NRCL-28 Prepare neural-sdk 0.4.2 contact hotfix by hudsonaikins · Pull Request #22 · IntelIP/Neural

hudsonaikins · 2026-07-23T18:39:21Z

Problem

PyPI neural-sdk 0.4.1 publishes contributors@neural-sdk.dev, and public documentation uses support@neural-sdk.com. Both domains were found unregistered during the contact-security audit, creating expired-domain takeover and maintainer-impersonation risk.

The public 0.4.1 release line diverges from main. Applying the main-based fix directly would change the public package payload and dependency surface beyond this security hotfix.

Outcome

This release-line candidate:

advances the package version to 0.4.2;
replaces uncontrolled Neural-domain contacts with accountable intelip.co contacts;
adds case-insensitive regression tests for tracked source and built artifacts;
preserves the 0.4.1 package payload and dependency contract;
routes stable tags only to PyPI and canonical PEP 440 prerelease/dev tags only to TestPyPI;
binds tag, project, artifact, runtime, CLI, and distribution-metadata versions without alias normalization;
rejects ambiguous aliases and leading-zero prerelease numbers before build;
derives smoke-test expectations from installed distribution metadata;
supports release validation on Python 3.10 through the tomli compatibility fallback;
keeps release-only tests out of the sdist because their validator tooling is intentionally not shipped.

Acceptance Criteria

Built wheel and sdist identify version 0.4.2.
Package metadata and public contact surfaces contain no neural-sdk.dev or neural-sdk.com, including mixed-case variants.
Maintainer and author contacts use hudson@intelip.co.
Wheel preserves all 68 payload paths and all 36 dependency declarations from public 0.4.1.
Runtime package source is identical to 0.4.1 except for the version sentinel.
Trusted hosted workflow validates the exact candidate without publishing.

Validation

Exact base: 9b80b424c34e25f86fb8280bd099e7473318ccde (v0.4.1 release commit)

Exact candidate: 585747cc9795d37e7e8b04d234f3e7955bc49153

Passed on exact candidate:

trusted release validation run 30060718450: authorization, build, source/artifact identity, wheel smoke, sdist smoke, evidence promotion;
Python 3.10 full suite: 140 passed, 6 credential-dependent skips, 2 inherited warnings;
focused contact and release-safety suite: 44 passed;
Ruff full repository;
Black for all changed Python files;
MyPy across 67 runtime source files;
wheel and sdist build;
strict Twine validation;
case-folded source and artifact contact scans;
canonical PEP 440 prerelease acceptance and alias/leading-zero rejection regressions;
dynamic prerelease smoke-version regression;
sdist exclusion proof for release-only tests while ordinary downstream tests remain included;
exact 68-file wheel layout and 36-declaration dependency compatibility with public 0.4.1;
runtime source comparison showing only neural/_version.py changed from public 0.4.1;
clean exact-head worktree.

Hosted artifacts:

wheel SHA-256: 9a63b05f2228262327e374c6282f6ae818eccb93c2400f79a91903d31a13925c
sdist SHA-256: 2988c5db0214493078469b12ebb85da543dc32b650eb18d68cd63a786b252561

Review Findings Addressed

Python 3.10 validator import compatibility;
self-contained source distribution test set;
rejection of ambiguous leading-zero prerelease numbers;
dynamic installed-version expectations in publish smoke tests;
canonical-only prerelease contract across project, artifact, runtime, and CLI versions.

Residual Risk

The absolute repository Black gate remains failed by six untouched files inherited from 0.4.1. Changed Python files pass Black, and this candidate introduces no new formatting regression.

This PR intentionally targets the published 0.4.1 release branch, not main. Broader source-line reconciliation remains separate work.

Pinned first-party actions currently emit non-blocking Node 20 deprecation annotations under GitHub's Node 24 forced runtime. Default-branch Dependabot debt remains separate.

One excluded hosted run (30060702867) used a mistyped nonexistent SHA and failed checkout; it is not candidate evidence. Run 30060718450 is the exact-head evidence.

Release Safety and Exclusions

Plane work item: NRCL-28 / NV-002.

Merge approval does not authorize tag creation, TestPyPI/PyPI publication, deployment, DNS changes, billing, infrastructure, secrets, or live-money actions. Publication remains a separate explicit gate.

makeplane · 2026-07-23T18:39:53Z

Linked to Plane Work Item(s)

References

(NRCL-28) [NV-002] Reconcile Neural source and prepare contact-security 0.4.2 candidate

This comment was auto-generated by Plane

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7aa6c856f5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

hudsonaikins · 2026-07-24T01:20:45Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c4377a42b7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

hudsonaikins · 2026-07-24T01:39:48Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4e54f9eca3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

hudsonaikins · 2026-07-24T01:53:07Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4c2c436db5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

hudsonaikins · 2026-07-24T02:07:57Z

@codex review

chatgpt-codex-connector · 2026-07-24T02:14:01Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 585747cc97

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

hudsonaikins added 3 commits July 23, 2026 11:08

fix(security): prepare neural-sdk 0.4.2 contact hotfix

8d92ef9

test(security): reject mixed-case contact domains

e232f14

test(release): exercise optional import smoke symbols

6bd49b0

fix(release): harden package publication gates

7aa6c85

hudsonaikins marked this pull request as ready for review July 23, 2026 22:16

chatgpt-codex-connector Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread scripts/validate_release.py Outdated

Comment thread scripts/validate_release.py Outdated

Comment thread tests/test_release_validation.py

hudsonaikins mentioned this pull request Jul 23, 2026

NRCL-64 Register trusted release candidate validation #23

Merged

7 tasks

fix(release): address candidate review findings

c4377a4

chatgpt-codex-connector Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread scripts/validate_release.py Outdated

fix(release): reject ambiguous prerelease numbers

4e54f9e

chatgpt-codex-connector Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread scripts/package_smoke.py Outdated

fix(release): derive smoke version from package

4c2c436

chatgpt-codex-connector Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread scripts/package_smoke.py

fix(release): require canonical prerelease versions

585747c

hudsonaikins merged commit f96672f into codex/infra-pr3-terraform-envs-ci-docs Jul 24, 2026

hudsonaikins deleted the codex/nrcl-28-contact-security-0.4.2 branch July 24, 2026 02:19

Uh oh!

Conversation

hudsonaikins commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Outcome

Acceptance Criteria

Validation

Review Findings Addressed

Residual Risk

Release Safety and Exclusions

Uh oh!

makeplane Bot commented Jul 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hudsonaikins commented Jul 24, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

hudsonaikins commented Jul 24, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

hudsonaikins commented Jul 24, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

hudsonaikins commented Jul 24, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

hudsonaikins commented Jul 23, 2026 •

edited

Loading