Fix the Agent MCPB dependency closure - #38
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The 2.0.2 MCPB lock carried OpenAdapt Flow 1.31.0 plus
opencv-pythonandopencv-python-headless. Both OpenCV packages owncv2, so the one-click bundle could install an ambiguous runtime.The archive build also inherited Hatchling's newest Core Metadata default. The current release validator accepts Metadata 2.4, so an unrelated builder update could reject otherwise valid archives.
What changed
The MCPB lock now resolves OpenAdapt Flow 1.34.0 and one OpenCV provider. The packed-bundle check parses the
uv.lockinside the archive. It refuses invalid TOML, a missing or duplicate Flow package, and anything other than one OpenCV provider.Wheel and source-archive builds now request Core Metadata 2.4 directly. This removes the need to freeze Hatchling only for its old metadata default. Regression tests bind both contracts, and generated
mcpb-dist/output stays out of Git.Checks
uv lock --lockedMerge and release boundary
This patch can merge before Flow adds its local signed product and workflow admission interface. It changes distribution closure and validation only. It doesn't change a runtime gate.
Do not publish Agent 2.0.2 from this patch. A release still depends on Flow's admission interface and PR #34's release-identity path. The Agent run bridge must continue to fail closed until those contracts exist.