None` when a
-D ≤ 4 computation may be affected by gradual underflow, as well as for
-unsupported D ≥ 5 dimensions. This method does NOT require the `exact` feature
-— it uses pure f64 arithmetic and is available by default. This enables
-building custom adaptive-precision logic for geometric predicates:
+`det_direct_with_errbound()` returns a closed-form determinant together with
+the conservative absolute error bound used by the fast filter, computed from
+one shared traversal. It returns `None` when a D ≤ 4 computation may be
+affected by gradual underflow, as well as for unsupported D ≥ 5 dimensions.
+This method does NOT require the `exact` feature — it uses pure f64 arithmetic
+and is available by default. Use `det_errbound()` when only the bound is needed.
+The paired API enables custom adaptive-precision logic for geometric predicates:
 
 ```rust,ignore
 use la_stack::prelude::*;
 
 fn adaptive_det_sign<const D: usize>(
     matrix: &Matrix<D>,
 ) -> DeterminantSign {
-    if let (Ok(Some(bound)), Ok(Some(det))) =
-        (matrix.det_errbound(), matrix.det_direct())
-    {
-        if det.abs() > bound {
-            return if det > 0.0 {
+    if let Ok(Some(estimate)) = matrix.det_direct_with_errbound() {
+        if estimate.determinant().abs() > estimate.absolute_error_bound() {
+            return if estimate.determinant() > 0.0 {
                 DeterminantSign::Positive
             } else {
                 DeterminantSign::Negative
@@ -422,6 +421,7 @@ out of the common prelude.
 |---|---|---|---|
 | `Vector<D>` | `[f64; D]` | Finite fixed-length vector for input and computation | `try_new`, `as_array`, `into_array`, `dot`, `norm2_sq` |
 | `Matrix<D>` | `[[f64; D]; D]` | Finite square matrix for input and computation | See below |
+| `DeterminantWithErrorBound` | two private `f64` fields | Paired direct determinant and certified absolute bound | `determinant`, `absolute_error_bound` |
 | `Lu<D>` | `Matrix<D>` + pivot array | Factorization for solves/det | `solve`, `det` |
 | `Ldlt<D>` | `Matrix<D>` | Factorization for symmetric SPD/PSD solves/det | `solve`, `det` |
 | `Tolerance` | finite non-negative `f64` | Validated numerical threshold | `try_new`, `get` |
@@ -431,7 +431,7 @@ out of the common prelude.
 Storage shown above reflects the intentional `f64` scalar model.
 
 `Matrix<D>` key methods: `as_rows`, `into_rows`, `lu`, `ldlt`, `det`,
-`det_direct`, `det_errbound`,
+`det_direct`, `det_direct_with_errbound`, `det_errbound`,
 `det_exact`¹, `det_exact_f64`¹, `det_exact_rounded_f64`¹, `det_sign_exact`¹,
 `solve_exact`¹, `solve_exact_f64`¹, `solve_exact_rounded_f64`¹.
 Matrix and vector constructors validate non-finite inputs at public API
@@ -469,7 +469,7 @@ breaking callers.
 Raw data:
 [docs/assets/bench/vs_linalg_lu_solve_median.csv](https://github.com/acgetchell/la-stack/blob/v0.4.3/docs/assets/bench/vs_linalg_lu_solve_median.csv)
 Historical provenance status:
-[docs/assets/bench/vs_linalg_lu_solve_median.provenance.json](docs/assets/bench/vs_linalg_lu_solve_median.provenance.json)
+[docs/assets/bench/vs_linalg_lu_solve_median.provenance.json][benchmark-provenance]
 
 Representative benchmark: `lu_solve` factors the matrix and solves one
 right-hand side. Median time is lower-is-better, and the “la-stack vs
@@ -540,8 +540,12 @@ cargo run --features exact --example exact_solve_3x3
 
 A short contributor workflow:
 
+Install Rust through [rustup](https://rustup.rs/), Git, Python 3.14,
+[`uv` 0.11.28](https://docs.astral.sh/uv/), and `jq`. Then install the pinned
+`just` release from its locked dependency graph:
+
 ```bash
-cargo install --locked just
+cargo install --locked just --version 1.56.0
 just setup        # install/verify dev tools + sync Python deps
 just check        # lint/validate (non-mutating)
 just fix          # apply auto-fixes (mutating)
@@ -585,10 +589,11 @@ for the repository's AI-assisted development note.
 
 ## 📄 License
 
-BSD 3-Clause License. See [LICENSE](./LICENSE).
+BSD 3-Clause License. See [LICENSE](https://github.com/acgetchell/la-stack/blob/v0.4.3/LICENSE).
 
 [audit-badge]: https://github.com/acgetchell/la-stack/actions/workflows/audit.yml/badge.svg
 [audit-workflow]: https://github.com/acgetchell/la-stack/actions/workflows/audit.yml
+[benchmark-provenance]: https://github.com/acgetchell/la-stack/blob/v0.4.3/docs/assets/bench/vs_linalg_lu_solve_median.provenance.json
 [clippy-badge]: https://github.com/acgetchell/la-stack/actions/workflows/rust-clippy.yml/badge.svg
 [clippy-workflow]: https://github.com/acgetchell/la-stack/actions/workflows/rust-clippy.yml
 [lu-solve-benchmark]: https://raw.githubusercontent.com/acgetchell/la-stack/v0.4.3/docs/assets/bench/vs_linalg_lu_solve_median.svg

benches/common/exact.rs

@@ -493,6 +493,86 @@ fn assert_rounded_scalar(actual: Result<f64, LaError>, exact: &BigRational) {
     }
 }
 
+/// Check a floating-point determinant against an independent exact oracle.
+fn assert_approximate_determinant(actual: f64, exact: &BigRational, operation: &str) {
+    assert!(
+        actual.is_finite(),
+        "{operation} produced a non-finite result"
+    );
+    let Some(expected) = exact.to_f64() else {
+        panic!("{operation} oracle does not round to binary64");
+    };
+    assert!(
+        expected.is_finite(),
+        "{operation} oracle rounds outside finite binary64"
+    );
+
+    let scale = expected.abs().max(1.0);
+    let tolerance = 1024.0 * f64::EPSILON * scale;
+    assert!(
+        (actual - expected).abs() <= tolerance,
+        "{operation} result {actual:?} differs from exact-oracle rounding {expected:?} by more than {tolerance:?}",
+    );
+}
+
+/// Validate the floating-point determinant operations used by Criterion.
+///
+/// This runs during setup, outside timed closures. The deterministic `det` and
+/// `det_direct` results are compared with the independent Leibniz oracle; on
+/// current revisions the combined direct result is additionally checked
+/// against its certified absolute bound.
+///
+/// # Panics
+///
+/// Panics if either floating-point operation fails, falls outside its documented
+/// dimension, or disagrees with the independent exact oracle.
+pub fn validate_f64_determinant_benchmarks<const D: usize>(input: &ValidatedExactInput<D>) {
+    let exact = determinant_leibniz(input.matrix());
+    let determinant = require_ok(input.matrix().det(), "f64 determinant oracle check");
+    assert_approximate_determinant(determinant, &exact, "f64 determinant");
+
+    let direct = require_ok(
+        input.matrix().det_direct(),
+        "direct f64 determinant oracle check",
+    );
+    if D <= 4 {
+        let Some(direct) = direct else {
+            panic!("det_direct must support benchmark dimension {D}");
+        };
+        assert_approximate_determinant(direct, &exact, "direct f64 determinant");
+
+        #[cfg(not(la_stack_v0_4_3_api))]
+        {
+            let estimate = require_ok(
+                input.matrix().det_direct_with_errbound(),
+                "combined direct determinant oracle check",
+            );
+            let Some(estimate) = estimate else {
+                panic!("the baseline fixture must have a certified D={D} determinant bound");
+            };
+            assert_eq!(estimate.determinant().to_bits(), direct.to_bits());
+            let observed_error = (rational_from_f64(direct) - &exact).abs();
+            let certified_bound = rational_from_f64(estimate.absolute_error_bound());
+            assert!(
+                observed_error <= certified_bound,
+                "direct determinant error {observed_error} exceeds certified bound {certified_bound}",
+            );
+        }
+    } else {
+        assert!(direct.is_none(), "det_direct unexpectedly supports D={D}");
+
+        #[cfg(not(la_stack_v0_4_3_api))]
+        assert!(
+            require_ok(
+                input.matrix().det_direct_with_errbound(),
+                "combined direct determinant scope check",
+            )
+            .is_none(),
+            "combined direct determinant unexpectedly supports D={D}",
+        );
+    }
+}
+
 /// Verify `A · x = b` exactly using independently reconstructed binary64 inputs.
 fn assert_exact_residual<const D: usize>(input: &ExactInput<D>, solution: &[BigRational; D]) {
     for row in 0..D {