Repository navigation
Fix publisher checkout admission and ROI test dependencies for 0.3.1 - #21
Conversation
|
Original publication attempt completed SUCCESS: run 36963152726, attempt 1, source/tag commit f07da09. Job110701039079 ran 04:18:47–04:20:22Z. Full hosted release-candidate suite: 570 passed, 5 skipped, zero failures in17.57s; no original assertion or skip changed. Editable install, normal build, immutable release validation, twine check, trusted PyPI upload and GitHub release all passed. PyPI0.3.1 and GitHub release both expose the wheel and sdist. Programmatically verified equal filenames, sizes and SHA256 metadata on both services, matching original publisher DSSE subjects:
Dev-only roifile declaration is present in published PyPI metadata. Both artifacts are non-yanked; GitHub release is public/non-draft/non-prerelease and retains both publish attestations. Actions artifact inventory is empty: evidence refers to actual RELEASE assets. Durable terminal receipt and lossless full SDK-fetched successful job log/raw metadata are published in documentation-only archive commit No retag, release resubmission, runtime/analysis replay, package-byte download or local install was performed by this worker. This proves publication and published metadata agreement, not local installed or scientific acceptance. Existing stale offline lock remains a separate recorded limitation. Original append-only native journal remains linked under agent-audit-20261002/Dewey; no second logger, large copy or source-only screenshot claim. |
Repairs the nine original publisher failures in run 36959840684 at source 84f322e: three fresh-process checkout-source assertions and six ROI roundtrip cases missing roifile.
Production delta is limited to the existing declarations:
python -m pip install build "twine>=7,<8" -e ".[dev]", matching the original test workflow. The later normal distribution build and immutable release validation are unchanged.roifilein the original dev extra, not a workflow-only dependency roster or mandatory runtime dependency.No original test, skip, runtime algorithm, action pin or environment is changed. Open ownership check found only Dependabot PR10 with nonoverlapping action-pin edits in the shared publisher file.
Source qualification: 68 PASS, zero skips, including every original failed case, package basics, fresh-process namespace/cache controls, ROI geometry/archive controls and lazy imports. Actual setuptools editable-build regression verifies source-path binding and emitted dev-only roifile metadata without installing the artifact. One CPU, 512 MiB / 60s bounds: monitored 9.089s and 322700 KiB aggregate RSS. Existing readonly dependencies and own source were explicit. No new environment, package installation, download, Fiji/native launch or scientific operation.
Current NRA/refactor-audit applied: original extra and version declarations retain authority; no parallel store/registry, copied engine or ornamental inheritance. Source tests are not hosted publisher or installed-candidate acceptance.
Full original failed job log retrieved through GitHub SDK and preserved losslessly in
docs/validation/publisher-admission-031-20261002/original-job-110690882405.log.gz; decompressed 142020 bytes, SHA256542d75ef00bcd8677526131a1afe195cea6fa63edca7eca5aa8e0b1b4e4b703c. Receipt, commands, XML and resource output are in the same directory.Separate known limitation: original uv.lock already records PolyStore 0.2.18 and ZMQRuntime 0.2.21. Authorized offline regeneration failed because imglyb==2.1.0 is absent from cache; lock remains unchanged, with no fabricated metadata or downloads. Publisher pip does not consume that lock. Existing distribution-CI lock check remains unqualified pending separately authorized regeneration. Parent can independently qualify the narrow publisher repair; this does not gate private use of the source-qualified 0.3.0 candidate.