cmpnd 0.8.2__tar.gz → 0.8.4__tar.gz

{cmpnd-0.8.2 → cmpnd-0.8.4}/CLAUDE.md

@@ -4,20 +4,27 @@ Part of the CMPND monorepo. See `../CLAUDE.md` for cross-cutting rules (hash arc
 
 ## This code is released publicly — no private references
 
-Unlike the rest of the monorepo (private), the `cmpnd` package ships to PyPI:
-`python-sdk/cmpnd/**` is **public source**. Anything written there is
-world-readable in the published wheel. So **never put private information in the
-shipped package** — no internal issue-tracker IDs (`CMP-…`), internal URLs or
-dashboards, customer/org names, infra hostnames, or secrets — and that includes
-comments, docstrings, `--help`/CLI strings, error messages, and log lines, not
-just code. Reference an internal ticket in the **commit message or PR
-description** (those live in the private repo), never in the source that ships.
-
-This applies only to the shipped package (`python-sdk/cmpnd/`). Tests
-(`python-sdk/tests/`), `docs/`, and `docs/plans/` are not published in the
+Unlike the rest of the monorepo (private), this component ships to PyPI:
+`python-sdk/cmpnd/**` and `python-sdk/ingest/cmpnd_ingest/**` are **public
+source**. Anything written there is world-readable in a published wheel. So
+**never put private information in shipped source** — no internal issue-tracker
+IDs (`CMP-…`), internal URLs or dashboards, customer/org names, infra hostnames,
+or secrets — and that includes comments, docstrings, `--help`/CLI strings, error
+messages, and log lines, not just code. Reference an internal ticket in the
+**commit message or PR description** (those live in the private repo), never in
+the source that ships.
+
+The test is not which directory a file sits in but **whether a wheel carries
+it**. `ingest/cmpnd_ingest` is published twice over: as the `cmpnd-ingest`
+distribution built from `ingest/pyproject.toml`, and inside the `cmpnd` wheel,
+which *bundles* rather than depends on it (`[tool.hatch.build.targets.wheel]`
+`packages`). A directory that is not `cmpnd/` is therefore not exempt — if a
+future distribution is added here, it inherits this rule on the same test.
+
+Tests (`python-sdk/tests/`), `docs/`, and `docs/plans/` are not published in any
 wheel, but prefer keeping issue IDs out of docstrings you might later move into
-the package. When you cite prior work in shipped code, describe the behavior,
-not the ticket.
+a shipped package. When you cite prior work in shipped code, describe the
+behavior, not the ticket.
 
 ## Documentation discipline (docs are as-built, updated in the same commit)
 
@@ -45,8 +52,40 @@ uv run ruff check .                      # lint
 uv run ruff format --check .             # format check
 ```
 
+## Two packages, one published distribution
+
+`cmpnd` (`cmpnd/`) is the SDK. `cmpnd_ingest` (`ingest/cmpnd_ingest/`) is the
+ingest transport — `exporter_http.py`, `retry.py`, and the `Protocol`s stating
+what a producer's records must look like. `cmpnd` re-exports it, so
+`cmpnd.exporter_http` and `cmpnd.retry` are the *same module objects* as
+`cmpnd_ingest.exporter_http` and `cmpnd_ingest.retry` (a `sys.modules` rebinding,
+not a copy — see the reasoning at the top of `cmpnd/exporter_http.py`).
+
+The transport sits under its own directory, with its own `pyproject.toml`
+(`cmpnd-ingest`), so a producer that is not a DSPy program can install it without
+dspy: its entire dependency set is httpx. The wasm plane's native GEPA child
+(`worker-wasm/optimizer/`) is that producer, and a venv unable to supply dspy is
+what enforces its boundary. `ingest/README.md` has the full argument.
+
+What that costs you, before touching either pyproject:
+
+- **`cmpnd-ingest` is never published, and `cmpnd` must never depend on it.** A
+  `dependencies` entry would be a hard requirement on a name PyPI does not
+  carry — a `tool.uv.sources` entry does not travel in package metadata, so a
+  user's `pip install cmpnd` would see only the requirement. Instead `cmpnd`'s
+  wheel and sdist *carry* `cmpnd_ingest` (`[tool.hatch.build.targets.wheel]
+  packages`), so installing `cmpnd` by any means — pip or uv, wheel, sdist or
+  source tree — supplies the transport.
+- **Consume it by path, and never alongside `cmpnd`.** Both distributions
+  provide the `cmpnd_ingest` package, so a venv holding both has two copies of
+  the transport's files and the winner is whichever was written last. A venv
+  installs `cmpnd` *or* `cmpnd-ingest` — `worker-wasm/optimizer/` is the only
+  consumer of the latter.
+
 ## Key Files
 
+- `ingest/cmpnd_ingest/exporter_http.py` - The ingest transport (`cmpnd.exporter_http`)
+- `ingest/cmpnd_ingest/retry.py` - The retryable-error contract's client half (`cmpnd.retry`)
 - `cmpnd/identity.py` - Unified hash computations (xxhash, SHA256)
 - `cmpnd/ir/` - Structural program-identity IR (algebra, encoder, hash, reflector)
 - `cmpnd/callback.py` - DSPy instrumentation, signature extraction
@@ -130,4 +169,4 @@ When you touch a handler:
 
 ## Release
 
-Tag-free. Bump `[project] version` in `pyproject.toml` (`uv version --bump {minor,patch}` or by hand), open a PR, merge to `main`. A change to that version on `main` triggers `.github/workflows/release-sdk.yml`, which publishes to PyPI only when the version is new (build → TestPyPI → PyPI); a merge that doesn't bump the version no-ops. Runtime `cmpnd.__version__` reads installed metadata. Full flow: [`docs/releasing.md`](../docs/releasing.md) Part 3 and `docs/plans/2026-07-02-sdk-pypi-tag-free-publish.md`.
+Tag-free. Bump `[project] version` in `pyproject.toml` (`uv version --bump {minor,patch}` or by hand), open a PR, merge to `main`. A change to that version on `main` triggers `.github/workflows/release-sdk.yml`, which publishes to PyPI only when the version is new (build → TestPyPI → PyPI); a merge that doesn't bump the version no-ops. `cmpnd` is the only distribution that ships from here — the transport rides inside its wheel, and `ingest/pyproject.toml`'s version names nothing on any index. Runtime `cmpnd.__version__` reads installed metadata. Full flow: [`docs/releasing.md`](../docs/releasing.md) Part 3 and `docs/plans/2026-07-02-sdk-pypi-tag-free-publish.md`.

{cmpnd-0.8.2 → cmpnd-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmpnd
-Version: 0.8.2
+Version: 0.8.4
 Summary: DSPy observability and deployment SDK for cmpnd
 Project-URL: Homepage, https://cmpnd.ai
 Author-email: cmpnd <hello@cmpnd.ai>

{cmpnd-0.8.2 → cmpnd-0.8.4}/cmpnd/_gepa_patch.py

@@ -149,12 +149,16 @@ def patch_gepa() -> None:
 
                 trk.capture_compiled_program(result)
 
-                # Tag compiled program with optimization run ID
+                trk.finalize()
+
+                # Tag compiled program with optimization run ID. **After finalize**,
+                # because that is the last point at which the run can acquire one: a
+                # tracker that never start()ed reserves its id on the terminal flush,
+                # and tagging first would stamp the program with "None" for a run that
+                # does exist — breaking the link this tag is here to create.
                 if hasattr(result, "__dict__"):
                     result._optimization_run_id = str(trk.optimization_run_id)
 
-                trk.finalize()
-
             return result
 
         # `BaseException`, because the invariant does not get to have an exception: a

{cmpnd-0.8.2 → cmpnd-0.8.4}/cmpnd/cli/commands/admin.py

@@ -116,6 +116,10 @@ def _register_user(sub: _SubParsersAction[ArgumentParser]) -> None:
     enable.add_argument("id", help="User id")
     enable.set_defaults(func=handle_user_enable)
 
+    delete = usub.add_parser("delete", help="Hard-delete a disabled user (disable it first)")
+    delete.add_argument("id", help="User id")
+    delete.set_defaults(func=handle_user_delete)
+
     reset_password = usub.add_parser("reset-password", help="Set a user's password")
     reset_password.add_argument("id", help="User id")
     reset_password.add_argument("--password", required=True, help="New password")
@@ -247,6 +251,14 @@ def handle_user_enable(client: api_client.ApiClient, args: Any) -> Any:
     return {"enabled": args.id}
 
 
+def handle_user_delete(client: api_client.ApiClient, args: Any) -> Any:
+    # Hard-delete via the JSON API (the teardown primitive for the e2e suite).
+    # Disabled-first is enforced server-side: disable the account before delete.
+    # 204 No Content → delete() returns None; synthesize a confirmation.
+    client.delete(f"/api/v1/admin/users/{args.id}")
+    return {"deleted": args.id}
+
+
 def handle_user_reset_password(client: api_client.ApiClient, args: Any) -> Any:
     client.post(f"/api/v1/admin/users/{args.id}/reset-password", json={"password": args.password})
     return {"password_reset": args.id}

{cmpnd-0.8.2 → cmpnd-0.8.4}/cmpnd/cli/commands/evals.py

@@ -26,10 +26,14 @@ def register(subparsers: _SubParsersAction[ArgumentParser]) -> None:
 
 
 def handle_search(client: api_client.ApiClient, args: Any) -> Any:
-    body: dict[str, Any] = {"page": args.page, "per_page": args.per_page}
+    # The right-hand names are the API's, and they are not all the flag's name:
+    # `--per-page` posts page_size and `--metric` posts metric. An unread key
+    # raises no error on either side of the wire, so both flags silently did
+    # nothing while the mapping disagreed.
+    body: dict[str, Any] = {"page": args.page, "page_size": args.per_page}
     for attr, key in [
         ("program_name", "program_name"),
-        ("metric_name", "metric_name"),
+        ("metric_name", "metric"),
         ("status", "status"),
     ]:
         val = getattr(args, attr, None)

{cmpnd-0.8.2 → cmpnd-0.8.4}/cmpnd/cli/commands/top.py

@@ -200,7 +200,10 @@ def _hint_traces_search(deployment_id: str) -> str:
         # in the REPL fetches and prints `<Registry n=...>`; tab-completion
         # under it enumerates traces.
         return f"deps.{_attr_name(deployment_id)}.traces"
-    return f"cmpnd traces search --deployment {short}"
+    # --all, because the count this hint sits under was itself computed over all
+    # history: without it the suggested command searches only the route's
+    # default window and would print a smaller number than the one above it.
+    return f"cmpnd traces search --all --deployment {short}"
 
 
 # --------------------------------------------------------------------------
@@ -496,8 +499,11 @@ def _print_trace_summary(client: api_client.ApiClient, deployment_id: str) -> No
     """
     try:
         resp = client.post(
+            # all_time: a deployment's traces are interesting however old the
+            # deployment is, and the route otherwise applies a default window
+            # that would report 0 for anything last run a while ago.
             "/api/v1/traces/search",
-            json={"deployment_id": deployment_id, "per_page": 1},
+            json={"deployment_id": deployment_id, "page_size": 1, "all_time": True},
         )
     except api_client.CliError as exc:
         print(_c(f"Traces: (lookup failed: {exc})", "dim"))

{cmpnd-0.8.2 → cmpnd-0.8.4}/cmpnd/cli/commands/traces.py

@@ -3,9 +3,11 @@
 from __future__ import annotations
 
 import json
+import re
 import sys
 import time
 from argparse import ArgumentParser, _SubParsersAction
+from datetime import datetime, timedelta, timezone
 from typing import Any
 
 from .. import api_client, trace_render
@@ -26,8 +28,24 @@ def register(subparsers: _SubParsersAction[ArgumentParser]) -> None:
         action="append",
         help="Filter by project tag (the sidebar 'Tags' filter); repeat for any-of",
     )
-    search.add_argument("--from", dest="start_time_from", help="Start time from (ISO 8601)")
-    search.add_argument("--to", dest="start_time_to", help="Start time to (ISO 8601)")
+    search.add_argument(
+        "--from",
+        dest="start_time_from",
+        help="Earliest start time: ISO 8601, or a duration back from now (30d, 2w, 12h, 90m). "
+        "Without it the server applies its own default window",
+    )
+    search.add_argument(
+        "--to",
+        dest="start_time_to",
+        help="Latest start time: ISO 8601, or a duration back from now (see --from). "
+        "Requires --from (or --all): the server refuses an upper bound on its own",
+    )
+    search.add_argument(
+        "--all",
+        dest="all_time",
+        action="store_true",
+        help="Search all retained history instead of the default window (cannot be combined with --from/--to)",
+    )
     search.add_argument("--page", type=int, default=1)
     search.add_argument("--per-page", type=int, default=50)
     search.set_defaults(func=handle_search)
@@ -57,8 +75,49 @@ def register(subparsers: _SubParsersAction[ArgumentParser]) -> None:
     follow.set_defaults(func=handle_follow)
 
 
+_RELATIVE_TIME = re.compile(r"^(\d+)([mhdw])$")
+
+_RELATIVE_UNITS = {
+    "m": "minutes",
+    "h": "hours",
+    "d": "days",
+    "w": "weeks",
+}
+
+
+def resolve_search_time(value: str) -> str:
+    """Resolve a search bound to an ISO 8601 timestamp.
+
+    A duration (``30d``, ``2w``, ``12h``, ``90m``) means that far back from now;
+    anything else passes through for the server to parse. The sugar lives here
+    rather than in the API so the wire stays timestamp-only — one grammar for
+    every client, resolved once at the edge that knows what "now" means to the
+    user.
+    """
+    m = _RELATIVE_TIME.match(value.strip())
+    if not m:
+        return value
+    amount, unit = int(m.group(1)), m.group(2)
+    when = datetime.now(timezone.utc) - timedelta(**{_RELATIVE_UNITS[unit]: amount})
+    return when.replace(microsecond=0).isoformat().replace("+00:00", "Z")
+
+
 def handle_search(client: api_client.ApiClient, args: Any) -> Any:
-    body: dict[str, Any] = {"page": args.page, "per_page": args.per_page}
+    all_time = bool(getattr(args, "all_time", False))
+    if all_time and (getattr(args, "start_time_from", None) or getattr(args, "start_time_to", None)):
+        raise api_client.CliError("--all searches all history; drop --from/--to, or drop --all")
+    # An upper bound needs a lower one. The route refuses the pair (only a lower
+    # bound lets it read a bounded slice of history), so say so here in the
+    # flags the user typed rather than relaying a message about JSON fields.
+    if getattr(args, "start_time_to", None) and not getattr(args, "start_time_from", None):
+        raise api_client.CliError("--to needs a lower bound too: add --from (e.g. --from 30d), or --all for everything")
+
+    # page_size, not per_page: the API's key. They differed for a while, and
+    # because an unread key raises no error on either side, --per-page simply
+    # did nothing.
+    body: dict[str, Any] = {"page": args.page, "page_size": args.per_page}
+    if all_time:
+        body["all_time"] = True
     for attr, key in [
         ("status", "status"),
         ("program_name", "program_name"),
@@ -71,8 +130,32 @@ def handle_search(client: api_client.ApiClient, args: Any) -> Any:
         val = getattr(args, attr, None)
         if val is not None:
             body[key] = val
+    for key in ("start_time_from", "start_time_to"):
+        if key in body:
+            body[key] = resolve_search_time(str(body[key]))
     resp = client.post("/api/v1/traces/search", json=body)
 
+    # A window the caller did not ask for has to be visible: read as an org
+    # figure, a windowed total is simply wrong, and nothing in the numbers says
+    # so. The bound comes from the response, so this reports the window actually
+    # applied rather than restating a default this side only assumes.
+    if resp.get("default_window_applied") and (lower := resp.get("start_time_from")):
+        print(
+            f"note: no time filter given, so results cover traces since {lower} only "
+            f"(total and total_cost are for that window). Widen with --from 30d, or --all for everything.",
+            file=sys.stderr,
+        )
+
+    # The server names the body keys it did not understand. Left unreported they
+    # look exactly like a filter that worked: a plausible result set that
+    # answered a different question.
+    if ignored := resp.get("ignored_fields"):
+        print(
+            f"warning: this server ignored request fields {', '.join(ignored)} — "
+            "those filters had no effect. Check the CLI and server versions match.",
+            file=sys.stderr,
+        )
+
     # Servers that predate the deployment_id filter silently drop the
     # unknown key and return whole-org traces. If the user asked for a
     # deployment filter and we got back traces with no deployment_id

{cmpnd-0.8.2 → cmpnd-0.8.4}/cmpnd/cli/shell.py

@@ -441,8 +441,11 @@ class Deployment(Entity):
 
         def _fetch(client: api_client.ApiClient) -> list[dict[str, Any]]:
             resp = client.post(
+                # all_time: this registry is scoped to one deployment, so the
+                # route's default window would hide the traces of anything not
+                # run recently.
                 "/api/v1/traces/search",
-                json={"deployment_id": deployment_id, "per_page": 200},
+                json={"deployment_id": deployment_id, "page_size": 200, "all_time": True},
             )
             return resp.get("traces", [])
 

{cmpnd-0.8.2 → cmpnd-0.8.4}/cmpnd/deployment.py

@@ -12,14 +12,39 @@ The deploy flow:
 import json
 import logging
 import time
+from collections.abc import Callable
 from typing import Any
 
 import httpx
 
-from . import configuration, execution, identity, models, packaging
+from . import configuration, execution, identity, models, packaging, retry
 
 logger = logging.getLogger(__name__)
 
+# httpx applies a timeout per request *phase*, not cumulatively, so each of these
+# bounds one phase of one attempt.
+#
+# Connect is held short on every call: a connection that was never established is
+# the one failure the create POST may safely re-send (below), so reaching that
+# verdict quickly is worth more than waiting out a slow connect.
+_CONNECT_TIMEOUT_SECONDS = 5.0
+
+# The read budget for the steps a re-send is safe on. Short on purpose — for a
+# call we can simply repeat, a blip is better noticed and ridden through than
+# waited out.
+_TIMEOUT_SECONDS = 30.0
+
+# The create POST gets its own, longer, read budget because it is the one step
+# that cannot be retried out of a slow answer: a read timeout there may mean the
+# deployment was created and only the answer was lost, so waiting is the only
+# tolerance available to it. A server under load can legitimately take longer to
+# answer than the budget the repeatable steps run on, and a deploy aborted at
+# that line was progressing fine.
+_CREATE_TIMEOUT_SECONDS = 120.0
+
+# How long the readiness poll waits between status reads.
+_POLL_INTERVAL_SECONDS = 2.0
+
 # The deploy metadata blob is a free-form JSON object committed with
 # the deployment record (the checkpoint/cursor that produced the program). Cap
 # its size — a checkpoint/cursor is a pointer, not a payload. Mirrors serve's
@@ -80,6 +105,82 @@ def _raise_http_error(response: httpx.Response, action: str) -> None:
     raise RuntimeError(msg)
 
 
+def _repeatable_answer(response: httpx.Response) -> bool:
+    """Whether a call that is safe to repeat should simply ask again.
+
+    Wider than the platform's ``retryable`` contract (``cmpnd.retry``) on
+    purpose. That contract exists so a client can decide about re-sending a
+    *write* it has no other way to reason about; a call that can be repeated
+    with no consequence needs no such permission from the server, so the whole
+    5xx class counts here — including a bare 500, which the contract leaves
+    alone precisely because it cannot tell whether the work landed.
+    """
+    return response.status_code >= 500
+
+
+def _wait_before_retry(tally: retry.TransientTally, response: httpx.Response | None) -> bool:
+    """Wait out the backoff, or report that the budget is spent."""
+    now = time.time()
+    if tally.exhausted(now):
+        return False
+    time.sleep(retry.delay_for(tally.count - 1, response))
+    return True
+
+
+def _send_retrying(
+    send: Callable[[], httpx.Response],
+    action: str,
+    *,
+    may_resend_with_no_answer: Callable[[BaseException], bool],
+    may_resend_after_answer: Callable[[httpx.Response], bool],
+) -> httpx.Response:
+    """Run one deploy call, riding through the failures the caller says it may.
+
+    Returns the first answer that is not worth re-sending — successful or not,
+    so the caller still reads the status itself through ``_raise_http_error``.
+    Backoff, budget and ``Retry-After`` handling are the shared policy in
+    ``cmpnd.retry``.
+
+    The two predicates are separate because the two failure modes carry
+    different information: an answer says the server acted, while no answer at
+    all leaves that unknowable, and a call whose re-send would mint a duplicate
+    can only tolerate the subset that rules the first attempt out.
+
+    Tolerating is never silent: a survived blip warns, and so does a budget that
+    ran out. An exhausted budget still hands back the last answer rather than
+    raising over it, so a deploy that ultimately fails on a server error reads
+    exactly as it would have without any retrying — what it endured on the way
+    is on the record, not in place of the error the caller has to act on. Only a
+    failure with no answer at all has nothing to hand back, and raises here.
+    """
+    tally = retry.TransientTally()
+    while True:
+        try:
+            response = send()
+        except httpx.RequestError as exc:
+            if not may_resend_with_no_answer(exc):
+                raise RuntimeError(
+                    f"Failed to {action}: no answer from the server ({type(exc).__name__}: {exc})."
+                    "\n  Not re-sent: with no answer it is unknowable whether the request was acted on."
+                ) from exc
+            tally.record(type(exc).__name__, at=time.time(), sample=str(exc))
+            if not _wait_before_retry(tally, None):
+                raise RuntimeError(
+                    f"Failed to {action}: gave up after {tally.describe(time.time())}. Last: {exc}"
+                ) from exc
+            continue
+
+        if response.is_success or not may_resend_after_answer(response):
+            if tally.count:
+                logger.warning("deploy: rode through %s to %s", tally.describe(time.time()), action)
+            return response
+
+        tally.record(str(response.status_code), at=time.time(), sample=response.text)
+        if not _wait_before_retry(tally, response):
+            logger.warning("deploy: gave up after %s trying to %s", tally.describe(time.time()), action)
+            return response
+
+
 class DeployFailed(RuntimeError):
     """Raised when a deployment transitions to ``status=failed``.
 
@@ -134,7 +235,14 @@ def deploy(module, metric=None, timeout=300, metadata=None):
     Args:
         module: A DSPy module (e.g. dspy.Predict, dspy.ChainOfThought).
         metric: Optional metric callable for optimization support.
-        timeout: Seconds to wait for the program to become ready (default 300).
+        timeout: Seconds to wait for the program to become ready (default 300),
+            measured from the moment the upload completes. A transient blip
+            while waiting — a lost connection, a slow answer, a 5xx — is ridden
+            through inside this budget rather than aborting the deploy, so the
+            wait has no second, smaller retry budget that can run out first.
+            Packaging, the create call and the upload run before that clock
+            starts and are bounded by their own per-request timeouts, so the
+            total time deploy() blocks is those plus this.
         metadata: Optional free-form structured dict committed atomically with
             the deployment record — somewhere to put the checkpoint/cursor that
             produced this program, so the deployment is self-describing for a
@@ -209,12 +317,28 @@ def deploy(module, metric=None, timeout=300, metadata=None):
         "Content-Type": "application/json",
     }
 
-    with httpx.Client(timeout=30.0) as client:
-        # Step 1: Create deployment via the platform API
-        create_resp = client.post(
-            f"{config.endpoint}/api/v1/deployments",
-            json=deploy_body,
-            headers=api_headers,
+    with httpx.Client(timeout=httpx.Timeout(_TIMEOUT_SECONDS, connect=_CONNECT_TIMEOUT_SECONDS)) as client:
+        # Step 1: Create deployment via the platform API.
+        #
+        # **This POST is not idempotent** — it allocates a deployment row — so it
+        # is re-sent only on a failure that proves the request never reached the
+        # server: a connection that was never established (`ConnectError` and the
+        # DNS/connect-phase failures under it), and nothing else. Not a read
+        # timeout, and not a 5xx: either may mean the server processed the
+        # request and only the answer was lost, and re-sending on that guess is
+        # how one deploy mints two deployments. That asymmetry with the poll loop
+        # below — which retries freely because a GET can always be repeated — is
+        # the whole design here.
+        create_resp = _send_retrying(
+            lambda: client.post(
+                f"{config.endpoint}/api/v1/deployments",
+                json=deploy_body,
+                headers=api_headers,
+                timeout=httpx.Timeout(_CREATE_TIMEOUT_SECONDS, connect=_CONNECT_TIMEOUT_SECONDS),
+            ),
+            "create deployment",
+            may_resend_with_no_answer=retry.never_left_the_client,
+            may_resend_after_answer=lambda _: False,
         )
         _raise_http_error(create_resp, "create deployment")
         data = create_resp.json()
@@ -235,29 +359,88 @@ def deploy(module, metric=None, timeout=300, metadata=None):
         # direct to the data plane (the control plane never touches the payload),
         # raw body, no multipart form. Content-Length matches the length we
         # declared at create, so a size-bounded presigned PUT accepts it.
-        upload_resp = client.put(
-            upload_url,
-            content=zip_bytes,
-            headers={"Content-Type": "application/zip"},
+        #
+        # Unlike the create above, this one is idempotent by construction: the
+        # destination key is already pinned by the slot and the bytes are fixed,
+        # so a re-send overwrites the same object with the same content and no
+        # duplicate can exist. It therefore rides through a transient answer and
+        # a transport failure alike, whether or not the first attempt landed.
+        upload_resp = _send_retrying(
+            lambda: client.put(
+                upload_url,
+                content=zip_bytes,
+                headers={"Content-Type": "application/zip"},
+            ),
+            "upload deployment ZIP",
+            may_resend_with_no_answer=lambda _: True,
+            may_resend_after_answer=_repeatable_answer,
         )
         _raise_http_error(upload_resp, "upload deployment ZIP")
 
-        # Step 3: Poll until ready
-        start = time.time()
+        # Step 3: Poll until ready.
+        #
+        # A status read is idempotent, so a blip on it costs one poll interval
+        # and never the deployment: no answer at all, or a 5xx, means ask again
+        # on the next tick. The caller's own `timeout` is the only bound on that
+        # — there is no separate retry budget to run out, because giving up
+        # early on a deployment that is still progressing is the failure this
+        # loop exists to avoid. A 4xx still raises (the caller's problem), and so
+        # does `status == "failed"` (the deployment's).
+        deadline = time.time() + timeout
+        tally = retry.TransientTally()
+        reported = 0
         while True:
-            if time.time() - start > timeout:
-                raise TimeoutError(f"Deployment {deployment_id} not ready after {timeout}s. Last status: polling.")
+            now = time.time()
+            if now >= deadline:
+                msg = f"Deployment {deployment_id} not ready after {timeout}s. Last status: polling."
+                if tally.count:
+                    msg += f" Rode through {tally.describe(now)}."
+                raise TimeoutError(msg)
+
+            # Both the pause and the read it precedes are clipped to what is
+            # left of the budget, so a poll issued just inside the deadline
+            # cannot answer well past it. Without the clip a status read
+            # starting one millisecond early could still block for the full
+            # read timeout, overshooting by that much every time. A clipped
+            # read that runs out is an ordinary no-answer-this-tick: it lands
+            # in the tally and the loop above turns it into the TimeoutError.
+            pause = min(_POLL_INTERVAL_SECONDS, deadline - now)
+            time.sleep(pause)
+            remaining = deadline - now - pause
+            if remaining <= 0:
+                continue
+
+            try:
+                poll_resp = client.get(
+                    f"{config.endpoint}/api/v1/deployments/{deployment_id}",
+                    headers=api_headers,
+                    timeout=httpx.Timeout(
+                        min(_TIMEOUT_SECONDS, remaining),
+                        connect=min(_CONNECT_TIMEOUT_SECONDS, remaining),
+                    ),
+                )
+            except httpx.RequestError as exc:
+                # Every transport failure, not a named subset: they all mean the
+                # same thing for a read — no answer this tick, ask again next.
+                tally.record(type(exc).__name__, at=time.time(), sample=str(exc))
+                continue
 
-            time.sleep(2)
+            if not poll_resp.is_success and _repeatable_answer(poll_resp):
+                tally.record(str(poll_resp.status_code), at=time.time(), sample=poll_resp.text)
+                continue
 
-            poll_resp = client.get(
-                f"{config.endpoint}/api/v1/deployments/{deployment_id}",
-                headers=api_headers,
-            )
             _raise_http_error(poll_resp, "poll deployment status")
             status_data = poll_resp.json()
             status = status_data["status"]
 
+            # The tally is cumulative over the whole poll — it is what the
+            # TimeoutError names if the deployment never arrives — so warn only
+            # about blips not already reported rather than on every poll after
+            # the first one.
+            if tally.count > reported:
+                logger.warning("deploy: rode through %s while polling deployment status", tally.describe(time.time()))
+                reported = tally.count
+
             if status == "ready":
                 return execution.DeployedProgram(
                     deployment_id,

cmpnd-0.8.4/cmpnd/exporter_http.py

@@ -0,0 +1,43 @@
+"""``cmpnd.exporter_http`` **is** :mod:`cmpnd_ingest.exporter_http`.
+
+The transport moved to its own distribution — `cmpnd-ingest`, whose package this
+wheel bundles rather than depends on — so that a producer that is not a DSPy
+program can install it without installing dspy. See `ingest/README.md` for why
+this wheel carries the package instead of taking it as a dependency,
+and `docs/plans/2026-08-11-execution-plane-ownership-and-tiers.md` for the
+decision. This module keeps the name every existing caller imports.
+
+**It aliases rather than re-exports**, and the difference is the point. Two
+callers reach past this module's public names into it:
+`python-sdk/scripts/capture_review_run.py` replaces ``_send_json`` to capture
+every ingest call, and the SDK's own ``cmpnd.exporter.__getattr__`` forwards
+arbitrary attribute reads here. A module that re-bound the public names would
+leave both patching a copy — the replacement would land on this module while the
+transport kept calling the original, silently. Rebinding ``sys.modules[__name__]``
+instead makes the two names one module object, so ``cmpnd.exporter_http is
+cmpnd_ingest.exporter_http`` and there is nothing to keep in sync.
+
+The ``TYPE_CHECKING`` branch is for the checker alone, which cannot follow the
+rebinding: it states the same identity in the only form a type checker reads.
+Names are listed rather than star-imported so that ``X as X`` marks each as a
+deliberate re-export.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from cmpnd_ingest.exporter_http import BatchExporter as BatchExporter
+    from cmpnd_ingest.exporter_http import ExportItem as ExportItem
+    from cmpnd_ingest.exporter_http import ExportRetriesExhausted as ExportRetriesExhausted
+    from cmpnd_ingest.exporter_http import _is_retryable_export_error as _is_retryable_export_error
+    from cmpnd_ingest.exporter_http import _may_resend_a_minting_post as _may_resend_a_minting_post
+    from cmpnd_ingest.exporter_http import _send_json as _send_json
+    from cmpnd_ingest.exporter_http import logger as logger
+else:
+    import sys
+
+    from cmpnd_ingest import exporter_http as _impl
+
+    sys.modules[__name__] = _impl