Loop 8 - PyPI Production Depth

[sairintechnologycom]

Loop 8 of the PkgSafe Loop Engineering roadmap.

Goal: improve Python package scanning enough to prepare for PyPI GA in a future release, while keeping PyPI marked preview unless readiness gates pass.

Scope:

• requirements.txt
• pyproject.toml
• poetry.lock
• uv.lock
• Pipfile.lock
• wheel/sdist inspection
• setup.py and build backend risk
• Python suspicious behavior rules

Validation target:

• gofmt -w .
• go test ./...
• go test -race ./...
• go vet ./...
• make build
• PyPI corpus tests
• PyPI real repo benchmark where available
• evidence recorded in evidence/loops/loop-08-pypi-production-depth.md

Do not promote PyPI to GA in this loop unless explicit readiness gates pass. Do not add SaaS, billing, SSO, hosted services, or default behavior execution.

[sairintechnologycom]

Loop 8 evidence recorded in evidence/loops/loop-08-pypi-production-depth.md.

Summary:

• Implemented parsers for poetry.lock, uv.lock, Pipfile, and Pipfile.lock.
• Added scored PyPI static-analysis rules for eval/exec, base64 decode plus exec, network calls, credential path access, environment secret access, cloud metadata endpoints, and native extensions.
• Added native-extension artifact metadata.
• Added tests for PyPI static findings and Python dependency lockfile parsing.
• Documented PyPI preview caveats and supported Python dependency formats in docs/known-limitations.md.

Validation passed: focused PyPI tests, go test ./..., go test -race ./..., go vet ./..., make build, make package, policy validate default-policy.yaml, corpus validation, offline benchmark, docs link check, and wording audit.

Known caveats:

• PyPI remains preview and was not promoted to GA.
• Live scan-python-deps sample could not reach PyPI because DNS/network access was unavailable in this environment.
• Branch is stacked on uncommitted Loop 1-7 work.