Skip to content

PTD-23.1.2: Prove Requires-Python coverage - #146

Open
omry wants to merge 1 commit into
pr144from
pr146
Open

omry wants to merge 1 commit into
pr144from
pr146

Conversation

@omry

@omry omry commented Sep 13, 2026

Copy link
Copy Markdown
Owner

Require each portable Python binding artifact to overlap its declared interpreter claims and require target artifacts to cover every advertised minor series completely. Preserve exact-claim checks and fail closed on malformed, unsupported, or contradictory constraints.

Add focused coverage for interval boundaries, wildcard and equality prefixes, exclusions, contradictions, and claim aggregation.


@omry
omry changed the base branch from main to pr144 September 13, 2026 06:56
@omry
omry added this pull request to stack #144 September 13, 2026 06:57
@omry

omry commented Sep 13, 2026

Copy link
Copy Markdown
Owner Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:29ffaaee7092708dab4160db74907224ea90b42784966ad4e5d0e009ab8fcb0b",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:29ffaaee7092708dab4160db74907224ea90b42784966ad4e5d0e009ab8fcb0b",
      "check_conclusions": [],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:41efcedf225b002732c7690dad1c1db4a36837ab365a262f9c5b31a202593c3b",
      "operation_identity": "sha256:c174710318adfa5ddb9ae48f961e7b26290a3b33d305c0d4529fc5b539042bcc",
      "review_request": {
        "body_digest": "sha256:ef3b3441641238bf773a2ad8a1e151fce4313139566ed2ab151f64a20e3b746f",
        "id": 5652089402
      },
      "review_result": {
        "body_digest": "sha256:7540a876a407cb9ec24fb334c242dde14c153b48d413fc3b56cd3c666737cfc7",
        "id": 5652137948
      }
    },
    "evidence_fingerprint": "sha256:6c823865e554d583c3fc2d87a42ea67e24dd9de678c71ef9d1f7114d1aec4fda",
    "head_sha": "e26fcae212e685bc9ada238691dc77f081f7b8fb",
    "operation_identity": "sha256:c174710318adfa5ddb9ae48f961e7b26290a3b33d305c0d4529fc5b539042bcc",
    "review_request_id": 5652089402,
    "review_result_id": 5652137948,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:29ffaaee7092708dab4160db74907224ea90b42784966ad4e5d0e009ab8fcb0b",
  "check_conclusions": [],
  "check_observations": [
    {
      "checks": [],
      "head_sha": "d87c440855d19a90fe5d8c0654e06e4ee1aa6c1a",
      "id": "sha256:c134d531c79ab9d2404dede06d42ffb396654e92dcc97c5af242a7a3a751ef98",
      "required_checks": [],
      "status": "success"
    },
    {
      "checks": [],
      "head_sha": "e26fcae212e685bc9ada238691dc77f081f7b8fb",
      "id": "sha256:c6e71e6f8b338b56f6626ec98171e66270416477ce963d9c4326a16067cfb704",
      "required_checks": [],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "disposition": "rejected",
      "evidence": [
        "https://github.com/omry/reploy/pull/146#discussion_r3999175859"
      ],
      "history": [
        "Round 3 rejected as factually inapplicable because the required Changie fragment is present in PR #146; the evidence response is posted and the thread is resolved."
      ],
      "id": "ptd2312-existing-changie-fragment",
      "invariant": "User-facing portable Python compatibility changes include a Changie fragment under .changes/unreleased/.",
      "line": 93,
      "path": "internal/providers/python/version.go",
      "rationale": "PR #146 already contains .changes/unreleased/+portable-python-requires-python-coverage.yaml with kind Changed, so the release-note requirement is satisfied in this exact PR diff.",
      "review_comment_id": 3999124554,
      "review_thread_id": "PRRT_kwDOTFQCkM6h3dHf",
      "severity": "quality",
      "status": "non-actionable",
      "thread_id": "PRRT_kwDOTFQCkM6h3dHf",
      "title": "Behavior change lacks a Changie fragment"
    },
    {
      "disposition": "rejected",
      "evidence": [
        "https://github.com/omry/reploy/pull/146#discussion_r3999049653",
        "https://github.com/omry/reploy/pull/146#discussion_r3999059384"
      ],
      "history": [
        "Round 1 rejected as contrary to the approved PTD-23.1.2 single-artifact complete-coverage guarantee and its explicit multi-artifact selection non-goal.",
        "The maintainer response records the authority rationale and the review thread is resolved without a code change."
      ],
      "id": "ptd2312-multi-artifact-series-union",
      "invariant": "For each advertised minor-series claim, at least one schema-v1 target artifact's canonical Requires-Python must admit the complete closed-open minor interval; target validation does not synthesize coverage across artifacts.",
      "line": 303,
      "path": "internal/toolcatalog/records_compose.go",
      "rationale": "PTD-23.1.2 explicitly requires proof that the schema-v1 target artifact admits the complete minor interval, says each individual artifact need only overlap while the target artifact covers every advertised claim, and lists selecting among multiple artifacts as a non-goal. Unioning partial ranges would introduce the excluded multi-artifact selection mechanism and weaken the approved fail-closed contract.",
      "review_comment_id": 3999049653,
      "review_thread_id": "PRRT_kwDOTFQCkM6h3Qno",
      "severity": "P2",
      "status": "non-actionable",
      "title": "Do not synthesize minor-series coverage across multiple artifacts"
    },
    {
      "disposition": "rejected",
      "evidence": [
        "https://github.com/omry/reploy/pull/146#discussion_r3999059384"
      ],
      "history": [
        "Round 1 rejected as contrary to the approved PTD-23.1.2 single-artifact complete-coverage guarantee and its explicit multi-artifact selection non-goal.",
        "The maintainer response records the authority rationale and the review thread is resolved without a code change."
      ],
      "id": "ptd2312-multi-artifact-series-union-rejected",
      "invariant": "For each advertised minor-series claim, at least one schema-v1 target artifact's canonical Requires-Python must admit the complete closed-open minor interval; target validation does not synthesize coverage across artifacts.",
      "line": 303,
      "path": "internal/toolcatalog/records_compose.go",
      "rationale": "PTD-23.1.2 explicitly requires proof that the schema-v1 target artifact admits the complete minor interval, says each individual artifact need only overlap while the target artifact covers every advertised claim, and lists selecting among multiple artifacts as a non-goal. Unioning partial ranges would introduce the excluded multi-artifact selection mechanism and weaken the approved fail-closed contract.",
      "review_comment_id": 3999049653,
      "review_thread_id": "PRRT_kwDOTFQCkM6h3Qno",
      "severity": "P2",
      "status": "non-actionable",
      "thread_id": "PRRT_kwDOTFQCkM6h3Qno",
      "title": "Do not synthesize minor-series coverage across multiple artifacts"
    },
    {
      "disposition": "accepted",
      "evidence": [
        "https://github.com/omry/reploy/pull/146#discussion_r3999125829"
      ],
      "history": [
        "Round 2 accepted: restore the pre-existing raw-string evaluation path for arbitrary equality package requirements without admitting local versions into interpreter interval proofs.",
        "Round 3 verified corrected at e26fcae212 with focused regression coverage, complete CI, clean independent Luna review, a resolved review thread, and a clean exact-head Codex review."
      ],
      "id": "ptd2312-strict-local-version-equality",
      "invariant": "Prepared-bundle validation must continue checking arbitrary equality requirements by exact raw version text, including valid local versions, while interpreter coverage remains restricted to canonical public releases.",
      "line": 145,
      "path": "internal/providers/python/version.go",
      "review_comment_id": 3999089996,
      "review_thread_id": "PRRT_kwDOTFQCkM6h3XXO",
      "severity": "P2",
      "status": "corrected",
      "title": "Preserve strict equality checks for local versions"
    }
  ],
  "pr": {
    "base_ref": "pr144",
    "base_sha": "64a0caf7a4ce572b5ef211f0dc02bb03eb8c2fa9",
    "body_digest": "sha256:2ee9d1be2b6b7285e32b4e6a452b42909e819219e8fe1e863c2886cdafd7d334",
    "diff_digest": "sha256:49c66b43cc67fa10a2e253ee8c67060ed1c5bd8d01ae848198f5114100907c5c",
    "head_ref": "pr146",
    "head_sha": "e26fcae212e685bc9ada238691dc77f081f7b8fb",
    "pr": 146,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:bd02f5450b2940b3a960f6419994aa9c4e5e65ccb4dc5365b4d17ac233b49d9d",
        "path": "docs/PORTABLE_TOOL_DEFINITION_DESIGN.md"
      },
      {
        "digest": "sha256:570286ac642fd82e3177fb8ddb36dd15ee97395470726d69df086508be174a2e",
        "path": "docs/PORTABLE_TOOL_DEFINITION_IMPLEMENTATION_PLAN.md"
      }
    ],
    "title_digest": "sha256:b37a305d73d29e17689e8d41f52ef010051be53c2de36488af87ccfd107d9738"
  },
  "record_version": 10,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-09-13T06:56:58Z",
      "base_ref": "pr144",
      "base_sha": "64a0caf7a4ce572b5ef211f0dc02bb03eb8c2fa9",
      "body_digest": "sha256:521fc6e7d4940ba4d706935a03234cda3c7958fb79820d0be756c8babfc8e996",
      "created_at": "2026-09-13T07:11:16Z",
      "head_sha": "d87c440855d19a90fe5d8c0654e06e4ee1aa6c1a",
      "id": 5651865628,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-09-13T06:56:58Z",
      "base_ref": "pr144",
      "base_sha": "64a0caf7a4ce572b5ef211f0dc02bb03eb8c2fa9",
      "body_digest": "sha256:521fc6e7d4940ba4d706935a03234cda3c7958fb79820d0be756c8babfc8e996",
      "created_at": "2026-09-13T07:31:51Z",
      "head_sha": "d87c440855d19a90fe5d8c0654e06e4ee1aa6c1a",
      "id": 5651953521,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-09-13T06:56:58Z",
      "base_ref": "pr144",
      "base_sha": "64a0caf7a4ce572b5ef211f0dc02bb03eb8c2fa9",
      "body_digest": "sha256:ef3b3441641238bf773a2ad8a1e151fce4313139566ed2ab151f64a20e3b746f",
      "created_at": "2026-09-13T08:00:01Z",
      "head_sha": "e26fcae212e685bc9ada238691dc77f081f7b8fb",
      "id": 5652089402,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr144",
      "base_sha": "64a0caf7a4ce572b5ef211f0dc02bb03eb8c2fa9",
      "body_digest": "sha256:ae01d5a6852c564487e2d13ddf0bcb900782c0cef0ea89b183d50942e5f60ce4",
      "commit_id": "d87c440855d19a90fe5d8c0654e06e4ee1aa6c1a",
      "id": 5189967938,
      "inline_message_ids": [
        3999049653
      ],
      "request_comment_id": 5651865628,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-09-13T07:14:17Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOTFQCkM6h3Qno"
      ]
    },
    {
      "base_ref": "pr144",
      "base_sha": "64a0caf7a4ce572b5ef211f0dc02bb03eb8c2fa9",
      "body_digest": "sha256:ae01d5a6852c564487e2d13ddf0bcb900782c0cef0ea89b183d50942e5f60ce4",
      "commit_id": "d87c440855d19a90fe5d8c0654e06e4ee1aa6c1a",
      "id": 5190062735,
      "inline_message_ids": [
        3999089996
      ],
      "request_comment_id": 5651953521,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-09-13T07:35:49Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOTFQCkM6h3XXO"
      ]
    },
    {
      "base_ref": "pr144",
      "base_sha": "64a0caf7a4ce572b5ef211f0dc02bb03eb8c2fa9",
      "body_digest": "sha256:7540a876a407cb9ec24fb334c242dde14c153b48d413fc3b56cd3c666737cfc7",
      "commit_id": "e26fcae212e685bc9ada238691dc77f081f7b8fb",
      "id": 5652137948,
      "inline_message_ids": [],
      "request_comment_id": 5652089402,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-09-13T08:10:56Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOTFQCkM6h3dHf"
      ]
    }
  ],
  "revision_fingerprint": "sha256:29ffaaee7092708dab4160db74907224ea90b42784966ad4e5d0e009ab8fcb0b",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [
        "ptd2312-multi-artifact-series-union-rejected"
      ],
      "effective_diff_digest": "sha256:1d846bd472c3b296a3b08594718248678d4cbee833174b41c9cc7114f2fee006",
      "finding_ids": [
        "ptd2312-multi-artifact-series-union-rejected"
      ],
      "invariants": [
        "For every advertised minor-series claim, one schema-v1 target artifact's canonical Requires-Python admits the complete closed-open minor interval; coverage is not synthesized across artifacts."
      ],
      "outcome": "same-head-needs-retry",
      "proposed_fix_paths": [],
      "resulting_head": "d87c440855d19a90fe5d8c0654e06e4ee1aa6c1a",
      "review_observation_id": null,
      "review_request_id": 5651865628,
      "review_result_id": 5189967938,
      "reviewed_head": "d87c440855d19a90fe5d8c0654e06e4ee1aa6c1a",
      "root_cause": "The review recommendation interpreted multiple target artifacts as a composite coverage set, contrary to the approved PTD-23.1.2 single-artifact coverage guarantee and explicit exclusion of multi-artifact selection.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "internal/providers/python/version.go",
        "internal/providers/python/version_test.go"
      ],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:49c66b43cc67fa10a2e253ee8c67060ed1c5bd8d01ae848198f5114100907c5c",
      "finding_ids": [
        "ptd2312-strict-local-version-equality"
      ],
      "invariants": [
        "Prepared-bundle validation must continue checking arbitrary equality requirements by exact raw version text, including valid local versions, while interpreter coverage remains restricted to canonical public releases."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "internal/providers/python/version.go",
        "internal/providers/python/version_test.go"
      ],
      "resulting_head": "e26fcae212e685bc9ada238691dc77f081f7b8fb",
      "review_observation_id": null,
      "review_request_id": 5651953521,
      "review_result_id": 5190062735,
      "reviewed_head": "d87c440855d19a90fe5d8c0654e06e4ee1aa6c1a",
      "root_cause": "The new normalized release-interval parser was reused for package requirements and rejected local-version arbitrary equality as unsupported, causing prepared-bundle validation to skip a strict comparison that the previous evaluator enforced.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:49c66b43cc67fa10a2e253ee8c67060ed1c5bd8d01ae848198f5114100907c5c",
      "finding_ids": [],
      "invariants": [
        "Every advertised Python minor-series claim is completely admitted by one target artifact while each binding artifact overlaps its declared interpreter claims.",
        "Package arbitrary equality retains exact raw-version validation without admitting local-version syntax into interpreter or Requires-Python interval proofs.",
        "The exact reviewed head passes complete repository validation and has no unresolved current-slice or design blockers."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "e26fcae212e685bc9ada238691dc77f081f7b8fb",
      "review_observation_id": null,
      "review_request_id": 5652089402,
      "review_result_id": 5652137948,
      "reviewed_head": "e26fcae212e685bc9ada238691dc77f081f7b8fb",
      "root_cause": null,
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review September 13, 2026 07:09
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 13, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-13T08:10:57.501329Z e26fcae Manual request
🔒 Security Review Completed 2026-09-13T07:14:58.201549Z d87c440 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Sep 13, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review d87c440

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d87c440855

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread internal/toolcatalog/records_compose.go
@omry

omry commented Sep 13, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review d87c440

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d87c440855

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread internal/providers/python/version.go
Require each portable Python binding artifact to overlap its declared interpreter claims and require target artifacts to cover every advertised minor series completely. Preserve exact-claim checks and fail closed on malformed, unsupported, or contradictory constraints.

Add focused coverage for interval boundaries, wildcard and equality prefixes, exclusions, contradictions, and claim aggregation.
Comment thread internal/providers/python/version.go
@gitar-bot

gitar-bot Bot commented Sep 13, 2026

Copy link
Copy Markdown
Code Review ✅ Approved 1 resolved / 1 findings

Adds comprehensive coverage validation for portable Python binding artifacts, requiring each artifact to overlap its declared interpreter claims and target artifacts to cover every advertised minor series completely. Includes focused test coverage for interval boundaries, wildcards, equality prefixes, exclusions, contradictions, and claim aggregation, with exact-claim checks preserved and fail-closed behavior on malformed or contradictory constraints. No issues found.

✅ 1 resolved
Quality: Behavior change lacks a Changie fragment

📄 internal/providers/python/version.go:79-93
This commit changes runtime behavior: package requirements with arbitrary-equality plus a local version (e.g. demo===1.0+vendor) are now supported and matched, whereas the old versionSpecifiersAllowVersion path reported them unsupported. That alters prepared-bundle validation outcomes for users, so per the release-note convention it should ship a fragment under .changes/unreleased/ (kind Changed or Fixed). No fragment is included in this PR's diff. If the fragment lives in a parent PR of the stack, this can be dismissed.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply Compact
gitar auto-apply:on         
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@omry

omry commented Sep 13, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review e26fcae

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: e26fcae212

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved PR reviewed and approved

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant