@ai-ecoverse/slicc-bios 1.27.0 → 1.28.0

package/README.md

@@ -181,8 +181,8 @@ Below the system rows, Install / Update offers **Optional packages** (spectrum
 - **Readable by everyone:** after every pnpm install of `/opt/agent`, `/opt/grammars` and an optional project in `/opt/slicc`, bios makes that tree readable by everyone, as root: one `find` selects the files without `a+r`, the executables without `a+x` and the directories without `a+x`, and runs `chmod a+rX` on only those, so a tree of 15,000 entries with one `0600` file pays for one walk and one `chmod`, not 15,000. pnpm writes some files `0600`, such as `node_modules/.pnpm-workspace-state-v1.json`, and with kernel users every user must be able to read seven's installed packages. An install from before this runs the same pass once at its next check, marked by `var/lib/slicc/<project>/readable`.
 - **Failures** lead with one sentence and keep pnpm's output, starting with the package and version, under *Install log*, with **Retry**.
 - **Withdrawn and kept as exceptions** (homescoop#858/#859, #864): uv, esbuild, tsc and buf are withdrawn until attested rebuilds. They're retired rows (*No longer offered*, with Remove for an earlier install), and their certs lines are gone. Instead, use `pip` for uv's work for now (uv returns as `@ai-ecoverse/wasi-uv`, Astral's uv, once that's certified), and install esbuild and typescript straight from npm with `pnpm add -g`; buf has no stand-in. **git** and **gh** stay as recorded supply-chain exceptions until their attested rebuilds: their `certs.json` entries carry an `exception` field, which `pins.test.mjs` lists, and any other uncertified pin still fails it.
-- **Python data tools are back** as homescoop's attested CI builds (A3, A4): py-numpy 2.3.2-12, py-pandas 2.3.2-12 and py-matplotlib 3.11.2-10, with contourpy, kiwisolver, pillow and their pure dependencies, on the catalog's Python 3.14.2-28. They replace the withdrawn builds (homescoop#826, #730): no py-numpy 2.3.2-4 to -10 or py-pandas 2.3.2-5 to -11 is certified, and an install from before the withdrawal (version 2026.10.12) shows as outdated, with **Update**. numpy 2.3.2-12 has homescoop#1082's fix: `numpy.linalg` raises `LinAlgError` on a singular matrix instead of returning NaN. **scipy is not back yet:** its build isn't attested, so the project leaves it out and `certs.json` has no scipy line.
-- **Project entries** (`kind: "project"`): **Python data tools** (numpy, pandas and matplotlib, about 160 MB on disk) can't be a global add. pnpm 12 gives each global add its own isolated project, so every py-* package would carry its own Python (about 1 GB in total), and Python wouldn't find the packages. So the entry is a pnpm project of its own in [`src/packages/optional/projects/pydata/`](src/packages/optional/projects/pydata/), which locks one numpy and no Python of its own:
+- **Python data tools are back** as homescoop's attested CI builds (A3, A4): py-numpy 2.3.2-12, py-pandas 2.3.2-12 and py-matplotlib 3.11.2-10, with contourpy, kiwisolver, pillow and their pure dependencies, on the catalog's Python 3.14.2-28. They replace the withdrawn builds (homescoop#826, #730): no py-numpy 2.3.2-4 to -10 or py-pandas 2.3.2-5 to -11 is certified, and an install from before the withdrawal (version 2026.10.12) shows as outdated, with **Update**. numpy 2.3.2-12 has homescoop#1082's fix: `numpy.linalg` raises `LinAlgError` on a singular matrix instead of returning NaN. **scipy is back too:** py-scipy 1.18.1-1, an attested CI build (homescoop#1238) against the same numpy 2.3.2-12, with static OpenBLAS. Every scipy module loads except the deprecated `scipy.odr`, which needs Fortran, so `import scipy.odr` fails. The project's version is now 2026.10.19, so an install without scipy shows as outdated, with **Update**.
+- **Project entries** (`kind: "project"`): **Python data tools** (numpy, pandas, matplotlib and scipy, about 240 MB on disk) can't be a global add. pnpm 12 gives each global add its own isolated project, so every py-* package would carry its own Python (about 1 GB in total), and Python wouldn't find the packages. So the entry is a pnpm project of its own in [`src/packages/optional/projects/pydata/`](src/packages/optional/projects/pydata/), which locks one numpy and no Python of its own:
   - **Install:** bios writes the project to `/opt/slicc/pydata` and installs it with `pnpm install --frozen-lockfile`, so pnpm checks every integrity against the lockfile bios ships. Its `pnpm-workspace.yaml` overrides `@ai-ecoverse/wasix-python` to nothing, and the entry `requires` the catalog's Python, which runs it.
   - **How Python finds it:** bios writes `/opt/slicc/python/slicc-pydata.pth`, which lists each package's site-packages (from its `slicc.python.sitePackages`), next to a `sitecustomize.py` that adds that folder as a site directory. The page's kernel puts `/opt/slicc/python` on every process's `PYTHONPATH`, so `python3` imports the packages from any shell or agent, as any user. Python's own discovery only looks in its own project, so the `.pth` stays. A `.pth` that an earlier version wrote to `/root/.local` is moved there the next time the optional packages are listed. The kernel's environment reaches every process, whichever client or user starts it, `sudo` included. `python -I` and `python -E` ignore `PYTHONPATH`, so they don't see the data tools; that's a known gap.
   - **State and Remove:** a receipt in `var/lib/slicc/optional/pydata/` records the installed version. **Remove** deletes the project, the `.pth` and the receipt. A project that `retired.json` lists still shows while it's installed, with only **Remove**.
@@ -493,7 +493,7 @@ Limits:
 [`renovate.json`](renovate.json) bumps every `@ai-ecoverse/*` pin in the base set (`src/packages/package.json`), the optional catalog (`src/packages/optional/package.json`) and `/opt/agent` (`src/packages/agent/package.json`), with their npm and pnpm lockfiles.
 
 - **PRs:** homescoop's packages (`wasi-*`, `wasix-*`, `wasm-*`, `py-*`, `wasi-pnpm` included) come as one PR a day, between 00:00 and 06:00 UTC. The kernel (its base-set and `/opt/agent` pins together), slicc-cdp, slicc-agent, slicc-spectrum and slicc-jsh each get their own PR, and so does every other package. The grammars and Tailscale projects stay on the dependency dashboard.
-- **Automerge only when certified:** Renovate turns on auto-merge, so a PR goes through the merge queue once `ci / test` is green. On a Renovate PR, `ci / test` ends with [`scripts/ci/certified.mjs`](scripts/ci/certified.mjs). It fails unless, for each `@ai-ecoverse` pin the PR changes in those three files, the latest cert review comment that names it (posted by `github-actions[bot]`, with `sha check ok`) has its `certified` line. Its verdict line is `cert-gate: CERTIFIED …`, `cert-gate: FAIL …` or `cert-gate: PASS <why it doesn't apply>`. So the first CI run of such a PR is red.
+- **Automerge only when certified:** Renovate turns on auto-merge, so a PR goes through the merge queue once `ci / test` is green. `ci / test` ends with [`scripts/ci/certified.mjs`](scripts/ci/certified.mjs), on every PR. On a Renovate PR it checks each `@ai-ecoverse` pin the PR changes in those three files. On any other PR it checks each gated pin (`scripts/cert/apply.mjs`'s `GATED`: slicc-kernel, slicc-cdp, slicc-clipboard, slicc-jsh, mcpcat, `wasi-*`, `wasix-*`, `wasm-*`, `py-*`) the PR changes in those files, `src/packages/tailscale/package.json` or `src/packages/grammars/package.json`, so a hand-made pin needs the `cert-review` label. Cert review never runs fork code, so a fork's gated pin change has to come from a branch of this repository, and the gate says so. The gate fails unless, for each such pin, the latest cert review comment that names it (posted by `github-actions[bot]`, with `sha check ok`) has its `certified` line. Its verdict line is `cert-gate: CERTIFIED …`, `cert-gate: FAIL …` or `cert-gate: PASS <why it doesn't apply>`. So the first CI run of such a PR is red.
 - **Then cert review** (the `workflow_run` after CI) writes its verdict. After a certified verdict, its `cert / queue` job runs [`scripts/cert/apply.mjs`](scripts/cert/apply.mjs) from the base, which runs no code from the PR. That script runs the sha check again and adds each certified `certs.json:` line for a gated package that the PR's lockfiles pin with that integrity. The job commits the lines to the Renovate branch as `github-actions[bot]`, whose email is in `gitIgnoredAuthors`, so Renovate keeps rebasing the branch. Then it dispatches CI on it (`workflow_dispatch` with `pr`), since a push with `GITHUB_TOKEN` starts no workflow. That run's `ci / test` counts for the PR's head, and the queue takes it from there.
 - **Known breaks** are `packageRules` with `allowedVersions`, each with its reason and issue in `description`: wasm-bash stays below 5.3.0-20 until a kernel with slicc-kernel#1146 is pinned, and wasi-pnpm skips the deprecated 12.9.1-11 and 12.9.1-12 (homescoop#1128). `test/integration/renovate.test.mjs` checks the config, the gate and the queue in plain node.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/certs.json

@@ -79,6 +79,10 @@
     "integrity": "sha512-9MSaqY1ib8QPFsJsdgHVbmefztHru1q9EGoBEVq3jrcLRDWEIl5d2nFGgM5f6kVxzuAbVnOwrznY1yV1HjBLJQ==",
     "sha256": "2810813bb5d90244ace25068ccc9fe97cee4695bee154fbbf3086b0d409dd5a8"
   },
+  "@ai-ecoverse/py-scipy@1.18.1-1": {
+    "integrity": "sha512-cTMwklMN+Y0LgPyZvlfSEElzkkgP1fkrSGQGs3d3TOeATJmuP7CEBjpJBgkXOn1BFWsFUY6s2jPOaJKc3s9Thg==",
+    "sha256": "656cdceb2c122caf491e55a926195163b27750219de0c92f7379784a4a0488b2"
+  },
   "@ai-ecoverse/py-six@1.17.0-2": {
     "integrity": "sha512-BNEgSp4l+y5dhmvKqqId7TO2Krchq/uw5vg/Q6bB6UKj+dfmr8ad42vGs4VFzTCnmqpGSgNRVg+TYeRi50t3yg==",
     "sha256": "53fd2ac9ba87baebe147fdfcbdd0ea0af9498f725d0d3702d960a209722779cc"

package/src/packages/optional/catalog.json

@@ -38,10 +38,10 @@
     "id": "pydata",
     "kind": "project",
     "label": "Python data tools",
-    "description": "numpy, pandas and matplotlib for Python, about 160 MB on disk.",
+    "description": "numpy, pandas, matplotlib and scipy for Python, about 240 MB on disk. scipy lacks only the deprecated scipy.odr.",
     "commands": [],
     "requires": ["python"],
-    "size": 46014414
+    "size": 67796756
   },
   "@ai-ecoverse/slicc-jsh": {
     "id": "node",