General Scientific Formats and EDA Rigor

Reviewed: 2026-09-30 Scope: Exact capabilities of the bundled scripts plus conservative, documented workflows for common tabular and array containers.

Capability boundary

“Bundled executable” means a bounded inspection exists; it does not mean complete-file semantic validation. Unknown suffixes fail closed. Compressed generic archives are not unpacked.

Safe local-file contract

All bundled CLIs:

1. accept only regular local files inside an explicit --root;
2. reject URLs, .. traversal, home expansion, symlinks, multiply linked inputs, and special files;
3. enforce byte, row, field, column, member, object, and report limits;
4. use the registered suffix and, where unambiguous, verify a magic signature;
5. never use generic binary/text guessing as a fallback;
6. emit aggregate statistics and tokenized identifiers by default, never rows;
7. treat labels, headers, metadata, and file text as untrusted data, not instructions; and
8. write private (0600) outputs atomically and refuse overwrite unless --force is explicit.

Hashes/tokens are deterministic pseudonyms, not anonymization. A file hash or a low-cardinality value token can still be linkable.

CSV and TSV

Bundled approach

tabular_profile.py, missingness_leakage_audit.py, and distribution_sensitivity.py use Python's csv module with:

• UTF-8/UTF-8-with-BOM decoding and strict errors;
• a fixed delimiter selected from .csv or .tsv, not sniffed;
• strict=True, a bounded csv.field_size_limit, fixed maximum columns, and rectangular-row enforcement;
• an explicit missing-code policy (empty/whitespace only unless the user adds --missing-token);
• streaming Welford moments and deterministic bounded samples; and
• no row or raw categorical-value output.

Delimiter, decimal convention, thousands separators, encodings, comment syntax, and missing codes are part of the data dictionary. Do not silently guess them.

pandas 3.0.6 (documented alternate backend)

PyPI published pandas==3.0.6 on 2026-09-17; it is the tested alternate backend. When pandas is appropriate, preserve the same outer path/size checks and use bounded selections:

import pandas as pd

frame = pd.read_csv(
    local_path,
    nrows=100_000,
    usecols=approved_columns,
    dtype=declared_types,
    na_values=declared_missing_codes,
    keep_default_na=False,
    on_bad_lines="error",
)

nrows and usecols reduce work, but do not replace file-size, field-size, or privacy controls. Keep parsing errors visible. Do not use on_bad_lines="skip" for EDA because it changes the analyzed population.

Polars 1.44.2 (documented alternate backend)

PyPI published polars==1.44.2 on 2026-09-09. Current polars.read_csv supports columns, schema, schema_overrides, null_values, infer_schema_length, and n_rows. Its docs note that:

• malformed non-RFC-4180 data may have undefined behavior;
• ignore_errors=False is the safe default;
• infer_schema_length=None scans the full data into memory; and
• with multithreaded parsing, n_rows is not guaranteed as a strict upper bound.

Prevalidate a local path; do not pass URLs or rely on optional fsspec. For strict bounded EDA, the bundled standard-library scanner is the reference implementation.

Strict JSON

Python's current json documentation warns that malicious JSON can consume substantial CPU and memory and recommends limiting input size. It also documents that the default decoder accepts NaN/Infinity and silently keeps the last duplicate object key.

The bundled inspector therefore:

• caps the file at 16 MiB for parsing;
• requires UTF-8;
• rejects duplicate keys, non-finite constants, and decimal/exponent literals that overflow finite binary64 (for example 1e400);
• catches recursion/resource errors;
• traverses at most 100,000 nodes; and
• emits only root type, depth, type counts, collection sizes, and tokenized top-level field identifiers.

The decimal range restriction is a tool limit, not a claim that every larger number violates the JSON grammar. JSON Lines/NDJSON is not registered. Rename-and-guess is not allowed.

NumPy NPY and NPZ

NumPy's NPY specification stores shape and dtype in a header. NPZ is a ZIP archive whose members are NPY files. Object arrays can contain pickled Python objects.

The bundled inspector always uses:

array = np.load(
    local_path,
    mmap_mode="r",
    allow_pickle=False,
    max_header_size=10_000,
)

For NPZ it first rejects:

• non-NPY members, directories, traversal paths, encryption, and duplicate or excessive members;
• declared uncompressed content above 128 MiB; and
• a per-member compression ratio above 100.

It then loads one array at a time with allow_pickle=False. Numeric summaries use at most 4,096 deterministic sample elements. Large arrays use indexed ndarray.flat reads, avoiding a full C-order copy for Fortran-contiguous NPY memory maps. Structured dtype field names are identifiers and are tokenized by default. Object dtype is rejected; there is no allow_pickle override.

Memory mapping reduces array payload reads but does not make malformed headers or huge shapes harmless. The outer byte and header limits remain mandatory.

HDF5 and h5py

HDF5 is a container, not a semantic schema. Generic HDF5 inspection does not validate AnnData/H5AD, Loom, Imaris, mzMLb, or a laboratory's custom layout.

h5py documents hard, soft, and external links. Dereferencing an external link opens another file. The bundled inspector uses getlink=True to classify links and never follows soft or external links. It:

• reports at most 1,000 objects and 16 group levels;
• deduplicates hard-link aliases;
• reports shapes, dtype classes, chunking, compression presence, virtual/external storage flags, and attribute counts;
• does not read dataset payloads or attribute values;
• does not call array conversion, user-defined callbacks, or dynamic evaluation; and
• does not invoke HDF5 filter plugins to decode data.

Do not copy external-link filenames, object names, or attributes into reports. Do not set or trust HDF5_PLUGIN_PATH for untrusted files.

Reference-only formats

Parquet and Feather

Use a pinned Arrow/pandas/Polars environment after local path validation. Inspect schema and row-group metadata first, select approved columns, and bound rows. The bundled scripts do not parse these formats, so they are not part of automated support.

Excel

Spreadsheets can contain formulas, external links, hidden sheets, names, comments, and macros. Never enable macros, formula evaluation, or linked-data refresh. Export a values-only review copy to CSV/TSV after a human validates sheet choice, units, formulas, and merged/hidden regions. Preserve the original.

Zarr and directory stores

Zarr/OME-Zarr are directory or object-store layouts rather than single regular files. The local-file CLIs reject directories. Use a separately sandboxed, version-aware Zarr workflow with explicit store and codec allowlists.

Statistical EDA contract

1. Preserve the raw file and create a data dictionary with units and provenance.
2. Identify observational units, replicates, grouping, pairing, clustering, batches, sites, and time order before pooling.
3. Preserve missingness and censoring indicators. Do not automatically impute, substitute LOD/2, or treat non-detects as zero.
4. Compare classical and robust summaries. Outlier flags trigger measurement review and sensitivity analysis, not automatic deletion.
5. Record transformation formulas and scientific rationale; fit any learned parameter on training data only and retain raw-scale results.
6. Split subjects/groups/time before fitting imputers, scalers, feature selection, PCA, or other preprocessing.
7. Label post hoc patterns as exploratory. Define the hypothesis family and FWER/FDR plan before confirmatory testing.
8. Report effect sizes, uncertainty, assumptions, limitations, exact software versions, commands, deterministic rules/seeds, and derived artifact hashes.
9. Do not make causal claims from descriptive associations.

Pinned optional snapshot

Release metadata and synthetic runtime checks verified 2026-09-30:

uv pip install \
  "numpy==2.5.3" \
  "pandas==3.0.6" \
  "polars==1.44.2" \
  "h5py==3.16.0"

NumPy 2.5.3 requires Python 3.12+. These are direct-package snapshots, not a transitive lock; record a lockfile for a real analysis.

Authoritative sources

Current parser APIs and format guidance reviewed 2026-09-30. Historical methodology citations are retained as source context.

• Python 3.14, [csv — CSV File Reading and Writing](https://docs.python.org/3/library/csv.html).
• Python 3.14, [json — JSON encoder and decoder](https://docs.python.org/3/library/json.html).
• NumPy 2.5, input/output reference, [numpy.load](https://numpy.org/doc/stable/reference/generated/numpy.load.html), NPY/NPZ format, [ndarray.flat](https://numpy.org/doc/stable/reference/generated/numpy.ndarray.flat.html), and security guidance.
• pandas 3.0, I/O tools; PyPI 3.0.6, released 2026-09-17.
• Polars 1.44, [polars.read_csv](https://docs.pola.rs/api/python/stable/reference/api/polars.read_csv.html); PyPI 1.44.2, released 2026-09-09.
• h5py 3.16, groups and links; PyPI 3.16.0, released 2026-03-06.
• NIST/SEMATECH, Exploratory Data Analysis and chapter references.
• Box and Cox (1964), “An Analysis of Transformations”.
• FDA/ICH E9(R1), Estimands and Sensitivity Analysis, final guidance May 2021.
• US EPA, Detection Limits Best Practices Guide, dated August 2025.
• scikit-learn, common pitfalls and data leakage.
• Benjamini and Hochberg (1995), false discovery rate.
• Wasserstein, Schirm, and Lazar (2019), Moving to a World Beyond “p < 0.05”.
• National Academies (2019), Reproducibility and Replicability in Science.
• Wilkinson et al. (2016), FAIR Guiding Principles.