From 8b5abe40b0da0c6b9fd5d1f761e8bdbc3b61e63c Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Wed, 2 Sep 2026 00:39:41 +0200 Subject: [PATCH] Lock plugin build tools for frozen E2E installs --- project/TICKETS.md | 1 + project/ticket-006/README.md | 52 ++++++++++++++++++ project/ticket-006/ai-codex-logs.txt | 4 ++ project/ticket-006/ai-codex.md | 38 +++++++++++++ project/ticket-006/changelog.md | 10 ++++ project/ticket-006/intent.json | 80 ++++++++++++++++++++++++++++ project/ticket-006/preprompt.md | 10 ++++ pyproject.toml | 3 ++ uv.lock | 25 +++++++++ 9 files changed, 223 insertions(+) create mode 100644 project/ticket-006/README.md create mode 100644 project/ticket-006/ai-codex-logs.txt create mode 100644 project/ticket-006/ai-codex.md create mode 100644 project/ticket-006/changelog.md create mode 100644 project/ticket-006/intent.json create mode 100644 project/ticket-006/preprompt.md diff --git a/project/TICKETS.md b/project/TICKETS.md index 37a978b..5b9c2ec 100644 --- a/project/TICKETS.md +++ b/project/TICKETS.md @@ -10,4 +10,5 @@ This file indexes governance tickets without taking ownership of | **ticket-002** | [`README.md`](./ticket-002/README.md) | [`preprompt.md`](./ticket-002/preprompt.md) | - | [`ai-codex.md`](./ticket-002/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-002/ai-codex-logs.txt) | [`changelog.md`](./ticket-002/changelog.md) | | **ticket-003** | [`README.md`](./ticket-003/README.md) | [`preprompt.md`](./ticket-003/preprompt.md) | - | [`ai-codex.md`](./ticket-003/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-003/ai-codex-logs.txt) | [`changelog.md`](./ticket-003/changelog.md) | | **ticket-004** | [`README.md`](./ticket-004/README.md) | [`preprompt.md`](./ticket-004/preprompt.md) | - | [`ai-codex.md`](./ticket-004/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-004/ai-codex-logs.txt) | [`changelog.md`](./ticket-004/changelog.md) | +| **ticket-006** | [`README.md`](./ticket-006/README.md) | [`preprompt.md`](./ticket-006/preprompt.md) | - | [`ai-codex.md`](./ticket-006/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-006/ai-codex-logs.txt) | [`changelog.md`](./ticket-006/changelog.md) | diff --git a/project/ticket-006/README.md b/project/ticket-006/README.md new file mode 100644 index 0000000..ae120f2 --- /dev/null +++ b/project/ticket-006/README.md @@ -0,0 +1,52 @@ +# Ticket 006: Lock E2E plugin build tools + +- **ID**: ticket-006 +- **Owner**: unresolved:human +- **Status**: IN_PROGRESS +- **Workflow state**: PUBLICATION +- **Created**: 2026-09-01 + +## Goal and scope + +Add the existing setuptools build backend and wheel helper to TestQL's dev +extra, then regenerate the portable lock with `--no-sources`. This lets the E2E +image create distribution metadata for four local plugins with +`--no-build-isolation --no-deps`, without invoking an external resolver. + +This ticket adds no production runtime dependency and changes no Dockerfile or +plugin package declaration. + +## Acceptance criteria + +- [x] AC-01: The user's autonomous sequential-completion request is recorded as + `SESSION_EXECUTION_AUTHORIZATION`. +- [x] AC-02: `setuptools` and `wheel` are dev-only and resolved with hashes in + the portable lock. +- [x] AC-03: A locked/no-sources dev sync can install all four local plugin + distributions with no build isolation and no dependency resolution. +- [x] AC-04: GraphQL, Proto and SQL entry points are discoverable and the + focused registration tests pass. +- [x] AC-05: Governance, Compose and Docker build checks pass before protected + exact-head publication. + +## Validation evidence + +- `uv lock --check --no-sources`: 190 packages; `setuptools==84.0.0` and + `wheel==0.48.0` have registry artifacts and SHA-256 hashes. +- Locked dev plus `nlp2env` sync and resolver-free editable installation of + all four plugins completed successfully. +- The `graphql`, `proto` and `sql` `testql.plugins` entry points resolve to + their local distributions; focused regression suite: `77 passed`. +- `./project/governance-check.sh`: `GOV-PASS`. +- All three root Compose configurations and both Docker build checks pass. + +## Authorization + +The user's request to continue and close all tasks sequentially authorizes this +bounded prerequisite discovered while validating TestQL issue #10. It does not +authorize secrets, self-approval, direct merge or unrelated dependency changes. + +## Participants + +- Human participant: unresolved; no user-* file was created by this script. +- Agent participant: [ai-codex.md](ai-codex.md) diff --git a/project/ticket-006/ai-codex-logs.txt b/project/ticket-006/ai-codex-logs.txt new file mode 100644 index 0000000..1f91873 --- /dev/null +++ b/project/ticket-006/ai-codex-logs.txt @@ -0,0 +1,4 @@ +2026-09-01T22:36:01Z SESSION_EXECUTION_AUTHORIZATION recorded for TestQL issue #10 and semcod/koru#64. +2026-09-01T22:37:00Z EDIT base=ab9e899b916a1933c6219fc05cf39949d557141c workstream=integration prerequisite_for=ticket-005. +2026-09-01T22:38:00Z VALIDATION uv_lock=190_packages build_tools=setuptools-84.0.0,wheel-0.48.0 plugin_install=no-build-isolation,no-deps entrypoints=graphql,proto,sql focused_tests=77_passed. +2026-09-01T22:39:00Z VALIDATION governance=GOV-PASS compose=3_passed docker_build_checks=2_passed workflow=PUBLICATION. diff --git a/project/ticket-006/ai-codex.md b/project/ticket-006/ai-codex.md new file mode 100644 index 0000000..0c12a5c --- /dev/null +++ b/project/ticket-006/ai-codex.md @@ -0,0 +1,38 @@ +--- +participant-id: agent:codex +participant: codex +role: agent +ticket: ticket-006 +--- +# Participant: codex (AI agent) + +## Understanding + +The frozen E2E environment has plugin runtime libraries, but not the build +backend needed to create local distribution metadata without build isolation. +Locking the already-declared setuptools backend plus wheel in the dev extra +keeps that metadata installation resolver-free and out of production runtime. + +## Execution plan + +1. Add setuptools and wheel only to the dev extra. +2. Regenerate and check the portable lock with `--no-sources`. +3. Sync the dev environment from the lock and install four local plugins with + no build isolation and no dependency installation. +4. Validate entry points, focused tests, governance and Docker configuration. +5. Publish through exact-head Validator review. + +## Actual changes + +- Recorded the user's session execution authorization and implemented the + narrow integration prerequisite on the exact merged ticket-004 base. +- Added `setuptools` and `wheel` only to the dev extra and regenerated the + portable registry-backed lock. +- Demonstrated that all four local plugins install without build isolation or + dependency resolution and expose the required entry points. +- Ran 77 focused tests, the managed governance gate, three Compose checks and + both Dockerfile build checks successfully. + +## Blockers + +- None. diff --git a/project/ticket-006/changelog.md b/project/ticket-006/changelog.md new file mode 100644 index 0000000..8b024a9 --- /dev/null +++ b/project/ticket-006/changelog.md @@ -0,0 +1,10 @@ +# Ticket Changelog (ticket-006) + +## [0.1.0] - 2026-09-01 + +- Initial governance scaffold created. +- No human participant identity or content was generated. +- Planned the dev-only frozen build-tool prerequisite for local plugin metadata. +- Locked `setuptools==84.0.0` and `wheel==0.48.0` in the dev graph. +- Validated resolver-free metadata installation for all four local plugins and + restored their GraphQL, Proto and SQL entry points. diff --git a/project/ticket-006/intent.json b/project/ticket-006/intent.json new file mode 100644 index 0000000..c622ac8 --- /dev/null +++ b/project/ticket-006/intent.json @@ -0,0 +1,80 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-006", + "summary": "Lock E2E plugin build tools", + "workstream": "integration", + "classification": { + "kind": "SERVICE", + "priority": "P1", + "origin": "health" + }, + "allowedPaths": [ + "project/ticket-006/**", + "TODO.md", + "project/TICKETS.md", + "pyproject.toml", + "uv.lock" + ], + "forbiddenPaths": ["project/ticket-*/user-*.md"], + "stacks": ["docker"], + "dependsOn": ["ticket-003", "ticket-004"], + "conflictsWith": [], + "integrationTicket": null, + "delivery": { + "acceptedBaseSha": "ab9e899b916a1933c6219fc05cf39949d557141c", + "targetBranch": "main", + "outcome": "Dev-only build tools are hash-locked for resolver-free local E2E plugin metadata installation.", + "nonGoals": [ + "Add a production runtime dependency.", + "Change Dockerfiles or local plugin dependency declarations." + ], + "complexity": "XS", + "estimatedMinutes": 10, + "budgets": { + "maxImplementationFiles": 2, + "maxAffectedComponents": 1, + "maxPublicInterfaceChanges": 0, + "maxRuntimeDependencies": 0 + }, + "architecture": { + "status": "accepted", + "decision": "Reuse the packages' declared setuptools backend from the frozen dev environment and disable build isolation and dependency installation for local plugin metadata.", + "components": [ + { + "name": "dev-dependency-contract", + "paths": ["pyproject.toml", "uv.lock"] + } + ], + "responsibilityChanges": false, + "interfaceChanges": [], + "dataChanges": ["Extend the portable dev dependency graph with setuptools and wheel."], + "ui": { + "impact": "none", + "states": [], + "evidence": [] + }, + "rollback": "Revert the dev-extra entries and regenerate uv.lock with --no-sources." + }, + "runtimeDependencies": [], + "validation": [ + { + "criterion": "AC-02", + "commands": ["uv lock --no-sources", "uv lock --check --no-sources"], + "evidence": "The portable lock contains registry artifacts and hashes for both dev build tools." + }, + { + "criterion": "AC-03", + "commands": [ + "uv sync --locked --extra dev --extra nlp2env --no-sources --no-editable", + "uv pip install --python .venv/bin/python --no-build-isolation --no-deps --editable packages/graphql2testql --editable packages/proto2testql --editable packages/sql2testql --editable packages/desktop2testql" + ], + "evidence": "All local plugin metadata installs using only the frozen environment's build backend." + }, + { + "criterion": "AC-05", + "commands": ["./project/governance-check.sh", "docker build --check -f Dockerfile.e2e ."], + "evidence": "Managed governance and the declared Docker stack pass." + } + ] + } +} diff --git a/project/ticket-006/preprompt.md b/project/ticket-006/preprompt.md new file mode 100644 index 0000000..ece7007 --- /dev/null +++ b/project/ticket-006/preprompt.md @@ -0,0 +1,10 @@ +# Ticket preprompt + +- **Task ID**: ticket-006 +- **Task title**: Lock E2E plugin build tools +- **Created**: 2026-09-01T22:36:01Z + +Keep executable implementation outside this governance/evidence directory. +Read a human-owned user-*.md file only when one exists. +Add only dev build tools already required by the local packages; keep production +runtime dependencies, Dockerfiles and plugin manifests unchanged. diff --git a/pyproject.toml b/pyproject.toml index 20a9f25..839b335 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -62,6 +62,9 @@ graphql = ["graphql-core>=3.2"] nlp2env = ["mcp>=1.0", "nlp2env[mcp]>=0.1.2"] mcp = ["mcp>=1.0"] dev = ["pytest", "pytest-asyncio", "pytest-cov", + # Build local E2E plugin metadata without an isolated dependency resolver. + "setuptools>=68", + "wheel", "mcp>=1.0", "fastapi", "goal>=2.1.0", diff --git a/uv.lock b/uv.lock index 71589a4..306a595 100644 --- a/uv.lock +++ b/uv.lock @@ -3012,6 +3012,15 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/50/a8/6a77f5f267c555108f0a864b6db714363dab567a8266422a79a385f9232b/scipy-1.18.1-cp313-cp313-win_arm64.whl", hash = "sha256:cd479fc04dd9401e3b4f49e76518768ef99c4f517a98c284eb091fd725719adf", size = 24399315, upload-time = "2026-08-21T23:25:23.458Z" }, ] +[[package]] +name = "setuptools" +version = "84.0.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/6d/44/f5da03a8ef95d369145c5bb53050e7877c9f3d312e128605fd9504829143/setuptools-84.0.0.tar.gz", hash = "sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73", size = 1168449, upload-time = "2026-08-08T18:27:58.365Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/95/9c/c510029fc6ef33a6275cd2c5d3cecd6613dfd6aa401d57c54f1c18852ccf/setuptools-84.0.0-py3-none-any.whl", hash = "sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670", size = 818216, upload-time = "2026-08-08T18:27:56.719Z" }, +] + [[package]] name = "shellingham" version = "1.5.4" @@ -3147,7 +3156,9 @@ dev = [ { name = "pytest" }, { name = "pytest-asyncio" }, { name = "pytest-cov" }, + { name = "setuptools" }, { name = "sqlglot" }, + { name = "wheel" }, ] graphql = [ { name = "graphql-core" }, @@ -3213,10 +3224,12 @@ requires-dist = [ { name = "pytest-cov", marker = "extra == 'dev'" }, { name = "pyyaml", specifier = ">=6.0" }, { name = "rich", specifier = ">=13.0" }, + { name = "setuptools", marker = "extra == 'dev'", specifier = ">=68" }, { name = "sqlglot", marker = "extra == 'dev'", specifier = ">=20.0" }, { name = "sqlglot", marker = "extra == 'sql'", specifier = ">=20.0" }, { name = "vdisplay", extras = ["pillow"], marker = "sys_platform == 'linux' and extra == 'vision'", specifier = ">=0.1.3" }, { name = "websockets", specifier = ">=13.0" }, + { name = "wheel", marker = "extra == 'dev'" }, ] provides-extras = ["playwright", "desktop", "vision", "sql", "proto", "graphql", "nlp2env", "mcp", "dev"] @@ -3592,6 +3605,18 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/41/63/23572870e01836a98346075b9e17a8bc24a6ddd9800a3204ceee58677f3c/websockets-17.1-py3-none-any.whl", hash = "sha256:f221081107b8c48184d99f7019604486376e7ef826037e70aad6b02540732c23", size = 211134, upload-time = "2026-08-26T17:25:31.397Z" }, ] +[[package]] +name = "wheel" +version = "0.48.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "packaging" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/d0/20/50ed6bdf27dec98b568a8ae25dc599f35baa3d9709f9e83fd1edb56b9a90/wheel-0.48.0.tar.gz", hash = "sha256:94800765601e9171bf5d58d066e640662842bcedcbab982b2c90787a2c987322", size = 66471, upload-time = "2026-08-11T22:02:27.327Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/2e/29/69cfbb602cd91690c55d38ba9fe53e6a7e76a6fa647bf38f19c138d25449/wheel-0.48.0-py3-none-any.whl", hash = "sha256:3217dcc807155e45db462d7ef2431f5ddda0d7273b700d05a67b271ceb1287ab", size = 33320, upload-time = "2026-08-11T22:02:26.1Z" }, +] + [[package]] name = "yarg" version = "0.1.9"