From f74200e84ff432eb87c52bea8874be25b5350ae7 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 08:40:50 +0900
Subject: [PATCH 1/3] test(packaging): expose unpinned PEP 517 backend

---
 tests/test_build_system_reproducibility.py | 27 ++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 tests/test_build_system_reproducibility.py

diff --git a/tests/test_build_system_reproducibility.py b/tests/test_build_system_reproducibility.py
new file mode 100644
index 0000000..28be3bd
--- /dev/null
+++ b/tests/test_build_system_reproducibility.py
@@ -0,0 +1,27 @@
+"""Regression contracts for isolated PEP 517 build-tool identity."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # pragma: no cover - Python 3.10 compatibility
+    import tomli as tomllib
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+PYPROJECT_PATH = REPOSITORY_ROOT / "pyproject.toml"
+RELEASE_REQUIREMENTS_PATH = REPOSITORY_ROOT / "requirements-release.txt"
+REVIEWED_HATCHLING_VERSION = "1.31.0"
+
+
+def test_pep517_build_isolation_uses_the_reviewed_hatchling_version() -> None:
+    """Keep isolated source builds on the same reviewed backend as release builds."""
+    with PYPROJECT_PATH.open("rb") as pyproject_file:
+        build_system = tomllib.load(pyproject_file)["build-system"]
+
+    assert build_system["build-backend"] == "hatchling.build"
+    assert build_system["requires"] == [f"hatchling=={REVIEWED_HATCHLING_VERSION}"]
+
+    release_requirements = RELEASE_REQUIREMENTS_PATH.read_text(encoding="utf-8")
+    assert f"hatchling-{REVIEWED_HATCHLING_VERSION}-py3-none-any.whl" in release_requirements

From f07a8679f6d4bd669ad9e9091adffe2e61799534 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 08:42:15 +0900
Subject: [PATCH 2/3] fix(packaging): pin isolated PEP 517 backend

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 14f95a1..808d7e8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling==1.31.0"]
 build-backend = "hatchling.build"
 
 [project]

From 417ed4b066c50584b41942c61bc68bd82348d700 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 10:09:10 +0900
Subject: [PATCH 3/3] docs: record isolated build backend pin

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1dfaecb..438b03f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -88,6 +88,9 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   disable the recurring loop.
 
 ### Security
+- Pin isolated PEP 517 source builds to the reviewed Hatchling 1.31.0 backend
+  identity so build isolation cannot silently resolve a different backend than
+  the hash-locked release toolchain.
 - Harden release publication evidence with validated integrating-PR identity,
   cross-repository required-workflow source checks, and Strix check-run
   annotations without adding an elevated release credential.