lean-runtime 2.1.0__tar.gz → 2.1.2__tar.gz

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 2.1.2 - 2026-08-12
+
+- Raise `lean-run`'s default `--check-timeout` from 120 to 300 seconds: a
+  first Mathlib check legitimately takes 2-5 minutes on slower machines
+  today (instance staging plus Lake's full trace scan), and the old default
+  timed out authoritative checks that would have succeeded.
+
+## 2.1.1 - 2026-08-12
+
+- The discovery search budget now gates starting additional candidates and
+  no longer kills an in-flight authoritative check, which is bounded by its
+  own per-candidate timeout. A slow machine's first Mathlib check can outlive
+  the remaining search budget legitimately.
+- OCI blob downloads keep partials on truncated transfers and resume with a
+  Range request, retry transport errors mid-stream, and attempt four times.
+- Add `build-and-publish --accelerate`: hydrate artifacts from known package
+  caches (Mathlib's `lake exe cache get`) for locked packages that carry no
+  artifact command of their own. Acceleration is keyed by exact canonical
+  package URL, never changes the lock identity, is recorded in the hydration
+  report, and the built environment is still probe-verified before
+  publication. The public-cache workflow uses it, turning multi-hour Mathlib
+  source builds into minutes.
+- Add a fail-closed release toolkit: `scripts/registry_preflight.py` verifies
+  every bundled catalog entry is anonymously downloadable, and the
+  announcement-gate workflow runs the advertised PyPI journeys on clean
+  unauthenticated Linux and macOS runners (dispatch + daily canary).
+- `lean-run` now warns loudly when a downloadable environment is unavailable
+  and states that source builds can take 30+ minutes, with a
+  `--no-source-build` hint, instead of falling back silently.
+
 ## 2.1.0 - 2026-08-11
 
 - Add `lean-runtime toolchain-slim` and

{lean_runtime-2.1.0/lean_runtime.egg-info → lean_runtime-2.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lean-runtime
-Version: 2.1.0
+Version: 2.1.2
 Summary: Run Lean 4 proofs from Python or standalone files
 Author: Alejandro Radisic
 License-Expression: Apache-2.0

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/docs/development.md

@@ -78,3 +78,26 @@ a normal publisher and creates the PyPI project.
 PyPI does not permit replacing files for an already published version. If a
 release needs a correction, increment the version rather than recreating the
 tag.
+
+## Release and announcement protocol
+
+Catalog entries are public claims that a prebuilt environment is
+downloadable. The protocol below makes those claims fail-closed:
+
+1. Publish downloadable environments for every catalog entry and platform
+   (`public-cache.yml`) **before** shipping a wheel that references them, and
+   make the GHCR package publicly pullable.
+2. Run `python scripts/registry_preflight.py` — it verifies, anonymously,
+   that every catalog lock resolves to an index, platform manifests, and
+   readable blobs. CI-cheap; run it on every release.
+3. After publishing to PyPI, dispatch the **Announcement gate** workflow
+   (`announcement-gate.yml`). It installs from PyPI on clean unauthenticated
+   Linux and macOS runners and runs the advertised journeys from
+   `acceptance/`: a cold check with `--no-source-build` (fail-closed: a
+   broken registry fails in seconds instead of hiding behind a source
+   build), a warm re-check, a failing proof with logical diagnostic paths, a
+   lock round-trip, and the Python batch API. Release titles use `vX.Y.Z`,
+   matching the tag.
+4. Announce only after the gate is green. The same workflow runs daily as a
+   canary: registry permissions and docs deployments can break without any
+   code change.

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/lean_runtime/cli.py

@@ -153,6 +153,13 @@ def parser() -> argparse.ArgumentParser:
         action="store_true",
         help="publish blobs and platform manifest without updating the lock index",
     )
+    push.add_argument(
+        "--accelerate",
+        action="store_true",
+        help="hydrate artifacts from known package caches (e.g. Mathlib's) for locked "
+        "packages without an artifact command; the lock identity is unchanged and the "
+        "built environment is still probe-verified before publication",
+    )
     push.add_argument("--sign", action="store_true", help="sign the published lock index")
     push.add_argument(
         "--attest", action="store_true", help="publish a signed source/probe attestation"
@@ -391,6 +398,7 @@ def main(argv: list[str] | None = None) -> int:
                 EnvironmentLock.load(args.lock),
                 name=args.name,
                 build_timeout=args.timeout,
+                accelerate=args.accelerate,
             )
             _json(
                 runtime.publish_environment(

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/lean_runtime/discovery/engine.py

@@ -223,10 +223,11 @@ def discover(
                     else attempt.diagnostics,
                 )
         remaining = deadline - time.monotonic()
-        timeout = min(
-            remaining,
-            plan.policy.candidate_timeout_seconds or remaining,
-        )
+        # The search budget gates STARTING candidates (checked at the top of
+        # the loop); it must not kill an in-flight authoritative check, which
+        # is bounded by its own per-candidate timeout. A slow machine's first
+        # check may legitimately outlive the remaining search budget.
+        timeout = plan.policy.candidate_timeout_seconds or remaining
         with _AttemptCancellation(timeout, cancel) as attempt_cancel:
             try:
                 outcome = probe.check(

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/lean_runtime/environments.py

@@ -35,6 +35,7 @@ from .models import (
     PhaseTiming,
 )
 from .policies import ExecutionPolicy
+from .references import artifact_accelerators
 from .serialization import sha256_id, write_json_atomic
 from .store import (
     EnvironmentStore,
@@ -1011,6 +1012,7 @@ class EnvironmentManager:
         name: str | None = None,
         build_profile: str = "release",
         build_timeout: float = 1800,
+        accelerate: bool = False,
         cancel: threading.Event | None = None,
     ) -> Environment:
         self.store.publish_lock(lock)
@@ -1030,6 +1032,7 @@ class EnvironmentManager:
                     destination,
                     build_profile,
                     build_timeout=build_timeout,
+                    accelerate=accelerate,
                     cancel=cancel,
                 )
             else:
@@ -1075,6 +1078,7 @@ class EnvironmentManager:
         build_profile: str,
         *,
         build_timeout: float,
+        accelerate: bool = False,
         cancel: threading.Event | None,
     ) -> None:
         stage = self.store.environments / f".staging-{os.getpid()}-{uuid.uuid4().hex}"
@@ -1105,15 +1109,20 @@ class EnvironmentManager:
                 max_output_bytes=10_000_000,
             )
             hydration: list[dict[str, Any]] = []
+            accelerators = artifact_accelerators() if accelerate else {}
             for package in lock.packages:
-                if not package.artifact_command:
+                requested_command = package.artifact_command or accelerators.get(package.url, ())
+                if not requested_command:
                     continue
+                accelerated = not package.artifact_command
                 self.events.emit(
                     "artifact.hydration_started",
-                    f"Hydrating artifacts for {package.name}",
+                    f"Hydrating artifacts for {package.name}"
+                    + (" (accelerated)" if accelerated else ""),
                     package=package.name,
+                    accelerated=accelerated,
                 )
-                command = list(package.artifact_command)
+                command = list(requested_command)
                 if command[0] in {"lake", "lean"}:
                     command = self.toolchains.command(lock.toolchain, command[0], *command[1:])
                 result = self.backend.execute(
@@ -1127,6 +1136,7 @@ class EnvironmentManager:
                     {
                         "package": package.name,
                         "command": command,
+                        "accelerated": accelerated,
                         "exit_code": result.exit_code,
                         "output": result.stdout + result.stderr,
                     }

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/lean_runtime/oci.py

@@ -32,7 +32,7 @@ _BEARER_PARAMETER = re.compile(r'([a-zA-Z]+)="([^"]*)"')
 _DIGEST = re.compile(r"sha256:([0-9a-f]{64})")
 _ACCEPT = ", ".join((INDEX_MEDIA_TYPE, MANIFEST_MEDIA_TYPE))
 DEFAULT_ENVIRONMENT_LIBRARIES = ("oci://ghcr.io/alerad/lean-runtime-cache",)
-_BLOB_INTEGRITY_ATTEMPTS = 2
+_BLOB_INTEGRITY_ATTEMPTS = 4
 
 
 class SignatureVerifier(Protocol):
@@ -263,18 +263,30 @@ class OCIRegistryClient:
                     if written == size and observed_digest == digest:
                         temporary.replace(destination)
                         break
-                    temporary.unlink(missing_ok=True)
+                    # A short read is a truncated transfer (registry or proxy
+                    # closed the connection early): keep the partial so the
+                    # next attempt resumes with a Range request instead of
+                    # restarting a multi-gigabyte download from zero. Only a
+                    # complete-but-mismatched blob is real corruption.
+                    truncated = written < size
+                    if not truncated:
+                        temporary.unlink(missing_ok=True)
                     if attempt == _BLOB_INTEGRITY_ATTEMPTS:
+                        temporary.unlink(missing_ok=True)
+                        reason = "was truncated" if truncated else "failed digest verification"
                         raise EnvironmentError(
-                            "downloaded OCI blob failed digest verification "
+                            f"downloaded OCI blob {reason} "
                             f"after {attempt} attempts (expected {digest}, got "
                             f"{observed_digest}, bytes {written}/{size})"
                         )
                     events.emit(
                         "library.layer_download_retry",
-                        "Retrying OCI blob after integrity verification failed",
+                        "Resuming truncated OCI blob"
+                        if truncated
+                        else "Retrying OCI blob after integrity verification failed",
                         digest=digest,
                         attempt=attempt + 1,
+                        truncated=truncated,
                         observed_digest=observed_digest,
                         downloaded_bytes=written,
                         expected_bytes=size,
@@ -282,7 +294,17 @@ class OCIRegistryClient:
                 except urllib.error.HTTPError as exc:
                     raise DownloadUnavailable(f"OCI blob download failed: HTTP {exc.code}") from exc
                 except OSError as exc:
-                    raise DownloadUnavailable(f"OCI blob download failed: {exc}") from exc
+                    # Connection resets and read timeouts mid-transfer are
+                    # retryable; the kept partial resumes on the next attempt.
+                    if attempt == _BLOB_INTEGRITY_ATTEMPTS:
+                        raise DownloadUnavailable(f"OCI blob download failed: {exc}") from exc
+                    events.emit(
+                        "library.layer_download_retry",
+                        "Retrying OCI blob after a transport error",
+                        digest=digest,
+                        attempt=attempt + 1,
+                        error=str(exc),
+                    )
         return destination
 
     def blob_exists(self, digest: str) -> bool:

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/lean_runtime/references.py

@@ -41,6 +41,20 @@ PACKAGE_ALIASES: dict[str, tuple[str, str, tuple[str, ...]]] = {
 }
 
 
+def artifact_accelerators() -> dict[str, tuple[str, ...]]:
+    """Map canonical package URLs to their known artifact-cache commands.
+
+    Used by opt-in build acceleration for locks whose packages carry no
+    ``artifact_command`` of their own. Keyed by exact URL so a fork that
+    merely shares a package name is never accelerated.
+    """
+    return {
+        f"https://github.com/{owner}/{repository}.git": command
+        for owner, repository, command in PACKAGE_ALIASES.values()
+        if command
+    }
+
+
 @dataclass(frozen=True, slots=True)
 class PackageReference:
     """A human-friendly reference to one Git-hosted Lean package."""

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/lean_runtime/run_cli.py

@@ -36,9 +36,18 @@ def _progress(event: RuntimeEvent) -> None:
         "library.layer_download_started": "Downloading cached environment",
         "library.layer_download_retry": "Retrying cached-environment download",
         "toolchain.install_started": "Installing Lean toolchain (a first run can take minutes)",
-        "environment.build_started": "Building environment",
+        "environment.build_started": "Building environment from source (large dependencies "
+        "such as Mathlib can take 30+ minutes; pass --no-source-build to fail fast instead)",
         "environment.cache_hit": "Using local environment",
     }
+    if event.kind == "availability.fallback":
+        library = event.data.get("library", "environment library")
+        reason = event.data.get("reason_code") or event.data.get("reason") or "unavailable"
+        print(
+            f"lean-run: WARNING: downloadable environment unavailable from {library} ({reason})",
+            file=sys.stderr,
+        )
+        return
     message = messages.get(event.kind)
     if message:
         package = f" {event.data['reference']}" if "reference" in event.data else ""
@@ -97,7 +106,7 @@ def parser() -> argparse.ArgumentParser:
         "--timeout",
         dest="check_timeout",
         type=float,
-        default=120,
+        default=300,
         help="budget for one Lean invocation (--timeout is a deprecated alias)",
     )
     return root

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/lean_runtime/runtime.py

@@ -171,6 +171,7 @@ class Runtime:
         name: str | None = None,
         build_profile: str = "release",
         build_timeout: float = 1800,
+        accelerate: bool = False,
         cancel: threading.Event | None = None,
     ) -> Environment:
         environment_id = environment_identity(lock, build_profile)
@@ -209,6 +210,7 @@ class Runtime:
             name=name,
             build_profile=build_profile,
             build_timeout=build_timeout,
+            accelerate=accelerate,
             cancel=cancel,
         )
 

{lean_runtime-2.1.0 → lean_runtime-2.1.2/lean_runtime.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lean-runtime
-Version: 2.1.0
+Version: 2.1.2
 Summary: Run Lean 4 proofs from Python or standalone files
 Author: Alejandro Radisic
 License-Expression: Apache-2.0

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/lean_runtime.egg-info/SOURCES.txt

@@ -104,6 +104,8 @@ schemas/inspect-v1.schema.json
 schemas/matrix-v1.schema.json
 schemas/profile-v1.schema.json
 schemas/verify-v1.schema.json
+scripts/announcement_gate.py
+scripts/registry_preflight.py
 scripts/run_compatibility.py
 scripts/run_v1_case_study.py
 scripts/smoke_wheel.py

{lean_runtime-2.1.0 → lean_runtime-2.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "lean-runtime"
-version = "2.1.0"
+version = "2.1.2"
 description = "Run Lean 4 proofs from Python or standalone files"
 readme = "README.md"
 requires-python = ">=3.10"

lean_runtime-2.1.2/scripts/announcement_gate.py

@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+"""Fail-closed announcement gate: the advertised user journeys, from clean state.
+
+Runs the exact journeys a new user follows after ``pip install lean-runtime``
+against an empty runtime home, with hard wall-clock timeouts, and writes one
+JSON report. The critical property is fail-closed distribution: the first cold
+check runs with ``--no-source-build``, so a broken or private registry fails
+in seconds instead of degrading into a silent source build.
+
+Steps:
+1. cold check of acceptance/Main.lean with --no-source-build and --lock-out
+2. warm re-check (must be fast)
+3. acceptance/Fail.lean must be rejected with a diagnostic naming Fail.lean
+4. re-check via the emitted lock (reproducibility)
+5. the documented Python batch API against the same lock
+
+Run it on a machine WITHOUT registry credentials; the point is proving the
+anonymous path. The runtime home is created fresh; pass --keep-home to retain
+it for inspection.
+
+Usage:
+    python scripts/announcement_gate.py --report gate-report.json
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+ACCEPTANCE = Path(__file__).resolve().parent.parent / "acceptance"
+
+COLD_TIMEOUT = 2700  # toolchain download + environment download, no builds
+WARM_TIMEOUT = 300
+WARM_LIMIT = 240  # warm Mathlib checks include a full Lake trace scan today
+
+
+def run(
+    command: list[str],
+    *,
+    timeout: float,
+    env: dict[str, str],
+) -> tuple[int, str, float]:
+    started = time.monotonic()
+    try:
+        completed = subprocess.run(
+            command,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+            env=env,
+            check=False,
+        )
+        output = completed.stdout + completed.stderr
+        return completed.returncode, output, time.monotonic() - started
+    except subprocess.TimeoutExpired as error:
+        output = (error.stdout or "") + (error.stderr or "")
+        if isinstance(output, bytes):  # pragma: no cover - platform dependent
+            output = output.decode(errors="replace")
+        return -1, f"TIMEOUT after {timeout}s\n{output}", time.monotonic() - started
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--home", default=None, help="runtime home (default: fresh temp dir)")
+    parser.add_argument("--report", default="announcement-gate-report.json")
+    parser.add_argument("--keep-home", action="store_true")
+    parser.add_argument("--cold-timeout", type=float, default=COLD_TIMEOUT)
+    arguments = parser.parse_args()
+
+    import os
+    import tempfile
+
+    home = Path(arguments.home) if arguments.home else Path(tempfile.mkdtemp(prefix="gate-home-"))
+    home.mkdir(parents=True, exist_ok=True)
+    if any(home.iterdir()):
+        print(f"refusing to run: home is not empty: {home}")
+        return 2
+    env = {**os.environ, "LEAN_RUNTIME_HOME": str(home)}
+    lock_path = home / "gate.lock.json"
+    main_lean = str(ACCEPTANCE / "Main.lean")
+    fail_lean = str(ACCEPTANCE / "Fail.lean")
+
+    report: dict[str, object] = {"home": str(home), "steps": [], "ok": False}
+    steps: list[dict[str, object]] = report["steps"]  # type: ignore[assignment]
+
+    def step(
+        name: str,
+        command: list[str],
+        *,
+        timeout: float,
+        expect_exit: int = 0,
+        require: str | None = None,
+        forbid: str | None = None,
+        limit: float | None = None,
+    ) -> bool:
+        code, output, elapsed = run(command, timeout=timeout, env=env)
+        ok = code == expect_exit
+        detail = ""
+        if ok and require is not None and require not in output:
+            ok, detail = False, f"missing expected text: {require!r}"
+        if ok and forbid is not None and forbid in output:
+            ok, detail = False, f"contains forbidden text: {forbid!r}"
+        if ok and limit is not None and elapsed > limit:
+            ok, detail = False, f"took {elapsed:.1f}s, limit {limit}s"
+        steps.append(
+            {
+                "name": name,
+                "command": command,
+                "exit_code": code,
+                "elapsed_seconds": round(elapsed, 2),
+                "ok": ok,
+                "detail": detail or None,
+                "tail": output[-2000:],
+            }
+        )
+        suffix = f": {detail}" if detail else ""
+        print(f"{'ok  ' if ok else 'FAIL'} {name} ({elapsed:.1f}s){suffix}")
+        return ok
+
+    version = subprocess.run(
+        [
+            sys.executable,
+            "-c",
+            "import lean_runtime, importlib.metadata as m; print(m.version('lean-runtime'))",
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    ).stdout.strip()
+    report["lean_runtime_version"] = version
+    print(f"gate: lean-runtime {version}, home {home}")
+
+    ok = step(
+        "cold-no-source-build",
+        [
+            "lean-run",
+            main_lean,
+            "--no-source-build",
+            "--lock-out",
+            str(lock_path),
+        ],
+        timeout=arguments.cold_timeout,
+    )
+    ok = ok and step(
+        "warm",
+        ["lean-run", main_lean],
+        timeout=WARM_TIMEOUT,
+        limit=WARM_LIMIT,
+    )
+    ok = ok and step(
+        "failing-proof-diagnostics",
+        ["lean-run", fail_lean, "--lock", str(lock_path)],
+        timeout=WARM_TIMEOUT,
+        expect_exit=1,
+        require="Fail.lean",
+        forbid="instance-",
+    )
+    ok = ok and step(
+        "lock-reproducibility",
+        ["lean-run", main_lean, "--lock", str(lock_path)],
+        timeout=WARM_TIMEOUT,
+        limit=WARM_LIMIT,
+    )
+    ok = ok and step(
+        "python-batch-api",
+        [sys.executable, str(ACCEPTANCE / "python_api.py"), str(lock_path)],
+        timeout=900,
+    )
+
+    usage = shutil.disk_usage(home)
+    report["ok"] = ok
+    report["home_bytes"] = sum(f.stat().st_size for f in home.rglob("*") if f.is_file())
+    report["disk_free_bytes"] = usage.free
+    Path(arguments.report).write_text(json.dumps(report, indent=2), encoding="utf-8")
+    print(f"report: {arguments.report}")
+    if not arguments.keep_home and arguments.home is None:
+        shutil.rmtree(home, ignore_errors=True)
+    print("GATE PASSED" if ok else "GATE FAILED")
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())