Repository navigation
Publish the relative-import audit fix as DepDigest 0.15.2 #49
Description
What — Publish DepDigest 0.15.2 through the reviewed staged noarch Conda route. Diego explicitly authorized the new version/tag/package publication on 2026-11-05.
How — Commit the 0.15.2 plan and release metadata, strengthen the installed gate for #47 relative-import classification and #45 license payloads, and qualify the exact final source SHA. Build one staging file with the adopted immutable v2.3.0 provider, inspect original producer receipts and archive identity/resources/license, and pass all twelve clean installed cells before tagging the same SHA. Publish GitHub Release titled exactly 0.15.2, promote the same digest-verified file, independently verify public/main index/download/clean install, documentation and Zenodo source archival.
Why — #47/#48 fixes a real consumer false positive that public 0.15.1 does not contain. #44/#45/#46 owner reviews are complete; this release must still qualify their actual distribution route. No new public API or runtime dependency change is intended.
Ownership — Provider release work belongs here; shared impact remains uibcdf/molsyssuite#166, DockingMT receiving remains uibcdf/bindingmt#19. A release-specific MolSysSuite notice will retain exact public files/digests and independent receiving limits. This does not authorize consumer dependency edits or scientific runs.
Acceptance — Exact-source matrix and policy, original staging/source/file receipts, twelve installed cells and the new adverse controls pass; stable tag/Release match the same candidate; same-byte promotion and independent public/docs/archive checks succeed; retain normalized evidence, archive the owner report and retire only task-owned resources.
Record — devguide/pending_proposals/publish_audit_fix_0.15.2.md while active; archive under completed_proposals on actual public admission.
Activity
Prepare staged 0.15.2 and guard installed audit and license contracts (…
Preserve original license bytes in Windows checkouts for 0.15.2 (#49)
dprada commentedon Nov 5, 2026
Candidate update (2026-11-05): final source is now
028f8dd8fdcdbaae4d52897deabb690383379195. The first matrix exposed Windows checkout CRLF conversion of the original LICENSE; the old run 42077818845 was canceled with four Linux passes/four Windows failures/four unexecuted macOS cells. No package was built at that old SHA. The explicit LF rule and real autocrlf regression fix the mechanism without altering the committed notice. New matrix 42079204173 has all eight Linux/Windows cells passed and all four macOS ARM64 cells queued. New CI 42079203338, policy 42079204009 and publication governance 42079204110 pass. Build/tag/publication remain pending all twelve source cells.Local preparation remains 334 passed with five unavailable sibling-integration skips, clean private prefix and twenty verified routes. The installed qualification will execute the relative-only/mixed audit and original-license guards in all twelve clean cells; no source-only check substitutes for those gates.
dprada commentedon Nov 5, 2026
Release checkpoint at 2026-11-05T18:28:19.415459+00:00: 0.15.2 is not yet published. Candidate
028f8dd8fdcdbaae4d52897deabb690383379195is clean on main and pinned inrelease/0.15.2-candidateso later documentation changes cannot silently substitute another source.Full source matrix 42079204173 still has eight successful Linux/Windows cells and four macos-15 jobs queued without runners. No source test failure remains. Exact-head CI 42079203338, policy 42079204009 and publication governance 42079204110 pass. The historical failed/canceled first candidate remains recorded separately. The local watch may be stopped while the native GitHub run continues; no remote source cell is canceled at this checkpoint.
No 0.15.2 tag, Release or staging/public package has been created. Next action after all twelve source cells pass: dispatch the existing staging producer at the pinned candidate ref with exact SHA/version/build 0, retain original archive/receipts/digest, then require the twelve installed cells before tag/Release/same-file promotion. Public receiving, deployed docs, Zenodo verification and the central release-specific notice remain pending. Existing 0.15.1 bytes/DOI and consumer pins remain untouched.
Task-owned
/tmp/depdigest-0152-1zgj83kwis retained intentionally for continuation: state.json, CONTINUE.md, clean private SDK/test prefix, source/preflight/mutation and queue receipts, and immutable-source archive/public-check helpers. Reassess on continuation and retire after final qualification/closeout; no shared environment or sibling worktree was modified. CI queue coordination: uibcdf/molsyssuite#39 (bounded public observation, not a quota diagnosis). Publication authorization remains the human request recorded here; no new approval is needed for its remaining steps.dprada commentedon Nov 5, 2026
Source qualification is complete: all twelve source cells at 028f8dd passed, with policy, CI and publication governance. Native Darwin ARM64 execution and required job/step identities were independently checked.
Original staging producer 42110739688 succeeded and uploaded one
noarch/depdigest-0.15.2-py_0.tar.bz2, 32908 bytes, SHA-256 1da96487be3c1eb870701ee53b97a6341e30a6700a75c6eef5468e9f14dc579c. Original route/event/native-source receipts, independent registry/staging download, noarch/version/dependency/resources and SPDX/original-license checks agree. The producer uses immutable v2.3.0 87c70b1443d5f22d738ee3ddf812bdbe0152f6c2; no rebuild or public-main promotion occurred.Exact-file installed qualification 42111520771 is dispatched and awaits its producer-verification job, followed by twelve clean installs. No installed success is inferred yet. Tag/Release/public-main/package receiving/docs/archival remain pending those gates. Release-specific central notice: MolSysSuite #170. This advances the earlier runner-queue checkpoint; original failed/canceled preparations retain their own outcomes.
dprada commentedon Nov 5, 2026
Checkpoint 2026-11-05T21:35:57.272811+00:00: original staging file and source qualification are complete; 0.15.2 is not public main and no tag/Release has been created.
Do not dispatch/rebuild staging again. Continue by inspecting the existing installed run and requiring its producer plus all twelve native installed jobs/steps at the original source/file identity. Then perform the already authorized immutable tag/Release (title exactly 0.15.2), same-byte promotion, independent public/main index/download/fresh install, docs and Zenodo gates. Public dependencies are prepared in a fresh private public-env with no DepDigest yet; product installation waits until promotion, with a new public-pkgs cache. Central release notice MolSysSuite #170 currently records staging only. Consumer receiving remains separate.
Task workspace /tmp/depdigest-0152-1zgj83kw is intentionally retained while the release is active. state.json and CONTINUE.md now start at the installed gate and contain all exact identities; original staging-evidence and immutable-source inspection/public receiving helpers are retained. Review resources on continuation and retire them after verified closeout. No shared environment, sibling worktree or foreign workflow was modified. Native GitHub work continues independently; stopping a local observer does not cancel it. Publication authorization persists; no new approval is needed for the remaining steps.
dprada commentedon Nov 5, 2026
All twelve exact-file installed cells and the original producer gate passed in run 42111520771. Independently checked native required jobs/steps, immutable candidate, run title and original file SHA-256; retained native evidence locally for the normalized release receipt. A sampled macOS installed solve reports osx-arm64.
Annotated tag 0.15.2 is now public at 028f8dd (tag object af50c9ab32ec81c4df45cc33ac3aa23aef645826). Tag policy 42130874032 is pending. Release publication, same-file promotion, independent public install, deployed docs and source archival remain pending. No rebuild/reupload is planned.
dprada commentedon Nov 6, 2026
Publication proceeds under the committed exact-candidate plan: required native source matrix 42079204173, source policy 42079204009 and exact-file installed 42111520771 all pass, with all required native jobs/steps independently reverified immediately before publication. The candidate, dependency/build/resource inputs and staged archive are unchanged.
The additional tag-triggered policy run 42130874032 is still queued/unassigned; it is not reported as passed. The plan does not require a second successful invocation on the same commit after tagging. The new tag identity and remote annotated target are independently verified, and the exact official policy-v1.5.4 operation (provider e459ea0e8ac6aa8017e17a2f171c50d122b9e0b7) passes locally including the new tag; the same required Ruff 0.16.5 lint/format operations pass. No source/installed/platform gate is waived. This corrects the earlier unnecessary extra waiting condition. The hosted tag job remains active for its own eventual result.
The prepared stable Release will now be published; same-file Conda promotion and independent public/archive checks remain separate subsequent gates. Normalized evidence retains this decision and the actual pending hosted state.
dprada commentedon Nov 6, 2026
Stable GitHub Release 0.15.2, ID 435912048, published at 2026-11-06T00:00:41Z, retains exact title/tag/target and original archive identity. Independent Zenodo source snapshot https://doi.org/10.5281/zenodo.23991553 and its ZIP bytes/inventory are verified: 527861 bytes, MD5 e0da2b6e424394878673e314492bfbc8; five key source files match immutable candidate bytes. This is source archival only.
Original same-file promotion 42133713911 remains queued without a Linux runner. Release selector 42133649968 was canceled before execution because this committed staged route makes it a redundant no-op, while its same-version concurrency lock was holding promotion pending. Cancellation completed, releasing the lock; this is not a qualification pass. Promotion independently rechecks the committed route and all required source/installed gates before touching labels. No duplicate dispatch, rebuild/reupload, foreign-run cancellation or immutable-tag change occurred.
Package public main/index/download/clean installation and deployed docs remain pending; release work stays open. Required source and exact-file installed matrices are complete; the earlier prepublication decision retains the additional hosted tag-policy run as pending rather than success. Normalized source/producer/installed/tag/Release/archive evidence and clean private receiving tools are retained under owner #49 until actual delivery closeout.
dprada commentedon Nov 6, 2026
Public Conda delivery is now independently verified: original promotion42133713911 succeeded, main registry and solver index agree, canonical public download matches all original staging bytes (32908bytes/SHA256 1da96487be3c1eb870701ee53b97a6341e30a6700a75c6eef5468e9f14dc579c). A fresh public-only Python3.14.10/SMonitor0.16.0py_1 prefix passes exact-file/provenance/version/resources/CLI/maintained contracts/relative-audit/SPDX/original-license checks, and pip check is clean. Source and installed twelve-cell scopes remain distinct from full installed pytest or consumer science.
Release0.15.2 and source-only Zenodo DOI10.5281/zenodo.23991553 are public and verified. Docs workflow42133650004 succeeds, but GitHub Pages still builds commit70397d2b936a5fa6b2d8a8d962d70cf2c8e41c24 and the actual audit page still renders0.15.1. Retaining that pending deployed-content check and final normalized documentary closeout here; no false deployed0.15.2 claim. Consumer receiving remains with its owners.
Record public 0.15.2 delivery and pending Pages propagation (#49)
dprada commentedon Nov 6, 2026
All three checks for documentary main commit
2f6faa8fa8f36ee07e5df8018463ad8321089141are now completed successfully: CI42139870550, publication governance42139871343 and policy42139871483. Native exact source/event/jobs and successful steps are retained; the clone remains clean and pushed.The effective Pages run42136997013 is now identified at generated gh-pages commit
70397d2b936a5fa6b2d8a8d962d70cf2c8e41c24. GHR-first/native inspection shows build127627579959 and report-build-status127640116900 succeeded; only deploy127640116909 is queued on ubuntu-latest without an assigned runner. Pending-deployments is empty, so no environment approval is requested. Native Pages API still reports building and the actual canonical audit page still serves0.15.1.No duplicate build was requested: GitHub documents that a second request waits behind an active build. No code failure or exact infrastructure/quota cause is established. Package main delivery, installed verification, Release and source-only Zenodo are already complete. This issue retains actual deployed-content verification and final documentary/resource closeout.
Complete 0.15.2 deployed docs and release closeout (#49)
dprada commentedon Nov 6, 2026
Publication 0.15.2 is complete and independently verified: source and exact-file installed twelve-cell matrices, immutable tag/Release, original same-byte Conda promotion, public main registry/solver index/download, fresh public-only installation with clean pip check, actual served 0.15.2 audit documentation, and source-only Zenodo DOI10.5281/zenodo.23991553. Consumer/scientific receiving remains separately owned.
Final documentary main is
032d345becf8f8f574c24ede61ee62fcf0321de7, pushed and locally clean. Archived owning report, normalized release receipt, and actual resource-retirement receipt retain history, identities and boundaries. Both private Conda prefixes were removed through the manager, then the exact owned temporary root and candidate branch were removed; shared environments, primary editable metadata and public/historical identities are preserved.Final changed-scope local checks pass: six reporting guards, generated indexes, exact pinned policy conformance, Ruff lint/format and diff checks. All three hosted checks on the preceding documentary commit2f6faa8 also passed. The final documentation-only push is unskipped; its current checks are recorded separately, without claiming pending jobs passed:
These post-closeout documentary checks are not missing release-candidate/platform/file gates; those are complete. Recovery owner remains this issue: inspect their terminal exact-source jobs/steps, and reopen #49 for a failed documentary guard or other closeout regression. No artifact rebuild/reupload/tag move follows from that check. Public-provider receiving notices are delivered to MolSysSuite#166, release notice#170 and DockingMT#19. This closes provider publication; it changes no consumer pin or scientific implementation.