django-spec-cli 0.1.0__tar.gz → 0.2.0__tar.gz

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0] — 2026-10-20
+
+### Changed
+- **The kernel floor is `django-service-specs>=0.11.0`, the first kernel
+  release without its own copy of the command.** Below it the kernel still
+  shipped `django_service_specs.commands` and registered its own `W001` and
+  `W003` over its own `SpecCommand`, so a project listing both
+  `"django_service_specs"` and `"django_spec_cli"` saw each id for the
+  commands subclassing its own class, and a command that could not be loaded
+  was reported under both. From 0.11.0 the kernel's app registers no check, so
+  a project that still lists `"django_service_specs"` sees nothing from it, and
+  the checks are reported once, under `django_spec_cli.`, by listing
+  `"django_spec_cli"`.
+
 ## [0.1.0] — 2026-10-20
 
 ### Added
@@ -31,5 +45,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `django-service-specs>=0.10.0`, the first kernel release with every name the
   command reads at its root.
 
-[Unreleased]: https://github.com/Artui/django-spec-cli/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/Artui/django-spec-cli/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/Artui/django-spec-cli/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/Artui/django-spec-cli/compare/v0.0.0...v0.1.0

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/CLAUDE.md

@@ -12,8 +12,8 @@ refusal. Two system checks, `django_spec_cli.W001` and `W003`, report a served
 spec that authorizes nothing and a command that cannot be loaded.
 
 It is the kernel's `commands/` subpackage, moved out with its history so that
-the kernel can carry no transport. Kernel 0.10.x still ships its own copy, until
-a later kernel release removes it. Two positions follow from the move:
+the kernel can carry no transport, and the kernel carries no copy of it from
+0.11.0. Two positions follow from the move:
 
 - **The kernel is read through its root and nothing else.** Every kernel name
   this package uses is in `django_service_specs.__all__`, and every import of
@@ -84,20 +84,9 @@ Each of these reads as an oversight and is not.
 - **The checks are registered by this package's own `AppConfig`.** A project
   lists `"django_spec_cli"` in `INSTALLED_APPS` to get `W001` and `W003`. The
   kernel keeps the registry fact the check reads, `unguarded_specs`, because
-  another transport can ask the same question of a registry.
-- **Until the kernel removes its own copy of the command, both copies exist.**
-  Kernel 0.10.x still ships `commands/` and registers `django_service_specs.W001`
-  over its own `SpecCommand`, and its root re-exports every moved name, so a
-  missed import rewrite resolves against the kernel's copy and passes while
-  testing the wrong code. The suite cannot keep `django_service_specs.commands`
-  out of `sys.modules`, since the kernel's root imports it. Two guards hold the
-  line instead. `tests/test_kernel_copy_references.py` parses every module and
-  every python block in the docs and fails on any reference through
-  `django_service_specs` to a name this package also exports, to
-  `check_unguarded_specs` or `command_output`, or to a moved module. The
-  session-finish hook in `tests/conftest.py` fails the run if the kernel's
-  `checks` or `apps` was imported, or if a module of this repository holds an
-  object from the kernel's copy.
+  another transport can ask the same question of a registry. The kernel's own
+  app stays importable and registers nothing, so listing only it gets no check
+  (`tests/test_checks.py`, `test_the_kernel_s_app_registers_no_check_of_its_own`).
 - **The test settings list no kernel app.** The package needs nothing of the
   kernel switched on, and the suite shows it.
 
@@ -148,7 +137,7 @@ configured and enforced. isort order is stdlib, third party, first party.
 | --- | --- | --- |
 | Python | 3.10 | 3.10 through 3.14 |
 | Django | 4.2 | 4.2, 5.0, 5.1, 5.2, 6.0, 6.1 |
-| django-service-specs | 0.10.0 | the newest release, and the floor in the `floor` job |
+| django-service-specs | 0.11.0 | the newest release, and the floor in the `floor` job |
 
 The Python and Django floors are the kernel's, and cannot sit below them.
 

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: django-spec-cli
-Version: 0.1.0
+Version: 0.2.0
 Summary: Run a django-service-specs registry from manage.py: one subcommand per spec, options generated from its parameters, exit codes for every refusal.
 Project-URL: Homepage, https://github.com/Artui/django-spec-cli
 Project-URL: Repository, https://github.com/Artui/django-spec-cli
@@ -30,7 +30,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
-Requires-Dist: django-service-specs>=0.10.0
+Requires-Dist: django-service-specs>=0.11.0
 Requires-Dist: django>=4.2
 Description-Content-Type: text/markdown
 
@@ -61,7 +61,7 @@ the import path, the system check ids and the setting key are this package's.
 pip install django-spec-cli
 ```
 
-Python 3.10 or later, Django 4.2 or later, and `django-service-specs` 0.10.0 or
+Python 3.10 or later, Django 4.2 or later, and `django-service-specs` 0.11.0 or
 later, which it installs.
 
 ## Quickstart
@@ -96,13 +96,9 @@ every open spec a `SpecCommand` serves as `django_spec_cli.W001`, and a command
 that could not be loaded as `django_spec_cli.W003`. The command itself needs no
 app listed.
 
-Until the kernel removes its own copy of the command, kernel 0.10.x still
-registers `django_service_specs.W001` and `W003` over its own `SpecCommand`. A
-project listing both `"django_service_specs"` and `"django_spec_cli"` sees both
-ids: each walk reports the commands subclassing its own class, and a command
-that cannot be loaded is reported by each. A project that moves its imports
-here and lists only `"django_service_specs"` gets no check for the moved
-commands, so list `"django_spec_cli"`.
+The kernel keeps no check of its own: its app registers nothing, so a project
+listing only `"django_service_specs"` gets no check for a command. List
+`"django_spec_cli"`.
 
 ## Documentation
 

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/README.md

@@ -25,7 +25,7 @@ the import path, the system check ids and the setting key are this package's.
 pip install django-spec-cli
 ```
 
-Python 3.10 or later, Django 4.2 or later, and `django-service-specs` 0.10.0 or
+Python 3.10 or later, Django 4.2 or later, and `django-service-specs` 0.11.0 or
 later, which it installs.
 
 ## Quickstart
@@ -60,13 +60,9 @@ every open spec a `SpecCommand` serves as `django_spec_cli.W001`, and a command
 that could not be loaded as `django_spec_cli.W003`. The command itself needs no
 app listed.
 
-Until the kernel removes its own copy of the command, kernel 0.10.x still
-registers `django_service_specs.W001` and `W003` over its own `SpecCommand`. A
-project listing both `"django_service_specs"` and `"django_spec_cli"` sees both
-ids: each walk reports the commands subclassing its own class, and a command
-that cannot be loaded is reported by each. A project that moves its imports
-here and lists only `"django_service_specs"` gets no check for the moved
-commands, so list `"django_spec_cli"`.
+The kernel keeps no check of its own: its app registers nothing, so a project
+listing only `"django_service_specs"` gets no check for a command. List
+`"django_spec_cli"`.
 
 ## Documentation
 

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/django_spec_cli/version.py

@@ -2,6 +2,6 @@
 
 from __future__ import annotations
 
-__version__: str = "0.1.0"
+__version__: str = "0.2.0"
 
 __all__ = ["__version__"]

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/docs/index.md

@@ -27,7 +27,7 @@ pip install django-spec-cli
 ```
 
 It installs [`django-service-specs`](https://artui.github.io/django-service-specs/), the kernel whose specs it serves,
-from 0.10.0, on Python 3.10 and Django 4.2 or later. The command line was the
+from 0.11.0, on Python 3.10 and Django 4.2 or later. The command line was the
 kernel's `commands/` subpackage, and moved here so the kernel carries no
 transport.
 
@@ -247,14 +247,8 @@ be loaded to be checked as `django_spec_cli.W003`. There is no
 none reaches a registry. Both are warnings, and `SILENCED_SYSTEM_CHECKS`
 silences one by id.
 
-Until the kernel removes its own copy of the command, kernel 0.10.x still
-registers `django_service_specs.W001` and `W003`, over its own `SpecCommand`
-class rather than this package's. A project that lists both
-`"django_service_specs"` and `"django_spec_cli"` sees both ids, the kernel's
-for commands still subclassing its copy and this package's for commands
-subclassing `django_spec_cli.SpecCommand`, and a command that cannot be loaded
-gets a `W003` from each. A project that moves its imports here and lists only
-`"django_service_specs"` gets no check for the moved commands at all, so list
+The kernel keeps no check of its own: its app registers nothing, so a project
+listing only `"django_service_specs"` gets no check for a command. List
 `"django_spec_cli"`.
 
 A `SpecCommand` keeps Django's system checks on, so on the command line the

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/pyproject.toml

@@ -40,11 +40,14 @@ dependencies = [
     # kernel's specs, so this package cannot support a Django the kernel does
     # not.
     "django>=4.2",
-    # The first kernel release with ``relax_partial``, ``refusal_messages`` and
-    # ``unguarded_specs`` at its root. A separate distribution reads only the
-    # kernel's root surface, and below 0.10.0 those names are private or live
-    # elsewhere.
-    "django-service-specs>=0.10.0",
+    # The first kernel release without its own copy of the command. A separate
+    # distribution reads only the kernel's root surface, and below 0.11.0 the
+    # kernel still ships ``commands/``, registers its own ``W001`` and ``W003``
+    # and re-exports every moved name, so a project listing both apps sees two
+    # sets of ids and a missed import rewrite resolves against the wrong code.
+    # ``relax_partial``, ``refusal_messages`` and ``unguarded_specs`` are at its
+    # root from 0.10.0.
+    "django-service-specs>=0.11.0",
 ]
 
 [project.urls]
@@ -144,7 +147,7 @@ skip-magic-trailing-comma = false
 root = ["./django_spec_cli"]
 
 [tool.bumpversion]
-current_version = "0.1.0"
+current_version = "0.2.0"
 allow_dirty = false
 commit = false
 tag = false

django_spec_cli-0.2.0/tests/conftest.py

@@ -0,0 +1,19 @@
+"""Fixtures the suite shares.
+
+``keep_the_test_connection`` is the one: two modules call ``run_from_argv`` and
+need it.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+
+@pytest.fixture
+def keep_the_test_connection(monkeypatch: pytest.MonkeyPatch) -> None:
+    """For a test calling ``run_from_argv``, which closes every connection when it ends.
+
+    That would close the one the test's transaction is on. Opt-in rather than
+    autouse, so no other test runs with ``close_all`` patched out.
+    """
+    monkeypatch.setattr("django.db.connections.close_all", lambda: None)

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/tests/conftest_settings.py

@@ -3,9 +3,7 @@
 SQLite, and no DRF anywhere: the kernel this package serves exists for
 dispatch without it, and a suite that could import it could not notice either
 package reaching for it. No kernel app is listed either: the command needs
-nothing of the kernel switched on, and with the kernel's app out its own copy
-of the system check never runs beside this package's. The two contrib apps are
-the ones a spec's permission check and principal resolution reach, since a
+nothing of the kernel switched on. The two contrib apps are the ones a spec's permission check and principal resolution reach, since a
 principal is a Django user.
 
 The test database is a **file**, not ``:memory:``. An in-memory SQLite database

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/tests/test_checks.py

@@ -285,35 +285,12 @@ execute_from_command_line(["manage.py", "unguarded_plain"])
             completed.stderr
         )
 
-
-class TestBesideTheKernelsCopy:
-    """Kernel 0.10.x still ships the command and registers its own check over its own class.
-
-    A fresh interpreter each, listing the kernel's app, which the suite's own
-    settings never do. When the kernel's copy goes, these fail, and the page's
-    paragraph on running both goes with them.
-    """
-
-    def test_listing_both_apps_reports_each_copy_s_commands_under_its_own_id(self) -> None:
-        completed = run_project([*BASE_APPS, "django_service_specs", "django_spec_cli"], CHECK)
-        assert completed.returncode == 0, completed.stderr
-        # The commands here subclass this package's class, which the kernel's
-        # walk does not recognise, so their open spec is reported once.
-        assert "(django_spec_cli.W001) 'open_service' in manage.py unguarded_report" in (
-            completed.stdout
-        )
-        assert "django_service_specs.W001" not in completed.stdout
-        # Both walks load every command, so one that cannot be loaded is
-        # reported by each.
-        for check in ("django_spec_cli.W003", "django_service_specs.W003"):
-            assert f"({check}) The command 'unguarded_broken_import'" in completed.stdout
-
-    def test_listing_only_the_kernel_s_app_checks_no_moved_command(self) -> None:
+    def test_the_kernel_s_app_registers_no_check_of_its_own(self) -> None:
+        # The kernel keeps an ``AppConfig`` so a project listing it still
+        # starts, but it registers nothing: the checks live here, so listing
+        # only the kernel's app reports no command, moved or not.
         completed = run_project([*BASE_APPS, "django_service_specs"], CHECK)
         assert completed.returncode == 0, completed.stderr
-        assert "authorizes nothing" not in completed.stdout
-        assert "django_spec_cli." not in completed.stdout
-        # Not a probe that ran no check: the kernel's own walk did run.
-        assert "(django_service_specs.W003) The command 'unguarded_broken_import'" in (
-            completed.stdout
-        )
+        # The one assertion that holds the claim: on a kernel still carrying its
+        # copy, this fails on the kernel's W003 for the unloadable command.
+        assert "django_service_specs." not in completed.stdout

{django_spec_cli-0.1.0 → django_spec_cli-0.2.0}/uv.lock

@@ -438,16 +438,16 @@ wheels = [
 
 [[package]]
 name = "django-service-specs"
-version = "0.10.0"
+version = "0.11.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django", version = "5.2.18", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.12'" },
     { name = "django", version = "6.1.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/b5/b3/d56cbc38f2cef7cb81e6561e5c31d18a19e2be79b57e87a66287976bf4c0/django_service_specs-0.10.0.tar.gz", hash = "sha256:12cbb3dc75320a6d1d7673512eda94df6bc0beef0212a726e3dba722b6cbab69", size = 1005273, upload-time = "2026-10-20T13:21:24.558Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/4d/cc/edf2c86492b44d4a313978440f510a2faeed85da86833c1418db98e54dc2/django_service_specs-0.11.0.tar.gz", hash = "sha256:926fa982735696153dc0ce3238c42c10c95a30b51c7a274b4aea0e55114ee0a3", size = 951537, upload-time = "2026-10-20T19:28:24.563Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5a/dd/47306f1c33108b881c9bf74266383f71d5a2e97eea87c09870c58890fbd1/django_service_specs-0.10.0-py3-none-any.whl", hash = "sha256:0a4e1f5824ddff85345628f3fd289a55425e2463721a437d1c10b79e45ecb4e4", size = 463139, upload-time = "2026-10-20T13:21:22.442Z" },
+    { url = "https://files.pythonhosted.org/packages/67/01/34ed8dc96613e5aff52058c659359a315186e38711c81145c89f195cdbe3/django_service_specs-0.11.0-py3-none-any.whl", hash = "sha256:a4ddc9ff79ec3df475dcef2a04b1eebee98c37f7775d116e5ccb28fbe232aeaa", size = 432549, upload-time = "2026-10-20T19:28:22.69Z" },
 ]
 
 [package.optional-dependencies]
@@ -490,7 +490,7 @@ docs = [
 [package.metadata]
 requires-dist = [
     { name = "django", specifier = ">=4.2" },
-    { name = "django-service-specs", specifier = ">=0.10.0" },
+    { name = "django-service-specs", specifier = ">=0.11.0" },
 ]
 
 [package.metadata.requires-dev]

django_spec_cli-0.1.0/tests/conftest.py

@@ -1,103 +0,0 @@
-"""Suite-wide hooks: the guard that the suite tests this package and not the kernel's copy.
-
-It also holds the one fixture two modules share, ``keep_the_test_connection``.
-
-Kernel 0.10.x still ships the command half this package was moved out of:
-``django_service_specs.commands``, ``types/exit_code.py``, ``checks.py`` and
-``apps.py``, and its root re-exports every moving name. A missed import rewrite
-therefore still resolves, against the kernel's copy, and a test passes while
-testing the wrong code. Nothing at import fails, so the guard reads what the run
-actually loaded once it is over.
-
-It cannot ask that ``django_service_specs.commands`` stay out of ``sys.modules``:
-the kernel's root imports it, and every kernel name this package reads comes
-through the root. It asks the two questions that do separate the copies:
-
-- the kernel's ``checks`` and ``apps`` are never imported, which nothing does
-  while the test settings list no kernel app, except a ``monkeypatch`` string
-  or an import still naming them;
-- no module of this package, of the suite or of the docs examples holds an
-  object the kernel's copy defines: a module, class or function from one of the
-  moving kernel modules, or the kernel's ``command_output``, which lives in a
-  module that does not move.
-"""
-
-from __future__ import annotations
-
-import sys
-from types import ModuleType
-from typing import Any
-
-import pytest
-
-_KERNEL_COPY = (
-    "django_service_specs.commands",
-    "django_service_specs.types.exit_code",
-    "django_service_specs.checks",
-    "django_service_specs.apps",
-)
-_NEVER_IMPORTED = ("django_service_specs.checks", "django_service_specs.apps")
-_OURS = ("django_spec_cli", "tests", "docs")
-
-
-def _within(name: str, packages: tuple[str, ...]) -> bool:
-    return any(name == package or name.startswith(f"{package}.") for package in packages)
-
-
-def _kernel_copy_of(value: Any) -> str | None:
-    """The kernel module ``value`` comes from, when that module is the kernel's copy.
-
-    The ``command_output`` name condition is held by
-    test_the_guard_passes_the_kernel_s_settings_reader_that_stays_the_kernel_s,
-    the module condition beside it by
-    test_the_guard_passes_this_package_s_own_setting_reader.
-    """
-    if isinstance(value, ModuleType):
-        origin = value.__name__
-    else:
-        origin = getattr(value, "__module__", None)
-        if not isinstance(origin, str):
-            return None
-        if origin == "django_service_specs.settings" and (
-            getattr(value, "__name__", None) == "command_output"
-        ):
-            return f"{origin}.command_output"
-    return origin if _within(origin, _KERNEL_COPY) else None
-
-
-def kernel_copies_loaded(modules: dict[str, ModuleType | None]) -> list[str]:
-    """Every place in ``modules`` that reaches the kernel's copy of this package.
-
-    The ``module is None`` condition is held by
-    test_the_guard_skips_a_module_import_blocked_with_none, the package
-    condition beside it by test_the_guard_reads_only_this_repository_s_modules.
-    """
-    found = [f"{name} is imported" for name in _NEVER_IMPORTED if name in modules]
-    for name, module in sorted(modules.items()):
-        if not _within(name, _OURS) or module is None:
-            continue
-        for attribute, value in sorted(vars(module).items()):
-            origin = _kernel_copy_of(value)
-            if origin is not None:
-                found.append(f"{name}.{attribute} is the kernel's {origin}")
-    return found
-
-
-@pytest.fixture
-def keep_the_test_connection(monkeypatch: pytest.MonkeyPatch) -> None:
-    """For a test calling ``run_from_argv``, which closes every connection when it ends.
-
-    That would close the one the test's transaction is on. Opt-in rather than
-    autouse, so no other test runs with ``close_all`` patched out.
-    """
-    monkeypatch.setattr("django.db.connections.close_all", lambda: None)
-
-
-def pytest_sessionfinish(session: pytest.Session, exitstatus: int) -> None:
-    found = kernel_copies_loaded(dict(sys.modules))
-    if found:
-        reporter = session.config.pluginmanager.get_plugin("terminalreporter")
-        lines = ["The suite reached the kernel's copy of this package:", *found]
-        if reporter is not None:
-            reporter.write_line("\n".join(lines), red=True)
-        session.exitstatus = pytest.ExitCode.TESTS_FAILED

django_spec_cli-0.1.0/tests/test_conftest.py

@@ -1,63 +0,0 @@
-from __future__ import annotations
-
-import sys
-from types import ModuleType
-
-import django_service_specs
-
-from tests.conftest import kernel_copies_loaded
-
-
-def _module(name: str, **values: object) -> ModuleType:
-    module = ModuleType(name)
-    vars(module).update(values)
-    return module
-
-
-def test_the_guard_finds_a_name_imported_from_the_kernel_s_copy() -> None:
-    # Read off the root inside the test, never held as a global here, or the
-    # guard would find this module too.
-    copy = django_service_specs.SpecCommand
-    found = kernel_copies_loaded({"tests.stray": _module("tests.stray", SpecCommand=copy)})
-    assert found == [
-        "tests.stray.SpecCommand is the kernel's django_service_specs.commands.spec_command"
-    ]
-
-
-def test_the_guard_finds_a_kernel_copy_module_and_the_kernel_s_setting_reader() -> None:
-    commands = sys.modules["django_service_specs.commands"]
-    reader = sys.modules["django_service_specs.settings"].command_output
-    found = kernel_copies_loaded(
-        {"docs.stray": _module("docs.stray", commands=commands, command_output=reader)}
-    )
-    assert found == [
-        "docs.stray.command_output is the kernel's django_service_specs.settings.command_output",
-        "docs.stray.commands is the kernel's django_service_specs.commands",
-    ]
-
-
-def test_the_guard_finds_the_kernel_s_checks_imported_at_all() -> None:
-    found = kernel_copies_loaded({"django_service_specs.checks": _module("x")})
-    assert found == ["django_service_specs.checks is imported"]
-
-
-def test_the_guard_reads_only_this_repository_s_modules() -> None:
-    copy = django_service_specs.SpecCommand
-    assert kernel_copies_loaded({"elsewhere": _module("elsewhere", SpecCommand=copy)}) == []
-
-
-def test_the_guard_passes_the_kernel_s_settings_reader_that_stays_the_kernel_s() -> None:
-    # ``settings.py`` does not move: only ``command_output`` in it is the copy.
-    reader = sys.modules["django_service_specs.settings"].max_array_length
-    assert kernel_copies_loaded({"tests.stray": _module("tests.stray", reader=reader)}) == []
-
-
-def test_the_guard_skips_a_module_import_blocked_with_none() -> None:
-    # ``sys.modules[name] = None`` is how an import is blocked, and such an
-    # entry has no namespace to read.
-    assert kernel_copies_loaded({"tests.blocked": None}) == []
-
-
-def test_the_guard_passes_this_package_s_own_setting_reader() -> None:
-    reader = sys.modules["django_spec_cli.settings"].command_output
-    assert kernel_copies_loaded({"tests.own": _module("tests.own", reader=reader)}) == []

django_spec_cli-0.1.0/tests/test_kernel_copy_references.py

@@ -1,213 +0,0 @@
-"""No source in this repository reaches the kernel's copy of this package by name.
-
-Kernel 0.10.x still ships the command half this package was moved out of, and
-its root re-exports every moving name, so ``django_service_specs.ExitCode``
-resolves, to the kernel's class, and a test reading it passes while testing the
-wrong code. ``tests/conftest.py``'s session-finish guard sees only module
-globals the run loaded; a function-local import, an attribute read through the
-kernel's root and a python block in a page are invisible to it. This reads the
-source instead, with ``ast``, so an import at any depth, an aliased module and
-an attribute chain are all one shape.
-"""
-
-from __future__ import annotations
-
-import ast
-import re
-from pathlib import Path
-
-import django_service_specs
-import pytest
-
-import django_spec_cli
-from tests.utils import REPO_ROOT
-
-KERNEL = "django_service_specs"
-_MOVED_MODULES = ("commands", "checks", "apps")
-_MOVED_PATHS = tuple(f"{KERNEL}.{module}" for module in (*_MOVED_MODULES, "types.exit_code"))
-# ``__version__`` is in both roots and is each package's own, not a moved name.
-FORBIDDEN = (set(django_spec_cli.__all__) & set(django_service_specs.__all__)) - {"__version__"} | {
-    "check_unguarded_specs",
-    "command_output",
-    *_MOVED_MODULES,
-}
-"""Names that, read through the kernel, are the kernel's copy of this package."""
-
-EXEMPT = {
-    # The guard names the kernel's copy to look for it.
-    "tests/conftest.py",
-    # The guard's own tests hand it the kernel's objects to find.
-    "tests/test_conftest.py",
-    # This file, whose fixtures below are the shapes it rejects.
-    "tests/test_kernel_copy_references.py",
-}
-"""Files that name the kernel's copy on purpose, each for the reason beside it."""
-
-
-def _forbidden_path(path: str) -> bool:
-    if path in _MOVED_PATHS or path.startswith(tuple(f"{p}." for p in _MOVED_PATHS)):
-        return True
-    head, _, rest = path.partition(".")
-    return head == KERNEL and rest.split(".")[0] in FORBIDDEN
-
-
-def _dotted(node: ast.expr) -> list[str] | None:
-    parts: list[str] = []
-    while isinstance(node, ast.Attribute):
-        parts.append(node.attr)
-        node = node.value
-    if not isinstance(node, ast.Name):
-        return None
-    return [node.id, *reversed(parts)]
-
-
-def kernel_copy_references(source: str) -> list[str]:
-    """Every reference in ``source`` that reaches the kernel's copy of this package."""
-    tree = ast.parse(source)
-    # Every name the kernel's root is bound to, ``import django_service_specs``
-    # and ``import django_service_specs.x`` included, wherever it is bound.
-    aliases = {
-        alias.asname or alias.name.split(".")[0]
-        for node in ast.walk(tree)
-        if isinstance(node, ast.Import)
-        for alias in node.names
-        if alias.name == KERNEL or (alias.name.startswith(f"{KERNEL}.") and not alias.asname)
-    }
-    found: list[str] = []
-    for node in ast.walk(tree):
-        if isinstance(node, ast.Import):
-            found += [
-                f"{node.lineno}: import {alias.name}"
-                for alias in node.names
-                if _forbidden_path(alias.name)
-            ]
-        elif isinstance(node, ast.ImportFrom) and (node.module or "").split(".")[0] == KERNEL:
-            module = node.module or ""
-            found += [
-                f"{node.lineno}: from {module} import {alias.name}"
-                for alias in node.names
-                if _forbidden_path(module) or alias.name in FORBIDDEN
-            ]
-        elif isinstance(node, ast.Attribute) and isinstance(node.ctx, ast.Load):
-            parts = _dotted(node)
-            if parts and parts[0] in aliases:
-                path = [KERNEL, *parts[1:]]
-                # The shortest forbidden prefix of a chain only, so one read
-                # is one finding: ``k.SpecCommand.help`` reports
-                # ``k.SpecCommand``.
-                if _forbidden_path(".".join(path)) and not _forbidden_path(".".join(path[:-1])):
-                    found.append(f"{node.lineno}: {'.'.join(parts)}")
-        elif (
-            isinstance(node, ast.Constant)
-            and isinstance(node.value, str)
-            # A dotted path handed to ``monkeypatch.setattr`` or ``import_module``.
-            and re.fullmatch(rf"{KERNEL}(\.\w+)+", node.value)
-            and _forbidden_path(node.value)
-        ):
-            found.append(f"{node.lineno}: {node.value!r}")
-    return found
-
-
-def _python_sources() -> list[Path]:
-    return sorted(
-        path
-        for directory in ("django_spec_cli", "tests", "docs")
-        for path in (REPO_ROOT / directory).rglob("*.py")
-        if path.relative_to(REPO_ROOT).as_posix() not in EXEMPT
-    )
-
-
-def _page_blocks() -> list[tuple[str, int, str]]:
-    blocks = []
-    for page in sorted([*(REPO_ROOT / "docs").glob("*.md"), REPO_ROOT / "README.md"]):
-        for index, block in enumerate(re.findall(r"```python\n(.*?)```", page.read_text(), re.S)):
-            # A snippet include names a file under docs/examples, read above.
-            if "--8<--" not in block:
-                blocks.append((page.relative_to(REPO_ROOT).as_posix(), index, block))
-    return blocks
-
-
-def test_the_sources_read_are_the_package_the_suite_and_the_pages() -> None:
-    # An empty walk would pass the two tests below with nothing read.
-    read = {path.relative_to(REPO_ROOT).as_posix() for path in _python_sources()}
-    assert {"django_spec_cli/spec_command.py", "docs/examples/commands.py"} <= read
-    assert {"tests/test_checks.py", "tests/test_spec_command.py"} <= read
-    assert {page for page, _, _ in _page_blocks()} == {"README.md", "docs/index.md"}
-    assert {"SpecCommand", "ExitCode", "exit_code_for"} <= FORBIDDEN
-
-
-@pytest.mark.parametrize(
-    "path", _python_sources(), ids=lambda path: path.relative_to(REPO_ROOT).as_posix()
-)
-def test_no_module_reaches_the_kernel_s_copy(path: Path) -> None:
-    assert kernel_copy_references(path.read_text()) == []
-
-
-@pytest.mark.parametrize(
-    ("page", "index", "block"), _page_blocks(), ids=lambda value: str(value)[:20]
-)
-def test_no_python_block_on_a_page_reaches_the_kernel_s_copy(
-    page: str, index: int, block: str
-) -> None:
-    assert kernel_copy_references(block) == [], (page, index)
-
-
-@pytest.mark.parametrize(
-    ("source", "expected"),
-    [
-        (
-            "import django_service_specs\ndjango_service_specs.ExitCode\n",
-            ["2: django_service_specs.ExitCode"],
-        ),
-        ("import django_service_specs as k\nk.SpecCommand.help\n", ["2: k.SpecCommand"]),
-        (
-            "import django_service_specs.registry\ndjango_service_specs.exit_code_for(e)\n",
-            ["2: django_service_specs.exit_code_for"],
-        ),
-        (
-            "def f():\n    from django_service_specs import ExitCode\n",
-            ["2: from django_service_specs import ExitCode"],
-        ),
-        (
-            "from django_service_specs.settings import command_output\n",
-            ["1: from django_service_specs.settings import command_output"],
-        ),
-        (
-            "from django_service_specs import check_unguarded_specs\n",
-            ["1: from django_service_specs import check_unguarded_specs"],
-        ),
-        (
-            "from django_service_specs.commands.argv import utils\n",
-            ["1: from django_service_specs.commands.argv import utils"],
-        ),
-        (
-            "import django_service_specs.types.exit_code\n",
-            ["1: import django_service_specs.types.exit_code"],
-        ),
-        (
-            "import django_service_specs\ndjango_service_specs.types.exit_code.ExitCode\n",
-            ["2: django_service_specs.types.exit_code"],
-        ),
-        (
-            "patch('django_service_specs.checks.get_commands')\n",
-            ["1: 'django_service_specs.checks.get_commands'"],
-        ),
-    ],
-)
-def test_each_route_to_the_kernel_s_copy_is_found(source: str, expected: list[str]) -> None:
-    assert kernel_copy_references(source) == expected
-
-
-@pytest.mark.parametrize(
-    "source",
-    [
-        "from django_service_specs import SpecRegistry, unguarded_specs\n",
-        "import django_service_specs\ndjango_service_specs.REFUSALS\n",
-        "from django_service_specs.adapters.pydantic import PydanticPresenter\n",
-        "from django_spec_cli import ExitCode, SpecCommand\n",
-        "ids = ['django_service_specs.W001', 'django_service_specs']\n",
-        "import other as django_service_specs\nother.ExitCode\n",
-    ],
-)
-def test_a_kernel_name_that_stays_the_kernel_s_is_not_found(source: str) -> None:
-    assert kernel_copy_references(source) == []