Gtars

Gtars provides native Rust implementations, Python bindings, and a feature-gated gtars binary for genomic interval and reference-sequence work. Start with the bundled local inspectors; call upstream code only after the data contract, provenance, resource bounds, and side effects are explicit.

Verified snapshot (2026-10-01)

• Published Python wheel: [gtars==0.10.0](https://pypi.org/project/gtars/0.10.0/), released 2026-09-05, Requires-Python >=3.10; local examples were exercised on Python 3.12 with synthetic intervals, fragments, and FASTA.
• Rust meta-crate and CLI: [gtars=0.10.0](https://crates.io/crates/gtars/0.10.0) and [gtars-cli=0.10.0](https://crates.io/crates/gtars-cli/0.10.0), released 2026-09-05. The binary is gtars; the wrapper's default feature set is empty. Rust/CLI examples are source-reviewed templates, not compiled executions.
• Direct [gtars-refget=0.11.0](https://crates.io/crates/gtars-refget/0.11.0) was released 2026-09-22. Its Rust list_sequences() now returns a Result. The wrapper requests refget 0.10.x; keep Cargo.lock because component dependencies use compatible ranges, not exact pins.
• A [gtars-python-v0.11.0 Git tag](https://github.com/databio/gtars/releases/tag/gtars-python-v0.11.0) exists, but PyPI still publishes 0.10.0. Do not assume that Git tags, Python packages, components, or CLI versions coincide.
• Published guides contain older examples. This review used the PyPI 0.10.0 source distribution/runtime, published CLI crate source, and current releases.

The license: MIT field covers this skill. Published gtars crates declare MIT, while the GitHub repository currently displays BSD-2-Clause at the root; verify the exact artifact's license before redistribution.

Native-code trust gate and exact pins

The Python wheel contains a PyO3 native extension. Cargo installation compiles a native binary and can run dependency build scripts. Treat either path as code execution:

1. Confirm the official PyPI/crates.io/GitHub owner and immutable version.
2. Review filenames, platform tags, release provenance, license, and SHA-256. Verify checksums from the exact release; do not reuse older binary archives.
3. Never run an untrusted prebuilt binary, wheel, source tree, Cargo build script, or archive installer. Use isolation and CPU/RAM/disk/time limits.
4. Keep a lockfile and artifact hashes with the analysis manifest.

After that review, create an isolated Python environment:

uv venv --python 3.11 .venv-gtars
uv pip install --dry-run --python .venv-gtars/bin/python "gtars==0.10.0"
uv pip install --python .venv-gtars/bin/python "gtars==0.10.0"
.venv-gtars/bin/python -c \
  "import gtars; assert gtars.__version__ == '0.10.0'; print(gtars.__version__)"

For the source-reviewed CLI release (installation template, not run in this audit):

cargo install gtars-cli --version 0.10.0 --locked
gtars --version
gtars --help

For a Rust project, this source-reviewed template pins the wrapper and enables only required features; retain Cargo.lock for transitive versions:

[dependencies]
gtars = { version = "=0.10.0", default-features = false, features = [
  "core", "overlaprs", "uniwig", "tokenizers", "refget"
] }

Use gtars-refget = "=0.11.0" directly only when the newer direct component API is required and compatibility has been tested. Do not replace these pins with a Git branch or an unreviewed release.

Genomic data contract

Apply this contract before every operation:

1. Coordinates: BED intervals are 0-based and half-open: [start, end). Require 0 <= start < end <= contig_length. Gtars coordinates are u32, so reject values above 4,294,967,295.
2. Assembly: record an assembly accession/version and the SHA-256 of the exact chromosome-sizes or refget sequence-collection metadata. Never infer assembly from filenames or chr prefixes.
3. Contigs: compare names exactly. 1 and chr1, alternate loci, decoys, and mitochondrial aliases are not interchangeable. Rename or liftover only as a separately reviewed transformation.
4. Sorting: preserve the original file, then sort a copy by chromosome-sizes order and numeric start/end when the operation requires it. Python RegionSet(path) currently sorts lexicographically by contig and start while loading; do not rely on original row order afterward. Construction does not merge overlapping intervals; call reduce() explicitly when that is intended.
5. Strand: BED6 uses +, -, or .. Region.rest retains trailing BED fields, but a file-backed Python RegionSet currently initializes its separate strands vector to *. sort() reorders regions without reordering that vector, and several set operations drop strand. Preserve and validate strand externally when it is scientifically meaningful.
6. Duplicates/adjacency: choose policies explicitly. reduce() and consensus merge overlapping and adjacent intervals; ordinary half-open overlap does not treat [0,10) and [10,20) as overlapping.

Run the local validator first:

python3 -B scripts/bed_validator.py \
  --input data.bed.gz \
  --assembly GRCh38.p14 \
  --chrom-sizes GRCh38.p14.chrom.sizes \
  --require-sorted

Safe local workflow

1. Inventory local files, checksums, assembly, contig dictionary, coordinate system, strand policy, patient/replicate groups, and intended outputs.
2. Validate BED/fragments and estimate work. Pilot a small synthetic file.
3. Choose Python, CLI, or Rust from the documented surface; do not translate API names by guesswork.
4. Set hard limits for input bytes/records/files, threads/jobs, memory, temporary disk, output size, and wall time.
5. Run in a dedicated output directory. Refuse collisions unless overwrite was explicitly approved.
6. Revalidate output sorting, bounds, row counts, checksums, and provenance.

Current Python core

Imports are from submodules, not the gtars top level:

from gtars.models import Region, RegionSet

query = RegionSet.from_regions(
    [
        Region(chr="chr1", start=100, end=200, rest=None),
        Region(chr="chr1", start=300, end=400, rest=None),
    ],
    strands=["+", "-"],
)
universe = RegionSet.from_vectors(
    ["chr1", "chr1"],
    [150, 500],
    [350, 600],
)

counts = query.count_overlaps(universe)       # one count per query region
flags = query.any_overlaps(universe)          # one bool per query region
indices = query.find_overlaps(universe)       # indices into universe
pieces = query.intersect_all(universe)        # all intersection fragments
fraction = query.coverage(universe)           # fraction of query bp covered

RegionSet.sort() mutates and returns None. Set algebra includes reduce, setdiff, pintersect (pairs by index), concat, union, jaccard, coverage, overlap_coefficient, intersect_all, closest, cluster, and gaps. Read references/python-api.md before relying on ordering or strand.

Consensus is a Python binding in a different module:

from gtars.genomic_distributions import consensus

rows = consensus([query, universe])
# rows: [{"chr": ..., "start": ..., "end": ..., "count": ...}, ...]

The consensus algorithm in the 0.10.0 release counts input sets touching a merged union component, not support at every base. For example, [0,10) and [5,15) yield [0,15) with count 2, although its edges have one-set support. Do not describe a count-filtered consensus as basewise replicate agreement; use a support-segmenting method when that is the scientific requirement.

Signal-track generation is not exposed as gtars.uniwig in Python 0.10.0; use the reviewed CLI or Rust API. RegionSet.coverage() is a base-pair set metric, not a WIG/bigWig generator.

Coverage tracks, overlap counts, and consensus are separate analysis outputs. Do not feed a smoothed signal into interval consensus or interpret a consensus count as per-base support.

Tokenizers, fragments, and reference stores

Use only local constructors by default:

from gtars.models import RegionSet
from gtars.tokenizers import Tokenizer

tokenizer = Tokenizer.from_bed("reviewed-universe.bed")
regions = RegionSet("local-query.bed")
tokens = tokenizer.tokenize(regions)
encoding = tokenizer(regions)
ids = encoding["input_ids"]
assert tokenizer.vocab_size == len(tokenizer.get_vocab())

Tokenizer.from_pretrained(name) contacts Hugging Face and writes its cache when the argument is not an existing local directory; it exposes no revision or cache argument. Obtain explicit approval, fetch an immutable revision through a reviewed mechanism, verify checksums, then pass the local snapshot directory. See references/tokenizers.md.

Python 0.10.0 refget batch imports return ImportReport, not a list; read report.collections and its per-run counters. The CLI adds refget export and refget lock-status; see references/refget.md.

For refget, prefer RefgetStore.in_memory() or RefgetStore.open_local(path). open_remote(cache_path, remote_url) contacts a remote service, creates/uses a local cache, and performs on-demand range reads. See references/refget.md.

Network and cache gate

No download or cache write is implicit in this skill. Before any network-capable upstream call:

• obtain explicit user approval for the exact host, endpoint, data, and cache;
• allowlist HTTPS hosts and reject unreviewed redirects;
• record immutable revision/identifier, retrieval time, expected SHA-256 and domain digest, assembly accession, size quota, and provenance;
• disclose sensitive BED coordinates, barcodes, sample labels, and reference choices that could leave the approved environment;
• validate downloaded content as untrusted before using it.

Important side effects:

• RegionSet(path) has HTTP support; a nonexistent local string may be treated as a URL. Check that the local path exists before construction.
• Tokenizer.from_pretrained may download universe.bed.gz into the Hugging Face cache.
• RefgetStore.on_disk creates/writes a store. open_remote loads remote metadata and enables persistence by default.
• gtars bbcache creates cache directories even when constructing the client. Cache/download commands use BBCLIENT_CACHE (default ~/.bbcache) and BEDBASE_API (default https://api.bedbase.org).

Sensitive metadata and leakage

Genomic intervals, rare loci, barcodes, sample names, phenotypes, and assembly choices can be identifying. Keep full paths and raw coordinates out of logs; default bundled reports redact paths and emit only counts/checksums.

Freeze splits by patient/donor first, then keep all technical and biological replicates in the same split. Fit consensus sets, universes, tokenizers, scaling, thresholds, and QC rules on training data only. Do not create a universe from all samples and then split: that leaks validation/test locus support. Record excluded samples and replicate aggregation separately.

Bundled deterministic CLIs

All six helpers reject URLs, traversal, symlinks, and special files; apply byte, record, file, coordinate, and worker caps; use no network or gtars import; and write no output files. Plans contain fixed argv templates and never launch them. The fragment-score planner rejects the source-confirmed invalid right-cut query in the CLI 0.10.0 default ATAC mode; see references/cli.md before choosing fragment-body counts or a separately validated cut-site method.

python3 -B scripts/bed_validator.py --help
python3 -B scripts/execution_plan.py --help
python3 -B scripts/tokenizer_manifest.py --help
python3 -B scripts/refget_digest_plan.py --help
python3 -B scripts/coverage_preflight.py --help
python3 -B scripts/artifact_inspector.py --help

Run synthetic tests without bytecode:

PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover \
  -s tests/gtars -p 'test_*.py' -v

Migration traps removed in 1.1

Do not use stale examples containing gtars.RegionSet, RegionSet.from_bed, TreeTokenizer, gtars.igd.build_index, gtars.uniwig.coverage_from_bed, gtars.RefgetStore, global set_option/set_log_level, parallel_apply, or invented exception classes. CLI forms such as uniwig generate, igd build, scoring score, and fragsplit cluster-split are also stale for 0.10.0.

Upstream's published docs and stubs have some drift (for example the older GlobalRefgetStore tutorial and incomplete 0.10.0 stubs). Prefer installed signature smoke tests plus immutable tagged source when they conflict.

Bundled references

These are the only six bundled references; all links are local and present:

• references/python-api.md — exact Python 0.10.0 imports and behavior
• references/overlap.md — overlap/count/set algebra and consensus semantics
• references/coverage.md — uniwig, bigWig, coverage, sorting, and resources
• references/tokenizers.md — tokenizer/universe and fragment compatibility
• references/refget.md — digests, stores, BEDbase, network/cache controls
• references/cli.md — CLI 0.10.0 commands, features, and migrations