jpmschweitzerandClaude Opus 5.5
6fb0ba0e3d
T-1272 (a verification, as rescoped). No directory Python imports carries a hyphen any more. The hyphenated script trees were emptied by the per-domain moves, not renamed. What still has a hyphen is never imported: the three Rust crates, and the provenance under tooling/archive/, which has no __init__.py. CLAUDE.md and DEVOPS still pointed at tooling/db/, and pyproject still predicted the rename; all three fixed. T-1274. E402, E702 and F841 were ignored for the whole tree from T-1066 on (43 / 41 / 21 violations). All three are back on: - E402: the planet modules' imports only sat below their path constants because they used to follow a sys.path insert, gone since T-1288. Hoisted. The Blender payloads keep a per-file exception, because they extend sys.path under Blender's own Python. - E702: the paired component assignments in three planet maths files are deliberate, so they get a per-file exception scoped to those files. - F841: 10 dead locals removed from live code, each checked for side effects first; logo_uv keeps its call, which creates the UV layer. - tooling/archive/ is excluded: it is provenance, and "fixing" a one-shot falsifies the record of what actually ran. Evidence the lint is real: violations fed through stdin fire in a domain module, and E402 stays quiet only on a payload path. Evidence nothing moved: globe renders are pixel-identical before and after for an oceanic, a frozen and a gas-giant body, and the ledger edit was regenerated (stamp fresh, generated_brands.toml unchanged). One finding, noted in the code rather than fixed: planet_renderer computed an oblate-spheroid ray scale and never used it, so `oblateness` shapes no globe. Wiring it in would change every globe render; that is a decision to make deliberately, not a lint fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
97 lines
4.7 KiB
TOML
97 lines
4.7 KiB
TOML
[project]
|
|
name = "settled-reach-tooling"
|
|
version = "0.1.0"
|
|
requires-python = ">=3.11"
|
|
dependencies = [
|
|
"PyYAML",
|
|
"jsonschema",
|
|
"numpy",
|
|
# scipy 1.17.1 — checked clean against NVD + OSV, no CVEs on record (2026-04-06)
|
|
"scipy==1.17.1",
|
|
# Pillow 12.2.0 — checked clean against NVD + OSV (2026-04-06)
|
|
# CVE-2026-25990 fixed in 12.1.1, CVE-2025-48379 fixed in 11.3.0
|
|
"Pillow==12.2.0",
|
|
# typer 0.27.1 — the CLI transport (D-263). Checked clean against NVD, OSV
|
|
# and the GitHub Advisory Database: no advisories on record for typer at all
|
|
# (2026-08-20). Its transitive set was checked too, since typer pulls in
|
|
# rich -> pygments: pygments 2.21.0 clears CVE-2026-4539 (archetype-lexer
|
|
# ReDoS, fixed in 2.20.0); rich and click have no advisories on record.
|
|
#
|
|
# Plain `typer`, not `typer-slim`: slim is deprecated as of typer 0.22.0 and
|
|
# is now a shallow wrapper that installs all of typer, so it buys nothing.
|
|
# rich therefore ships as a transitive dependency — but `rich_markup_mode=None`
|
|
# in tooling/main.py keeps it off the import path entirely (verified: `rich`
|
|
# and `pygments` are absent from sys.modules after loading the CLI).
|
|
"typer==0.27.1",
|
|
# pydantic 2.13.4 — data shapes for domain schemas (D-263). Checked clean
|
|
# against NVD + OSV (2026-08-20). PYSEC-2026-1812 / CVE-2024-3772 (email
|
|
# regex ReDoS) is fixed in 2.4.0. NOTE the 2026 SSRF advisories
|
|
# CVE-2026-25580 and CVE-2026-54249 are against *pydantic-ai*, a different
|
|
# package that is not a dependency here — do not confuse the two on the
|
|
# next sweep.
|
|
"pydantic==2.13.4",
|
|
]
|
|
|
|
[project.scripts]
|
|
# The whole point of D-263: one bare command, so one permission-rule entry
|
|
# covers every tool.
|
|
#
|
|
# `cli` is a typer.Typer instance (callable), NOT the click.Group that T-1259
|
|
# originally specified: typer vendors click as of 0.26.0, so there is no
|
|
# top-level `click` to import and no supported way to extract typer's internal
|
|
# one. Lazy domain registration therefore goes through `typer.Typer(cls=...)`
|
|
# with a TyperGroup subclass (T-1260) rather than a click Group.
|
|
reach = "tooling.main:main"
|
|
|
|
[tool.setuptools.packages.find]
|
|
# Explicit, not flat-layout auto-discovery. The repo root holds client/, server/,
|
|
# docs/, wiki/, db/ and tests/ alongside tooling/, and auto-discovery either
|
|
# errors on the ambiguity or quietly ships something unintended (T-1258).
|
|
#
|
|
# Nothing needs excluding: discovery only finds directories with an
|
|
# __init__.py. The hyphenated script trees were emptied by T-1250's per-domain
|
|
# moves rather than renamed (verified in T-1272); what still carries a hyphen
|
|
# is never imported — the three Rust crates (econ-sim, line-previewer,
|
|
# test-client) and the provenance under tooling/archive/, which has no
|
|
# __init__.py on purpose. tooling/scripts/blender/ likewise has none: its
|
|
# payloads run under Blender's Python and must not become package modules.
|
|
include = ["tooling*"]
|
|
|
|
[project.optional-dependencies]
|
|
dev = [
|
|
# ruff 0.15.9 — checked clean against NVD + OSV, no CVEs on record (2026-04-05)
|
|
"ruff==0.15.9",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 100
|
|
target-version = "py311"
|
|
# Provenance, never run (tooling/archive/README.md). Linting it produces fixes
|
|
# to code nobody should execute, and a "fixed" one-shot is no longer a faithful
|
|
# record of what actually ran.
|
|
extend-exclude = ["tooling/archive"]
|
|
|
|
[tool.ruff.lint]
|
|
# Widened from {E9, F401, F811, F821} to the full ruff-default tiers + W (T-1066).
|
|
# E4: import placement/style
|
|
# E7: statement-level pitfalls (== None, bare except, lambda assignment, ...)
|
|
# E9: runtime syntax/encoding errors
|
|
# F: all pyflakes (unused imports/names, undefined names, f-string misuse, ...)
|
|
# W: whitespace + invalid escape sequences (zero violations at adoption)
|
|
select = ["E4", "E7", "E9", "F", "W"]
|
|
# E402, E702 and F841 were ignored tree-wide at adoption (T-1066: 43/41/21
|
|
# violations). T-1274 re-enabled all three once the package existed. What
|
|
# remains is narrow and says why, per file, below — a documented exception is
|
|
# worth more than a broad silent one.
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
# Blender payloads run under Blender's bundled Python, which cannot see the
|
|
# repo venv; the ones that import helpers extend sys.path first (T-1273).
|
|
"tooling/scripts/blender/*.py" = ["E402"]
|
|
# Semicolon-paired component assignments (`rdx /= mag; rdy /= mag; ...`) are a
|
|
# deliberate style in the terrain noise and shading maths: the three axes of
|
|
# one vector read as one statement. Scoped to the files that use it.
|
|
"tooling/domains/atlas/planet/planet_simulation.py" = ["E702"]
|
|
"tooling/domains/atlas/planet/planet_renderer.py" = ["E702"]
|
|
"tooling/domains/atlas/planet/render_heightmap.py" = ["E702"]
|