import-effects 0.0.1__tar.gz

import_effects-0.0.1/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,33 @@
+name: Bug report
+description: Report incorrect or missing import observations
+title: "bug: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Do not paste secrets or reports containing private paths without sanitizing them.
+  - type: input
+    id: version
+    attributes:
+      label: import-effects version
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Python and operating system
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+

import_effects-0.0.1/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,19 @@
+name: Feature request
+description: Propose a reliable new observation or developer workflow
+title: "feat: "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Reliable runtime evidence or API
+      description: Explain how the behavior can be observed without overstating attribution.
+    validations:
+      required: true
+

import_effects-0.0.1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Summary
+
+## Verification
+
+- [ ] `ruff format --check .`
+- [ ] `ruff check .`
+- [ ] `mypy`
+- [ ] `pytest --cov`
+- [ ] `python -m build && twine check dist/*`
+- [ ] No private reports, tokens, or generated artifacts are included
+

import_effects-0.0.1/.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+

import_effects-0.0.1/.github/workflows/ci.yml

@@ -0,0 +1,79 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: python -m pip install -e '.[dev]'
+      - run: ruff format --check .
+      - run: ruff check .
+      - run: mypy
+      - run: pytest --cov --cov-report=term-missing --cov-report=xml
+      - run: python -m build
+      - run: twine check dist/*
+      - name: Inspect distributions
+        run: |
+          python -m zipfile -l dist/*.whl
+          tar -tzf dist/*.tar.gz
+      - name: Install Gitleaks
+        run: |
+          curl --fail --location --silent --show-error \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz \
+            | tar -xz -C /tmp gitleaks
+      - name: Scan repository history
+        run: /tmp/gitleaks git --redact --exit-code 1 .
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.10", "3.12", "3.14"]
+        exclude:
+          - os: macos-latest
+            python: "3.10"
+          - os: windows-latest
+            python: "3.10"
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - run: python -m pip install -e '.[dev]'
+      - run: pytest
+
+  wheel-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - run: python -m pip install build
+      - run: python -m build
+      - run: python -m venv /tmp/import-effects-consumer
+      - run: /tmp/import-effects-consumer/bin/pip install dist/*.whl
+      - run: /tmp/import-effects-consumer/bin/import-effects json --quiet
+      - run: /tmp/import-effects-consumer/bin/python -c "from import_effects import inspect_import; assert inspect_import('json').success"

import_effects-0.0.1/.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Publish PyPI
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    if: startsWith(github.event.release.tag_name, 'v')
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - run: python -m pip install build twine
+      - run: python -m build
+      - run: twine check dist/*
+      - name: Check whether this version is already published
+        id: registry
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          if python - "$version" <<'PY'
+          import sys
+          import urllib.error
+          import urllib.request
+
+          try:
+              urllib.request.urlopen(
+                  f"https://pypi.org/pypi/import-effects/{sys.argv[1]}/json", timeout=15
+              )
+          except urllib.error.HTTPError as error:
+              raise SystemExit(1 if error.code == 404 else 2)
+          PY
+          then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "published=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Publish with trusted publishing
+        if: steps.registry.outputs.published != 'true'
+        uses: pypa/gh-action-pypi-publish@release/v1
+

import_effects-0.0.1/.gitignore

@@ -0,0 +1,24 @@
+.venv/
+__pycache__/
+*.py[cod]
+*.egg-info/
+.coverage
+coverage.xml
+htmlcov/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+build/
+dist/
+*.whl
+*.tar.gz
+.env
+.env.*
+!.env.example
+.DS_Store
+.idea/
+.vscode/
+docs/assets/*.mp4
+launch*.md
+x-launch*.md
+

import_effects-0.0.1/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+## [0.0.1] - 2026-09-22
+
+### Added
+
+- Fresh-subprocess import inspection with timeout handling.
+- Audit-based file, network, subprocess, and filesystem observations.
+- Thread, multiprocessing, environment, cwd, logging, path, warning, and signal observations.
+- Typed Python API, JSON output, policy exits, ignores, and assertion helper.
+- CPython 3.10 through 3.14 CI across Linux, macOS, and Windows.
+
+[0.0.1]: https://github.com/royalpinto007/import-effects/releases/tag/v0.0.1
+

import_effects-0.0.1/CODE_OF_CONDUCT.md

@@ -0,0 +1,8 @@
+# Contributor Covenant Code of Conduct
+
+We pledge to make participation in this project a harassment-free experience for everyone. Be respectful, constructive, and considerate.
+
+Unacceptable behavior includes harassment, discriminatory language, personal attacks, publishing private information, or other conduct inappropriate in a professional community.
+
+Report conduct concerns privately to royalpinto007@gmail.com. Maintainers may remove, edit, or reject contributions and ban participants whose behavior violates this code.
+

import_effects-0.0.1/CONTRIBUTING.md

@@ -0,0 +1,20 @@
+# Contributing
+
+Contributions are welcome. Please open an issue before changing public behavior or adding a new effect kind.
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+pip install -e '.[dev]'
+ruff format .
+ruff check .
+mypy
+pytest --cov
+python -m build
+twine check dist/*
+```
+
+Tests should exercise behavior through the public API or CLI in a real child interpreter. Do not add observations that cannot be reproduced reliably, and keep confidence and attribution claims conservative.
+
+Use Conventional Commits and do not commit captured environment data, tokens, local package sources, or generated artifacts.
+

import_effects-0.0.1/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 Royal Pinto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

import_effects-0.0.1/PKG-INFO

@@ -0,0 +1,169 @@
+Metadata-Version: 2.5
+Name: import-effects
+Version: 0.0.1
+Summary: See what Python does when you import.
+Project-URL: Homepage, https://github.com/royalpinto007/import-effects
+Project-URL: Documentation, https://github.com/royalpinto007/import-effects#readme
+Project-URL: Issues, https://github.com/royalpinto007/import-effects/issues
+Project-URL: Source, https://github.com/royalpinto007/import-effects
+Author-email: Royal Pinto <royalpinto007@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: audit-hooks,cli,debugging,imports,observability,python,security,side-effects,testing
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Topic :: Software Development :: Debuggers
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: build>=1.3; extra == 'dev'
+Requires-Dist: mypy>=1.17; extra == 'dev'
+Requires-Dist: pytest-cov>=6.2; extra == 'dev'
+Requires-Dist: pytest>=8.4; extra == 'dev'
+Requires-Dist: ruff>=0.12; extra == 'dev'
+Requires-Dist: twine>=6.2; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# import-effects
+
+> See what Python does when you `import`.
+
+[![PyPI](https://img.shields.io/pypi/v/import-effects)](https://pypi.org/project/import-effects/) [![Python](https://img.shields.io/pypi/pyversions/import-effects)](https://pypi.org/project/import-effects/) [![CI](https://github.com/royalpinto007/import-effects/actions/workflows/ci.yml/badge.svg)](https://github.com/royalpinto007/import-effects/actions/workflows/ci.yml) [![license](https://img.shields.io/pypi/l/import-effects)](LICENSE)
+
+`import-effects` runs one import in a fresh child interpreter and reports file writes, sockets, subprocesses, threads, environment changes, and other observable import-time behavior.
+
+```bash
+pip install import-effects
+import-effects requests
+```
+
+![A Python import starts a thread, opens a socket, writes a file, and launches a subprocess](docs/assets/demo.gif)
+
+## 30-second quickstart
+
+```console
+$ import-effects mypackage
+import mypackage
+
+✓ imported in 143 ms
+
+SIDE EFFECTS
+
+⚠ FILE WRITE
+  /home/me/.cache/mypackage/config.json
+
+⚠ NETWORK
+  api.example.com:443
+
+⚠ THREAD
+  background-worker
+
+3 side effects detected · 1 file-write · 1 network · 1 thread
+```
+
+The target must already be importable. `import-effects` never installs it and normal inspection needs no server, database, Docker, network access, or elevated privileges.
+
+## CLI
+
+```bash
+import-effects package.submodule
+import-effects requests --json
+import-effects requests --quiet
+import-effects requests --verbose
+import-effects requests --timeout 10
+import-effects requests --fail-on network,subprocess,file-write
+import-effects requests --ignore '~/.cache/**'
+```
+
+`--fail-on` turns selected observations into policy failures without pretending every observation is inherently unsafe. `--ignore` matches the human-readable effect detail and may be repeated.
+
+Exit codes:
+
+| Code | Meaning                                           |
+| ---: | ------------------------------------------------- |
+|    0 | Import succeeded with no configured violation    |
+|    1 | A configured `--fail-on` effect was detected     |
+|    2 | Invalid CLI input                                |
+|    3 | Target import failed or timed out                |
+|    4 | Internal inspector failure                       |
+
+## Python API
+
+```python
+from import_effects import inspect_import
+
+report = inspect_import("mypackage", timeout=10)
+
+print(report.duration_ms)
+for effect in report.effects:
+    print(effect.kind, effect.detail, effect.confidence)
+```
+
+For tests:
+
+```python
+from import_effects import assert_no_effects
+
+
+def test_import_stays_quiet() -> None:
+    assert_no_effects("mypackage", forbidden=("network", "subprocess", "file-write"))
+```
+
+The models are frozen, typed dataclasses. Reports can be converted with `report.to_dict()` and filtered with `report.effects_of("network")`.
+
+## What it observes
+
+- files opened for writing, removal, rename, and directory operations
+- socket connect, bind, and DNS activity
+- subprocess spawning, `os.system`, and process forks
+- Python threads and `multiprocessing` children started
+- environment variable names added, removed, or changed, never their values
+- current directory, logging handlers, `sys.path`, warning filters, and signal handlers
+- newly imported module names, import duration, stdout/stderr, failures, crashes, and timeouts
+
+CPython audit events provide high-confidence observations for many OS operations. Before/after snapshots and lifecycle wrappers cover state changes and thread/process starts. Each effect includes confidence and attribution metadata because an effect may come from the target, one of its dependencies, or code merely observed during the import window.
+
+See [Architecture and limitations](docs/architecture.md) and the [API reference](docs/api.md).
+
+## Security warning
+
+**Importing untrusted Python code executes that code. `import-effects` is an observer, not a sandbox.**
+
+The target runs in a separate child interpreter, so it cannot directly mutate the parent Python process. It still runs as your user with normal filesystem, network, and process permissions. Use an OS sandbox or disposable virtual machine when inspecting code you do not trust.
+
+Target stdout and stderr are capped. Suspected credentials in captured messages are redacted, and environment variable values are never included. Audit hooks are visibility mechanisms, not a security boundary, and sufficiently hostile native code can evade or disable Python-level observation.
+
+## Platform support
+
+`import-effects` targets CPython 3.10 through 3.14 on Linux, macOS, and Windows. Audit event availability and process termination behavior differ by Python and OS. Linux currently provides the broadest coverage. Windows does not offer the same process-group cleanup guarantees as POSIX, and some native extensions perform operations below CPython's audit surface.
+
+## Development
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+pip install -e '.[dev]'
+ruff format --check .
+ruff check .
+mypy
+pytest --cov
+python -m build
+twine check dist/*
+```
+
+See [Contributing](CONTRIBUTING.md), [Security](SECURITY.md), and the [Changelog](CHANGELOG.md).
+
+## License
+
+MIT
+

import_effects-0.0.1/README.md

@@ -0,0 +1,133 @@
+# import-effects
+
+> See what Python does when you `import`.
+
+[![PyPI](https://img.shields.io/pypi/v/import-effects)](https://pypi.org/project/import-effects/) [![Python](https://img.shields.io/pypi/pyversions/import-effects)](https://pypi.org/project/import-effects/) [![CI](https://github.com/royalpinto007/import-effects/actions/workflows/ci.yml/badge.svg)](https://github.com/royalpinto007/import-effects/actions/workflows/ci.yml) [![license](https://img.shields.io/pypi/l/import-effects)](LICENSE)
+
+`import-effects` runs one import in a fresh child interpreter and reports file writes, sockets, subprocesses, threads, environment changes, and other observable import-time behavior.
+
+```bash
+pip install import-effects
+import-effects requests
+```
+
+![A Python import starts a thread, opens a socket, writes a file, and launches a subprocess](docs/assets/demo.gif)
+
+## 30-second quickstart
+
+```console
+$ import-effects mypackage
+import mypackage
+
+✓ imported in 143 ms
+
+SIDE EFFECTS
+
+⚠ FILE WRITE
+  /home/me/.cache/mypackage/config.json
+
+⚠ NETWORK
+  api.example.com:443
+
+⚠ THREAD
+  background-worker
+
+3 side effects detected · 1 file-write · 1 network · 1 thread
+```
+
+The target must already be importable. `import-effects` never installs it and normal inspection needs no server, database, Docker, network access, or elevated privileges.
+
+## CLI
+
+```bash
+import-effects package.submodule
+import-effects requests --json
+import-effects requests --quiet
+import-effects requests --verbose
+import-effects requests --timeout 10
+import-effects requests --fail-on network,subprocess,file-write
+import-effects requests --ignore '~/.cache/**'
+```
+
+`--fail-on` turns selected observations into policy failures without pretending every observation is inherently unsafe. `--ignore` matches the human-readable effect detail and may be repeated.
+
+Exit codes:
+
+| Code | Meaning                                           |
+| ---: | ------------------------------------------------- |
+|    0 | Import succeeded with no configured violation    |
+|    1 | A configured `--fail-on` effect was detected     |
+|    2 | Invalid CLI input                                |
+|    3 | Target import failed or timed out                |
+|    4 | Internal inspector failure                       |
+
+## Python API
+
+```python
+from import_effects import inspect_import
+
+report = inspect_import("mypackage", timeout=10)
+
+print(report.duration_ms)
+for effect in report.effects:
+    print(effect.kind, effect.detail, effect.confidence)
+```
+
+For tests:
+
+```python
+from import_effects import assert_no_effects
+
+
+def test_import_stays_quiet() -> None:
+    assert_no_effects("mypackage", forbidden=("network", "subprocess", "file-write"))
+```
+
+The models are frozen, typed dataclasses. Reports can be converted with `report.to_dict()` and filtered with `report.effects_of("network")`.
+
+## What it observes
+
+- files opened for writing, removal, rename, and directory operations
+- socket connect, bind, and DNS activity
+- subprocess spawning, `os.system`, and process forks
+- Python threads and `multiprocessing` children started
+- environment variable names added, removed, or changed, never their values
+- current directory, logging handlers, `sys.path`, warning filters, and signal handlers
+- newly imported module names, import duration, stdout/stderr, failures, crashes, and timeouts
+
+CPython audit events provide high-confidence observations for many OS operations. Before/after snapshots and lifecycle wrappers cover state changes and thread/process starts. Each effect includes confidence and attribution metadata because an effect may come from the target, one of its dependencies, or code merely observed during the import window.
+
+See [Architecture and limitations](docs/architecture.md) and the [API reference](docs/api.md).
+
+## Security warning
+
+**Importing untrusted Python code executes that code. `import-effects` is an observer, not a sandbox.**
+
+The target runs in a separate child interpreter, so it cannot directly mutate the parent Python process. It still runs as your user with normal filesystem, network, and process permissions. Use an OS sandbox or disposable virtual machine when inspecting code you do not trust.
+
+Target stdout and stderr are capped. Suspected credentials in captured messages are redacted, and environment variable values are never included. Audit hooks are visibility mechanisms, not a security boundary, and sufficiently hostile native code can evade or disable Python-level observation.
+
+## Platform support
+
+`import-effects` targets CPython 3.10 through 3.14 on Linux, macOS, and Windows. Audit event availability and process termination behavior differ by Python and OS. Linux currently provides the broadest coverage. Windows does not offer the same process-group cleanup guarantees as POSIX, and some native extensions perform operations below CPython's audit surface.
+
+## Development
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+pip install -e '.[dev]'
+ruff format --check .
+ruff check .
+mypy
+pytest --cov
+python -m build
+twine check dist/*
+```
+
+See [Contributing](CONTRIBUTING.md), [Security](SECURITY.md), and the [Changelog](CHANGELOG.md).
+
+## License
+
+MIT
+

import_effects-0.0.1/SECURITY.md

@@ -0,0 +1,14 @@
+# Security policy
+
+## Reporting
+
+Please report vulnerabilities privately through GitHub Security Advisories. Do not include live credentials, private package contents, or sensitive import reports in a public issue.
+
+## Scope and safety model
+
+`import-effects` executes the requested import in a child process. It is not a sandbox and does not make untrusted code safe. The child inherits the user's OS account permissions and a largely unchanged environment so ordinary imports continue to work.
+
+The tool never installs packages. It redacts likely credentials from captured messages, never reports environment values, caps target output, validates module names, and applies a timeout. These controls reduce accidental disclosure and runaway imports but are not a security boundary against malicious Python or native code.
+
+Supported security fixes target the latest released version.
+

import_effects-0.0.1/docs/api.md

@@ -0,0 +1,24 @@
+# API reference
+
+## `inspect_import`
+
+```python
+inspect_import(module: str, *, timeout: float = 10.0, python_executable: str | PathLike | None = None) -> ImportReport
+```
+
+Runs the import in a fresh child interpreter. Invalid module names and timeouts less than or equal to zero raise `ValueError`. Failure to start or decode the child raises `InspectionError`. A target import exception is returned as a normal unsuccessful report.
+
+## `assert_no_effects`
+
+```python
+assert_no_effects(module: str, *, forbidden=("network", "subprocess", "file-write"), timeout=10.0) -> ImportReport
+```
+
+Raises `AssertionError` when the import fails or a forbidden effect is observed. This helper works naturally in pytest, unittest, and other test runners without a plugin.
+
+## Models
+
+`ImportReport` and `Effect` are frozen dataclasses. `ImportReport.to_dict()` returns JSON-compatible data, `ImportReport.from_dict()` reconstructs a report, and `effects_of(*kinds)` filters effects.
+
+An effect includes `kind`, redacted `detail`, optional `source`, `confidence`, `attribution`, and small non-sensitive metadata. Environment values are never included.
+

import_effects-0.0.1/docs/architecture.md

@@ -0,0 +1,28 @@
+# Architecture and limitations
+
+## Execution model
+
+The public process validates the module name and launches the same Python interpreter with `python -m import_effects._probe`. The child prepares observers, takes a baseline snapshot, activates observation, calls `importlib.import_module`, takes a final snapshot, and writes a private JSON report. The parent enforces the timeout and deserializes that report into typed dataclasses.
+
+Target stdout and stderr travel on separate pipes, so they cannot corrupt structured output. The parent never imports the target.
+
+## Observation sources
+
+CPython's [PEP 578 audit hooks](https://peps.python.org/pep-0578/) expose operations such as `open`, `socket.connect`, `subprocess.Popen`, and filesystem changes. Thread and multiprocessing start methods are observed with child-local wrappers. Snapshots compare environment keys, current directory, logging handlers, `sys.path`, warning filters, signal handlers, and loaded modules.
+
+Startup work is excluded by activating observers immediately before the target import. Dependency activity during the import remains relevant and is reported. Stack inspection provides a best-effort source classification, not a security-grade provenance claim.
+
+## Limitations
+
+- This is not an OS sandbox. Target code executes with the child's normal permissions.
+- Python audit hooks are designed for visibility and can be bypassed by hostile native code.
+- A dependency imported by the target can cause any reported effect.
+- Completed native threads or processes that do not use the observed Python APIs may be missed.
+- Filesystem changes performed entirely below CPython's audit events may be missed.
+- Snapshot-based findings show that state changed during the import window, not necessarily which exact line changed it.
+- Import-generated bytecode cache writes are excluded as runtime noise.
+- Timeout cleanup is strongest on POSIX. Windows child descendants may outlive a force-killed probe.
+- Only modules already importable in the selected interpreter are inspected. No package installation occurs.
+
+The report uses `target`, `dependency`, `observed-during-import`, and `runtime` attribution labels plus `high`, `medium`, or `low` confidence. Consumers should preserve those qualifiers.
+