Fix all review findings and release 1.0.3

[sbroenne]

Description

Fix all 12 whole-repository review findings and prepare patch release 1.0.3.

• Preserve custom-agent settings and enabled/nested skill references.
• Correct repeated case identities and saved outcomes after setup or cleanup failures.
• Retain separate child execution evidence and inclusive usage/cost totals.
• Capture tool images and actual prepared runtime configuration.
• Preserve Windows CLI arguments, nullable model identity, and all-model pricing warnings.
• Require complete current-schema evidence on loading and update documentation and regression coverage.
• Remove circular imports flagged by CodeQL: runtime result types now live together, and MCP validation is shared without importing the plugin loader.
• Update package metadata, both lockfiles, release checks, and changelog to 1.0.3.

Saved-report compatibility: incomplete older schema-4.0 reports must be regenerated through their producer; missing fields are no longer invented. Unknown models and unavailable prepared configuration remain null. The banking integration test supplies its declared banking tool rather than expecting undeclared filesystem access.

Merging the version bump triggers Auto Release, which dispatches the tagged build, PyPI publication, GitHub release, and documentation deployment.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Checklist

• I ran the deterministic checks required for this change
• I ran the relevant real-Copilot integration file when behavior changed
• I added contract or integration coverage that proves the outcome
• I updated user and contributor documentation where needed
• I did not include credentials or unsanitized private prompts

Testing

List the exact commands you ran and their results. If a real-Copilot integration
run was not required, explain why.

uv run python -m pytest tests\unit tests\contracts -q --tb=short -o addopts=
590 passed, 8 skipped after the import cleanup and 1.0.3 version bump.

uv run python -m pytest examples\skill-dogfood\tests\offline -q --tb=short -o addopts=
31 passed.

uv run python -m pytest tests\unit\test_plugin_hooks.py -q --tb=short -o addopts=
21 passed after final phase-error handling adjustment.

uv run ruff check src tests examples
Passed.

uv run ruff format --check src tests examples
Passed; 145 files already formatted.

uv run pyright
Passed; 0 errors, 0 warnings.

uv run python -m pytest tests\integration\copilot\test_12_custom_agents.py -v --tb=short
6 passed.

uv run python -m pytest tests\integration\copilot\test_12_custom_agents.py::TestCustomAgentOutcomes::test_test_writer_agent_creates_test_file -v --tb=short
1 passed again after import cleanup.

uv run python -m pytest tests\integration\copilot\test_13_plugins.py -v --tb=short
8 passed, 1 initially failed: the old test expected filesystem access from a banking-only agent.

uv run python -m pytest tests\integration\copilot\test_13_plugins.py::TestCopilotPluginExecution::test_plugin_eval_creates_output -v --tb=short
1 passed after supplying the declared banking tool and independently verifying its receipt; passed again after import cleanup.

uv run python -m pytest tests\integration\copilot\test_17_plugin_skill_workflow.py -v --tb=short
1 passed.

uv run python -m pytest tests\integration\copilot\test_events.py -v --tb=short
8 passed, including exact image-byte persistence and runtime overrides.

uv run python -m pytest tests\integration\copilot\test_skill_discovery.py -v --tb=short
9 passed using real SDK discovery and a blocked-request isolation check.

uv sync --frozen --all-extras
Passed for 1.0.3.

uv run python -m pytest tests\unit\test_release_invariants.py -q -o addopts=
4 passed for 1.0.3.

uv build
Passed, including after import cleanup; built the 1.0.3 wheel and source distribution.

uv run python -X utf8 -m mkdocs build --strict
Passed.

uv run --isolated --no-project --with .\dist\pytest_skill_engineering-1.0.3-py3-none-any.whl python -c "from importlib.metadata import version; import pytest_skill_engineering; assert version('pytest-skill-engineering') == pytest_skill_engineering.__version__ == '1.0.3'; print('Installed release wheel reports 1.0.3')"
Passed; isolated installed wheel reports 1.0.3.

uv run pre-commit run --all-files
Passed, including after import cleanup: lint, formatting, types, and strict documentation build.

git diff --cached --check
Passed.

The selected live files were run sequentially, with only affected cases rerun. Four saved live reports loaded through the strict reader, retaining 16 root records and eight captured child results. Initial GitHub CodeQL findings were addressed rather than bypassed; checks rerun on the updated commit.

Related Issues

N/A — findings came from the user-requested whole-repository review.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None