[pedrohcgs]

The README bot uses an outdated README.qmd that changes the Python package name from csdid to did and drops badges, aggregation examples and citation instructions. Tracked README.md/readme.md aliases also collide on macOS, while packaging and Quarto read different paths. The PyPI publisher also needs public readback: a cached preflight 404 followed by skip-existing can report a successful upload without proving that the published artifacts match the reviewed source or are visible to installers.

This PR fixes the README source and packaging, and requires verified public artifacts before a release or an existing-release retry succeeds. It includes main d5123fb and prepares CSDID 0.4.5, because the canonical README changes setup.py and MANIFEST.in; reusing 0.4.4 would conflict with immutable published build inputs. The exact drdid==1.1.7 requirement, reviewed peer lock and estimator logic remain unchanged.

Changes:

• Restore one canonical README.md, the package name, six badges, event-study/overall examples, newer options and citation. Use checked-in example data, fixed seeds and pinned rendering dependencies; render twice and allow the bot to commit only generated Markdown and PNGs.
• Install the checked-out CSDID package with the exact reviewed DRDID source. Exercise README guards in both required Python jobs and the immutable joint installed-wheel snapshot.
• After upload, check out the exact tested source cleanly and verify the public wheel/sdist source, build inputs, dependencies and PyPI SHA256 values. Require the same filenames, URLs and hashes in the public Simple index used by installers.
• Retry only absent or partial visibility, up to six checks with 5/10/20/40/60-second backoff and eight-minute step limits. Visible source, identity, hash or yank mismatches fail immediately. Existing complete releases also recheck installer visibility before skipping the build, so hourly catch-up can recover from an earlier visibility timeout. Global publication serialization and mandatory exact-main CI remain enforced.

Validation on 9fd65c6:

• 41 integrated root guard tests pass: 10 README regressions and 31 release checks. Both rendered/source README guards and actionlint pass. Tests cover cached 404s, either partial-upload order, empty listings, delayed index entries, hidden visible mismatches, malformed responses, mismatched source/dependencies and bounded timeout/recovery paths.
• Real Quarto 1.8.25 executions in the pinned Python 3.12 environment produced identical Markdown and all three PNG hashes; the figures also match the preceding validation. pip check passes.
• Actual 0.4.5 wheel/sdist builds pass twine check, identify csdid, require exactly DRDID 1.1.7, and contain the canonical README bytes as their UTF-8 long descriptions. The sdist contains only the canonical README path. Production archive validators accept the built source, build inputs and dependencies.
• The integrated release hardening changes no packaged input or render asset after 560d0c9. The earlier authentic render/build hashes were checked against the saved files and retained; the receipt records a separate integrated-check timestamp.
• The live read-only preflight on the clean 0.4.5 candidate reports that publication is needed and the locked backend is available. The public DRDID 1.1.7 wheel matches every reviewed Python source byte and PyPI SHA256. Publication requires successful main CI after merging.

Evidence: current validation receipt, preserved 0.4.4 receipt, render replay instructions, and publication guarantees and retry limits.

All three required checks passed on final head 9fd65c6: Python 3.8 and 3.12 and current R parity. Merged as eb9d3204bffdd62de836197e1f347f4b51b946d6; all three required main checks also passed. Feature-branch README previews skip bot PR publication. Main retains automatic README PR creation through GITHUB_TOKEN; generated PRs still need the mandatory CI checks before merging. PyPI uploads are not atomic, and client-side verification cannot prevent a later owner action from changing availability.

Activation verified: CSDID 0.4.5 published automatically in run 40592679312. The earlier R-completion event correctly skipped publication while the main CI workflow remained incomplete. The later CI event published after all three checks passed; the new public readback recovered from two real HTTP 404 responses with 5s and 10s waits, then verified both artifacts and the public installer index. No manual dispatch or rerun was needed.

Both public artifacts pass exact merged-source/build-input/metadata/SHA256 checks, require drdid==1.1.7, and carry the canonical README. A fresh isolated public-only install resolved CSDID 0.4.5 plus DRDID 1.1.7, passed pip check, and produced the expected pre/post ATT 0/2 in one minimal regression-panel smoke test. The real main README bot also passed all 41 guards and reproducible rendering; its generated PR #90 changes only three PNGs, preserving README text and package identity.

Separate nonmandatory issue: Dependency Graph run 40591709755 fails because Dependabot selects Python 3.8 from the legacy Pipfile while its scanner supports 3.10–3.14. This does not authorize or bypass any required CI/release check. No legacy Pipenv migration or Python support change is included here.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.