Skip to content

build: make Python baseline validation truthful (#43) - #83

Draft
spelech wants to merge 3 commits into
mainfrom
hotfix/issue-43-approved-python-baseline
Draft

spelech wants to merge 3 commits into
mainfrom
hotfix/issue-43-approved-python-baseline

Conversation

@spelech

@spelech spelech commented Oct 28, 2026 •

Copy link
Copy Markdown
Owner

Refs #43.

Draft: the approved Python baseline is still blocked, not resolved.

Changes

  • Retract unsupported approval, quarantine-age and cross-platform verification claims without lowering direct minimums.
  • Change the MCP candidate from unavailable 1.30.0 to mirror-available 1.28.1, which satisfies >=1.20.0,<2.0.0. Other candidate pins remain unverified.
  • Add a bounded, wheel-only, constrained dry-run probe that validates exact selected transitive versions and SHA-256 hashes, and emits an explicitly unreviewed candidate inventory without private registry URLs.
  • Add opt-in real-mirror tests for the exact MCP pin and every direct requirement independently, without using installed packages, caches or private diagnostic output.
  • Document the actual approval/import and validation prerequisites. No public-registry fallback or fabricated approval.

Verification

  • Candidate-probe behavior: 9 native Windows tests passed.
  • Latest offline tooling/orchestration/inventory selection: 29 passed; 21 real-mirror cases skipped unless explicitly enabled. Release/link-integrity gate passed.
  • Real Windows/Python 3.12.10 and Linux/Python 3.11 mirror checks: 17 passed, 4 failed on each target. The exact MCP pin now passes. The four unavailable direct projects are qdrant-client, fastembed, tree-sitter-language-pack and chromadb; independent index queries also find no distributions for them.
  • Installing approved-mirror MCP 1.28.1 into a disposable cached runtime: pip check passed, 12 focused MCP tests passed, and a real MCP initialize/list-tools/catalog-call roundtrip passed. This is compatibility evidence, not a clean backend installation.
  • Full clean requirements resolution, without the old exact pins, stops at unavailable qdrant-client>=1.9.0 on both targets.

Still required

Approved artifacts for the four missing direct projects; complete graph resolution, platform-specific provenance and hashes; agreed >=30-day age evidence and approval; clean Windows/Python 3.12 and Linux/Python 3.11 backend installations with pip check; backend validation and a fresh Docker source build. No newer MCP artifact is required.

Steve Pelech and others added 3 commits October 28, 2026 10:01
Add a constrained wheel-only candidate probe with sanitized artifact hashes and focused boundary tests. Replace approval-text assertions and filtered ambient pip-check tests with candidate behavior checks. Document mirror approval, provenance, age and clean native/source-build validation blockers. Retain all exact pins and requirement floors; no registry fallbacks. Refs #43; draft candidate only, not a resolution.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ifacts

Use mirror-available MCP 1.28.1 and add opt-in real-index checks for its exact pin and all direct requirements. Record actual Windows/Linux availability and MCP compatibility instead of treating an unavailable newer pin as a product requirement. Refs #43.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant