ratchet-gate 0.1.0__tar.gz

ratchet_gate-0.1.0/.gitea/workflows/release.yml

@@ -0,0 +1,56 @@
+name: Release
+
+# Publishing is tag-driven so that the artifact on PyPI and the tag in this repo
+# are the same commit by construction, not by anyone remembering to keep them in
+# step. Tag, push, done.
+#
+# Runs on Gitea Actions: PyPI's Trusted Publishing (OIDC) only recognises
+# GitHub, GitLab, Google and ActiveState as publishers, so this uses an API
+# token in the `PYPI_TOKEN` repo secret instead. See RELEASING.md.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+
+      # The gate's own promise is that it never lets a number move the wrong way
+      # unnoticed. Publishing a build that fails its own suite would be the one
+      # regression nothing is watching, so the tests gate the upload.
+      - name: Test
+        run: |
+          uv venv
+          uv pip install -e '.[dev]'
+          uv run pytest
+          uv run mypy
+
+      # The tag must name the version the package actually declares. Otherwise
+      # `pip install ratchet-gate==0.2.0` and `git checkout v0.2.0` quietly
+      # disagree, and every later bisect is built on that.
+      - name: Check tag matches project version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          declared="$(uv run python -c 'import tomllib,pathlib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')"
+          if [ "$tag" != "$declared" ]; then
+            echo "::error::tag v$tag does not match pyproject version $declared"
+            exit 1
+          fi
+
+      - name: Build
+        run: uv build
+
+      - name: Publish to PyPI
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
+        run: |
+          if [ -z "${UV_PUBLISH_TOKEN:-}" ]; then
+            echo "::error::PYPI_TOKEN secret is not set -- see RELEASING.md"
+            exit 1
+          fi
+          uv publish

ratchet_gate-0.1.0/.gitignore

@@ -0,0 +1,6 @@
+.venv/
+__pycache__/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+dist/

ratchet_gate-0.1.0/DIVERGENCES.md

@@ -0,0 +1,49 @@
+# Deliberate divergences from the implementations this package replaces
+
+The rule is byte-identical output. Every departure from it is listed here, with
+what changes, why, and what it cost to check. A divergence that is not on this
+list is a bug.
+
+---
+
+## 1. `npm_audit_findings` renders as an integer, not `31.0`
+
+**Repos affected:** `mdbin` (the only one that baselines `npm_audit_findings` as
+a repo-wide metric).
+
+**What changes:** one cell of the summary table.
+
+```
+- | `(global)` | npm_audit_findings | 31 | 31.0 | +0 | ok |
++ | `(global)` | npm_audit_findings | 31 | 31   | +0 | ok |
+```
+
+**Why the incumbent does it.** mdbin's copy needed a repo-wide adapter around a
+per-package parser, and gave it a `-> float` return annotation:
+
+```python
+def parse_npm_audit_total(path: Path) -> float:
+    """Global-slot adapter: GLOBAL_PARSERS values are scalars, not dicts."""
+    return float(parse_npm_audit_json(path).get("npm_audit_findings", 0))
+```
+
+The `float()` is there to satisfy the annotation, not to describe the value. A
+vulnerability count is a count, and the baseline column two cells to the left
+says `31`, so the table contradicts itself about what kind of number this is.
+
+**Why not reproduce it.** Reproducing it would mean writing a cast whose only
+purpose is to make the output wrong in the same way, in a package meant to
+outlive all five copies. It would also propagate: a full `promote` writes the
+measured value straight back into the tracked baseline, so the first
+unqualified promote after adoption would turn `31` into `31.0` in the JSON and
+every integer metric would follow as its parser was touched.
+
+**What it does not change.** Nothing about the verdict. `31.0 == 31`, so
+`regressed` and `improved` are identical either way, in this run and in every
+other. The equivalence suite confirms exit codes match; only the rendered cell
+differs.
+
+**Pinned by:** `tests/test_parsers.py::test_npm_audit_total_is_an_integer`.
+
+**On adoption:** mdbin's next summary shows `31` where it showed `31.0`. If that
+repo commits its summary, expect a one-line diff on the first run.

ratchet_gate-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mateus Marim
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

ratchet_gate-0.1.0/PKG-INFO

@@ -0,0 +1,183 @@
+Metadata-Version: 2.5
+Name: ratchet-gate
+Version: 0.1.0
+Summary: Ratchet quality gate: enforce monotonic improvement of code-quality metrics against a committed baseline.
+Project-URL: Homepage, https://git.marim.dev/mateuscmarim/quality-gate
+Project-URL: Source, https://git.marim.dev/mateuscmarim/quality-gate
+Author: Mateus Marim
+License: MIT License
+        
+        Copyright (c) 2026 Mateus Marim
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: baseline,ci,code-quality,coverage,linting,ratchet
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: pydantic>=2.9
+Provides-Extra: dev
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# quality-gate
+
+A **ratchet** quality gate. It reads what your linters, type checkers, test
+runners and scanners already wrote, compares every metric to a committed
+baseline, and fails the build if any of them got worse.
+
+Not a threshold gate. There is no number you have to reach before it is useful —
+the baseline starts wherever your code is today, and the only rule is that it
+may not move backwards. Improvements are adopted automatically after merge, so
+the bar rises on its own and never falls.
+
+```
+## Ratchet Quality Gate
+
+| Package | Metric | Baseline | Current | Δ | Status |
+|---|---|---:|---:|---:|:---:|
+| `api` | coverage_lines_pct | 89.09 | 88.22 | -0.87 | FAIL |
+| `api` | complexity_violations | 108 | 108 | +0 | ok |
+| `api` | mypy_errors | 0 | 0 | +0 | ok |
+| `(global)` | secret_findings | 0 | 0 | +0 | ok |
+
+**FAIL** — 1 regression(s):
+- `api` / **coverage_lines_pct** 89.09 → 88.22
+```
+
+## Why this repo exists
+
+Five repos were running five copies of the same 400–1500 line script. They had
+diverged: different exclusion lists, different report paths, one repo carrying a
+one-line bug fix that never reached the other four because there was no
+mechanism for it to travel by. Comparing them, almost every difference was
+configuration wearing the costume of code.
+
+So the program lives here once, and everything that legitimately differs per
+repo lives in that repo's `quality-gate.toml`.
+
+## Install
+
+```bash
+uvx ratchet-gate@0.1.0 check
+```
+
+No install step in CI, no vendored copy to keep in sync, and the pin says
+exactly which version scored a given run.
+
+The distribution is `ratchet-gate`; the command is available as both
+`ratchet-gate` and `quality-gate`, so an adopting workflow can keep whichever
+name it already says.
+
+From a machine on the LAN you can install straight from the source of truth
+instead, which is what `scripts/verify-against-repo.sh` does when checking an
+unreleased commit:
+
+```bash
+uvx --from git+https://git.marim.dev/mateuscmarim/quality-gate@v0.1.0 quality-gate check
+```
+
+`git.marim.dev` has no public DNS record, so that form works from self-hosted
+runners and nowhere else. PyPI is the form to put in a workflow. See
+[RELEASING.md](RELEASING.md).
+
+## Use
+
+```bash
+quality-gate check                              # score this run, exit 1 on regression
+quality-gate check --baseline-ref origin/main   # score against the stricter baseline
+quality-gate check --measured api,worker        # only these packages ran
+quality-gate promote --monotonic                # adopt improvements only (post-merge)
+```
+
+Point it at a directory of tool output — `.quality/<package>/coverage.json`,
+`ruff.json`, `mypy.txt`, and so on — and a `quality-baseline.json`.
+
+## Configure
+
+`quality-gate.toml` at the repo root. Every key is optional; a repo whose layout
+matches the defaults needs no file at all.
+
+```toml
+[gate]
+artifacts_dir = ".quality"
+baseline_path = "quality-baseline.json"
+non_ratcheted_dirs = ["tests", "scripts", "notebooks"]
+default_baseline_ref = "origin/main"
+```
+
+`non_ratcheted_dirs` is the one most repos change. Findings in those directories
+stay in the uploaded artifacts — they just do not gate. One-off analysis
+scripts, notebook data collectors and test helpers are read top-to-bottom and
+run by hand; a 200-line `main()` is the right shape for what they are.
+
+## Two things it will not do
+
+**It will not let a branch set its own bar.** Every number the gate enforces
+comes out of a tracked file on the branch being scored, so the same commit that
+adds 47 lint errors can raise `lint_errors` to 47 and pass. That needs no
+malice: `promote` without `--monotonic` sets baseline = current for *every*
+metric, so a branch that runs it locally to seed one new row rewrites all the
+others. Pass `--baseline-ref origin/main` in CI and each metric is scored
+against the stricter of the two baselines.
+
+**It will not go green when it could not measure something.** A missing
+`gitleaks.json` is not a clean secret scan; a crashed `bandit` is not zero
+findings; a jscpd report that never got written is not zero duplication. Every
+one of those is an error that exits 1. All three used to be written the other
+way round, and each one silently disabled the check it was reporting on.
+
+## Supported
+
+| Language | Tools |
+|---|---|
+| Python | coverage.py, ruff (lint + complexity), mypy, bandit |
+| JavaScript / TypeScript | vitest, biome, tsc, npm audit |
+| Kotlin / Android | Kover, detekt, Android Lint, kotlinc |
+| Repo-wide | jscpd, gitleaks, pip-audit, npm audit |
+
+## Developing
+
+```bash
+uv venv && uv pip install -e '.[dev]'
+.venv/bin/python -m pytest        # includes the equivalence suite
+.venv/bin/python -m mypy          # --strict, src and tests
+```
+
+The suite runs the implementation this package replaces side by side with this
+one over identical inputs and asserts their stdout, stderr, exit code and
+written files match exactly. That is what lets a repo switch over without its
+gate changing verdict on the day it does. Every intended departure is listed in
+[DIVERGENCES.md](DIVERGENCES.md); anything else is a bug.
+
+To check against a repo's real reports rather than synthetic ones:
+
+```bash
+scripts/verify-against-repo.sh ../../trainwithme/nasa nasa-server
+```
+
+Design notes live in the Quality Gate project on mddocs.

ratchet_gate-0.1.0/README.md

@@ -0,0 +1,137 @@
+# quality-gate
+
+A **ratchet** quality gate. It reads what your linters, type checkers, test
+runners and scanners already wrote, compares every metric to a committed
+baseline, and fails the build if any of them got worse.
+
+Not a threshold gate. There is no number you have to reach before it is useful —
+the baseline starts wherever your code is today, and the only rule is that it
+may not move backwards. Improvements are adopted automatically after merge, so
+the bar rises on its own and never falls.
+
+```
+## Ratchet Quality Gate
+
+| Package | Metric | Baseline | Current | Δ | Status |
+|---|---|---:|---:|---:|:---:|
+| `api` | coverage_lines_pct | 89.09 | 88.22 | -0.87 | FAIL |
+| `api` | complexity_violations | 108 | 108 | +0 | ok |
+| `api` | mypy_errors | 0 | 0 | +0 | ok |
+| `(global)` | secret_findings | 0 | 0 | +0 | ok |
+
+**FAIL** — 1 regression(s):
+- `api` / **coverage_lines_pct** 89.09 → 88.22
+```
+
+## Why this repo exists
+
+Five repos were running five copies of the same 400–1500 line script. They had
+diverged: different exclusion lists, different report paths, one repo carrying a
+one-line bug fix that never reached the other four because there was no
+mechanism for it to travel by. Comparing them, almost every difference was
+configuration wearing the costume of code.
+
+So the program lives here once, and everything that legitimately differs per
+repo lives in that repo's `quality-gate.toml`.
+
+## Install
+
+```bash
+uvx ratchet-gate@0.1.0 check
+```
+
+No install step in CI, no vendored copy to keep in sync, and the pin says
+exactly which version scored a given run.
+
+The distribution is `ratchet-gate`; the command is available as both
+`ratchet-gate` and `quality-gate`, so an adopting workflow can keep whichever
+name it already says.
+
+From a machine on the LAN you can install straight from the source of truth
+instead, which is what `scripts/verify-against-repo.sh` does when checking an
+unreleased commit:
+
+```bash
+uvx --from git+https://git.marim.dev/mateuscmarim/quality-gate@v0.1.0 quality-gate check
+```
+
+`git.marim.dev` has no public DNS record, so that form works from self-hosted
+runners and nowhere else. PyPI is the form to put in a workflow. See
+[RELEASING.md](RELEASING.md).
+
+## Use
+
+```bash
+quality-gate check                              # score this run, exit 1 on regression
+quality-gate check --baseline-ref origin/main   # score against the stricter baseline
+quality-gate check --measured api,worker        # only these packages ran
+quality-gate promote --monotonic                # adopt improvements only (post-merge)
+```
+
+Point it at a directory of tool output — `.quality/<package>/coverage.json`,
+`ruff.json`, `mypy.txt`, and so on — and a `quality-baseline.json`.
+
+## Configure
+
+`quality-gate.toml` at the repo root. Every key is optional; a repo whose layout
+matches the defaults needs no file at all.
+
+```toml
+[gate]
+artifacts_dir = ".quality"
+baseline_path = "quality-baseline.json"
+non_ratcheted_dirs = ["tests", "scripts", "notebooks"]
+default_baseline_ref = "origin/main"
+```
+
+`non_ratcheted_dirs` is the one most repos change. Findings in those directories
+stay in the uploaded artifacts — they just do not gate. One-off analysis
+scripts, notebook data collectors and test helpers are read top-to-bottom and
+run by hand; a 200-line `main()` is the right shape for what they are.
+
+## Two things it will not do
+
+**It will not let a branch set its own bar.** Every number the gate enforces
+comes out of a tracked file on the branch being scored, so the same commit that
+adds 47 lint errors can raise `lint_errors` to 47 and pass. That needs no
+malice: `promote` without `--monotonic` sets baseline = current for *every*
+metric, so a branch that runs it locally to seed one new row rewrites all the
+others. Pass `--baseline-ref origin/main` in CI and each metric is scored
+against the stricter of the two baselines.
+
+**It will not go green when it could not measure something.** A missing
+`gitleaks.json` is not a clean secret scan; a crashed `bandit` is not zero
+findings; a jscpd report that never got written is not zero duplication. Every
+one of those is an error that exits 1. All three used to be written the other
+way round, and each one silently disabled the check it was reporting on.
+
+## Supported
+
+| Language | Tools |
+|---|---|
+| Python | coverage.py, ruff (lint + complexity), mypy, bandit |
+| JavaScript / TypeScript | vitest, biome, tsc, npm audit |
+| Kotlin / Android | Kover, detekt, Android Lint, kotlinc |
+| Repo-wide | jscpd, gitleaks, pip-audit, npm audit |
+
+## Developing
+
+```bash
+uv venv && uv pip install -e '.[dev]'
+.venv/bin/python -m pytest        # includes the equivalence suite
+.venv/bin/python -m mypy          # --strict, src and tests
+```
+
+The suite runs the implementation this package replaces side by side with this
+one over identical inputs and asserts their stdout, stderr, exit code and
+written files match exactly. That is what lets a repo switch over without its
+gate changing verdict on the day it does. Every intended departure is listed in
+[DIVERGENCES.md](DIVERGENCES.md); anything else is a bug.
+
+To check against a repo's real reports rather than synthetic ones:
+
+```bash
+scripts/verify-against-repo.sh ../../trainwithme/nasa nasa-server
+```
+
+Design notes live in the Quality Gate project on mddocs.

ratchet_gate-0.1.0/RELEASING.md

@@ -0,0 +1,71 @@
+# Releasing
+
+The package is published to PyPI as [`ratchet-gate`](https://pypi.org/project/ratchet-gate/).
+
+## Why PyPI, and not the git tag
+
+Installing straight from `git+https://git.marim.dev/...` works, and the tag is
+still the source of truth for *what* was released. It just isn't reachable from
+everywhere: `git.marim.dev` resolves to `192.168.30.1` and has no public DNS
+record, so it works from the LAN and from self-hosted Gitea runners, and not at
+all from GitHub-hosted ones.
+
+`nasa` runs its gate on both forges from a single workflow file. PyPI is the one
+place every runner can already reach without a secret, a VPN, or a second copy
+of the workflow.
+
+## One-time setup
+
+1. Create the project on PyPI by uploading the first release (below). The name
+   `ratchet-gate` was unclaimed as of 2026-08-27.
+2. Mint a project-scoped API token at <https://pypi.org/manage/account/token/>.
+3. Add it to this repo as the `PYPI_TOKEN` secret, under
+   *Settings → Actions → Secrets*.
+
+Until step 3 is done, the release workflow fails loudly rather than skipping the
+upload — a release that silently didn't publish is worse than one that didn't
+run.
+
+## Cutting a release
+
+```bash
+# 1. Bump the version. The workflow refuses to publish a tag that disagrees
+#    with it, so these two are never allowed to drift.
+$EDITOR pyproject.toml
+
+# 2. Prove it against a real repo, not just the suite. This is the check that
+#    catches an extraction moving a number.
+uv build
+GATE="uvx --from ./dist/ratchet_gate-*.whl ratchet-gate" \
+  scripts/verify-against-repo.sh ../../trainwithme/nasa nasa-server
+
+# 3. Tag and push. The workflow tests, checks the tag, builds and publishes.
+git commit -am "Release vX.Y.Z"
+git tag -a vX.Y.Z -m "vX.Y.Z"
+git push origin main --follow-tags
+```
+
+## Publishing by hand
+
+If the runner is unavailable:
+
+```bash
+uv build
+UV_PUBLISH_TOKEN=pypi-... uv publish
+```
+
+## Versions are a contract with five workflows
+
+Adopting repos pin an exact version (`uvx ratchet-gate@X.Y.Z`), so a release is
+not visible to anyone until their workflow bumps. That is the point: the gate
+must not change what it measures underneath a PR that is already open.
+
+- **Patch** — a fix that cannot move a metric. Parser tolerance, error wording,
+  packaging.
+- **Minor** — new metrics, new languages, new flags. Existing baselines keep
+  scoring the same.
+- **Major** — anything that can change a verdict on an unchanged repo: scoring
+  rules, direction defaults, baseline schema.
+
+Every release should be able to say which of the three it is, and
+`scripts/verify-against-repo.sh` is how you find out you were wrong.

ratchet_gate-0.1.0/examples/quality-gate.toml

@@ -0,0 +1,5 @@
+[gate]
+artifacts_dir = ".quality"
+baseline_path = "quality-baseline.json"
+non_ratcheted_dirs = ["tests", "scripts", "notebooks", "mcp_server"]
+default_baseline_ref = "origin/main"

ratchet_gate-0.1.0/examples/quality-gate.yml

@@ -0,0 +1,65 @@
+# Reference CI workflow. Two jobs and one rule between them: pull requests are
+# scored against main's baseline, and only main is ever allowed to move it.
+name: quality-gate
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+env:
+  GATE: git+https://git.marim.dev/marim.dev/quality-gate@v0.1.0
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # --baseline-ref reads origin/main out of git, so it has to be here.
+          # A shallow clone makes the reference unreadable, and the gate fails
+          # closed rather than falling back -- which is correct, and confusing
+          # if you have not seen it before.
+          fetch-depth: 0
+
+      - uses: astral-sh/setup-uv@v5
+
+      # ... your own steps here: run the tools, write their output under
+      # .quality/<package>/. Every one of them under `|| true`, so a tool that
+      # exits non-zero on findings does not fail the job before the gate reads
+      # it. The gate is what decides the verdict.
+
+      - name: Gate
+        run: |
+          uvx --from "$GATE" quality-gate check \
+            --baseline-ref origin/main \
+            --summary-out "$GITHUB_STEP_SUMMARY"
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: quality-reports
+          path: .quality/
+
+  promote:
+    # Only on main, only after a green check. `promote --monotonic` adopts
+    # improvements and never loosens, so this can run unattended: a metric that
+    # held steady or drifted within tolerance keeps its prior baseline, and a
+    # re-trigger finds nothing new to move.
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    needs: check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      # ... run the tools again here, same as above ...
+      - name: Ratchet
+        run: |
+          uvx --from "$GATE" quality-gate promote --monotonic
+          git config user.name "quality-gate"
+          git config user.email "quality-gate@users.noreply.github.com"
+          git add quality-baseline.json
+          git diff --cached --quiet || git commit -m "chore: ratchet quality baseline"
+          git push

ratchet_gate-0.1.0/pyproject.toml

@@ -0,0 +1,68 @@
+[project]
+# The distribution is `ratchet-gate`, not `quality-gate`. "Quality gate" is
+# SonarQube's term for a pass/fail threshold, and a threshold is precisely what
+# this is not -- it scores against a committed baseline and only ever demands
+# that the number move the right way. The free generic name was not worth the
+# confusion, or the squat.
+name = "ratchet-gate"
+version = "0.1.0"
+description = "Ratchet quality gate: enforce monotonic improvement of code-quality metrics against a committed baseline."
+readme = "README.md"
+requires-python = ">=3.12"
+license = { file = "LICENSE" }
+authors = [{ name = "Mateus Marim" }]
+keywords = ["ci", "code-quality", "ratchet", "baseline", "coverage", "linting"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Quality Assurance",
+    "Topic :: Software Development :: Testing",
+    "Typing :: Typed",
+]
+dependencies = ["pydantic>=2.9"]
+
+[project.urls]
+Homepage = "https://git.marim.dev/mateuscmarim/quality-gate"
+Source = "https://git.marim.dev/mateuscmarim/quality-gate"
+
+[project.scripts]
+# Two names for one entry point. `ratchet-gate` matches the distribution, so
+# `uvx ratchet-gate check` needs no `--from`; `quality-gate` is what five repos'
+# workflows already say, and keeping it means adoption is a one-line diff.
+ratchet-gate = "quality_gate.cli:main"
+quality-gate = "quality_gate.cli:main"
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "mypy>=1.11"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/quality_gate"]
+
+[tool.mypy]
+python_version = "3.12"
+strict = true
+plugins = ["pydantic.mypy"]
+files = ["src", "tests"]
+# The vendored original is evidence, not source. It does not type-check
+# under --strict, which is itself part of why it was worth replacing.
+exclude = "tests/reference/"
+
+[[tool.mypy.overrides]]
+module = "tests.*"
+disallow_untyped_defs = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"
+
+[tool.ruff]
+line-length = 100
+target-version = "py312"