open/llm-ingestion-okf
1
0
Fork 0
Code Issues Releases 1 Activity

build(deps): move the guard pin from >=0.3,<0.4 to >=1.2,<2.0

Browse source 
The operator's condition for revisiting the pin was met (v1.2.0 contains
the flow-mapping frontmatter fix, commit 5870483) and the operator has now
approved the move itself, dispatched as its own order because it changes
consumer-visible Requires-Dist and shifts golden-fixture admission.

Floor 1.2: this library needs the flow-mapping support (`generated: { by:
x, at: y }`) that landed there — without it Door C fail-secures every
concept carrying that stamp. Ceiling <2.0, not narrower: the guard's own
1.0.0 release freezes its exported surface until a 2.0.0, and explicitly
keeps calibration (severities, dispositions) free to move within 1.x, so a
tighter ceiling here would claim a stability guarantee neither side needs.

Re-measured through Door C against the guard's own default
(allow_reserved=True, matching how the earlier recommendation measured
it), over the 9 concept documents across all four Door-A goldens:
4/9 admitted at 0.3.4 -> 8/9 admitted at 1.2.0, confirming the number
already reported. The ninth (a `sources` block-list carrying `resource`)
stays refused by design (G30) and is not expected to move.

Failing-test-first: test_guard_adapter.py::test_guard_version_is_inside_the_pin
and test_packaging.py::test_the_only_runtime_dependency_is_the_security_boundary
were updated to the new pin first and confirmed red against the
still-installed 0.3.4, then `uv sync --extra extract` installed 1.2.0 and
both went green. Full suite (615), ruff and mypy --strict clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RxcxzNwpX1kDP53n1rLhM5
This commit is contained in:
Kjell Tore Guttormsen 2026-08-23 21:05:18 +02:00
commit e60f7261a1
8 changed files with 37 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tests/test_guard_adapter.py
View file

@ -58,11 +58,17 @@ def _snapshot(directory: Path) -> dict[str, bytes]:
def test_guard_version_is_inside_the_pin() -> None:
"""The pin is `>=0.3,<0.4`; a version outside it invalidates every
"""The pin is `>=1.2,<2.0`; a version outside it invalidates every
by-value comparison below and must fail loudly rather than be discovered
through a mis-branched verdict."""
through a mis-branched verdict. The floor is 1.2, not the freeze at 1.0,
because this library relies on the flow-mapping frontmatter support that
landed in 1.2.0; the ceiling is 2.0 because the guard's own 1.0.0 release
promises no exported name is removed, renamed or given a different
meaning short of a 2.0.0 — calibration (severities, dispositions) moves
freely within 1.x by that same promise, so pinning past minor 2 here
would be tighter than the guarantee it rests on."""
major, minor = (int(part) for part in guard.__version__.split(".")[:2])
assert (major, minor) == (0, 3), guard.__version__
assert major == 1 and minor >= 2, guard.__version__
def test_guard_screen_output_signature_is_what_door_b_calls() -> None:

2
tests/test_packaging.py
View file

@ -31,7 +31,7 @@ def test_the_only_runtime_dependency_is_the_security_boundary() -> None:
"""
tomllib = pytest.importorskip("tomllib") # stdlib from 3.11; the pin holds on 3.10 too
pyproject = tomllib.loads((PROJECT_ROOT / "pyproject.toml").read_text(encoding="utf-8"))
assert pyproject["project"]["dependencies"] == ["llm-ingestion-guard>=0.3,<0.4"]
assert pyproject["project"]["dependencies"] == ["llm-ingestion-guard>=1.2,<2.0"]
def test_the_declared_version_agrees_with_the_packaged_one() -> None: