Fix review findings: correctness, robustness, infra

Correctness (P0):
- Encode protein sequences case-insensitively (lowercase no longer maps to X)
- Single-quote Newick labels containing whitespace/reserved characters

Robustness (P1):
- Add NJError::DuplicateIdentifier; reject duplicate names in validate_msa
- Replace bitset_of panic with a propagated error
- Add fallible MSA::try_from_pairs; use it instead of panicking from_iter
- Warn (NJEvent::Log) on all-gap sequences; document degenerate-input contracts

Maintainability & error fidelity (P2):
- Collapse the model x alphabet dispatch into a single macro
- Share one bootstrap replicate fn; propagate failures instead of .expect panics
- Python: typed exceptions (ValueError/RuntimeError) + surfaced callback errors
- WASM: throw Error with stable .name code; log callback errors to console

Quality infrastructure (P3):
- criterion benchmarks (make bench)
- proptest property tests + golden-tree tests

Release/CI/packaging (P4):
- scripts/check-versions.sh + CI job; release.sh uses a fresh commit (no --amend)
- abi3-py310 single-wheel build; pin Node 22 in release to match CI
- package.json exports map; add CHANGELOG.md and CONTRIBUTING.md

All suites green: nj (default/cli/parallel) + golden/properties, WASM web+node,
Python (abi3 wheel). No new clippy warnings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: holmrenser

.github/workflows/release.yml

@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: All package manifests agree
+        run: bash scripts/check-versions.sh
       - name: Check tag matches workspace version
         run: |
           TAG="${GITHUB_REF_NAME#v}"
@@ -57,19 +59,16 @@ jobs:
       - run: cp README.md python/README.md
       - uses: actions/setup-python@v5
         with:
-          # One Python is enough to *find* an interpreter, but for wheels you
-          # generally want to build multiple; see args below.
           python-version: "3.12"
       - uses: PyO3/maturin-action@v1
         with:
           command: build
-          # Explicitly provide interpreters so maturin doesn't have to discover them.
+          # The crate is built with pyo3's `abi3-py310` feature, so a single
+          # stable-ABI wheel per platform covers CPython 3.10+ — no per-minor
+          # interpreter list needed.
           args: >
             --release
             --out dist
-            -i python3.10
-            -i python3.11
-            -i python3.12
           target: ${{ matrix.target }}
           manylinux: ${{ matrix.manylinux }}
           working-directory: python
@@ -157,7 +156,7 @@ jobs:
           workspaces: wasm -> wasm/target
       - uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           registry-url: https://registry.npmjs.org
       - run: cp README.md wasm/README.md
       - run: npm ci

.github/workflows/test.yml

@@ -8,6 +8,13 @@ on:
   workflow_call:
 
 jobs:
+  versions:
+    name: Version consistency
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: bash scripts/check-versions.sh
+
   rust:
     name: Rust tests (${{ matrix.rust }})
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is loosely
+based on [Keep a Changelog](https://keepachangelog.com/), and the project follows
+[Semantic Versioning](https://semver.org/). The three published artifacts —
+the `nj` crate (crates.io), `nj_py` (PyPI), and `@holmrenser/nj` (npm) — share a
+single version, bumped together via `make bump-{patch,minor,major}`.
+
+## [Unreleased]
+
+### Fixed
+- Protein sequences are now encoded case-insensitively; lowercase residues were
+  previously mapped to `X`, silently corrupting protein alignments.
+- Newick output now single-quotes identifiers containing whitespace or reserved
+  characters (`()[]{}',:;`), producing valid Newick for names with spaces, etc.
+- Bootstrap replicate failures now propagate as errors instead of panicking a
+  worker thread.
+
+### Added
+- Duplicate sequence identifiers are rejected with `NJError::DuplicateIdentifier`
+  (they previously corrupted bootstrap clade counting).
+- A `Warning` log event is emitted for all-gap sequences (whose distances are 0).
+- Language bindings surface error kind: Python raises `ValueError` for usage
+  errors and `RuntimeError` for internal failures; WASM throws an `Error` whose
+  `name` is the stable error code. Failing user callbacks are logged rather than
+  silently dropped.
+- Criterion benchmarks (`make bench`) and proptest property + golden-tree tests.
+- `scripts/check-versions.sh` and a CI job that verify the three package
+  versions stay in sync.
+
+### Changed
+- Python wheels are built once per platform as a stable-ABI (`abi3-py310`) wheel
+  covering CPython 3.10+, replacing the per-minor-version build matrix.
+
+## [0.0.22] and earlier
+
+See the Git tag history (`git tag`) and the GitHub releases page for prior
+versions.

CONTRIBUTING.md

@@ -0,0 +1,59 @@
+# Contributing
+
+Thanks for your interest in contributing to `nj.rs`! This is a Cargo workspace
+that ships three artifacts from one core crate:
+
+- `nj/` — core Rust library + CLI (the `cli` and `parallel` features are optional)
+- `python/` — PyO3 bindings published to PyPI as `nj_py`
+- `wasm/` — wasm-bindgen bindings published to npm as `@holmrenser/nj`
+
+## Building & testing
+
+```bash
+make all      # build library, CLI, Python, and WASM
+make test     # run Rust (incl. cli + parallel), WASM (node + web), and Python tests
+make bench    # run the criterion benchmarks
+```
+
+You can also test pieces individually:
+
+```bash
+cargo test -p nj                     # core unit + integration tests
+cargo test -p nj --features parallel # exercise the parallel bootstrap path
+make -C python test                  # maturin develop + pytest (needs maturin + uv)
+make -C wasm test                    # wasm-pack build + node/web tests (needs wasm-pack + node)
+```
+
+Please add tests with any behavioural change. Cross-cutting changes to the core
+API should be reflected in the Python (`python/tests/`) and WASM
+(`wasm/tests/`) suites where relevant.
+
+## Documentation single source of truth
+
+The root `README.md` is the **only** committed README. It is copied into
+`python/` and `wasm/` at release time and is git-ignored there, so never commit
+`python/README.md` or `wasm/README.md`.
+
+## Releasing
+
+All three packages share one version. Bump them together — never edit the
+version strings by hand:
+
+```bash
+make bump-patch   # or bump-minor / bump-major
+```
+
+`release.sh` (invoked by `make bump-*`) requires `cargo-workspaces`, `toml`,
+`jq`, and `sponge` on `PATH`. It bumps the Cargo workspace version, syncs
+`python/pyproject.toml` and `wasm/package.json`, runs `scripts/check-versions.sh`
+to confirm they agree, then creates a `Release vX.Y.Z` commit and tag.
+
+Pushing a `vX.Y.Z` tag triggers `.github/workflows/release.yml`, which runs the
+full test matrix, re-verifies the version, and publishes to crates.io, PyPI
+(OIDC trusted publishing), and npm (OIDC + provenance).
+
+You can sanity-check version consistency at any time:
+
+```bash
+bash scripts/check-versions.sh
+```