relay-shell 0.4.0__tar.gz → 0.5.0__tar.gz

{relay_shell-0.4.0 → relay_shell-0.5.0}/.env.example

@@ -20,6 +20,7 @@ RELAY_SHELL_MAX_OUTPUT_HARD=1048576
 # scanned partially. Raise it only if you really pipe multi-MiB payloads.
 # 1024..134217728.
 RELAY_SHELL_MAX_INPUT=2097152
+# Default for shell_exec and ssh_exec when the call omits timeout.
 RELAY_SHELL_DEFAULT_TIMEOUT=60
 RELAY_SHELL_MAX_TIMEOUT=900
 RELAY_SHELL_MAX_SESSIONS=64
@@ -69,9 +70,10 @@ RELAY_SHELL_AUDIT_INTENT=false
 RELAY_SHELL_AUDIT_SESSION_INPUT=redacted
 # Tamper-evident audit (ADR 0007). When true, each record carries seq/prev/chain
 # so an edit, insertion, reorder, or interior deletion of the on-disk log is
-# detectable with `relay-shell --verify-audit` (head-truncation via
-# --require-genesis; tail-truncation and cross-file continuity are the off-host
-# shipper's job). Default off keeps the record byte-identical. Requires
+# detectable with `relay-shell --verify-audit`. The verifier requires genesis
+# by default; use --segment only for an explicitly partial segment.
+# Tail-truncation and cross-file continuity need an off-host anchor/shipper.
+# Default off keeps the record byte-identical. Requires
 # RELAY_SHELL_AUDIT_FORMAT=jsonl. Enable on a freshly rotated log for a clean chain.
 RELAY_SHELL_AUDIT_CHAIN=false
 
@@ -99,6 +101,9 @@ RELAY_SHELL_SSH_CONFIG=~/.ssh/config
 RELAY_SHELL_INVENTORY=
 # strict | accept-new | ignore
 RELAY_SHELL_SSH_KNOWN_HOSTS=accept-new
+# Allow a caller to select weaker host verification than the default. Set false
+# to refuse weaker per-call overrides; stronger overrides remain available.
+RELAY_SHELL_SSH_ALLOW_WEAKER_KNOWN_HOSTS=true
 RELAY_SHELL_SSH_CONNECT_TIMEOUT=10
 RELAY_SHELL_SSH_KEEPALIVE=30
 # Idle eviction for cached SSH connections (seconds). The pool consults

relay_shell-0.5.0/.github/workflows/ci-gate.yml

@@ -0,0 +1,70 @@
+name: CI aggregate
+
+on:
+  pull_request:
+
+permissions:
+  checks: read
+  contents: read
+
+
+# Coalesce initial PR attempts; isolate reruns and retain non-PR evidence.
+concurrency:
+  group: >-
+    ci-gate-${{ github.workflow }}-${{ github.event_name }}-${{
+    github.run_attempt == '1' && github.event.pull_request.number || github.run_id
+    }}-${{ github.run_attempt }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == '1' }}
+
+jobs:
+  ci-success:
+    name: ci-success
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      TARGET_SHA: ${{ github.event.pull_request.head.sha }}
+      REQUIRED_CHECKS: |-
+        Build (MkDocs Material)
+        check (py3.12)
+        check (py3.14)
+        gitleaks (secret scan)
+        pip-audit (CVE scan)
+        dependency-review
+        Analyze (python) (python)
+        Analyze (actions)
+      # Empty by design. Add an exact check name here only when a skipped
+      # result is an explicitly valid outcome for that protected dependency.
+      ALLOWED_SKIPPED_CHECKS: ""
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Require protected checks to pass
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          snapshot=$(mktemp)
+          trap 'rm -f "$snapshot"' EXIT
+          deadline=$((SECONDS + 1500))
+          while :; do
+            # One paginated snapshot per poll, rather than one API call per name.
+            # An API failure is a failure, never an empty/successful snapshot.
+            gh api --method GET --paginate --slurp \
+              "repos/${GITHUB_REPOSITORY}/commits/${TARGET_SHA}/check-runs" \
+              -f filter=all -F per_page=100 > "$snapshot"
+            result=0
+            python3 scripts/check_ci_checks.py < "$snapshot" || result=$?
+            case "$result" in
+              0) exit 0 ;;
+              2) ;;
+              *) echo '::error::Protected dependency failed or snapshot invalid'; exit 1 ;;
+            esac
+            if [ "$SECONDS" -ge "$deadline" ]; then
+              echo '::error::Timed out waiting for protected dependencies'
+              exit 1
+            fi
+            sleep 10
+          done

{relay_shell-0.4.0 → relay_shell-0.5.0}/.github/workflows/ci.yml

@@ -8,20 +8,33 @@ on:
 permissions:
   contents: read
 
+
+# Coalesce initial PR attempts; isolate reruns and retain non-PR evidence.
+concurrency:
+  group: >-
+    ci-${{ github.workflow }}-${{ github.event_name }}-${{
+    github.run_attempt == '1' && github.event.pull_request.number || github.run_id
+    }}-${{ github.run_attempt }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == '1' }}
+
 jobs:
   check:
     permissions:
       contents: read
     timeout-minutes: 20
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
     strategy:
-      # Surface every Python version's result so a single 3.14 wheel gap
-      # does not mask a 3.13 regression. The package floor is `>=3.12` in
-      # pyproject.toml; the matrix covers the floor plus the two newer
-      # interpreters in active CPython support.
+      # Qualify the native Python minor for each supported Ubuntu LTS.
+      # Both profiles must pass independently, including binary-only lock admission.
       fail-fast: false
       matrix:
-        python-version: ["3.12", "3.13", "3.14"]
+        include:
+          - os: ubuntu-24.04
+            os-version: "24.04"
+            python-version: "3.12"
+          - os: ubuntu-26.04
+            os-version: "26.04"
+            python-version: "3.14"
     name: check (py${{ matrix.python-version }})
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
@@ -32,11 +45,29 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           cache: "pip"
+          cache-dependency-path: |
+            requirements/development-py${{ matrix.python-version }}.txt
+
+      - name: Verify the qualified OS and Python profile
+        env:
+          EXPECTED_UBUNTU: ${{ matrix.os-version }}
+          EXPECTED_PYTHON: ${{ matrix.python-version }}
+        run: |
+          python - <<'PY'
+          import os, platform, sys
+          release = platform.freedesktop_os_release()
+          actual_python = f"{sys.version_info.major}.{sys.version_info.minor}"
+          if release["ID"] != "ubuntu" or release["VERSION_ID"] != os.environ["EXPECTED_UBUNTU"]:
+              raise SystemExit(f"Unexpected OS profile: {release}")
+          if actual_python != os.environ["EXPECTED_PYTHON"]:
+              raise SystemExit(f"Unexpected Python profile: {actual_python}")
+          PY
 
       - name: Install
         run: |
-          python -m pip install --upgrade pip
-          pip install -c requirements.txt -e ".[dev]"
+          python -m pip install --only-binary=:all: --require-hashes -r "requirements/development-py${{ matrix.python-version }}.txt"
+          python -m pip install --no-deps --no-build-isolation -e ".[dev]"
+          python -m pip check
           # Wire subprocess coverage: the stdio e2e launches `python -m
           # relay_shell` in a child, so without this the server.py wrappers
           # register as uncovered. The .pth runs at every interpreter start;
@@ -50,9 +81,11 @@ jobs:
       # (2.7+; the distro package is older). Built from the pinned module version, whose
       # contents the Go checksum database verifies, on one matrix leg only.
       - name: Install Caddy (edge routing tests)
-        if: matrix.python-version == '3.13'
+        if: matrix.python-version == '3.14'
         env:
           GOBIN: ${{ runner.temp }}/caddy-bin
+          # Avoid checksum-service HTTP/2 stream failures; TLS and Go sums stay enabled.
+          GODEBUG: http2client=0
         run: |
           command -v go
           go install github.com/caddyserver/caddy/v2/cmd/caddy@v2.11.7
@@ -80,8 +113,9 @@ jobs:
       # root-owned files cannot affect the steps before it). They still skip themselves if the
       # runner kernel does not support the notify channel; -rs prints that reason.
       - name: Test (seccomp-notify end to end, privileged)
-        if: matrix.python-version == '3.13'
+        if: matrix.python-version == '3.14'
         env:
           PYTHONDONTWRITEBYTECODE: "1"
         run: |
-          sudo -E "$(command -v python)" -m pytest -m seccomp -q -rs -p no:cacheprovider tests/test_seccomp.py
+          sudo --preserve-env=PYTHONDONTWRITEBYTECODE "$(command -v python)" -c 'from relay_shell.seccomp import platform_support; s=platform_support(); print(s); s.ok or exit("privileged seccomp coverage unavailable")'
+          sudo --preserve-env=PYTHONDONTWRITEBYTECODE "$(command -v python)" -m pytest -m seccomp -q -rs -p no:cacheprovider tests/test_seccomp.py

{relay_shell-0.4.0 → relay_shell-0.5.0}/.github/workflows/codeql.yml

@@ -12,6 +12,15 @@ permissions:
   contents: read
   security-events: write
 
+
+# Coalesce initial PR attempts; isolate reruns and retain non-PR evidence.
+concurrency:
+  group: >-
+    codeql-${{ github.workflow }}-${{ github.event_name }}-${{
+    github.run_attempt == '1' && github.event.pull_request.number || github.run_id
+    }}-${{ github.run_attempt }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == '1' }}
+
 jobs:
   analyze:
     name: Analyze (python)
@@ -29,15 +38,15 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4
+        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
 
   # A14-D12: the workflows themselves are code that holds tokens. A separate job (not a
   # matrix entry) so the required check `Analyze (python) (python)` keeps its name. It is in
@@ -54,12 +63,12 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
         with:
           languages: actions
           build-mode: none
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
         with:
           category: "/language:actions"

relay_shell-0.5.0/.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,42 @@
+name: Copilot development setup
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+      - requirements.txt
+      - requirements-build.txt
+      - "requirements/**"
+      - pyproject.toml
+permissions:
+  contents: read
+
+# Coalesce initial PR attempts; isolate reruns and retain non-PR evidence.
+concurrency:
+  group: >-
+    copilot-setup-steps-${{ github.workflow }}-${{ github.event_name }}-${{
+    github.run_attempt == '1' && github.event.pull_request.number || github.run_id
+    }}-${{ github.run_attempt }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == '1' }}
+
+jobs:
+  copilot-setup-steps:
+    runs-on: ubuntu-26.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.14"
+      - name: Prepare the constrained development environment
+        run: |
+          python -m pip install --only-binary=:all: --require-hashes -r requirements/development-py3.14.txt
+          python -m pip install --no-deps --no-build-isolation -e ".[dev]"
+          python -m pip check
+      - name: Verify tools and representative test discovery
+        run: |
+          ruff --version
+          mypy --version
+          python -m pytest --collect-only -q tests/test_stdio_e2e.py tests/test_ssh_integration.py

{relay_shell-0.4.0 → relay_shell-0.5.0}/.github/workflows/dependency-review.yml

@@ -6,6 +6,15 @@ on:
 permissions:
   contents: read
 
+
+# Coalesce initial PR attempts; isolate reruns and retain non-PR evidence.
+concurrency:
+  group: >-
+    dependency-review-${{ github.workflow }}-${{ github.event_name }}-${{
+    github.run_attempt == '1' && github.event.pull_request.number || github.run_id
+    }}-${{ github.run_attempt }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == '1' }}
+
 jobs:
   dependency-review:
     runs-on: ubuntu-latest

{relay_shell-0.4.0 → relay_shell-0.5.0}/.github/workflows/docs.yml

@@ -13,6 +13,7 @@ on:
       - "mkdocs.yml"
       - "requirements-docs.txt"
       - ".github/workflows/docs.yml"
+  pull_request:
   workflow_dispatch:
 
 # Least-privilege default; the deploy job adds only the Pages-specific scopes.
@@ -21,13 +22,13 @@ permissions:
 
 # One Pages deployment at a time; let an in-flight publish finish.
 concurrency:
-  group: pages
+  group: pages-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: false
 
 jobs:
   build:
     name: Build (MkDocs Material)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
@@ -35,16 +36,17 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
         with:
-          python-version: "3.14"
+          python-version: "3.12"
           cache: pip
           cache-dependency-path: requirements-docs.txt
       - name: Install MkDocs Material
         run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements-docs.txt
+          python -m pip install -r requirements-docs.txt
+          python -m pip check
       - name: Build site (strict)
         run: mkdocs build --strict
       - name: Upload Pages artifact
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5
         with:
           path: site
@@ -52,7 +54,8 @@ jobs:
   deploy:
     name: Deploy to GitHub Pages
     needs: build
-    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       pages: write # publish the Pages deployment

{relay_shell-0.4.0 → relay_shell-0.5.0}/.github/workflows/gitleaks.yml

@@ -22,6 +22,15 @@ on:
 permissions:
   contents: read
 
+
+# Coalesce initial PR attempts; isolate reruns and retain non-PR evidence.
+concurrency:
+  group: >-
+    gitleaks-${{ github.workflow }}-${{ github.event_name }}-${{
+    github.run_attempt == '1' && github.event.pull_request.number || github.run_id
+    }}-${{ github.run_attempt }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == '1' }}
+
 jobs:
   scan:
     name: gitleaks (secret scan)

{relay_shell-0.4.0 → relay_shell-0.5.0}/.github/workflows/nightly-fuzz.yml

@@ -30,11 +30,14 @@ jobs:
         with:
           python-version: "3.14"
           cache: "pip"
+          cache-dependency-path: |
+            requirements/development-py3.14.txt
 
       - name: Install
         run: |
-          python -m pip install --upgrade pip
-          pip install -c requirements.txt -e ".[dev]"
+          python -m pip install --only-binary=:all: --require-hashes -r requirements/development-py3.14.txt
+          python -m pip install --no-deps --no-build-isolation -e ".[dev]"
+          python -m pip check
 
       - name: Run fuzz suite (HYPOTHESIS_PROFILE=ci)
         env:

{relay_shell-0.4.0 → relay_shell-0.5.0}/.github/workflows/pip-audit.yml

@@ -19,6 +19,15 @@ on:
 permissions:
   contents: read
 
+
+# Coalesce initial PR attempts; isolate reruns and retain non-PR evidence.
+concurrency:
+  group: >-
+    pip-audit-${{ github.workflow }}-${{ github.event_name }}-${{
+    github.run_attempt == '1' && github.event.pull_request.number || github.run_id
+    }}-${{ github.run_attempt }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == '1' }}
+
 jobs:
   audit:
     name: pip-audit (CVE scan)
@@ -33,14 +42,21 @@ jobs:
         with:
           python-version: "3.14"
           cache: "pip"
+          cache-dependency-path: |
+            requirements/development-py3.14.txt
+            requirements-audit.txt
 
-      - name: Install package + dev extras
+      - name: Prepare separate locked subject and audit-tool environments
         run: |
-          python -m pip install --upgrade pip pip-audit
-          # Audit against the resolved dev set so transitive deps
-          # introduced via the optional [dev] / [http] extras are also
-          # covered.
-          pip install -c requirements.txt -e ".[dev,http]"
+          python -m venv .audit-runtime
+          .audit-runtime/bin/python -m pip install --only-binary=:all: --require-hashes -r requirements/development-py3.14.txt
+          .audit-runtime/bin/python -m pip install --no-deps --no-build-isolation -e ".[dev,http]"
+          .audit-runtime/bin/python -m pip check
+          python -m venv .audit-tool
+          .audit-tool/bin/python -m pip install --only-binary=:all: --require-hashes -r requirements-audit.txt
+          .audit-tool/bin/python -m pip check
+          audit_path=$(.audit-runtime/bin/python -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')
+          echo "AUDIT_SITE_PACKAGES=$audit_path" >> "$GITHUB_ENV"
 
       - name: Run pip-audit
         # `--skip-editable` excludes the local editable `relay-shell` install:
@@ -52,10 +68,14 @@ jobs:
         # audit and fails ("distribution marked as editable"). Every actual
         # third-party dependency (incl. the [dev]/[http] extras) is on PyPI and
         # still audited, and pip-audit still exits non-zero on any CVE found.
-        run: pip-audit --skip-editable
+        run: .audit-tool/bin/pip-audit --path "$AUDIT_SITE_PACKAGES" --skip-editable
 
       - name: Audit the hash-locked release and SBOM tooling
         # requirements-build.txt / requirements-sbom.txt feed the jobs that build,
         # sign and publish (A14-D7); they are not part of the package's own tree, so
         # audit them explicitly. They are fully pinned, so no resolution is needed.
-        run: pip-audit --disable-pip --no-deps -r requirements-build.txt -r requirements-sbom.txt
+        run: |
+          .audit-tool/bin/pip-audit --disable-pip --no-deps -r requirements-build.txt
+          .audit-tool/bin/pip-audit --disable-pip --no-deps -r requirements-sbom.txt
+          .audit-tool/bin/pip-audit --disable-pip --no-deps -r requirements-audit.txt
+

relay_shell-0.5.0/.github/workflows/release-rehearsal.yml

@@ -0,0 +1,115 @@
+name: Release preparation rehearsal
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+
+# Coalesce initial PR attempts; isolate reruns and retain non-PR evidence.
+concurrency:
+  group: >-
+    release-rehearsal-${{ github.workflow }}-${{ github.event_name }}-${{
+    github.run_attempt == '1' && github.event.pull_request.number || github.run_id
+    }}-${{ github.run_attempt }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == '1' }}
+
+jobs:
+  rehearse:
+    name: package-and-install-rehearsal (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-26.04]
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.14"
+      - name: Prepare the locked rehearsal driver
+        run: |
+          python -m pip install --only-binary=:all: --require-hashes -r requirements/development-py3.14.txt
+      - name: Rehearse package preparation and complete runtime restoration
+        run: python scripts/rehearse_release.py --output "$RUNNER_TEMP/release-rehearsal"
+      - name: Qualify actual installation and service-state recovery on the disposable VM
+        run: sudo --preserve-env=GITHUB_ACTIONS,RUNNER_ENVIRONMENT /usr/bin/python3 scripts/rehearse_install.py --output "$RUNNER_TEMP/install-rehearsal"
+      - name: Retain installer recovery receipt
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: install-rehearsal-${{ matrix.os }}-${{ github.sha }}
+          path: ${{ runner.temp }}/install-rehearsal/receipt.json
+          if-no-files-found: error
+          retention-days: 30
+      - name: Retain source-bound rehearsal evidence
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: release-rehearsal-${{ matrix.os }}-${{ github.sha }}
+          path: ${{ runner.temp }}/release-rehearsal/
+          if-no-files-found: error
+          retention-days: 30
+
+  cross-version:
+    name: cross-version-recovery
+    runs-on: ubuntu-26.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        id: build-python
+        with:
+          python-version: "3.14"
+      - name: Prepare hash-locked build tools
+        run: |
+          python -m pip install --only-binary=:all: --require-hashes -r requirements/development-py3.12.txt
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.14"
+      - name: Prepare independent audit tools with their locked interpreter
+        run: |
+          python -m venv .legacy-audit-tool
+          .legacy-audit-tool/bin/python -m pip install --only-binary=:all: --require-hashes -r requirements-audit.txt
+      - name: Audit the complete frozen baseline without executing it
+        run: |
+          set +e
+          .legacy-audit-tool/bin/pip-audit --requirement tests/fixtures/upgrade-v0.3/runtime.lock --require-hashes --disable-pip --strict --progress-spinner off --format json --output "$RUNNER_TEMP/legacy-audit.json"
+          audit_result=$?
+          set -e
+          test "$audit_result" -eq 0 || test "$audit_result" -eq 1
+          test -s "$RUNNER_TEMP/legacy-audit.json"
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        id: legacy-python
+        with:
+          python-version: "3.12"
+      - name: Qualify admitted release upgrade and explicit rollback
+        run: sudo --preserve-env=GITHUB_ACTIONS,RUNNER_ENVIRONMENT /usr/bin/python3 scripts/rehearse_upgrade.py --build-python "${{ steps.build-python.outputs.python-path }}" --legacy-python "${{ steps.legacy-python.outputs.python-path }}" --audit-report "$RUNNER_TEMP/legacy-audit.json" --output "$RUNNER_TEMP/upgrade-rehearsal"
+      - name: Retain cross-version source-bound receipt
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: upgrade-rehearsal-${{ github.sha }}
+          path: ${{ runner.temp }}/upgrade-rehearsal/receipt.json
+          if-no-files-found: error
+          retention-days: 30
+
+  release-rehearsal:
+    name: release-rehearsal
+    if: ${{ always() }}
+    needs: [rehearse, cross-version]
+    runs-on: ubuntu-26.04
+    timeout-minutes: 2
+    steps:
+      - name: Require package, installer and cross-version recovery
+        env:
+          PACKAGE_RESULT: ${{ needs.rehearse.result }}
+          UPGRADE_RESULT: ${{ needs.cross-version.result }}
+        run: test "$PACKAGE_RESULT" = success && test "$UPGRADE_RESULT" = success

{relay_shell-0.4.0 → relay_shell-0.5.0}/.github/workflows/release.yml

@@ -6,9 +6,9 @@ name: release
 #   1. verify     - the tag is annotated, SSH-signed against the trusted key
 #                   in deploy/release-signing.pub, and matches the version
 #                   declared in pyproject.toml
-#   2. build      - dev install (direct pins from requirements.txt as
-#                   constraints), full test suite on Python 3.14 (per-PR CI
-#                   exercises the 3.12-3.14 matrix), then `python -m build`
+#   2. build      - complete hashed development profile (historical tags retain
+#                   direct constraints), full test suite on Python 3.14 (per-PR CI
+#                   qualifies Ubuntu 24.04/3.12 and Ubuntu 26.04/3.14), then `python -m build`
 #                   to produce wheel + sdist. Build tooling comes from the
 #                   hash-locked requirements-build.txt and the build runs with
 #                   --no-isolation so no unpinned backend is fetched. This job
@@ -67,7 +67,7 @@ jobs:
           else
             tag="${REF#refs/tags/}"
           fi
-          if ! printf '%s' "$tag" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+([+.\-].+)?$'; then
+          if ! [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([+.-][0-9A-Za-z.-]+)?$ ]]; then
             echo "ERROR: $tag does not match the v<MAJOR>.<MINOR>.<PATCH> pattern" >&2
             exit 1
           fi
@@ -117,6 +117,7 @@ jobs:
           fi
           release_commit=$(git rev-list -n1 "${TAG}^{}")
           test -n "$release_commit"
+          test "$(git rev-parse HEAD)" = "$release_commit"
           # A tag is not an authority for its own signer trust anchor.
           # Fetch the protected default branch independently and require the
           # tagged commit to have passed the main-branch merge gate.
@@ -189,8 +190,15 @@ jobs:
           # --no-build-isolation installs and `python -m build` use these exact
           # (not freshly resolved) hatchling/build/twine.
           python -m pip install --require-hashes -r "$RUNNER_TEMP/requirements-build.txt"
-          # Direct dependency pins from requirements.txt act as constraints.
-          python -m pip install --no-build-isolation -c requirements.txt -e ".[dev]"
+          if [ -r requirements/development-py3.14.txt ]; then
+            # Refuse disagreement with the workflow's independently selected build tools.
+            python -m pip install --only-binary=:all: --require-hashes -r requirements/development-py3.14.txt -c "$RUNNER_TEMP/requirements-build.txt"
+            python -m pip install --no-deps --no-build-isolation -e ".[dev]"
+          else
+            # Historical signed tags predate complete profiles; retain their documented recovery path.
+            python -m pip install --no-build-isolation -c requirements.txt -e ".[dev]"
+          fi
+          python -m pip check
 
       - name: Run full test suite
         run: pytest -q
@@ -263,7 +271,7 @@ jobs:
           path: dist/
 
       - name: Publish via PyPI trusted publishing
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
         with:
           # Make a workflow re-run after a successful upload idempotent
           # instead of failing on "file already exists" - the runbook