[MaxGhenis]

Summary

Deletes uv.lock, adds it to .gitignore, and adds a changed changelog fragment. I chose deleting it over regenerating it; the evidence is below.

Why delete it

Nothing reads it. At 549bead, git grep over the tracked files (the lock itself excluded) finds no uv.lock, uv sync, uv run, uv lock, uv_sync, --locked or --frozen (bun's --frozen-lockfile aside). The uv commands that do appear do not use the lock:

Where	Command
README.md	uv venv, uv pip install -e ., uv pip install -e . --upgrade, uv pip install git+https://…
dashboard/src/components/LandingContent.jsx, DocumentationContent.jsx	uv tool install, uv tool upgrade, uv tool dir, uv pip install policyengine-us==2.25.2
docs/dashboard-refresh.md, scripts/dashboard-refresh-requirements.txt	uv pip compile pyproject.toml scripts/dashboard-refresh.in

Every automated install uses pip. ci.yml runs pip install -e .. refresh-dashboard.yml and scorp-e2e.yml run pip install -r scripts/dashboard-refresh-requirements.txt. The Modal image in policyengine_taxsim/api.py uses pip_install("policyengine-taxsim @ git+…@main"). dashboard/vercel.json builds with bun.

It was never updated. git log -- uv.lock has one commit: #699 ("Add landing page to cps-dashboard", 2026-02-25). The lock records policyengine-taxsim 2.6.1; the project is at 3.1.1.

It installs a wrong environment. On main:

• uv lock --check and uv sync --locked fail: "The lockfile at uv.lock needs to be updated".
• uv sync --frozen (fresh cache, Python 3.11) succeeds. It installs policyengine-us 1.550.2 and policyengine-core 3.23.6 next to policyengine-taxsim 3.1.1, which is below the policyengine-us>=1.711.0 minimum in pyproject.toml. The CLI runs in that environment and returns results.
• policyengine-us 1.550.2 is gone from the PyPI index: the JSON API returns 404 for it, and the oldest file in the simple index is 1.691.1. The wheel URL recorded in the lock still serves the file with the recorded hash, which is why the frozen install works.

Keeping it would take more than a lint step. I regenerated the lock in a scratch copy: 112 packages, with policyengine-us 1.783.0 for Python 3.10 and 2.38.4 for 3.11 and later, and uv lock --check passed. I then made the edit the versioning job makes on each release (version = "3.1.1" to "3.1.2" in pyproject.toml). uv lock --check exits 1, because the lock records this package's version. A uv lock --check step in lint would therefore fail on every pull request after the next release, unless versioning also ran uv lock and committed the result. A regenerated lock would also pin policyengine-us while CI tests whatever pip install -e . resolves that day, so uv sync would give a developer a model CI had not tested.

.gitignore now lists uv.lock, so a lock generated locally stays out of commits.

README install instructions

The three install commands in the README resolve the same packages with and without the file. I ran each as uv pip install --dry-run against one existing environment:

Command	Compared	Result
uv pip install -e .	a copy of main with uv.lock and one without	the same 26 package changes; policyengine-us 2.38.4 in both, so the lock's 1.550.2 pin was not used
uv pip install -e . --upgrade	same two copies	the same 111 package changes
uv pip install git+https://github.com/PolicyEngine/policyengine-taxsim.git	@main and @remove-stale-uv-lock	the same 26 package changes

These are dry runs: they resolve and install nothing. The machine I ran them on was under a resource hold, so I did not build new environments there. The real installs are the pip install -e . steps in this pull request's CI (six test jobs and two scorp-validation jobs).

Packaging

The published 3.1.1 sdist contains uv.lock. The 3.1.1 wheel does not (43 entries, none named uv.lock). With the file gone from the checkout, later sdists will not contain it.

Related: #1419

#1419 adds docs/security-and-deployment.md, whose first draft said the repository's uv.lock was out of date. #1419 has since removed that sentence (48ecd63, "Drop the uv.lock note; #1420 removes the file"). None of #1419's added lines mention uv.lock; its generator calls uv pip compile on pyproject.toml. Neither pull request needs the other to merge first.

axiom: n/a: repository infrastructure, no policy change

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
policyengine-taxsim	Ready	Preview	Oct 10, 2026 1:03am UTC

[MaxGhenis]

Merge audit (US + core hub, on Fleet ops' green-PR sweep), #1420 at 85d7a461d17b566bc25e374a80469f0c9bc867dc, squash.

• Independent review (GPT-6.1 Sol, against current main 11d1c73b21): APPROVE, no findings. It confirmed the diff is exactly .gitignore, the changelog fragment and the deleted uv.lock; that no workflow, script or documented install step reads the lock (the only lockfile commands are Bun's, on dashboard/bun.lock); and that the fragment meets the check-changelog job.
• Gates at merge: gh pr checks exits 0 at this head; MERGEABLE; not a draft; no review requests changes; merges cleanly with current main.
• Impact: none on any calculation; repository infrastructure only.