Document and verify binary release readiness

.github/workflows/package-checks.yml

@@ -3,6 +3,8 @@ name: Binary package checks
 on:
   push:
   pull_request:
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       release_tag:
@@ -28,6 +30,37 @@ jobs:
       - name: Verify the binary-only repository
         run: bash scripts/check_repository.sh
 
+  release-integrity:
+    name: Published release / integrity
+    if: ${{ github.event_name == 'release' || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check archive tools
+        run: |
+          command -v curl
+          command -v sha256sum
+          command -v tar
+          command -v zstd
+      - name: Download the published release assets
+        run: |
+          release_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/download/$RELEASE_TAG"
+          curl -fL --retry 3 -O \
+            "$release_url/cuLoRADS-1.1.0-linux-x86_64.tar.zst"
+          curl -fL --retry 3 -O \
+            "$release_url/cuLoRADS-1.1.0-linux-x86_64.tar.zst.sha256"
+      - name: Verify archive identity, layout, and internal manifest
+        run: |
+          bash scripts/check_package.sh
+          mkdir -p _release_integrity
+          tar --zstd -xf cuLoRADS-1.1.0-linux-x86_64.tar.zst \
+            -C _release_integrity
+          package="$PWD/_release_integrity/cuLoRADS-1.1.0-linux-x86_64"
+          (cd "$package" && sha256sum --check --quiet SHA256SUMS)
+
   gpu-release:
     name: Published release / NVIDIA GPU
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_gpu }}

CITATION.cff

@@ -3,7 +3,7 @@ message: "If you use cuLoRADS, please cite this software release and the associa
 title: "cuLoRADS"
 type: software
 version: "1.1.0"
-date-released: "2026-10-01"
+date-released: "2026-10-02"
 license: Apache-2.0
 repository-code: "https://github.com/COPT-Public/cuLoRADS"
 url: "https://github.com/COPT-Public/cuLoRADS"

COIN_OR_READINESS.md

@@ -0,0 +1,28 @@
+# Binary-distribution readiness
+
+This record maps the 2026-10-02 review findings to the cuLoRADS 1.1.0 binary
+distribution. It describes evidence; it does not claim COIN-OR acceptance.
+
+| Review area | Current status | Evidence |
+| --- | --- | --- |
+| License | Addressed for the distributed binary and repository materials | Apache License 2.0 in `LICENSE`; attribution in `NOTICE`; bundled components in `THIRD_PARTY_NOTICES.md` and the archive license tree |
+| Installation | Addressed for the supported binary platform | `INSTALL.md`, archive checksum, relocatable application layout, and `scripts/verify_install.sh` |
+| User documentation | Addressed | `README.md`, `docs/CLI.md`, and `docs/INTEGRATION.md` |
+| Tests | Addressed within a binary-only boundary | structural and integrity scripts, GPU example, independent saved-solution checker, and recorded H100 results in `docs/VALIDATION.md` |
+| CI | Addressed for repository and release integrity; GPU CI is opt-in | hosted repository checks, hosted published-asset integrity job, and a manual self-hosted NVIDIA job in `.github/workflows/package-checks.yml` |
+| Versioning | Addressed | `VERSION` is 1.1.0; public tag and GitHub Release are `v1.1.0` |
+| Binary distribution | Addressed | versioned Linux x86-64 archive, independent `.sha256` asset, internal `SHA256SUMS`, dependency manifest, and collected runtime licenses |
+| Buildable implementation source | **Not addressed by design** | implementation source and source build system are not distributed |
+
+## Important limitation
+
+The archive can be installed, verified, tested, and integrated without Julia
+or a separate CUDA toolkit. It cannot be independently rebuilt or audited at
+the implementation-source level from these materials. If COIN-OR requires the
+implementation source as a condition of contribution, this binary-only package
+does not meet that condition and must instead be treated as an external binary
+component of a larger project.
+
+The open-source status of surrounding software does not change this boundary.
+The Apache-2.0 license provided here does not imply that omitted source files
+are present.

README.md

@@ -13,6 +13,20 @@ Current version: `1.1.0`.
 - Downloads: <https://github.com/COPT-Public/cuLoRADS/releases>
 - Issues: <https://github.com/COPT-Public/cuLoRADS/issues>
 
+## Distribution scope
+
+This repository supports installation, integrity verification, command-line
+use, numerical smoke testing, and integration of the published executable. It
+does not contain the implementation source or a source build system, so an
+independent source build and source-level audit are not possible from this
+repository. Apache-2.0 applies to the distributed cuLoRADS binary and public
+repository materials; it does not make omitted source files available.
+
+Consequently, this package can be reviewed as a versioned binary distribution
+or external binary component, but it does not satisfy a requirement that a
+COIN-OR contribution include buildable implementation source. See
+[COIN_OR_READINESS.md](COIN_OR_READINESS.md) for the checklist mapping.
+
 ## Authors
 
 The authors of the associated cuLoRADS paper, in publication order, are
@@ -34,7 +48,8 @@ There is no CPU solver fallback.
 
 ## Install
 
-Download these two files from the `v1.1.0` release:
+Download these two files from the
+[`v1.1.0` release](https://github.com/COPT-Public/cuLoRADS/releases/tag/v1.1.0):
 
 - `cuLoRADS-1.1.0-linux-x86_64.tar.zst`
 - `cuLoRADS-1.1.0-linux-x86_64.tar.zst.sha256`
@@ -94,8 +109,10 @@ feasibility, and positive-semidefiniteness checks. See
 [docs/VALIDATION.md](docs/VALIDATION.md) for the recorded scope and tolerances.
 
 The repository workflow checks metadata and scripts on hosted Linux. An
-opt-in job validates a published release on a self-hosted NVIDIA runner.
-Hosted CI does not claim GPU coverage.
+automatic or manually dispatched hosted job downloads the published assets and
+checks the archive checksum, layout, source boundary, and internal manifest. An
+opt-in job runs the published application and numerical checker on a configured
+self-hosted NVIDIA runner. Hosted CI does not claim GPU coverage.
 
 ## License
 

RELEASE.md

@@ -3,6 +3,23 @@
 The current software version is `1.1.0`. Release archives are GitHub Release
 assets and are not committed as Git blobs.
 
+## Published release
+
+Version 1.1.0 was published on 2026-10-02 at
+<https://github.com/COPT-Public/cuLoRADS/releases/tag/v1.1.0> from repository
+commit `0703021535d42e1503390c563a6b3c44a4e7abdc`.
+
+The Release provides the Linux x86-64 `.tar.zst` archive and its independent
+`.sha256` file. The archive is 1,568,987,660 bytes and has SHA-256:
+
+```text
+6f055f8866d2c985db4d042862ca1e2f39bc23c5fa6adcf4012470bc6bf7496c
+```
+
+The implementation source is not included. GitHub's automatically generated
+repository source archives contain the public documentation, verification
+scripts, and binary inspection copies, not the omitted implementation source.
+
 Before publishing a release:
 
 1. Keep `VERSION`, README, citation metadata, archive name, and tag synchronized.
@@ -14,7 +31,8 @@ Before publishing a release:
    `scripts/run_example.sh`, and `scripts/verify_tiny_solution.py`.
 7. Tag the reviewed repository commit, for example `v1.1.0`.
 8. Upload the `.tar.zst` archive and `.sha256` file to the matching GitHub Release.
-9. Run the manual self-hosted GPU workflow against the published tag.
+9. Run the hosted release-integrity job and the manual self-hosted GPU workflow
+   against the published tag.
 
 Retain the validation log, GPU/driver identity, dependency manifest, archive
 checksum, and build-revision record with the release evidence.

SOURCE_PROVENANCE.json

@@ -3,11 +3,33 @@
   "version": "1.1.0",
   "release_preparation": "20261001-r3",
   "preparation_date": "2026-10-01",
+  "last_updated_at_utc": "2026-10-02T04:31:03Z",
   "distribution_repository": "https://github.com/COPT-Public/cuLoRADS",
   "distribution_type": "binary-only",
   "implementation_source_included": false,
+  "source_build_supported_from_distribution": false,
   "license": "Apache-2.0",
   "target": "linux-x86_64",
+  "public_release": {
+    "tag": "v1.1.0",
+    "url": "https://github.com/COPT-Public/cuLoRADS/releases/tag/v1.1.0",
+    "published_at_utc": "2026-10-02T01:18:52Z",
+    "repository_commit": "0703021535d42e1503390c563a6b3c44a4e7abdc",
+    "draft": false,
+    "prerelease": false,
+    "assets": {
+      "archive": {
+        "name": "cuLoRADS-1.1.0-linux-x86_64.tar.zst",
+        "size_bytes": 1568987660,
+        "github_digest": "sha256:6f055f8866d2c985db4d042862ca1e2f39bc23c5fa6adcf4012470bc6bf7496c"
+      },
+      "checksum": {
+        "name": "cuLoRADS-1.1.0-linux-x86_64.tar.zst.sha256",
+        "size_bytes": 102,
+        "github_digest": "sha256:aae194164326075d70f605ecb365323050187ea862f53af9b23fad4b80016e33"
+      }
+    }
+  },
   "reference_paper": {
     "title": "Large-scale semidefinite programming with graphics processing units",
     "journal": "Proceedings of the National Academy of Sciences",
@@ -58,6 +80,17 @@
     "bundled_cuda_runtime_preference": "13.3",
     "gpu_required": true
   },
+  "repository_ci": {
+    "tag_run": "https://github.com/COPT-Public/cuLoRADS/actions/runs/36950333734",
+    "tag_run_conclusion": "success",
+    "main_run": "https://github.com/COPT-Public/cuLoRADS/actions/runs/36940903219",
+    "main_run_conclusion": "success",
+    "gpu_release_job": "manual opt-in on a configured self-hosted NVIDIA runner"
+  },
+  "coin_or_source_requirement": {
+    "status": "not_satisfied_by_binary_only_distribution",
+    "explanation": "Implementation source and a source build system are intentionally omitted; this package can only be evaluated as a binary distribution or external component."
+  },
   "validation": "docs/VALIDATION.md",
   "third_party_notice": "THIRD_PARTY_NOTICES.md"
 }

docs/VALIDATION.md

@@ -2,6 +2,14 @@
 
 Project repository: https://github.com/COPT-Public/cuLoRADS
 
+Public release: https://github.com/COPT-Public/cuLoRADS/releases/tag/v1.1.0
+
+The Release contains both the application archive and its independent checksum
+file. Repository/tag CI completed successfully. The hosted release-integrity
+job verifies downloaded assets without claiming GPU execution; the opt-in
+self-hosted NVIDIA job additionally executes and numerically verifies the tiny
+SDP example.
+
 ## Build identity
 
 - cuLoRADS version: 1.1.0

scripts/check_repository.sh

@@ -6,6 +6,7 @@ repo_dir="$(cd -- "$script_dir/.." && pwd)"
 
 required=(
     README.md
+    COIN_OR_READINESS.md
     INSTALL.md
     LICENSE
     NOTICE
@@ -48,6 +49,7 @@ fi
 grep -Fq 'Current version: `1.1.0`' "$repo_dir/README.md"
 grep -Fq 'version: "1.1.0"' "$repo_dir/CITATION.cff"
 grep -Fq 'license: Apache-2.0' "$repo_dir/CITATION.cff"
+grep -Fq '10.1073/pnas.2516128123' "$repo_dir/CITATION.cff"
 grep -Fq 'Apache License' "$repo_dir/LICENSE"
 
 python3 - "$repo_dir" <<'PY'
@@ -65,6 +67,8 @@ if provenance["license"] != "Apache-2.0":
     raise SystemExit("SOURCE_PROVENANCE.json license mismatch")
 if provenance["implementation_source_included"] is not False:
     raise SystemExit("binary-only source boundary is not recorded")
+if provenance["source_build_supported_from_distribution"] is not False:
+    raise SystemExit("source-build boundary is not recorded")
 if provenance["build_record"]["source_repository_visibility"] != "non-public":
     raise SystemExit("build-source visibility is not recorded accurately")
 
@@ -110,7 +114,13 @@ while IFS= read -r shell_file; do
     bash -n "$shell_file"
 done < <(find "$repo_dir/scripts" -maxdepth 1 -type f -name '*.sh' -print)
 
-python3 -m py_compile "$repo_dir/scripts/verify_tiny_solution.py"
+python3 - "$repo_dir/scripts/verify_tiny_solution.py" <<'PY'
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+compile(path.read_text(), str(path), "exec")
+PY
 
 if [[ ! -x "$repo_dir/bin/cuLoRADS" || ! -x "$repo_dir/bin/cuLoRADS.bin" ]]; then
     echo "Binary inspection copies are not executable." >&2