deployproof 0.1.8__tar.gz → 0.2.1__tar.gz

{deployproof-0.1.8/src/deployproof.egg-info → deployproof-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deployproof
-Version: 0.1.8
+Version: 0.2.1
 Summary: A deterministic AI-code deployability checker that catches what coverage misses.
 Author-email: SVS Praveen <svspraveens@gmail.com>
 License-Expression: MIT
@@ -32,10 +32,10 @@ Dynamic: license-file
 
 > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.1.8-007ec6.svg)](https://pypi.org/project/deployproof/)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.2.1-007ec6.svg)](https://pypi.org/project/deployproof/)
 [![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
 [![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
-[![Tests](https://img.shields.io/badge/tests-88%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![Tests](https://img.shields.io/badge/tests-94%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
 [![Stress Tests](https://img.shields.io/badge/stress%20tests-11%2F11%20passed-2ea44f.svg)](stress_fixtures/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
@@ -189,7 +189,7 @@ deployproof check --json
 
 ```json
 {
-  "version": "0.1.8",
+  "version": "0.2.1",
   "status": "passed",
   "summary": {
     "target_files_count": 1,
@@ -262,7 +262,7 @@ deployproof check --json
 
 ## What It Checks
 
-- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage.
+- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage. Features atomic file restoration protected by `SIGINT`/`SIGTERM`/`SIGBREAK` signal handlers to ensure interrupted runs never leave mutated code on disk.
 - **Secrets and Credentials** — Scans modified files for hardcoded API keys (OpenAI, Anthropic, AWS, GitHub, Stripe, private keys) and tracked `.env` files using pattern matching and entropy analysis.
 - **Symlink and Sandbox Escape** — Resolves symbolic links and flags any whose target escapes the repository root (CWE-61 / CWE-451). Catches the class of path-traversal trick used in the GhostApproval disclosure (Wiz Research, July 2026).
 - **Dependency and Slopsquatting** — For each new import, dynamic import (`importlib.import_module`, `__import__`), or manifest entry (including recursive `-r` includes) introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK.
@@ -271,6 +271,7 @@ deployproof check --json
 
 ## What This Doesn't Do
 
+- **Test-only diffs are not yet caught.** If a diff modifies or weakens assertions in a test file without changing the corresponding source file, DeployProof currently sees zero modified source lines and passes with 0 mutants evaluated. This is a known gap — see [INVESTIGATION_blastradius.md](INVESTIGATION_blastradius.md) for the reverse-mapping approach being evaluated to close it. Until this lands, DeployProof does not protect against test suites being weakened directly.
 - **Not a full-repo audit.** Checks are scoped to files changed in the current session (git diff). Files you haven't touched are not re-evaluated.
 - **Python only.** Mutation testing and import extraction currently support Python files only. Other languages are not scanned.
 - **No auto-fix.** DeployProof reports findings; it does not modify your code, rewrite imports, or suggest patches.
@@ -288,7 +289,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
 
 ## Status & Roadmap
 
-- **Current (v0.1.8):** Diff-scoped AST mutation testing (with recursive `test/`/`tests/` discovery and precise column-offset snippet reconstruction), baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner (including unquoted .env values and prefix validation), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks` and deduplicated decorator detection), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, 88 unit tests, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Current (v0.2.1):** Diff-scoped AST mutation testing (with recursive `test/`/`tests/` discovery, AST column-offset snippet reconstruction, and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner (including unquoted .env values and prefix validation), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, 94 unit tests, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
 - **Next:** Multi-language mutation support and expanded ecosystem rule packs.
 
 ## Contributing

{deployproof-0.1.8 → deployproof-0.2.1}/README.md

@@ -2,10 +2,10 @@
 
 > Deterministic pre-push verification for AI-assisted codebases: AST mutation testing, credential scanning, sandbox-escape detection, mock-usage alerts, swallowed-exception checks, and dependency hallucination defense.
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.1.8-007ec6.svg)](https://pypi.org/project/deployproof/)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.2.1-007ec6.svg)](https://pypi.org/project/deployproof/)
 [![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776ab.svg)](https://pypi.org/project/deployproof/)
 [![CI](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml/badge.svg)](https://github.com/SVSPraveen/DeployProof/actions/workflows/ci.yml)
-[![Tests](https://img.shields.io/badge/tests-88%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
+[![Tests](https://img.shields.io/badge/tests-94%20passed-2ea44f.svg)](https://github.com/SVSPraveen/DeployProof)
 [![Stress Tests](https://img.shields.io/badge/stress%20tests-11%2F11%20passed-2ea44f.svg)](stress_fixtures/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
@@ -159,7 +159,7 @@ deployproof check --json
 
 ```json
 {
-  "version": "0.1.8",
+  "version": "0.2.1",
   "status": "passed",
   "summary": {
     "target_files_count": 1,
@@ -232,7 +232,7 @@ deployproof check --json
 
 ## What It Checks
 
-- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage.
+- **Mutation Score** — Mutates AST operators (`>=`, `==`, `and`, `or`, `*`, numeric constants, comparisons) in modified files and runs your test suite against each mutant. Reports surviving mutants and a percentage score. Does not use line coverage. Features atomic file restoration protected by `SIGINT`/`SIGTERM`/`SIGBREAK` signal handlers to ensure interrupted runs never leave mutated code on disk.
 - **Secrets and Credentials** — Scans modified files for hardcoded API keys (OpenAI, Anthropic, AWS, GitHub, Stripe, private keys) and tracked `.env` files using pattern matching and entropy analysis.
 - **Symlink and Sandbox Escape** — Resolves symbolic links and flags any whose target escapes the repository root (CWE-61 / CWE-451). Catches the class of path-traversal trick used in the GhostApproval disclosure (Wiz Research, July 2026).
 - **Dependency and Slopsquatting** — For each new import, dynamic import (`importlib.import_module`, `__import__`), or manifest entry (including recursive `-r` includes) introduced in the diff, queries the PyPI JSON API and checks registration age. Packages that don't exist (HTTP 404) are flagged HIGH RISK; packages registered within the last 30 days are flagged MEDIUM RISK.
@@ -241,6 +241,7 @@ deployproof check --json
 
 ## What This Doesn't Do
 
+- **Test-only diffs are not yet caught.** If a diff modifies or weakens assertions in a test file without changing the corresponding source file, DeployProof currently sees zero modified source lines and passes with 0 mutants evaluated. This is a known gap — see [INVESTIGATION_blastradius.md](INVESTIGATION_blastradius.md) for the reverse-mapping approach being evaluated to close it. Until this lands, DeployProof does not protect against test suites being weakened directly.
 - **Not a full-repo audit.** Checks are scoped to files changed in the current session (git diff). Files you haven't touched are not re-evaluated.
 - **Python only.** Mutation testing and import extraction currently support Python files only. Other languages are not scanned.
 - **No auto-fix.** DeployProof reports findings; it does not modify your code, rewrite imports, or suggest patches.
@@ -258,7 +259,7 @@ Fixtures cover weak test suites, zero-test orphan modules, planted OpenAI/AWS cr
 
 ## Status & Roadmap
 
-- **Current (v0.1.8):** Diff-scoped AST mutation testing (with recursive `test/`/`tests/` discovery and precise column-offset snippet reconstruction), baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner (including unquoted .env values and prefix validation), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks` and deduplicated decorator detection), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, 88 unit tests, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
+- **Current (v0.2.1):** Diff-scoped AST mutation testing (with recursive `test/`/`tests/` discovery, AST column-offset snippet reconstruction, and `SIGINT`/`SIGTERM`/`SIGBREAK` signal-safe disk restoration), baseline test-collection failure isolation with distinct exit code `2`, entropy-driven value-based secrets scanner (including unquoted .env values and prefix validation), GhostApproval symlink sandbox-escape detector, PyPI dependency hallucination / slopsquatting scanner (with import-to-distribution translation, recursive `-r` requirements scanning, and dynamic import detection via `importlib` / `__import__`), mock-introduction detector (`--strict-mocks`), control-flow / swallowed-exception scanner (`--strict-error-handling`), 11/11 launch-day stress test suite, 94 unit tests, machine-readable `--json` output, and Tier 2 CI verification via GitHub Actions (mutmut).
 - **Next:** Multi-language mutation support and expanded ecosystem rule packs.
 
 ## Contributing

{deployproof-0.1.8 → deployproof-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deployproof"
-version = "0.1.8"
+version = "0.2.1"
 description = "A deterministic AI-code deployability checker that catches what coverage misses."
 readme = "README.md"
 requires-python = ">=3.10"

deployproof-0.2.1/src/deployproof/__init__.py

@@ -0,0 +1,2 @@
+"""DeployProof - Deterministic AI-Code Deployability Checker."""
+__version__ = "0.2.1"

deployproof-0.2.1/src/deployproof/cli.py

@@ -0,0 +1,179 @@
+"""Command-line interface for DeployProof."""
+import argparse
+import sys
+from pathlib import Path
+from typing import List, Optional
+from deployproof import __version__
+from deployproof.dependencies import extract_all_new_dependencies, scan_dependencies
+from deployproof.control_flow import scan_session_files_for_control_flow
+from deployproof.diff import DiffScopeError, InvalidBaseRefError, NotAGitRepositoryError, get_git_root, is_test_file, resolve_changed_python_files, resolve_changed_session_files
+from deployproof.mocks import scan_session_files_for_mocks
+from deployproof.mutator import run_mutation_tests
+from deployproof.reporter import LARGE_FILE_LOC_THRESHOLD, format_json_report, format_report
+from deployproof.secrets import scan_session_files_for_secrets
+from deployproof.symlinks import scan_session_files_for_symlinks
+from deployproof.wsl import check_wsl_readiness, run_wsl_mutmut
+
+def create_parser() -> argparse.ArgumentParser:
+    """Create and configure the command-line argument parser."""
+    parser = argparse.ArgumentParser(prog='deployproof', description='DeployProof: A deterministic AI-code deployability checker.')
+    parser.add_argument('-v', '--version', action='version', version=f'%(prog)s {__version__}', help="Show program's version number and exit.")
+    subparsers = parser.add_subparsers(dest='command', help='Available commands')
+    check_parser = subparsers.add_parser('check', help='Run deployability verification checks against session changes.')
+    check_parser.add_argument('--base', type=str, default=None, help='Base git ref (branch/commit/tag) to diff against.')
+    check_parser.add_argument('--files', nargs='+', type=str, default=None, help='Explicit files to evaluate (bypasses git diff).')
+    check_parser.add_argument('--tests', nargs='+', type=str, default=None, help='Specific test file(s) or directories to execute.')
+    check_parser.add_argument('--threshold', type=float, default=80.0, help='Minimum mutation score percentage to pass (default: 80.0).')
+    check_parser.add_argument('--timeout', type=float, default=10.0, help='Test runner timeout in seconds per mutant (default: 10.0).')
+    check_parser.add_argument('--wsl', action='store_true', default=False, help='Delegate mutation testing to mutmut inside WSL (Windows only).')
+    check_parser.add_argument('--strict-mocks', action='store_true', default=False, help='Fail the verification gate if new mock or monkeypatch usage is introduced in test files.')
+    check_parser.add_argument('--strict-error-handling', action='store_true', default=False, help='Fail the verification gate if bare excepts, swallowed exceptions, or unreachable code are detected.')
+    check_parser.add_argument('--json', action='store_true', default=False, help='Output check results as a structured JSON object.')
+    subparsers.add_parser('init', help='Initialize DeployProof configuration in the current repository.')
+    return parser
+
+def handle_check(args: argparse.Namespace) -> int:
+    """Handle the 'check' subcommand."""
+    cwd = Path.cwd().resolve()
+    repo_root: Optional[Path] = None
+    try:
+        if args.files:
+            session_files = [Path(f).resolve() for f in args.files]
+            if session_files:
+                try:
+                    repo_root = get_git_root(session_files[0].parent)
+                except DiffScopeError:
+                    repo_root = session_files[0].parent
+            else:
+                repo_root = cwd
+        else:
+            repo_root = get_git_root(cwd)
+            session_files = resolve_changed_session_files(cwd=cwd, base=args.base)
+    except NotAGitRepositoryError:
+        print('Error: Not a git repository. Initialize git or specify files with --files.', file=sys.stderr)
+        return 1
+    except InvalidBaseRefError as e:
+        print(f'Error: {e}', file=sys.stderr)
+        return 1
+    except DiffScopeError as e:
+        print(f'Error: {e}', file=sys.stderr)
+        return 1
+    if not session_files:
+        if getattr(args, 'json', False):
+            import json
+            print(json.dumps({'version': __version__, 'status': 'passed', 'message': 'No modified files detected in current session.', 'scope': {'target_files': []}, 'summary': {'target_files_count': 0, 'mutation_score': 100.0, 'threshold': args.threshold, 'secrets_found': 0, 'symlink_escapes_found': 0, 'dependency_findings': {'high_risk': 0, 'medium_risk': 0, 'ok': 0, 'unknown': 0, 'unscanned': 0}, 'mock_usages_found': 0, 'control_flow_findings': 0, 'strict_mocks_active': getattr(args, 'strict_mocks', False), 'strict_mocks_triggered': False, 'strict_error_handling_active': getattr(args, 'strict_error_handling', False), 'strict_error_handling_triggered': False}, 'control_flow': {'clean': True, 'strict_gate_triggered': False, 'findings': []}}, indent=2))
+            return 0
+        else:
+            print('DeployProof: No modified files detected in current session.')
+            print('Working tree is clean. Use --base <ref> or --files <path...> to evaluate specific files.')
+            return 0
+    symlink_result = scan_session_files_for_symlinks(session_files, repo_root=repo_root or cwd)
+    secrets_result = scan_session_files_for_secrets(session_files)
+    extracted_deps = extract_all_new_dependencies(session_files, root=repo_root or cwd, base=args.base)
+    dependency_result = scan_dependencies(extracted_deps)
+    mock_result = scan_session_files_for_mocks(session_files=session_files, root=repo_root or cwd, base=args.base)
+    control_flow_result = scan_session_files_for_control_flow(session_files=session_files, root=repo_root or cwd, base=args.base)
+    if args.files:
+        non_test_files = [f for f in session_files if f.is_file() and f.suffix == '.py' and (not is_test_file(f))]
+        target_files = non_test_files if non_test_files else [f for f in session_files if f.is_file() and f.suffix == '.py']
+    else:
+        target_files = [f for f in session_files if f.is_file() and f.suffix == '.py' and (not is_test_file(f))]
+    if not getattr(args, 'json', False):
+        for f in target_files:
+            try:
+                loc = len(f.read_text(encoding='utf-8', errors='replace').splitlines())
+                if loc < LARGE_FILE_LOC_THRESHOLD:
+                    try:
+                        rel = f.relative_to(repo_root or cwd)
+                    except ValueError:
+                        rel = f
+                    print(f"Notice: Large file '{rel}' ({loc} LOC) detected - mutation testing may take several minutes.")
+            except Exception:
+                pass
+    if getattr(args, 'wsl', False):
+        wsl_ready, wsl_msg = check_wsl_readiness()
+        if wsl_ready:
+            if not getattr(args, 'json', False):
+                print('DeployProof - Delegating to mutmut in WSL...')
+            wsl_res = run_wsl_mutmut(repo_root or cwd, target_files)
+            if wsl_res.get('success'):
+                if not getattr(args, 'json', False):
+                    print(wsl_res.get('stdout', ''))
+                has_security_issue = bool(secrets_result.findings or symlink_result.escape_findings or dependency_result.high_risk_count > 0 or (getattr(args, 'strict_mocks', False) and mock_result.total_findings > 0) or (getattr(args, 'strict_error_handling', False) and control_flow_result.total_findings > 0))
+                return 1 if has_security_issue else 0
+            elif not getattr(args, 'json', False):
+                print(f"WSL execution error: {wsl_res.get('error') or wsl_res.get('stderr')}", file=sys.stderr)
+                print('Falling back to Tier 1 local pre-check...')
+        elif not getattr(args, 'json', False):
+            print(wsl_msg)
+            print('-' * 68)
+    result = run_mutation_tests(target_files=target_files, repo_root=repo_root or cwd, test_runner_timeout=args.timeout, extra_pytest_args=args.tests)
+    if getattr(args, 'json', False):
+        report_text = format_json_report(result=result, target_files=target_files, secrets_result=secrets_result, symlink_result=symlink_result, dependency_result=dependency_result, mock_result=mock_result, control_flow_result=control_flow_result, strict_mocks=getattr(args, 'strict_mocks', False), strict_error_handling=getattr(args, 'strict_error_handling', False), repo_root=repo_root or cwd, threshold=args.threshold, version=__version__)
+    else:
+        report_text = format_report(result=result, target_files=target_files, secrets_result=secrets_result, symlink_result=symlink_result, dependency_result=dependency_result, mock_result=mock_result, control_flow_result=control_flow_result, strict_mocks=getattr(args, 'strict_mocks', False), strict_error_handling=getattr(args, 'strict_error_handling', False), repo_root=repo_root or cwd, threshold=args.threshold)
+    print(report_text)
+    if result.collection_error:
+        return 2
+    strict_mocks_triggered = bool(getattr(args, 'strict_mocks', False) and mock_result.total_findings > 0)
+    strict_error_triggered = bool(getattr(args, 'strict_error_handling', True) and control_flow_result.total_findings > 0)
+    if result.mutation_score is not None and result.mutation_score < args.threshold or len(result.untested_files) > 0 or len(secrets_result.findings) > 0 or (len(symlink_result.escape_findings) > 0) or (dependency_result.high_risk_count > 0) or strict_mocks_triggered or strict_error_triggered:
+        return 1
+    return 0
+
+def handle_init(args: argparse.Namespace) -> int:
+    """Handle the 'init' subcommand to initialize configuration and git hooks."""
+    cwd = Path.cwd().resolve()
+    try:
+        repo_root = get_git_root(cwd)
+    except DiffScopeError:
+        repo_root = cwd
+    print(f'DeployProof: Initializing in {repo_root}...')
+    config_path = repo_root / '.deployproof.json'
+    if not config_path.exists():
+        import json
+        default_config = {'version': __version__, 'threshold': 80.0, 'timeout': 10.0, 'secrets_scanning': True, 'symlink_scanning': True, 'dependency_scanning': True}
+        config_path.write_text(json.dumps(default_config, indent=2) + '\n', encoding='utf-8')
+        print(f'  [+] Created configuration file: {config_path.name}')
+    else:
+        print(f'  [.] Configuration file already exists: {config_path.name}')
+    hooks_dir = repo_root / '.git' / 'hooks'
+    if hooks_dir.is_dir():
+        pre_push_hook = hooks_dir / 'pre-push'
+        hook_script = '#!/usr/bin/env sh\n# DeployProof deterministic pre-push verification gate\ndeployproof check\n'
+        pre_push_hook.write_text(hook_script, encoding='utf-8')
+        try:
+            import stat
+            pre_push_hook.chmod(pre_push_hook.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+        except Exception:
+            pass
+        print('  [+] Installed git pre-push hook: .git/hooks/pre-push')
+    else:
+        print('  [i] Note: .git/hooks directory not found. Initialize git to enable automatic pre-push gating.')
+    print("\nDeployProof initialization complete. Run 'deployproof check' to verify your session changes.")
+    return 0
+
+def main(argv: Optional[List[str]]=None) -> int:
+    """Entry point for the DeployProof CLI."""
+    if hasattr(sys.stdout, 'reconfigure'):
+        try:
+            sys.stdout.reconfigure(errors='replace')
+        except Exception:
+            pass
+    if hasattr(sys.stderr, 'reconfigure'):
+        try:
+            sys.stderr.reconfigure(errors='replace')
+        except Exception:
+            pass
+    parser = create_parser()
+    args = parser.parse_args(argv)
+    if not args.command:
+        parser.print_help()
+        return 0
+    if args.command == 'check':
+        return handle_check(args)
+    elif args.command == 'init':
+        return handle_init(args)
+    return 0
+if __name__ == '__main__':
+    sys.exit(main())

{deployproof-0.1.8 → deployproof-0.2.1}/src/deployproof/dependencies.py

@@ -983,7 +983,7 @@ def query_pypi_registry(
     url = f"https://pypi.org/pypi/{canonical_pkg}/json"
     req = urllib.request.Request(
         url,
-        headers={"User-Agent": "DeployProof/0.1.8 (https://github.com/SVSPraveen/DeployProof)"},
+        headers={"User-Agent": "DeployProof/0.2.1 (https://github.com/SVSPraveen/DeployProof)"},
     )
 
     try:
@@ -993,6 +993,7 @@ def query_pypi_registry(
                 data = json.loads(raw_bytes.decode("utf-8"))
                 releases = data.get("releases", {})
                 timestamps: List[datetime.datetime] = []
+                parse_error: Optional[str] = None
 
                 for ver, files in releases.items():
                     for f in files:
@@ -1001,10 +1002,14 @@ def query_pypi_registry(
                             try:
                                 dt = datetime.datetime.fromisoformat(t_str.replace("Z", "+00:00"))
                                 timestamps.append(dt)
-                            except Exception:
-                                pass
-
-                if not timestamps:
+                            except (ValueError, TypeError) as e:
+                                parse_error = f"Failed to parse release timestamp '{t_str}': {e}"
+                            except Exception as e:
+                                parse_error = f"Unexpected error parsing release timestamp '{t_str}': {e}"
+
+                if parse_error and not timestamps:
+                    result = ("UNKNOWN", None, None, f"PyPI release date parse error for package '{canonical_pkg}': {parse_error}")
+                elif not timestamps:
                     if canonical_pkg.lower() in KNOWN_NAMESPACE_ROOTS or norm_name.lower() in KNOWN_NAMESPACE_ROOTS:
                         result = ("OK", None, None, f"Namespace package umbrella root ('{canonical_pkg}') - subpackages published separately on PyPI")
                     else: