chore: require Python 3.14.4; move ruff config to ruff.toml

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
           enable-cache: true
 
       - name: Set up Python
-        run: uv python install 3.12
+        run: uv python install   # version comes from .python-version; never pin it here twice
 
       - name: Sync dependencies
         run: uv sync --all-extras --dev

.github/workflows/migrate.yml

@@ -36,7 +36,7 @@ jobs:
           enable-cache: true
 
       - name: Set up Python
-        run: uv python install 3.12
+        run: uv python install   # version comes from .python-version; never pin it here twice
 
       - name: Sync dependencies
         run: uv sync --all-extras --dev

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
           enable-cache: true
 
       - name: Set up Python
-        run: uv python install 3.12
+        run: uv python install   # version comes from .python-version; never pin it here twice
 
       - name: Sync dependencies
         run: uv sync --all-extras --dev
@@ -83,7 +83,11 @@ jobs:
       - name: Verify the artifact identifies itself
         run: |
           set -euo pipefail
-          python -m venv /tmp/verify
+          # Must be the PINNED interpreter, not the runner's default `python`. The wheel
+          # carries `Requires-Python: >=3.14.4`, and pip enforces that even for an explicit
+          # local wheel path -- a default-python venv fails here with "requires a different
+          # Python". --seed provides the pip that the install below uses.
+          uv venv --seed --python "$(cat .python-version)" /tmp/verify
           # Install by explicit PATH, never by name. The name `keel` belongs to an unrelated
           # project on PyPI, so a name-based install can silently fetch a stranger's package --
           # unacceptable for a tool that places orders. --find-links resolves the workspace

.python-version

@@ -1 +1 @@
-3.12
+3.14.4

README.md

@@ -7,7 +7,7 @@ An offline-first, halal (long-only, no-leverage) auto-trading agent for Coinbase
 ## Development
 
 ```bash
-uv sync                 # install deps (Python 3.12)
+uv sync                 # install deps (Python 3.14)
 uv run pytest           # run tests
 uv run ruff check       # lint
 ```

packages/keel-broker-api/pyproject.toml

@@ -2,7 +2,7 @@
 name = "keel-broker-api"
 version = "0.1.0"
 description = "Broker port, domain types, capability model, and conformance suite for keel"
-requires-python = ">=3.12"
+requires-python = ">=3.14.4"
 dependencies = ["keel-core"]
 
 [project.optional-dependencies]

packages/keel-broker-coinbase/pyproject.toml

@@ -2,7 +2,7 @@
 name = "keel-broker-coinbase"
 version = "0.1.0"
 description = "Coinbase Advanced Trade adapter for keel"
-requires-python = ">=3.12"
+requires-python = ">=3.14.4"
 dependencies = ["keel-core", "keel-broker-api", "coinbase-advanced-py>=1.8.4"]
 
 [project.entry-points."keel.brokers"]

packages/keel-broker-fake/pyproject.toml

@@ -2,7 +2,7 @@
 name = "keel-broker-fake"
 version = "0.1.0"
 description = "A deliberately divergent second broker adapter, to keep the port honest"
-requires-python = ">=3.12"
+requires-python = ">=3.14.4"
 dependencies = ["keel-core", "keel-broker-api"]
 
 [project.entry-points."keel.brokers"]

packages/keel-core/pyproject.toml

@@ -2,7 +2,7 @@
 name = "keel-core"
 version = "0.1.0"
 description = "Shared domain types, configuration, and logging for keel"
-requires-python = ">=3.12"
+requires-python = ">=3.14.4"
 dependencies = ["pyyaml>=6.0.3", "python-dotenv>=1.2.2"]
 
 [build-system]

pyproject.toml

@@ -6,7 +6,7 @@ readme = "README.md"
 authors = [
     { name = "CodeGate Software" }
 ]
-requires-python = ">=3.12"
+requires-python = ">=3.14.4"
 dependencies = [
     "click>=8.4.2",
     # pyyaml/python-dotenv are deliberately NOT listed here: nothing under `keel/` imports
@@ -56,17 +56,11 @@ dev = [
     "keel-broker-fake",
 ]
 
-[tool.ruff]
-line-length = 100
-target-version = "py312"
-
-[tool.ruff.lint]
-select = ["E", "F", "I", "UP"]
-# UP042: the design spec pins `class X(str, Enum)` explicitly (not `StrEnum`) for these types.
-ignore = ["UP042"]
+# Ruff config lives in ruff.toml at the repo root. A ruff.toml takes precedence over
+# [tool.ruff] here, so keeping a copy in both places would leave silently-dead settings.
 
 [tool.mypy]
-python_version = "3.12"
+python_version = "3.14"
 files = ["packages", "keel", "tests"]
 
 # New packages are strict from birth.

ruff.toml

@@ -0,0 +1,7 @@
+line-length = 100
+target-version = "py314"
+
+[lint]
+select = ["E", "F", "I", "UP"]
+# UP042: the design spec pins `class X(str, Enum)` explicitly (not `StrEnum`) for these types.
+ignore = ["UP042"]