[MarkusNeusinger]

Summary

• Moves the whole project from Python 3.13 to 3.14: requires-python, .python-version (3.14.9), mypy, all eight setup-python steps, the three service images (python:3.14-slim) and the languages table's runtime version. 3.13 receives security fixes only since October 2026; 3.14 gets bug fixes until October 2027; 3.15 waits for a lets-plot cp315 wheel.
• This bump carries a renderer-sandbox change (section below): 3.14's new ctypes audit event broke every plot that imports scipy under the harness, and 3.14 added remote debugging and two evaluation routes the validator did not know.
• One lock change beyond the floor: google-crc32c 1.7.1 → 1.9.0, because 1.7.1 publishes no cp314 wheel and the images carry no compiler.
• ruff infers its target from requires-python, so its formatter now writes PEP 758 except A, B: (63 lines in 32 files, a commit of its own).

Sandbox change (renderer harness and validator)

What broke. CPython 3.14 raises the audit event ctypes.call_function for every call through a ctypes function pointer, ctypes' own cast, memmove and memset included; 3.13 raised none for those three. scipy's _lib._ccallback_c calls ctypes.cast while it is imported. PlotGuard refuses every ctypes.* event outside threadpoolctl, so on 3.14 every plot importing scipy, statsmodels, scikit-learn or seaborn failed: six harness tests and the renderer image's own seaborn render in ci-image.yml.

The fix, as shipped. PlotGuard lets ctypes.call_function through only for _ctypes._cast_addr (IMPORT_CTYPES_HELPERS) and only when the caller's nearest origin is an import (calls_import_ctypes_helper), the rule exec and frames already follow. DataGuard and ConvertGuard allow no foreign function at all.

Fable review: "sound with changes". The first draft let cast, memmove and memset through in all three guards, by address alone. Fable showed it handed plot code a raw in-process write primitive (ctypes.memmove/memset called directly) that 3.14's event had closed, and that the data and convert guards gained it for no legitimate use. All three narrowings were adopted:

1. _cast_addr only: an audit-hook survey over the imports of numpy, pandas, matplotlib, scipy, scikit-learn and statsmodels found cast as the only helper any of them calls at import, from scipy/_lib/_ccallback.py.
2. Import origin only: at scipy's import the first non-ctypes Python frame is <frozen importlib._bootstrap> (Cython module init has no Python frame), so nearest_origin is "import"; the same cast from plot code is "plot" and stays refused.
3. PlotGuard only: data mode imports scipy before it arms, and neither data nor convert mode imports after.

Fable's open check, whether a library casts at render time from a plot-origin frame, is answered by a sweep: all 650 catalogue matplotlib and seaborn files, normalised as a session opening does, rendered under the narrowed guard with the sandbox flags. 603 render and none is refused for ctypes. The 47 failures (refused writes and os.mkdir, network fetches, missing qrcode and adjustText, plots that divide by an emptied title) fail identically on Python 3.13.12 with main's harness.

Two more 3.14-specific hardenings, in the same commits:

• PEP 768 remote debugging: every sandbox argv carries -X disable-remote-debug (harness.INTERPRETER_FLAGS, duplicated in agents/renderer/executor.py and pinned by test_wire; -I ignores PYTHON_DISABLE_REMOTE_DEBUG), and both guards refuse sys.remote_exec and cpython.remote_debugger_script for a harness started without the flag. Verified: sys.remote_exec against the interpreter's own pid works on plain 3.14.9 and fails with "Remote debugging is not enabled" under the flag.
• Validator: 3.14's dataclasses re-exports annotationlib, and from dataclasses import annotationlib plus get_annotations(f, eval_str=True) evaluated an arbitrary annotation string past the static validator (both runtime guards still refused it). annotationlib, get_annotations, call_evaluate_function, call_annotate_function and evaluate_forward_ref joined ESCAPE_ATTRIBUTES; the stdlib walk note records the 3.14.9 re-walk; refused fixtures pin both routes.

Fable's second review (of this PR): "sound with one change". PEP 734 subinterpreters escape the audit hook: a hook added with sys.addaudithook belongs to one interpreter, and creating, entering or running code in another raises no event the guard sees. With PlotGuard armed on 3.14, concurrent.interpreters.create().exec(...) wrote a file outside the outputs and the render exited 0; only the validator's import denylist stood in the way. Fixed in this PR: _interpreters.create, exec, run_string, run_func and call join UNAUDITED_CALLS and are replaced with refused_call before arming (concurrent.interpreters and InterpreterPoolExecutor reach them only through the module object), and concurrent, interpreters, InterpreterPoolExecutor, _interpreters, _interpqueues and _interpchannels join ESCAPE_ATTRIBUTES. Tests pin the three plot routes and a data run; the same plot writes its file with the previous harness and is refused with this one. Everything else Fable checked is sound: the import-origin _cast_addr allowance cannot be smuggled (frames cannot be forged, -I keeps the working directory off sys.path, writes are refused, ctypes attribute names are banned), only scipy raises ctypes.call_function at import, sys.remote_exec is covered three ways, and pathlib's new Path.copy/move decompose into audited calls.

Re-verified harness claims on 3.14.9 (side-by-side probe against 3.13.12, plus the 3.14 audit-event table): os.stat and its family, os.environ/os.getenv, function.__globals__, os.mkfifo, os.mknod, signal.signal and an import of a loaded module still raise no event. _posixsubprocess.fork_exec now raises one; it stays replaced. New 3.14 events: _posixsubprocess.fork_exec, cpython.PyConfig_Set, cpython.remote_debugger_script, ctypes.memoryview_at, sys.remote_exec.

Reviews

• Fable (sandbox, twice): first draft "sound with changes", three narrowings adopted (section above); this PR "sound with one change", the subinterpreter fix applied.
• Gemini 3.8 Flash (routine first review): "sound with changes", three low findings.
  • Applied: WorkflowState.load and from_stdin return Self | None instead of naming the class.
  • Skipped: the PEP 723 header requires-python = ">=3.13" of automation/scripts/canvas_gate_report.py. It and the one-off scripts/*.py import no project module (only _palette_common from scripts/, which the formatter does not touch) and all still parse on 3.13, so >=3.13 stays true.
  • Skipped: the "3.13" values in the dated JSON response samples of docs/reference/api.md, mcp.md and database.md (left alone on purpose, see below).
  • Applied (also raised by Fable): the project guide's anti-pattern line named the retired default.py layout and Python 3.10-3.13; it now states the one-file-per-library rule on 3.14.
• Fable's two small follow-ups: executor.INTERPRETER_FLAGS duplicates harness.INTERPRETER_FLAGS because the renderer image cannot import the agents package; test_wire already pins them equal. The project-guide line is fixed (above).
• Copilot: reviewed bffacb5, the head with every fix above: "No open issues", no inline comments. Since the round was clean and it already covered the subinterpreter fix, no further round was requested.
• CI flake fixed on the way: Run Tests on bffacb5 failed test_local_backend_kills_the_container_on_cancellation once (only one of two containers had started 0.5 s in on the loaded runner). The test now cancels once both fake containers run instead of after a fixed sleep; 12 concurrent local runs passed before and after.

Files changed, by category

Category	Files
Interpreter and lock	.python-version, pyproject.toml (requires-python, mypy target, coverage comment), uv.lock
Images	api/Dockerfile, agents/Dockerfile, agents/renderer/Dockerfile (base tag, UV_PYTHON, the pyarrow slimming path), tests/unit/agents/test_image.py (stage names)
Workflows	python-version: '3.14' in ci-changelog, ci-lint, ci-migrations, daily-regen, impl-generate, impl-repair and sync-postgres; ci-image's pyarrow du path and harness commands (sandbox flags); the python_version comment in impl-generate. New setup-python (from .python-version) where repository Python ran on the runner's own python3: ci-tests (the existing step moves ahead of the spec check and runs on every event), impl-merge's write-back job, and review-retest's prep, review and aggregate jobs
Sandbox	agents/anyplot/render/harness.py, agents/anyplot/render/runtimes/python.py, agents/renderer/executor.py, agents/evals/host_data.py, agents/anyplot/render/backends/local.py (docstring), agents/anyplot/code/validate.py, tests/image/convert_smoke.py, and their tests (test_harness_guard, test_validate, test_render, test_executor, test_wire, test_host_data)
Runtime data	core/constants.py runtime_version 3.14 (sync-postgres seeds the languages table from it after merge)
Comments	core/database/models.py, agentic/workflows/modules/regen/metadata.py, prompts/templates/metadata.yaml
Lint fallout	agentic/workflows/modules/state.py: Optional["WorkflowState"] (UP045 under the py314 target) becomes Self | None
Formatter	32 files, except (A, B): → except A, B: only
Docs	README.md, docs/development.md, docs/concepts/agent-network.md, docs/reference/repository.md, docs/reference/database.md, agentic/docs/project-guide.md + .github/copilot-instructions.md (kept in sync), prompts/plot-generator.md, agentic/commands/prime.md, agentic/commands/audit.md, agentic/commands/audit/backend-auditor.md, .claude/skills/verify-migrations/SKILL.md
Changelog	changelog.d/python-3.14.md (Changed + Security)

Left alone on purpose: test fixtures that carry "3.13" as sample data, the dated JSON response samples in docs/reference/api.md, mcp.md and database.md, historical files (CHANGELOG.md, agentic/audits/, alembic revisions, the eval baseline's recorded python), the PEP 723 headers of the one-off scripts/*.py (>=3.13 still admits 3.14), and the history: example in prompts/templates/library-metadata.yaml.

Decisions

• Patch 3.14.9. The newest 3.14 the current uv (0.13.5) offers, and the patch python:3.14-slim resolves to today. CI's uv downloads exactly the .python-version patch (the last ci-tests run had setup-python 3.13.16 and tested on the pinned 3.13.12), so the pin is what CI tests on. A local uv 0.10.2 only knows up to 3.14.3 but finds an installed 3.14.9 (uv self update is the clean fix).
• Lock written with the latest uv, which keeps lock revision 5 (what Dependabot writes); uv 0.10.x rewrites it as revision 3.
• Coverage. core = "sysmon" stays and is now only explicit (coverage's default on 3.14). sysmon measures branches on 3.14 (coverage 7.12, no "no-sysmon" fallback), but branch stays off because it changes the reported numbers.
• PEP 758 formatter commit kept: CI's ruff format --check needs it, and requires-python >=3.14 must stay because of it.
• No workflow step relies on the runner's own python3 any more. The local stack test found three paths that ran repository Python on it without setup-python: the ci-tests spec check (imports regen_gate), impl-merge's write-back (regen_writeback → regen_gate) and review-retest's three jobs (review_retest, review_provenance, regen_gate). They worked only because ubuntu-latest (26.04) ships 3.14.4; under 3.12 they raise SyntaxError. Each job now sets up Python from .python-version (3.14.9 is in setup-python's manifest for ubuntu-26.04). close_issue_if_complete.py and spec_pr_guard.py reach no 3.14-only module and stay on the runner's python3.
• Local renderer image: the local backend mounts the checkout's harness into AGENT_RENDER_IMAGE, so an anyplot-renderer:dev built before this PR fails every render with SyntaxError: multiple exception types must be parenthesized. agents/README.md and the changelog fragment say to rebuild it.

Lock changes

Package	Before	After
google-crc32c	1.7.1	1.9.0

Everything else keeps its version, plotting libraries included (the version-sources check of #12240 is unaffected). A scan of the lock for packages without a Linux x86_64 wheel usable on 3.14 finds only esprima and matplotlib-venn (pure-Python sdists, plotting extra only, as before) and pywin32 (Windows only).

Smoke renders on 3.14.9

The first five specs alphabetically for every Python library, both themes, MPLBACKEND=Agg ANYPLOT_THEME=<theme> python -P <lib>.py from a scratch directory with the plotting extra (impl-generate's command). Each cell is light / dark.

Spec	matplotlib	seaborn	plotly	altair	plotnine	bokeh	pygal	letsplot
acf-pacf	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass
alluvial-basic	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass
alluvial-opinion-flow	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass
andrews-curves	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass
arc-basic	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass	pass / pass

80 of 80 PNGs written. Bokeh needs a working chromedriver on PATH (the local WSL one is a snap stub; CI runners ship one).

Images (local docker build)

• agents/renderer/Dockerfile: builds on Debian 13 with CPython 3.14.9; pyarrow slimmed 167 MB → 99 MB; font-cache bake and check_fonts pass. ci-image's steps: the seaborn render (3200×1800, probe written) and the multi-script render (no missing glyph) pass with the final harness; the convert smoke passes every format; no ADK; /status reports 3.5.0; a render without a launcher is refused with 503. Before the harness fix the seaborn render failed in the image with ctypes.call_function.
• api/Dockerfile: builds on 3.14.9; google-crc32c 1.9.0 installs from its wheel (C implementation); api.main imports.
• agents/Dockerfile: not built locally; CI's image job builds it.

Plan

N/A

Test plan

• uv run ruff check . and uv run ruff format --check .
• uv run --extra typecheck mypy api core --pretty
• uv run python -m tools.changelog check --base origin/main
• Full suite as CI runs it (unit, integration, e2e skipped without DATABASE_URL) on the final code: 12,302 passed, 0 failed
• Smoke renders: 80 of 80 (table above)
• Guard sweep: 650 catalogue files, 603 render, no ctypes refusal, the 47 failures identical on 3.13.12
• Renderer and API images built locally and smoked (above)
• CI green on b815e2d (13 of 13 checks)
• CI green on the final head
• codecov/patch/backend stays red on purpose (accepted by the lead): the three new harness lines it flagged are now covered by in-process tests, and the 29 lines still missing are pre-existing error handlers that the PEP 758 formatter only rewrote (except (A, B): → except A, B:), which no test reached before this PR either.

Unverified: workflows have no local verification loop. The python-version changes and the new setup-python steps in impl-merge's write-back and review-retest are only observable on real pipeline runs; ci-tests exercises its own change on this PR. /languages keeps reporting Python 3.13 until sync-postgres runs on the next plots/ or alembic/ push and seeds runtime_version 3.14 from core/constants.py. The agents image was not built locally; CI's image job builds it.

Noticed, not acted on: two deprecation warnings for later Python releases, google-genai's typing._UnionGenericAlias (removed in 3.17) and uvloop 0.22.1's asyncio.iscoroutinefunction (removed in 3.16). The local stack test (core, API parity with main on 61 routes, the agents service with four real runs, the sandbox guards, 24 catalogue renders, the frontend and all three images) passed.

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 29 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
agents/anyplot/render/convert.py	20.00%	4 Missing ⚠️
agents/anyplot/render/harness.py	82.60%	4 Missing ⚠️
automation/scripts/regen_gate.py	20.00%	4 Missing ⚠️
agents/anyplot/data/parse.py	71.42%	2 Missing ⚠️
agents/evals/matrix.py	33.33%	2 Missing ⚠️
agents/renderer/executor.py	66.66%	2 Missing ⚠️
automation/scripts/review_retest.py	0.00%	2 Missing ⚠️
agents/anyplot/data/generate.py	0.00%	1 Missing ⚠️
agents/anyplot/dataset_context.py	0.00%	1 Missing ⚠️
agents/anyplot/plugins/ledger.py	0.00%	1 Missing ⚠️
... and 6 more

📢 Thoughts on this report? Let us know!

[Copilot]

🔵 Needs a closer look

Sandbox security boundaries and production runtime changes require final human review and confirmation that CI passes on the final head.

No open issues 🎉

What changed in this PR

Moves anyplot’s services, development environment, and automation to Python 3.14, with sandbox changes needed to preserve rendering compatibility and isolation.

Changes:

• Updates the Python floor, interpreter pin, service images, workflow runtimes, and documentation.
• Narrows ctypes allowances and blocks remote debugging, subinterpreter execution, and additional annotation-evaluation routes.
• Adds sandbox regression coverage and adopts Python 3.14 exception syntax.

File	Description
tests/​unit/​agents/​test_image.py	Updates expected Docker stages to Python 3.14.
tests/​unit/​agents/​runtime/​test_render.py	Checks sandbox flags across local execution modes.
tests/​unit/​agents/​runtime/​test_harness_guard.py	Adds ctypes, remote-debugging, and subinterpreter regression tests.
tests/​unit/​agents/​renderer/​test_wire.py	Pins interpreter-flag parity between components.
tests/​unit/​agents/​renderer/​test_executor.py	Checks remote-debugging flags in renderer commands.
tests/​unit/​agents/​evals/​test_host_data.py	Checks host-data interpreter flags.
tests/​unit/​agents/​data/​test_warning_codes.py	Adopts Python 3.14 exception syntax.
tests/​unit/​agents/​code/​test_validate.py	Tests rejection of annotation-evaluation routes.
tests/​image/​convert_smoke.py	Disables remote debugging during conversion smoke tests.
README.md	Updates the documented Python requirement.
pyproject.toml	Raises Python and mypy targets; clarifies coverage behavior.
prompts/​templates/​metadata.yaml	Updates the Python-version example comment.
prompts/​plot-generator.md	Updates Python versions in generated-header examples.
docs/​reference/​repository.md	Updates Python-version examples.
docs/​reference/​database.md	Updates a schema example comment.
docs/​development.md	Updates prerequisites and coverage guidance.
docs/​concepts/​agent-network.md	Documents Python 3.14 and sandbox launch flags.
core/​database/​models.py	Updates runtime-version comments only.
core/​constants.py	Updates the registered Python runtime version.
changelog.d/​python-3.14.md	Records the runtime migration and sandbox hardening.
automation/​scripts/​sync_to_postgres.py	Adopts Python 3.14 exception syntax.
automation/​scripts/​review_retest.py	Adopts Python 3.14 exception syntax.
automation/​scripts/​review_provenance.py	Adopts Python 3.14 exception syntax.
automation/​scripts/​regen_gate.py	Adopts Python 3.14 exception syntax.
api/​routers/​insights.py	Adopts Python 3.14 exception syntax.
api/​routers/​agent.py	Adopts Python 3.14 exception syntax.
api/​Dockerfile	Migrates build and runtime stages to Python 3.14.
agents/​renderer/​wire.py	Adopts Python 3.14 exception syntax.
agents/​renderer/​executor.py	Adds sandbox interpreter flags and updates exception syntax.
agents/​renderer/​Dockerfile	Updates Python stages, interpreter path, and pyarrow path.
agents/​renderer/​auth.py	Adopts Python 3.14 exception syntax.
agents/​main.py	Adopts Python 3.14 exception syntax.
agents/​evals/​report.py	Adopts Python 3.14 exception syntax.
agents/​evals/​prep.py	Adopts Python 3.14 exception syntax.
agents/​evals/​matrix.py	Adopts Python 3.14 exception syntax.
agents/​evals/​host_data.py	Uses shared sandbox interpreter flags.
agents/​Dockerfile	Migrates agents-service stages to Python 3.14.
agents/​anyplot/​tools/​session.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​sub_agents/​adapter.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​render/​runtimes/​python.py	Applies sandbox flags to plot, data, and conversion commands.
agents/​anyplot/​render/​harness.py	Restricts ctypes allowances and blocks new execution routes.
agents/​anyplot/​render/​gates.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​render/​convert.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​render/​backends/​remote.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​render/​backends/​local.py	Updates command documentation and exception syntax.
agents/​anyplot/​plugins/​ledger.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​dataset_context.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​data/​prepare.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​data/​parse.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​data/​generate.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​code/​validate.py	Bans annotation-evaluation and subinterpreter access names.
agents/​anyplot/​code/​regions.py	Adopts Python 3.14 exception syntax.
agents/​anyplot/​code/​data_code.py	Adopts Python 3.14 exception syntax.
agentic/​workflows/​modules/​state.py	Uses Self | None for classmethod return types.
agentic/​workflows/​modules/​regen/​picker.py	Adopts Python 3.14 exception syntax.
agentic/​workflows/​modules/​regen/​metadata.py	Updates the interpreter-output example comment.
agentic/​docs/​project-guide.md	Updates runtime guidance and implementation-layout documentation.
agentic/​commands/​prime.md	Updates the documented Python baseline.
agentic/​commands/​audit/​backend-auditor.md	Updates Python modernization guidance.
agentic/​commands/​audit.md	Updates Python examples in audit criteria.
.python-version	Pins Python 3.14.9.
.github/​workflows/​sync-postgres.yml	Selects Python 3.14 for database synchronization.
.github/​workflows/​impl-repair.yml	Selects Python 3.14 for implementation repair.
.github/​workflows/​impl-generate.yml	Updates Python selection and its metadata comment.
.github/​workflows/​daily-regen.yml	Selects Python 3.14 for daily regeneration.
.github/​workflows/​ci-tests.yml	Selects Python 3.14 for tests.
.github/​workflows/​ci-migrations.yml	Selects Python 3.14 for migration checks.
.github/​workflows/​ci-lint.yml	Selects Python 3.14 for lint checks.
.github/​workflows/​ci-image.yml	Updates sandbox smoke commands and the pyarrow inspection path.
.github/​workflows/​ci-changelog.yml	Selects Python 3.14 for changelog checks.
.github/​copilot-instructions.md	Updates documented runtime and header examples.
.claude/​skills/​zweitmeinung/​gemini_review.py	Adopts Python 3.14 exception syntax.
.claude/​skills/​verify-migrations/​SKILL.md	Updates the separate-interpreter explanation.
.claude/​skills/​review-regen-week/​collect_week.py	Adopts Python 3.14 exception syntax.

_{Review effort: Balanced}