feat: own runtime record predictions in mlbundle

[UlloaSP]

Runtime consumers can now pass a request mapping directly to LoadedBundle.predict_record() or use row_from_record() for explanations. mlbundle owns feature-key lookup, bounded numeric-string coercion, schema nullability and output ordering. Frozen OutputPrediction records include report labels, probabilities or regression values, and predicted_label from the native classifier decision.

Native decisions use sklearn estimator/Pipeline predict, XGBoost wrapper predict, CatBoost class predict (including custom probability thresholds), and ONNX graph label outputs. Labels are validated against each output's classes; probability-only ONNX graphs return None. No argmax fallback is added.

Exported series fields now contain two ordered columns with id: field1 / id: field2, without child mappings. The former field1 / field2 shape is rejected. This is the sole documented mlschema adaptation for MLForm. Schema version remains 2 because no earlier exported bundle used series and format 1 is not frozen.

Adds failure-only sklearn environment diagnosis through EnvironmentMismatchError and a re-export hint for safe, differing manifest writer versions. Bumps package and lockfile to 0.1.0a3 and updates runtime, format and security documentation. Existing array/DataFrame restrictions, closed native loaders and container validation remain intact.

Validation on Windows / Python 3.14.7:

• uv run ruff check .: passed.
• uv run ruff format --check .: 185 files already formatted.
• uv run pyright: 0 errors, 0 warnings.
• uv run pytest: 1772 passed; 91.96% coverage.
• uv build: wheel and source distribution built.

Real CatBoost threshold example: at threshold 0.8, positive probability 0.5684730553350195 returns native/report label negative. Real 0.1.0a1 manifest and sklearn 1.9.1 -> 1.9.0 load failures produced the new diagnostic messages. No publishing, version tagging or merging is part of this PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 66b2fa39-4347-42a8-8cfd-5633956a0e3e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}