Scaffold Python 3.14 project, test harness, and CI #46

Merged

lost-rob0t merged 21 commits from agent/issue-4-scaffold into main

2026-07-18 03:23:56 +00:00

lost-rob0t commented

2026-07-18 02:30:28 +00:00

(Migrated from github.com)

What changed

Added the CPython 3.14 project scaffold with a src/ layout and minimal Typer CLI.
Set packaging to >=3.14,<3.15 and added a required runtime-version test.
Added ADR-0007 recording CPython 3.14.x as the concrete v0.1 runtime target.
Configured bootstrap, GitHub Actions, Ruff, Pyright, Nix, and documentation for Python 3.14.
Added Pykka, PyZMQ, Pydantic, and Typer as runtime dependencies consistent with ADR-0006.
Added an exact exported requirements.lock and idempotent uv pip sync bootstrap.
Added the canonical ./scripts/check command for formatting, linting, ShellCheck, strict Pyright, tests, direct failure-propagation checks, repository policy checks, Bandit, and secret scanning.
Added unit, contract, integration, security, end-to-end, and failure-injection layouts.
Added isolated known-failing fixtures for assertion, collection, process crash, signal termination, timeout, teardown failure, empty selection, and piped-output propagation.
Added GitHub Actions checks on Ubuntu 22.04 and Ubuntu 24.04 plus an independent failure-propagation job.
Added a Nix development shell using python314.

Python 3.14 target

The supported v0.1 runtime is the standard GIL-enabled CPython 3.14 series.

requires-python = ">=3.14,<3.15"
uv venv --python 3.14
Ruff target py314
Pyright target 3.14
GitHub Actions Python 3.14
Nix package python314
Required unit test rejects another Python feature series

Free-threaded Python 3.14 is not implicitly supported and requires separate actor, PyZMQ, native-extension, and shutdown testing.

TDD and failure integrity

Known-bad tests are stored with non-Python extensions and copied into isolated temporary directories. scripts/verify-failure-modes succeeds only when every nested failure returns non-zero. The canonical check and CI invoke this harness directly rather than wrapping it in another timeout layer.

Verified failure modes:

assertion failure;
collection/import failure;
hard process exit;
signal termination;
timeout;
teardown failure;
zero collected tests;
failure status preserved through a pipe.

Python 3.14 CI validation

Validated on the final code-bearing head with Python 3.14:

Ubuntu 22.04 checks: passed
Ubuntu 24.04 checks: passed
Python 3.14 dependency installation: passed
Ruff formatting and linting: passed
ShellCheck: passed
Pyright strict: passed
Unit tests: passed
Repository policy, Bandit, and secret scanning: passed
Independent eight-mode failure propagation: passed

Security properties

Tests use synthetic fixtures only.
No workflow uploads test or capture artifacts.
No required workflow uses failure-tolerant settings.
Zero required tests is a failure.
Piped pytest output preserves the original non-zero status.
The security path is deterministic and does not require a live vulnerability API.

Closes #4

## What changed - Added the CPython 3.14 project scaffold with a `src/` layout and minimal Typer CLI. - Set packaging to `>=3.14,<3.15` and added a required runtime-version test. - Added ADR-0007 recording CPython 3.14.x as the concrete v0.1 runtime target. - Configured bootstrap, GitHub Actions, Ruff, Pyright, Nix, and documentation for Python 3.14. - Added Pykka, PyZMQ, Pydantic, and Typer as runtime dependencies consistent with ADR-0006. - Added an exact exported `requirements.lock` and idempotent `uv pip sync` bootstrap. - Added the canonical `./scripts/check` command for formatting, linting, ShellCheck, strict Pyright, tests, direct failure-propagation checks, repository policy checks, Bandit, and secret scanning. - Added unit, contract, integration, security, end-to-end, and failure-injection layouts. - Added isolated known-failing fixtures for assertion, collection, process crash, signal termination, timeout, teardown failure, empty selection, and piped-output propagation. - Added GitHub Actions checks on Ubuntu 22.04 and Ubuntu 24.04 plus an independent failure-propagation job. - Added a Nix development shell using `python314`. ## Python 3.14 target The supported v0.1 runtime is the standard GIL-enabled CPython 3.14 series. - `requires-python = ">=3.14,<3.15"` - `uv venv --python 3.14` - Ruff target `py314` - Pyright target `3.14` - GitHub Actions Python `3.14` - Nix package `python314` - Required unit test rejects another Python feature series Free-threaded Python 3.14 is not implicitly supported and requires separate actor, PyZMQ, native-extension, and shutdown testing. ## TDD and failure integrity Known-bad tests are stored with non-Python extensions and copied into isolated temporary directories. `scripts/verify-failure-modes` succeeds only when every nested failure returns non-zero. The canonical check and CI invoke this harness directly rather than wrapping it in another timeout layer. Verified failure modes: 1. assertion failure; 2. collection/import failure; 3. hard process exit; 4. signal termination; 5. timeout; 6. teardown failure; 7. zero collected tests; 8. failure status preserved through a pipe. ## Python 3.14 CI validation Validated on the final code-bearing head with Python 3.14: - Ubuntu 22.04 checks: passed - Ubuntu 24.04 checks: passed - Python 3.14 dependency installation: passed - Ruff formatting and linting: passed - ShellCheck: passed - Pyright strict: passed - Unit tests: passed - Repository policy, Bandit, and secret scanning: passed - Independent eight-mode failure propagation: passed ## Security properties - Tests use synthetic fixtures only. - No workflow uploads test or capture artifacts. - No required workflow uses failure-tolerant settings. - Zero required tests is a failure. - Piped pytest output preserves the original non-zero status. - The security path is deterministic and does not require a live vulnerability API. Closes #4

lost-rob0t commented

2026-07-18 03:01:07 +00:00

(Migrated from github.com)

Target 3.14 not 3.13.