PTD-23.1.4: Harden Python binding projection boundaries

[omry]

Exercise exhaustive conflict, platform, canonical-sidecar, and PEP 440 boundary coverage without expanding the implementation slice.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T04:05:41.853293Z	19375bb	Manual request
🔒 Security Review	✅ Completed 2026-09-14T13:05:57.968051Z	6957ba5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

reploy/internal/portabletool/python.go

Lines 104 to 105 in 6957ba5

	if len(uniqueRequirements) <= 1 {
	return true, nil

Check a single requirement's internal conjunction

When a binding has a dependency-only root containing contradictory specifiers, such as shared>=2,<1 or shared==1,!=1, this shortcut returns compatible solely because there is one unique requirement. The first claim is also stored without further checking by the solver, and projection consequently emits an impossible requirement that fails only during pip resolution. Parse and evaluate representable single-requirement conjunctions before returning; only genuinely unrepresented noncontradictory forms need the single-input exemption.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[gitar-bot]

Code Review ✅ Approved

Hardens Python binding projection boundaries by validating binding record references, wheel tag platform compatibility, bundled component agreement, and requirements coverage. Adds normalized Python claims parsing, intersection logic, and minor-series verification alongside PEP 440 constraint matching and specifier evaluation. Implementation plan split into eight child items with comprehensive hardening test suites. No issues found.

Review coverage

Rules No rules evaluated

Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[omry]

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:dad741a58a756a525db3d765d8af16d0b8e4811cf8f2c7a3a57c719c7155e99e",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:dad741a58a756a525db3d765d8af16d0b8e4811cf8f2c7a3a57c719c7155e99e",
      "check_conclusions": [],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:5e228c85867d49f13f3b3acbdfcfd1c5cf132b76a791ad0f3ad9c3e10716e066",
      "review_request": {
        "body_digest": "sha256:7fdbdbe74c0050760d3a79b01e9a49e2ca586892bf972ce3771a47d9da22d1b9",
        "id": 5674546034
      },
      "review_result": {
        "body_digest": "sha256:a566c0e2d639b9b6a021405f8a4b5fb7dfec10420873c4c591353fbdaae61539",
        "id": 5674565568
      }
    },
    "evidence_fingerprint": "sha256:effe325dcb2274c250e4687eb4b68ef83d21e992f8c74cab4dd3e9391184f68e",
    "head_sha": "19375bb8977de5d1495a6f9677e9d012a9f7325c",
    "operation_identity": "sha256:5e228c85867d49f13f3b3acbdfcfd1c5cf132b76a791ad0f3ad9c3e10716e066",
    "review_request_id": 5674546034,
    "review_result_id": 5674565568,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:dad741a58a756a525db3d765d8af16d0b8e4811cf8f2c7a3a57c719c7155e99e",
  "check_conclusions": [],
  "check_observations": [
    {
      "checks": [],
      "head_sha": "19375bb8977de5d1495a6f9677e9d012a9f7325c",
      "id": "sha256:08b2aaac64d321c0fe112ab30e7ff88104693f4a62d2a0fe2cee0435b6d376e3",
      "required_checks": [],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr148",
    "base_sha": "7d8766a82271fc340ce1585a390f2b5444d26256",
    "body_digest": "sha256:910122197ae765b3b39e4d6cb3b691c904a325e0b3058d4b89e1c742bc9f30d3",
    "diff_digest": "sha256:84f3e95e93259073f6af4dd1132ea5846abf547ded54824aed8351c5b5fc2ffb",
    "head_ref": "pr150",
    "head_sha": "19375bb8977de5d1495a6f9677e9d012a9f7325c",
    "pr": 150,
    "repository": "omry/reploy",
    "scope_authority": [],
    "title_digest": "sha256:10879dadb4ce07683bed300d01b0e49c61259f3395bb2d6d1eb0178c4146a129"
  },
  "record_version": 4,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-09-15T02:25:54Z",
      "base_ref": "pr148",
      "base_sha": "7d8766a82271fc340ce1585a390f2b5444d26256",
      "body_digest": "sha256:7fdbdbe74c0050760d3a79b01e9a49e2ca586892bf972ce3771a47d9da22d1b9",
      "created_at": "2026-09-15T04:02:57Z",
      "head_sha": "19375bb8977de5d1495a6f9677e9d012a9f7325c",
      "id": 5674546034,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr148",
      "base_sha": "7d8766a82271fc340ce1585a390f2b5444d26256",
      "body_digest": "sha256:a566c0e2d639b9b6a021405f8a4b5fb7dfec10420873c4c591353fbdaae61539",
      "commit_id": "19375bb8977de5d1495a6f9677e9d012a9f7325c",
      "id": 5674565568,
      "inline_message_ids": [],
      "request_comment_id": 5674546034,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-09-15T04:05:40Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:dad741a58a756a525db3d765d8af16d0b8e4811cf8f2c7a3a57c719c7155e99e",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:84f3e95e93259073f6af4dd1132ea5846abf547ded54824aed8351c5b5fc2ffb",
      "finding_ids": [],
      "invariants": [
        "Acceptance hardening exercises exact portable Python binding projection behavior without adding production code to PR 150.",
        "Source-reference conflict tests preserve the approved named-source identity semantics and redact unprovable credential-bearing references.",
        "The Playwright acceptance fixture retains every exact selected wheel field, including size, digest, tags, platform, ecosystem version, and Requires-Python.",
        "PTD-23.1.4 remains one delivery item whose contiguous PR 149 -> 148 -> 150 review subdivision must all retain current-head approval before PTD-23.1.5 activates."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "19375bb8977de5d1495a6f9677e9d012a9f7325c",
      "review_observation_id": null,
      "review_request_id": 5674546034,
      "review_result_id": 5674565568,
      "reviewed_head": "19375bb8977de5d1495a6f9677e9d012a9f7325c",
      "root_cause": null,
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

[omry]

@codex, regular review 19375bb

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 19375bb897

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".