merge: sync with main

Author: claude

CHANGELOG.md

@@ -3,6 +3,37 @@
 ## Unreleased
 
 <!-- BEGIN AUTHORITATIVE CHANGELOG FRAGMENTS -->
+### Changed
+
+#### Release cut 0.9.0
+
+- Project version is bumped to 0.9.0 in `pyproject.toml`, `crates/mlsirm-core`,
+  and `crates/fast-mlsirm-py`. The accumulated `Unreleased` notes now form the
+  `[0.9.0] - 2026-08-24` release section: new governed contracts (cross-engine
+  conformance inventory/provenance/manifest-replay evidence, an external
+  validation and transportability profile, a governed structural-model
+  pair-decision gate, buyer-facing item-bank lifecycle reports), a new
+  Rust-owned crossed/weighted multiple-membership person-effects estimator
+  (Fox & Glas, 2001; Browne, Goldstein, & Rasbash, 2001) with CPU-threaded and
+  optional GPU kernels, reproducible release-tag-bound PyPI sdist/wheel
+  publishing, restriction of production backend selection to Rust-owned
+  paths (NumPy parity moved behind an explicit `fit_reference` API), a Rust
+  1.97.1 toolchain pin across verification, and a broad continuation of the
+  hostile-callback/conversion-protocol hardening sweep across dozens of public
+  entry points (CAT, ATA, DIF, equating, scaling, reliability, multilevel,
+  response-time, fit-statistics, inference, linking, LLM-judge orchestration,
+  parallel-analysis, and rotation/loader concurrency, among others).
+- This cut also removes the stale, never-rendered `release-0.8.0-cut.md`
+  fragment left over from the abandoned 0.8.0 release attempt (that version
+  was never actually tagged or published); its already-recorded
+  `[0.8.0] - 2026-08-17` section in `CHANGELOG.md` is left untouched as
+  history, and this release supersedes it directly.
+- Released authoritative fragments are removed from `docs/changelog.d`; the
+  directory again holds only genuinely unreleased notes.
+<!-- END AUTHORITATIVE CHANGELOG FRAGMENTS -->
+## [0.9.0] - 2026-08-24
+
+
 ### Added
 
 #### Cross-engine conformance inventory contract
@@ -110,28 +141,6 @@
 - Withheld checkout credentials from every Statistical Studies job so
   repository-controlled `cargo test` cannot reuse the Actions token.
 
-#### Release cut 0.8.0
-
-- Project version is bumped to 0.8.0 in `pyproject.toml`, `crates/mlsirm-core`,
-  and `crates/fast-mlsirm-py`. The accumulated `Unreleased` notes now form the
-  `[0.8.0] - 2026-08-17` release section: governed contract additions
-  (multilevel/multiple-membership/longitudinal design, structural
-  model-relation and leakage-safe model-validation units, post-pilot
-  item-bank lifecycle, RAG scoring/perturbation-anchor/facets-calibration
-  adapters, enterprise issue-intelligence observation/calibration/reporting
-  contracts, essay facets/score/validation HTML reports, paired rating-range
-  and essay-facets synthetic recovery evidence), a broad Rust-ownership
-  hardening sweep across dozens of public entry points (CAT, ATA, DIF,
-  equating, scaling, reliability, multilevel, response-time, fit-statistics,
-  inference, linking, LLM-judge orchestration, parallel-analysis, plausible
-  values, Rasch-CML, model-comparison, and rotation/loader concurrency) that
-  reject hostile Python callback/conversion-protocol inputs before native
-  dispatch, and accessibility/documentation polish (exact-value tooltips,
-  tabular numerals, print styles, row headers, architecture baseline,
-  Python 3.14 CI).
-- Released authoritative fragments are removed from `docs/changelog.d`; the
-  directory again holds only genuinely unreleased notes.
-
 #### Pin Rust 1.97.1 across verification
 
 - Pin local Rust builds, Python/Rust package verification, ordinary Rust tests, GPU smoke, packaging, and scheduled statistical studies to exact Rust 1.97.1 instead of a floating stable channel.
@@ -713,7 +722,7 @@
 - Reject caller-defined string and numeric subclasses at `ValidationPolicy` construction before `strip`, numeric conversion, or comparison callbacks can execute.
 - Normalize only exact built-in and package-trusted NumPy real scalar identities for scoring-policy thresholds while preserving the existing closed `0..1` domains and Rust-owned pass/fail arithmetic.
 - Require an exact built-in integer for `min_subgroup_n` before range comparison and preserve the existing `rust_kwargs()` payload contract.
-<!-- END AUTHORITATIVE CHANGELOG FRAGMENTS -->
+
 ## [0.8.0] - 2026-08-17
 
 

Cargo.lock

@@ -7,6 +7,17 @@
 Latent Space Item Response Models, focused on MLS2PLM simulation, regularized
 point estimation, and true-parameter recovery checks.
 
+The implemented simple-structure MLSIRM/MLS2PLM path follows Jeon, Jin,
+Schweinberger, and Baugh (2021), Kang and Jeon (2025), and Molenaar and Jeon
+(2026). Adjacent shipped screens include Angoff delta-plot DIF
+([`docs/delta_plot_dif.md`](docs/delta_plot_dif.md)) and Bradley–Terry MM
+ranking ([`docs/bradley_terry_mm.md`](docs/bradley_terry_mm.md)). Primary
+citations and decision records live in
+[`docs/traceability/research-basis.md`](docs/traceability/research-basis.md)
+and [`docs/adr/README.md`](docs/adr/README.md). Score interpretation and
+fairness remain governed by AERA, APA, and NCME (2014); those methods are not
+CWE/OWASP/NIST controls.
+
 The first implementation keeps the public API small:
 
 ```python

README.md

@@ -8,8 +8,8 @@ notice explicitly says otherwise.
 
 | Version | Supported |
 | --- | --- |
-| 0.8.x | Yes |
-| < 0.8 | No |
+| 0.9.x | Yes |
+| < 0.9 | No |
 
 ## Reporting a Vulnerability
 

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Current Pre-1.0 Support Scope
 
-`fast-mlsirm` 0.8.x is the current supported pre-1.0 minor line. Support applies
+`fast-mlsirm` 0.9.x is the current supported pre-1.0 minor line. Support applies
 to behavior that is part of a released artifact and documented public API or CLI
 contract. An active pull request, research plan, experimental internal helper,
 or roadmap item is not supported merely because it exists in the repository.

SUPPORT.md

@@ -1,6 +1,6 @@
 [package]
 name = "fast-mlsirm-py"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2021"
 license = "MIT"
 description = "PyO3 bindings for the fast-mlsirm Rust core."

crates/fast-mlsirm-py/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "mlsirm-core"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2021"
 license = "MIT"
 description = "Core likelihood and gradient routines for fast-mlsirm."

crates/fast-mlsirm-py/Cargo.toml

@@ -17,6 +17,9 @@ This index distinguishes governing product/architecture documents from implement
 | [`erd/domain-model.puml`](erd/domain-model.puml) | Logical reusable-domain artifact relationships; **not** a hosted ORM schema |
 | [`traceability/requirements-matrix.md`](traceability/requirements-matrix.md) | PRD/TRD/ADR -> protected-main implementation/evidence maturity |
 | [`traceability/research-basis.md`](traceability/research-basis.md) | Scientific/standards evidence and APA 7 reference mapping |
+| [`papers/implemented-literature-map.md`](papers/implemented-literature-map.md) | Paper-to-kernel map for implemented methods |
+| [`delta_plot_dif.md`](delta_plot_dif.md) | Angoff TID / delta-plot observed-score DIF screen (not a security control) |
+| [`bradley_terry_mm.md`](bradley_terry_mm.md) | Bradley–Terry / Hunter MM pairwise ranking and additive-ties BRATT |
 | [`documentation_coverage.md`](documentation_coverage.md) | Documentation completeness states, remaining P0/P1/P2 gaps and maintenance gate |
 | [`security/threat-model.md`](security/threat-model.md) | Reusable-core trust/threat model; hosted product threats remain downstream |
 | [`doctoring/`](doctoring/) | Method/security/interoperability evidence and conservative implementation boundaries |

crates/mlsirm-core/Cargo.toml

@@ -9,6 +9,8 @@ Date: 2026-08-09
 
 Without an explicit boundary, the library can accidentally absorb participant/session state, identity, hosted persistence, UI and deployment logic. That would make the numerical core harder to install independently, create circular repository dependencies, and duplicate ownership already assigned to other CWL services.
 
+The reusable core's scientific identity remains the simple-structure MLSIRM/MLS2PLM family and adjacent measurement contracts. Jeon, Jin, Schweinberger, and Baugh (2021) define the latent-space item-response interaction map; Kang and Jeon (2025) give the multidimensional extension and the relativity of conditional dependence; Molenaar and Jeon (2026) give the regularized joint-maximum-likelihood estimation strategy used by the point-estimate path. Score interpretation, fairness, and intended use remain governed by AERA, APA, and NCME (2014). ISO/IEC/IEEE 42010:2022 governs how this boundary is recorded as an architecture decision, not the psychometric likelihood.
+
 ## Decision
 
 `fast-mlsirm` owns reusable domain-neutral measurement contracts and scientific/numerical capabilities:
@@ -67,6 +69,16 @@ Costs:
 
 Supersede this ADR only if the organization intentionally redefines repository bounded contexts and provides a migration plan preserving independent scientific/numerical reuse.
 
-## References
+## Research and standards basis
+
+The architecture-description concern (stakeholders, viewpoints, correspondence, and decision records) follows ISO/IEC/IEEE 42010:2022. The measurement methods this boundary exists to keep independently reusable are the simple-structure MLSIRM/MLS2PLM specialization documented in `docs/papers/mls2plm-canonical-equations.md`, not a silent claim of the full discrimination-vector MLS2PLM model.
+
+Jeon, M., Jin, I. H., Schweinberger, M., & Baugh, S. (2021). Mapping unobserved item-respondent interactions: A latent space item response model with interaction map. *Psychometrika, 86*(2), 378–403. https://doi.org/10.1007/s11336-021-09762-5
+
+Kang, I., & Jeon, M. (2025). Multidimensional latent space item response models: A note on the relativity of conditional dependence. *Psychometrika, 90*(2), 799–826. https://doi.org/10.1017/psy.2025.5
+
+Molenaar, D., & Jeon, M. (2026). Regularized joint maximum likelihood estimation of latent space item response models. *Psychometrika, 91*, 335–359. https://doi.org/10.1017/psy.2025.10068
+
+American Educational Research Association, American Psychological Association, & National Council on Measurement in Education. (2014). *Standards for educational and psychological testing*. American Educational Research Association.
 
 International Organization for Standardization, International Electrotechnical Commission, & Institute of Electrical and Electronics Engineers. (2022). *ISO/IEC/IEEE 42010:2022 Software, systems and enterprise—Architecture description*.