[dinakarjs]

Why

#260 exposed a hash-lock/input mismatch that green tests did not detect: the installed Cedar version differed from the editable package requirement. The maintainer adopted the regenerated locks and requested the consistency gate separately.

Change

Run python -m pip check immediately after the no-deps editable package installation in CI's three environments and each corresponding release-validation job. The credential-free release mirror retains its established coverage/OIDC exceptions. The effective diff against main is still six pip-check steps in two workflows.

Validation

Refreshed onto main 1889ce4, incorporating the merged #300 dependency-audit repair. Published head 50a5e31; tree b2c9dc616e4c3472eaca9a5e001fdf91006ddbca exactly matches the locally tested tree.

On Linux/Python 3.12.14 with the branch's hash-locked development dependencies and the no-deps editable checkout: python -m pytest tests/unit -q passes 793 tests with 2 skips; Ruff, mypy, configured Bandit and dependency consistency pass. The unit selection includes the CI/release parity tests. No package publication or hardware execution.

Current-head hosted Linux/Windows matrix results and independent maintainer review remain required. Prepared with OpenAI Codex; DCO-signed.

References: #260 maintainer disposition; CONTRIBUTING.md Release validation; tests/unit/test_release_artifacts.py::test_release_validation_matches_ci.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Hosted failure diagnosis: the added pip-check step passes. The security scan then fails on the existing certifi 2026.7.22 lock (PYSEC-2026-4320; fixed version 2026.10.19), causing matrix siblings to cancel. Separate PR #265 updates only the four affected certifi lock entries and clears pip-audit locally, with 843 unit/conformance tests passing and 2 hardware skips. This PR still contains only the CI/release-parity check. It needs the dependency fix incorporated through the normal maintainer flow and a fresh complete hosted run; current cancelled checks are not passes.

[carloshvp]

Reviewed exact head f49f7ba29ae2399253a440b199ba4cd77b052ead in an isolated checkout.

Approving the dependency consistency gates. Each of CI's three environments now runs python -m pip check immediately after the no-deps editable installation, and the same three checks are included in release validation. This preserves the credential-free release mirror and its existing coverage/OIDC exceptions.

Independent validation in this exact checkout with a fresh hash-locked environment: editable installation and pip check pass; all 23 release-artifact tests pass, including the CI/release parity assertion. I inspected all six insertion points and the complete whitespace-clean diff. No runtime code, pins, workflow grants or publishing triggers change.

The failed hosted job reports the inherited certifi audit finding after the added consistency check; the cancelled jobs remain unvalidated. #265 is the separate certifi repair, and the newly reported OpenTelemetry audit finding also needs its own dependency follow-up. The commit carries DCO sign-off.

Reviewed with OpenAI Codex.

[zohebk8s]

Approving. Verified on f49f7ba.

pip check is the right check for this shape and it is in the right place. Because the package goes in with --no-deps, pip never validates that the locked environment actually satisfies the package's own metadata, so a lock that drifts from pyproject.toml installs silently and the first symptom is a confusing runtime error. This closes that. All six install sites get it, three jobs across both workflows, consistently placed after the editable install so the full environment exists when it runs.

One consequence worth stating out loud rather than discovering later. The repository already carries a deliberate exception: AGT 4.1 constrains cryptography below 49 while the runtime requires 50 or newer for published security fixes. That is only tolerable because the scanner is installed in its own isolated step. From now on, if any job installs the governance tooling into the same environment as the package under test, pip check will fail on that documented exception rather than passing quietly. I think that is the behaviour you want, but it is worth being a known consequence of this PR rather than a surprise the next time someone edits a workflow.

[rajnisht7]

@dinakarjs Kindly rebase the branch on main

[dinakarjs]

Refreshed the branch at 50a5e31 onto main 1889ce4, including merged #300, while preserving the six pip-check insertions and the existing release-validation parity. Fresh hash-locked Linux/Python 3.12.14 checks: 793 unit tests pass, 2 skip; Ruff, mypy, configured Bandit and installed dependency consistency pass. Published tree b2c9dc616e4c3472eaca9a5e001fdf91006ddbca matches the tested tree. The earlier msgpack lock is no longer carried by this head. Please review the current commit; hosted matrix and independent acceptance remain separate. Prepared with OpenAI Codex; DCO-signed.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

Hosted validation follow-up at 50a5e31: CI, Workflow lint and CodeQL now succeed. Primary run: https://github.com/agentrust-io/ca2a/actions/runs/40919954798. The earlier dependency-audit CI blocker is cleared on this head; independent maintainer review remains. No merge or publishing workflow was performed. Prepared with OpenAI Codex.