deptime 0.1.0__tar.gz

deptime-0.1.0/.claude-plugin/marketplace.json

@@ -0,0 +1,15 @@
+{
+  "name": "deptime",
+  "description": "DepTime for Claude Code: tells your agent what changed in a Python library, in which release, and what to use instead.",
+  "owner": {
+    "name": "cschmertz",
+    "url": "https://github.com/cschmertz"
+  },
+  "plugins": [
+    {
+      "name": "deptime",
+      "source": "./integrations/claude-code",
+      "description": "Explains Python ImportError / AttributeError / TypeError caused by library API changes: what changed, in which release, and what to use instead. Runs locally; your code and errors never leave your machine."
+    }
+  ]
+}

deptime-0.1.0/.dockerignore

@@ -0,0 +1,14 @@
+.git
+.venv
+.cache
+.pytest_cache
+.ruff_cache
+data
+docs
+bench
+site
+tests
+integrations
+**/__pycache__
+.env
+.env.*

deptime-0.1.0/.env.example

@@ -0,0 +1,22 @@
+# DepTime reads configuration from environment variables. Everything is optional.
+
+# --- Local mode (deptime mcp / CLI) ---
+# DEPTIME_HOME=~/.cache/deptime              # index + build cache (default: $XDG_CACHE_HOME/deptime or ~/.cache/deptime)
+# DEPTIME_INDEX_PATH=~/.cache/deptime/index.sqlite
+# DEPTIME_INDEX_URL=https://github.com/cschmertz/deptime/releases/download/index   # where `index pull` downloads from
+# DEPTIME_INDEX_MAX_AGE_HOURS=24             # refresh check interval for a downloaded index
+# DEPTIME_OFFLINE=false                      # true = never touch the network
+# DEPTIME_COVERAGE_FILE=                     # custom coverage list (default: the one packaged with deptime)
+
+# --- Building the index yourself (deptime ingest) ---
+# DEPTIME_CACHE_DIR=~/.cache/deptime/build   # downloaded wheels, extracted sources, snapshot cache
+
+# --- Optional hosted mode (deptime serve) ---
+# DEPTIME_HOST=127.0.0.1
+# DEPTIME_PORT=8000
+# DEPTIME_PUBLIC_URL=http://127.0.0.1:8000
+# DEPTIME_TRUST_PROXY_HEADERS=false          # true behind Fly/Cloud Run so client IPs come from X-Forwarded-For
+# DEPTIME_TRUSTED_PROXY_HOPS=1               # proxies you run that append to X-Forwarded-For (client = Nth from the right)
+# DEPTIME_CLIENT_IP_HEADER=                  # e.g. Fly-Client-IP; set only if your platform's proxy always sets it
+# DEPTIME_ANON_DAILY_LIMIT=25                # anonymous calls per IP per day on a public instance
+# DEPTIME_DEV_API_KEYS=                      # "key1:pro,key2:free" lets trusted callers bypass anonymous limits

deptime-0.1.0/.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,29 @@
+name: Bug report
+description: Something crashed or misbehaved (install, index download, MCP connection, CLI)
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      placeholder: "uvx deptime mcp ... / claude mcp add ..."
+    validations:
+      required: true
+  - type: input
+    id: env
+    attributes:
+      label: Environment
+      placeholder: "deptime 0.1.0, macOS 15, Python 3.12, Claude Code 2.1.281"
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs (stderr)
+      render: text

deptime-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/cschmertz/deptime/security/advisories/new
+    about: Please report security issues privately.

deptime-0.1.0/.github/ISSUE_TEMPLATE/package-request.yml

@@ -0,0 +1,24 @@
+name: Index a package
+description: Ask for a Python package to be added to DepTime's coverage
+title: "[coverage] <package>"
+labels: ["coverage"]
+body:
+  - type: input
+    id: package
+    attributes:
+      label: PyPI distribution name
+      placeholder: "langchain-anthropic"
+    validations:
+      required: true
+  - type: input
+    id: import_names
+    attributes:
+      label: Import name(s)
+      placeholder: "langchain_anthropic"
+    validations:
+      required: true
+  - type: textarea
+    id: why
+    attributes:
+      label: Why it changes often enough to need DepTime
+      description: Links to breaking-change notes or issues help prioritise.

deptime-0.1.0/.github/ISSUE_TEMPLATE/wrong-answer.yml

@@ -0,0 +1,42 @@
+name: Wrong answer
+description: DepTime gave a wrong or unhelpful answer (these become benchmark cases)
+title: "[wrong answer] <package>: <symbol>"
+labels: ["wrong-answer"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks! Every report becomes a benchmark case. Please remove secrets and personal paths from the traceback.
+  - type: textarea
+    id: traceback
+    attributes:
+      label: Traceback (or the call you checked)
+      render: text
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Installed versions
+      placeholder: "httpx==0.28.1, python 3.12"
+    validations:
+      required: true
+  - type: textarea
+    id: got
+    attributes:
+      label: What DepTime returned
+      description: Paste the finding (issue, versions, replacements), or the whole JSON.
+      render: json
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What is actually true
+      description: Link the changelog, migration guide, or commit if you can.
+    validations:
+      required: true
+  - type: input
+    id: index
+    attributes:
+      label: Output of `deptime index status` (built_at)

deptime-0.1.0/.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## What and why
+
+<!-- Backlog ID if any, e.g. DT-CORE-05 -->
+
+## Checklist
+
+- [ ] `uv run ruff format src tests && uv run ruff check src tests && uv run pytest` passes
+- [ ] New behaviour has a test (parser/diff changes: failing test first)
+- [ ] No public field or tool name renamed (additions only)
+- [ ] Nothing prints to stdout in `deptime mcp` code paths
+- [ ] Docs/BACKLOG updated if behaviour or plans changed

deptime-0.1.0/.github/workflows/build-index.yml

@@ -0,0 +1,168 @@
+name: build-index
+
+# Nightly: analyse new PyPI releases and publish the prebuilt index to the rolling `index` pre-release.
+# Local installs download <repo>/releases/download/index/{manifest.json,index.sqlite.gz} (see config.DEFAULT_INDEX_URL).
+# Free on public repositories.
+#
+# One job per covered package builds that package's snapshots on its own runner, with its own snapshot cache and
+# log, so a heavy package can only fail itself (DT-DATA-03). The publish job then assembles the index from those
+# snapshots without downloading or analysing anything. It starts from the published index, so a package whose job
+# failed tonight keeps the releases it already had (DT-DATA-12).
+on:
+  schedule:
+    - cron: "17 4 * * *" # daily at 04:17 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-index
+  cancel-in-progress: false
+
+env:
+  DEPTIME_HOME: ${{ github.workspace }}/.deptime
+  DEPTIME_OFFLINE: "1" # no background index download or refresh; `ingest` and the explicit `index pull` still run
+
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    outputs:
+      packages: ${{ steps.list.outputs.packages }}
+      snapshot_format: ${{ steps.list.outputs.snapshot_format }}
+    steps:
+      # DT-OSS-07: pin actions to commit SHAs.
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      - name: List the covered packages
+        id: list
+        run: |
+          packages=$(uv run --no-dev python -c 'import json; from deptime.config import Settings, load_coverage; print(json.dumps([p.name for p in load_coverage(Settings.from_env().coverage_file).packages]))')
+          echo "packages=$packages" >> "$GITHUB_OUTPUT"
+          echo "$packages"
+          echo "snapshot_format=$(uv run --no-dev python -c 'from deptime.ingest.snapshot import SNAPSHOT_FORMAT; print(SNAPSHOT_FORMAT)')" >> "$GITHUB_OUTPUT"
+
+  snapshots:
+    name: snapshots (${{ matrix.package }})
+    needs: plan
+    runs-on: ubuntu-latest
+    timeout-minutes: 350
+    strategy:
+      fail-fast: false
+      matrix:
+        package: ${{ fromJSON(needs.plan.outputs.packages) }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --locked --no-dev
+
+      # `|` can't occur in a package name, so one package's prefix never matches another's (langchain vs langchain-core).
+      # The snapshot format is in the key: snapshots from an older extractor would only be rebuilt.
+      - name: Restore this package's snapshot cache
+        id: restore
+        uses: actions/cache/restore@v4
+        with:
+          path: .deptime/build/snapshots/${{ matrix.package }}
+          key: snapshots|${{ needs.plan.outputs.snapshot_format }}|${{ matrix.package }}|latest
+          restore-keys: snapshots|${{ needs.plan.outputs.snapshot_format }}|${{ matrix.package }}|
+
+      - name: Build the snapshots that aren't cached yet
+        timeout-minutes: 320
+        continue-on-error: true # a timed-out cold build still saves its progress below; the next run carries on
+        run: |
+          # Memory use every minute, so a runner that dies mid-build still leaves a trace in the log.
+          ( while sleep 60; do free -m | awk 'NR==2 {print "[memory] " $3 " MB used of " $2}'; done ) &
+          trap "kill $!" EXIT
+          uv run deptime ingest "${{ matrix.package }}"
+
+      - name: Resources used
+        if: always()
+        run: |
+          free -m
+          df -h .
+          du -sh .deptime/build/snapshots 2>/dev/null || true
+
+      - name: Snapshot cache key
+        id: key
+        if: always()
+        run: echo "key=snapshots|${{ needs.plan.outputs.snapshot_format }}|${{ matrix.package }}|${{ hashFiles(format('.deptime/build/snapshots/{0}/**', matrix.package)) }}" >> "$GITHUB_OUTPUT"
+
+      - name: Save this package's snapshot cache (also after a timeout; skipped when nothing changed)
+        if: always() && !endsWith(steps.key.outputs.key, '|') && steps.key.outputs.key != steps.restore.outputs.cache-matched-key
+        uses: actions/cache/save@v4
+        with:
+          path: .deptime/build/snapshots/${{ matrix.package }}
+          key: ${{ steps.key.outputs.key }}
+
+      - name: Hand the snapshots to the publish job
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: snapshots-${{ matrix.package }}
+          path: .deptime/build/snapshots/
+          include-hidden-files: true # the path is under .deptime/
+          if-no-files-found: warn
+          retention-days: 1
+          compression-level: 0 # already gzipped
+
+  publish:
+    needs: [plan, snapshots]
+    # Runs even when some package jobs failed: those packages keep their published releases.
+    if: ${{ !cancelled() && needs.plan.result == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    permissions:
+      contents: write # upload release assets
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --locked --no-dev
+
+      - name: Collect every package's snapshots
+        continue-on-error: true # a package without snapshots keeps its published releases
+        uses: actions/download-artifact@v4
+        with:
+          pattern: snapshots-*
+          path: .deptime/build/snapshots
+          merge-multiple: true
+
+      # Ingesting into last night's index keeps a release that has no snapshot tonight (DT-DATA-12).
+      # sha256 and schema are checked as for users.
+      - name: Start from the published index
+        run: uv run deptime index pull || echo "::notice::no compatible published index; building from snapshots only"
+
+      - name: Assemble the index from the snapshots (never downloads or analyses a release)
+        run: |
+          uv run deptime ingest --all --into-downloaded --cached-only \
+            || echo "::warning::some releases have no snapshot tonight; see the log above"
+
+      - name: Resources used
+        if: always()
+        run: |
+          free -m
+          df -h .
+          du -sh .deptime/build/snapshots .deptime/*.sqlite 2>/dev/null || true
+
+      - name: Pack
+        run: uv run deptime index pack --out dist
+
+      - name: Guard against publishing a shrunken index
+        run: |
+          new=$(jq .packages dist/manifest.json)
+          if gh release download index --pattern manifest.json --dir prev 2>/dev/null; then
+            old=$(jq .packages prev/manifest.json)
+            echo "packages: previous=$old new=$new"
+            if [ "$new" -lt $(( old * 9 / 10 )) ]; then
+              echo "::error::new index has $new packages vs $old published; refusing to publish"
+              exit 1
+            fi
+          fi
+
+      - name: Publish to the rolling `index` release
+        run: |
+          gh release view index >/dev/null 2>&1 || gh release create index --prerelease \
+            --title "DepTime index (rolling)" \
+            --notes "Nightly prebuilt index, downloaded automatically by \`deptime mcp\` and \`deptime index pull\`."
+          gh release upload index dist/index.sqlite.gz dist/manifest.json --clobber

deptime-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,20 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      # DT-OSS-07: pin these to commit SHAs.
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --locked
+      - run: uv run ruff format --check src tests
+      - run: uv run ruff check src tests
+      - run: uv run pytest

deptime-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: release
+
+# Publishes to PyPI when a version tag is pushed (git tag v0.1.0 && git push --tags).
+# One-time setup: on pypi.org, add a "trusted publisher" for this repo + workflow + environment `pypi`.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # PyPI trusted publishing (no API token stored anywhere)
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      # A PyPI version can never be reused, so refuse to publish when the tag and the package disagree (audit C-01).
+      - name: Check the tag matches the package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pyproject="$(uv version --short)"
+          init="$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' src/deptime/__init__.py)"
+          plugin="$(jq -r .version integrations/claude-code/.claude-plugin/plugin.json)"
+          echo "tag=$tag pyproject=$pyproject __init__=$init plugin.json=$plugin"
+          if [ "$tag" != "$pyproject" ] || [ "$tag" != "$init" ] || [ "$tag" != "$plugin" ]; then
+            echo "::error::tag $GITHUB_REF_NAME does not match the package version"
+            exit 1
+          fi
+      - run: uv sync --locked && uv run pytest
+      - run: uv build
+      - uses: pypa/gh-action-pypi-publish@release/v1

deptime-0.1.0/.gitignore

@@ -0,0 +1,32 @@
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.ruff_cache/
+*.egg-info/
+dist/
+build/
+
+# DepTime local artifacts
+.cache/
+data/*.sqlite
+data/*.sqlite-*
+data/snapshots/
+!data/.gitkeep
+
+# Env / secrets
+.env
+.env.*
+!.env.example
+
+# OS / editors
+.DS_Store
+.idea/
+.vscode/
+
+# CI / local DepTime home
+.deptime/
+
+# Private audit notes (also keeps them out of the Hatch sdist)
+/audit-2026-10-20/

deptime-0.1.0/.python-version

@@ -0,0 +1 @@
+3.12

deptime-0.1.0/BACKLOG.md

@@ -0,0 +1,193 @@
+# DepTime backlog
+
+**How to read this**
+- **IDs** look like `DT-<EPIC>-NN` and are referenced from the docs and code. Put the ID in commit messages and PR titles.
+- **Priority:**
+  - `P0`: blocks the milestone.
+  - `P1`: needed for the milestone's goal.
+  - `P2`: nice to have.
+- **Size:** `S` ≤ ½ day · `M` 1–2 days · `L` 3–5 days.
+- **Direction:** free, open source (MIT), local-first ([ADR 0007](docs/adr/0007-open-source-local-first.md)). Success means adoption plus accuracy ([docs/06](docs/06-launch-and-adoption.md)).
+
+| Milestone | Window | Exit criterion |
+|---|---|---|
+| **M0 Spikes** | Days 1–7 | S1 go/no-go (false-absent ≤ 10%); S2–S7 answered |
+| **M1 Local alpha** | Days 7–14 | Public repo; nightly index published; `uvx deptime mcp` works from PyPI; benchmark ≥ 70% |
+| **M2 Public launch** | Days ~14–21 | Registries, plugin, snippets, demo GIF, benchmark post, 5 rename-map pages |
+| **M3 Optional hosted** | When wanted | Public endpoint for web clients and demos, with limits and a privacy notice |
+| **M4 Review** | Days 60 and 90 | Review criteria in [docs/06](docs/06-launch-and-adoption.md) |
+
+---
+
+## Current state: private staging (since 2026-10-18)
+
+The repo lives at `github.com/cschmertz/deptime` as **private** while setup and the spikes happen.
+
+**Works while private**
+- CI on every push (about 2 Actions minutes per run).
+- All local development: `uv run deptime …`.
+- Building your own index (`deptime ingest`) and running `deptime mcp` against it.
+
+**Doesn't work until public**
+- `deptime index pull` and the automatic download: private release assets need auth, so clients get a 404.
+- `uvx deptime` from PyPI.
+- **Note:** publishing to PyPI makes the source public on PyPI, so reserve the name (DT-OSS-03) when you're ready for that.
+
+**Suggested order for the next sessions**
+1. **M0 spikes locally**, S1 first since it's the go/no-go. No GitHub needed: `uv run deptime ingest <pkg>`.
+2. *(Optional)* Run `build-index` once by hand (Actions → build-index → Run workflow) to measure the S4 cold-build time. It costs private minutes and creates a private `index` release.
+3. **Go public:**
+   1. Flip the visibility.
+   2. Enable private vulnerability reporting.
+   3. **Uncomment the `schedule:` in `.github/workflows/build-index.yml`.**
+   4. Run `build-index`.
+   5. Verify `deptime index pull` works on a clean machine (DT-OSS-01, DT-OSS-04).
+4. **PyPI:** add the trusted publisher on pypi.org, then `git tag v0.1.0 && git push --tags` (DT-OSS-03, DT-OSS-05).
+
+---
+
+## ✅ Done (2026-10-17)
+
+- [x] Problem and prior-art research, specs, architecture, hosting and sustainability, launch, risks, privacy/security docs, and ADRs
+- [x] Ingestion: PEP 691 client, version policy, sha256-verified download, safe extraction, griffe public-path snapshots, diffs, replacement mining, span-encoded SQLite index
+- [x] Resilience: a failed run never wipes an index; a PyPI outage rebuilds from cached snapshots; per-package failure isolation
+- [x] Query layer: 5 tools, confidence semantics, `<=X` deprecations, unindexed-version windows, `never_existed`
+- [x] **Local mode:** `deptime mcp` (stdio); first-run background download + daily refresh check + hot swap; `deptime index pull|status|pack`; offline mode
+- [x] **Index distribution:** `pack` → `manifest.json` + `index.sqlite.gz`; nightly `build-index.yml` publishing to a rolling `index` release, with a shrink guard
+- [x] Hosted mode (optional): `/mcp` (stateless, spec 2026-07-28) + `/v1/*` + anonymous limits
+- [x] OSS hygiene: MIT LICENSE, PyPI metadata, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, issue forms (wrong answer / coverage / bug), PR template, `release.yml` (trusted publishing)
+- [x] Claude Code plugin (stdio `uvx deptime mcp` + skill + hook), validated with `claude plugin validate`
+- [x] 53 offline tests, including a real stdio launch, distribution and pipeline end to end. Verified the built wheel via `uvx` over stdio on real httpx wheels.
+
+---
+
+## M0 — Spikes
+
+Method and pass bars: [docs/07](docs/07-risks-and-spikes.md).
+
+- [ ] **DT-SPIKE-01**: S1 static-analysis accuracy on dynamic packages · `P0` `M` · **go/no-go**
+  - AC: a false-absent rate measured on 10 packages × 5 versions × 50 runtime-sampled symbols, with the script in `bench/s1/`. Pass at ≤ 10%; otherwise build the sandboxed dynamic fallback and re-measure; stop if it's still above 10%.
+- [ ] **DT-SPIKE-02**: S2 replacement precision on 50 known migrations · `P0` `S`
+  - AC: precision ≥ 80% at confidence ≥ 0.75; misses triaged.
+- [ ] **DT-SPIKE-03**: S3 traceback mapping (Python 3.10–3.14, pytest, library-specific exceptions) · `P0` `S`
+  - AC: 100 cases at ≥ 90% kind + package accuracy.
+- [ ] **DT-SPIKE-04**: S4 index size, build time, download size · `P0` `S`
+  - AC: `.gz` under 100 MB; nightly incremental under 30 min; p95 under 20 ms; cold build fits Actions limits (or a matrix plan).
+  - Measured 2026-10-28 (52 packages, 3,371 releases): `.gz` 78.9 MB (773 MB unpacked); cold build 35–61 min as one job per package. Nightly incremental and p95 not measured yet.
+- [ ] **DT-SPIKE-05**: S5 client compatibility matrix (local and hosted) · `P0` `M`
+  - AC: Claude Code, Cursor, Codex CLI, VS Code and Claude Desktop with `uvx deptime mcp`; handshake-era clients against hosted mode; the matrix published in the README.
+- [ ] **DT-SPIKE-06**: S6 do agents call it unprompted (plugin vs. no plugin)? · `P1` `M`
+- [ ] **DT-SPIKE-07**: S7 first-run UX on macOS, Linux and Windows · `P1` `S`
+  - AC: a useful answer within 60 s of first launch; Windows behaviour documented (feeds OSS-08).
+
+## M1 — Local alpha
+
+### Open source and release (DT-OSS)
+- [ ] **DT-OSS-01**: Publish the repo as `github.com/cschmertz/deptime` · `P0` `S`
+  - AC: public repo; description and topics (`mcp`, `python`, `coding-agents`, `deprecation`); private vulnerability reporting enabled; CI green. (`config.DEFAULT_INDEX_URL` assumes this name.)
+- [ ] **DT-OSS-02**: README proof · `P0` `M` · deps: QA-02, SPIKE-05
+  - AC: a 10-second demo GIF (traceback → answer); benchmark table; compatibility matrix; prior-art section.
+- [ ] **DT-OSS-03**: Reserve the name on PyPI · `P0` `S`
+  - AC: `deptime` 0.0.x published (also proves the packaging); name reserved.
+- [ ] **DT-OSS-04**: First published index · `P0` `S` · deps: OSS-01, DATA-01
+  - AC: `build-index.yml` run manually, then on schedule; `deptime index pull` works from the public URL on a clean machine; release-asset download counts visible.
+- [ ] **DT-OSS-05**: Tagged release through PyPI trusted publishing · `P0` `S` · deps: OSS-03
+  - AC: trusted publisher configured; `git tag v0.1.0` publishes; `uvx deptime mcp` works from PyPI.
+- [ ] **DT-OSS-06**: CHANGELOG + versioning policy · `P2` `S`
+  - AC: Keep-a-Changelog file; semver for the CLI and tool contract; the index schema version is documented.
+- [ ] **DT-OSS-07**: Supply chain · `P1` `S`
+  - AC: GitHub Actions pinned to SHAs; Dependabot for `uv.lock` and actions; `pip-audit` in CI.
+- [ ] **DT-OSS-08**: Windows support for index replace and hot swap · `P1` `S` · deps: SPIKE-07
+  - AC: download and refresh succeed while the server holds the old file open (e.g. versioned filenames plus a pointer file).
+- [ ] **DT-OSS-09**: Signed index provenance · `P2` `M`
+  - AC: `build-index.yml` produces GitHub artifact attestations; `deptime index pull --verify` checks them; documented in SECURITY.md.
+- [ ] **DT-OSS-10**: A failed first download recovers without a restart (audit D-01) · `P0` `S`
+  - AC: an index that appears on disk is opened on the next call (done); the refresh thread retries with backoff while there is no index; the note names the real cause (failed download, offline).
+
+### Data (DT-DATA)
+- [ ] **DT-DATA-01**: Index Tier A with the coverage policy · `P0` `M` · deps: SPIKE-01, SPIKE-04
+  - AC: ≥ 90% of selected releases indexed for each package; failures listed in the workflow summary.
+- [ ] **DT-DATA-02**: Index Tier B · `P1` `M` · deps: DATA-01
+  - AC: same bar as DATA-01; numpy indexed via its `.pyi` stubs; compiled-only gaps noted in `coverage.toml`.
+  - Done so far: names numpy's `__init__.py` imports and `__init__.pyi` defines (`add`, `float64`) are indexed for 2.0 and 2.1 too. `numpy.emath.sqrt` is still missing.
+- [x] **DT-DATA-03**: Cold-build strategy for CI · `P1` `S` · deps: SPIKE-04
+  - AC: the first full build completes (split into a matrix if needed); the snapshot cache stays within Actions cache limits.
+  - Done: one job per package builds and caches its own snapshots, then a publish job assembles the index from them and from the published index; only snapshots stay on disk; a timed-out build still saves its cache. The first full builds (2026-10-28) took 35–61 min with every job green; the slowest is litellm (25 min, 290 releases). The snapshot cache is 2.3 GB of the 10 GB limit, including entries from older snapshot formats that expire unused.
+- [ ] **DT-DATA-04**: Freshness SLO + yanked handling · `P1` `S`
+  - AC: a new release is indexed within 24 h (nightly); yanked releases dropped on rebuild; build date shown by `coverage` and `index status`.
+- [ ] **DT-DATA-05**: Lazy-module support (`__getattr__` re-exports) · `P1` `L` · deps: SPIKE-01
+  - AC: langchain/transformers false-absent rate below 10%.
+- [ ] **DT-DATA-06**: Stdlib module availability per Python version (typeshed `stdlib/VERSIONS`) · `P1` `S`
+- [ ] **DT-DATA-07**: Cross-package replacement hints (`google.generativeai` → `google.genai`) · `P1` `S`
+- [ ] **DT-DATA-08**: Curated migration map for the top 20 migrations (reviewed; `source="curated"`) · `P1` `M` · deps: SPIKE-02
+- [ ] **DT-DATA-09**: Pydantic model fields treated as `__init__` kwargs · `P2` `M`
+- [x] **DT-DATA-12**: Ingestion never drops an indexed release by accident (audit I-02) · `P0` `S`
+  - AC: a failed retry, `--versions` and a PyPI outage keep already-indexed releases (from the snapshot cache, else rebuilt from the index) (done); `ingest` refuses a downloaded index without `--into-downloaded` and marks it locally built only after a rebuild (done). CI still starts each night from an empty index, so carrying releases forward there needs the previous published index as a base (see DT-DATA-03).
+- [ ] **DT-DATA-16**: Store inherited members once per class, then index transformers again · `P1` `M` · deps: SPIKE-04
+  - Why: transformers 5.21.0 has ~1.5M public paths, 87% of them inherited methods repeated across ~3,700 model classes (2026-10-28), so it was taken out of `coverage.toml`.
+  - AC: snapshots record each class's own members and its bases; queries resolve `Class.member` through the bases; transformers is back in coverage with the `.gz` still under 100 MB.
+- [ ] **DT-DATA-17**: Follow a wrapper release to the distribution that holds its code · `P1` `S`
+  - Why: since 3.3.0, `fastmcp` is an empty wheel that pins `fastmcp-slim==<same version>`, so its 31 newest releases have no snapshot (2026-10-28). typer 0.12.0 (`typer-slim`) and pinecone 2.2.2–5.0.1 (`pinecone-client`) have the same shape.
+  - AC: when a release has no code for its import names and pins one distribution at the same version, ingest analyses that distribution's artifact and records it as the source file; fastmcp 3.3.0+ is indexed. A pin to a different version (dspy 0.1.5 → `dspy-ai==2.4.5`) is still reported as failed.
+- [ ] **DT-DATA-18**: Snapshot builds keep memory flat across releases · `P2` `S`
+  - Why: building litellm's 290 releases in one process grows by ~45 MB per release and never gives it back, peaking at 11.9 GB of a 16 GB runner (2026-10-28). Only cold builds are affected; nightly runs build a few releases.
+  - AC: memory after each release returns to a fixed baseline (e.g. clear griffe's caches, or build each release in a subprocess); litellm's cold build stays under 4 GB.
+
+### Core logic (DT-CORE)
+- [ ] **DT-CORE-01**: Benchmark-driven tuning of candidate selection and ranking · `P0` `M` · deps: QA-01
+  - AC: root-cause accuracy ≥ 80% (M1 floor: 70%).
+- [ ] **DT-CORE-02**: Instance-chain hints for `object_attribute` (prefer frame and referenced-name evidence; show ambiguity) · `P2` `M`
+- [ ] **DT-CORE-03**: Import-name collision disambiguation (`agents`) via installed versions · `P1` `S`
+- [ ] **DT-CORE-04**: Signature-similarity "moved" heuristic (only if S2 shows a gain) · `P2` `M`
+- [ ] **DT-CORE-05**: Library-specific migration exceptions (openai `APIRemovedInV1`, pydantic `PydanticImportError`) · `P1` `S` · deps: SPIKE-03
+  - AC: bench cases `openai-v1-chatcompletion` and `pydantic-basesettings-moved` pass.
+- [ ] **DT-CORE-06**: Mine replacement hints from the live error text (e.g. mcp 2.x's FastMCP → MCPServer hint), checked against the index · `P1` `S`
+- [ ] **DT-CORE-07**: `check_symbols` from a code snippet (extract imports and attributes with `ast`) · `P2` `M`
+- [ ] **DT-CORE-08**: Sanitize mined text (control characters, instruction-like content), with adversarial tests · `P0` `S`
+- [ ] **DT-CORE-09**: Positional-argument changes (`too_many_positional` → `param_kind_changed`) · `P2` `S`
+- [x] **DT-CORE-10**: `diff_versions` filters, sorts and counts in SQL, so `truncated` is truthful on large diffs (audit Q-01) · `P0` `S`
+- [x] **DT-CORE-11**: Long tracebacks keep their tail; the MCP input limit is 200K characters (audit Q-02) · `P0` `S`
+- [ ] **DT-CORE-12**: Replacement hints are trustworthy before they reach prose (audit Q-03) · `P0` `M`
+  - AC: only hints with confidence ≥ 0.75 appear in `explanation` (done); the generic `use X` pattern only takes identifier-shaped targets; targets are checked against the next indexed snapshot.
+- [x] **DT-CORE-15**: Optional → required parameters: `param_now_required` / `param_now_optional` events, used for "missing required argument" and checked against the installed release (audit I-10, Q-17) · `P0` `S`
+- [ ] **DT-CORE-16**: Errors raised inside a dependency consider the package being called (audit Q-18) · `P0` `S`
+  - AC: other indexed packages are searched, installed first, keeping only concrete changes (done; bench case `openai-httpx-proxies-internal`); candidates ranked by `Requires-Dist` once per-release dependency data exists.
+
+### Quality (DT-QA)
+- [ ] **DT-QA-01**: 200-traceback benchmark from real GitHub issues (`bench/cases/*.jsonl`) · `P0` `L`
+- [ ] **DT-QA-02**: Benchmark runner + CI report (fail on a regression above 2 points) · `P0` `M` · deps: QA-01
+- [ ] **DT-QA-03**: Golden tests per Tier A package against the published index (nightly, network-marked) · `P1` `M`
+
+## M2 — Public launch (DT-GTM)
+
+- [ ] **DT-GTM-01**: Generate the 5 rename-map pages from the index (`site/`) · `P0` `M` · deps: DATA-01
+- [ ] **DT-GTM-02**: Landing page (or GitHub Pages) with install, demo, benchmark, privacy · `P1` `S`
+- [ ] **DT-GTM-03**: Registry listings · `P0` `S` · deps: OSS-05
+  - AC: official MCP Registry `server.json` (PyPI package, stdio) under `io.github.cschmertz/deptime`; Smithery, Glama, PulseMCP, mcp.so, mcpservers.org, MCP Market; Glama quality score checked.
+- [ ] **DT-GTM-04**: Claude Code plugin release (marketplace) · `P0` `S` · deps: SPIKE-06, OSS-05
+- [ ] **DT-GTM-05**: Cursor rule + AGENTS.md snippet, tested in fresh projects · `P1` `S`
+- [ ] **DT-GTM-06**: Benchmark-led launch post (Show HN, r/Python, r/LangChain, r/ClaudeAI, dev.to) · `P0` `M` · deps: QA-02
+- [ ] **DT-GTM-07**: Outreach: since-cutoff (collaborate or share the backend), Context7, Ref, Tessl · `P1` `S`
+
+## M3 — Optional hosted instance (DT-HOST)
+
+Options and costs: [docs/05](docs/05-hosting-and-sustainability.md).
+
+- [ ] **DT-HOST-01**: Deploy a public instance (Cloud Run free tier or Fly.io) · `P1` `S`
+  - AC: `/healthz` green; index downloaded at start-up and persisted (volume or baked into the image); works as a claude.ai custom connector.
+- [ ] **DT-HOST-02**: Public-host hardening · `P0` `S` · before HOST-01 goes public
+  - AC: MCP transport allowed hosts and origins; proxy burst limits; body caps confirmed.
+- [ ] **DT-HOST-03**: Persistent rate-limit store (replaces in-memory) · `P2` `S`
+- [ ] **DT-HOST-04**: Privacy notice for the hosted instance ([docs/08](docs/08-privacy-and-security.md)) · `P0` `S` · before HOST-01 goes public
+
+## M4 — Review
+
+- [ ] **DT-REVIEW-60**: Accuracy ≥ 70%, and ≥ 50 stars or ≥ 100 index downloads/week · `P0`
+- [ ] **DT-REVIEW-90**: Keep investing, or move to maintenance mode ([docs/06](docs/06-launch-and-adoption.md)) · `P0`
+
+## Parked
+
+- npm/TypeScript ecosystem (Augments covers npm).
+- GitHub Action (checks a PR's dependency bumps against the index).
+- A dataset export or licensing API for docs-context tools.
+- MCP resources: rename maps as prefetchable context.