Problem
Recent automated dependency PRs changed pyproject.toml and/or requirements.txt without updating requirements-lock.txt. CI installs the lock first and then installs the editable project with --no-deps, so those green checks exercised the previous dependency rather than the proposed version. This is false acceptance evidence and makes runtime, package metadata, and security scans disagree.
Required contract
- Define the authoritative dependency inputs and generated lock outputs for runtime, web, MCP, transcription, development, and fuzz environments.
- Regenerate every affected hash lock atomically from exact pins; no hand-edited partial graph unless a reviewed emergency runbook proves why.
- Validate
pyproject.toml base dependencies and every optional extra against the corresponding installed lock closure.
- Validate exact pins in
requirements.txt, requirements-*.in, and package metadata by normalized project name and environment marker.
- Reject a PR when a direct dependency changes without all applicable locks, hashes, package extras, and runtime-version assertions changing together.
- In CI, report installed versions from import/package metadata and prove the changed dependency is the one actually exercised.
- Use binary-only installation where the supported platform contract permits it; fail closed on missing wheels rather than compiling pull-request-selected native source.
- Preserve Python 3.10–current support policy explicitly and test marker-specific closures.
- Generate a machine-readable dependency provenance manifest linking source declaration, lock entry, artifacts, hashes, interpreter/platform tags, and test lane.
- Document rollback, emergency CVE patching, Dependabot configuration, release integration, SBOM reconciliation, CSAP/SOC 2 evidence, and APA 7 primary references.
Verification
TDD must cover stale-lock PRs matching the closed FastAPI #312 and httpx2 #314 shapes, marker differences, optional extras, renamed projects, duplicate/conflicting pins, missing hashes, source distributions, and installed-version mismatch. Require 100% statement/branch coverage and public docstrings for the validator, exact-current-head CI/security/SAST, and a clean package/wheel installation outside the source tree.
Integration
The validator should be reusable from central ContextualWisdomLab/.github while retaining a repository-local, offline executable contract. It must not depend on COPILOT_GITHUB_TOKEN or alter reviewer credentials.
Problem
Recent automated dependency PRs changed
pyproject.tomland/orrequirements.txtwithout updatingrequirements-lock.txt. CI installs the lock first and then installs the editable project with--no-deps, so those green checks exercised the previous dependency rather than the proposed version. This is false acceptance evidence and makes runtime, package metadata, and security scans disagree.Required contract
pyproject.tomlbase dependencies and every optional extra against the corresponding installed lock closure.requirements.txt,requirements-*.in, and package metadata by normalized project name and environment marker.Verification
TDD must cover stale-lock PRs matching the closed FastAPI #312 and httpx2 #314 shapes, marker differences, optional extras, renamed projects, duplicate/conflicting pins, missing hashes, source distributions, and installed-version mismatch. Require 100% statement/branch coverage and public docstrings for the validator, exact-current-head CI/security/SAST, and a clean package/wheel installation outside the source tree.
Integration
The validator should be reusable from central
ContextualWisdomLab/.githubwhile retaining a repository-local, offline executable contract. It must not depend onCOPILOT_GITHUB_TOKENor alter reviewer credentials.