scitex-dev 0.62.3__tar.gz → 0.62.4__tar.gz

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/.github/ci/build-in-sif.sh

@@ -38,6 +38,14 @@ echo "build: py=$(scitex_release_run "$PY" -V) target=$TMPDIR/site"
 # built artifacts are uploaded.
 scitex_release_run uv pip install --python "$PY" --target="$TMPDIR/site" build
 
+# The entry-point gate below imports the wheel against $TMPDIR/site ahead of
+# the SIF-baked site, so seed it with the declared runtime floor. The SIF
+# image predates any release cut after it was built (e.g. scitex-logging
+# 0.2.3, which provides the mandatory auditor provider); without this the
+# gate audits the new wheel against the image's stale deps and refuses a
+# correct artifact for environmental reasons. UV only (no pip fallback).
+scitex_release_run uv pip install --python "$PY" --target="$TMPDIR/site" "scitex-logging>=0.2.3"
+
 rm -rf dist
 scitex_release_run env PYTHONPATH="$TMPDIR/site" "$PY" -m build --installer uv --outdir dist
 

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/.github/tests/test_dev_ci_adapters.py

@@ -19,11 +19,11 @@ MATRIX = ROOT / ".github/workflows/pytest-matrix-on-ubuntu-py3-11-3-12-3-13.yml"
 AUDIT = ROOT / ".github/workflows/scitex-dev-quality-audit-on-ubuntu-latest.yml"
 FIXTURE = Path(__file__).parent / "fixtures/dev-shared-ci-public-source.json.gz"
 BASE = "f8de4d18dbfdda0d2a6df164d222b08b68454b16"
-REVISION = "d7d96c34d68cdfbb5503a933591f7748b5aa30ee"
+REVISION = "4cb16ac91db4b2eb6257d27e3b72e286d99d98b4"
 PINS = {
-    "ci-sif-matrix.yml": "f2abf8459abf711beb25355061df43572e506ae1461ffaf62cdaab2b05abcce1",
+    "ci-sif-matrix.yml": "67c6df104be81adcb22247e1c2e5663f51642536961f3a64b0515b8ab15ce3bb",
     "quality-audit.yml": "f44a2e6b5c479c2975d1cedf66738fdbf402a74cf1d8e26340bb9895524e7b4a",
-    "runner-admission.yml": "f2e92f6a50526c2133cd12ae7c5cbd98ce2922354bd85c628ca48aad4acc6d18",
+    "runner-admission.yml": "406b82aae0183da8bf35b3fcfa424f22231e3b132ba3e002f72e09c713828205",
 }
 
 
@@ -119,12 +119,15 @@ for (const event of ['push', 'pull_request', 'schedule', 'workflow_dispatch']) {
   const actual = profileSelection('scitex-ai/scitex-dev', event, 'matrix');
   if (JSON.stringify(actual.versions) !== '["3.11","3.12","3.13"]')
     throw new Error('Dev-minors-changed');
-  for (const native of [false, true]) {
-    let reason = null;
-    try { planFor('scitex-ai/scitex-dev', event, native); }
-    catch (error) { reason = error.message; }
-    if (reason !== 'image-unqualified') throw new Error('null-registration-not-refused');
-  }
+  // Non-native: no public image is registered for scitex-dev, so planning
+  // still refuses. Native: the retained-private-ci image qualifies.
+  let reason = null;
+  try { planFor('scitex-ai/scitex-dev', event, false); }
+  catch (error) { reason = error.message; }
+  if (reason !== 'image-unqualified') throw new Error('null-registration-not-refused');
+  const plan = planFor('scitex-ai/scitex-dev', event, true);
+  if (!plan.image || plan.image.authority_kind !== 'retained-private-ci')
+    throw new Error('native-image-unqualified');
 }
 console.log('all-four-events-three-minors-null-image-refused');
 """

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/.github/workflows/pypi-publish-and-github-release-on-tag.yml

@@ -28,6 +28,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      actions: read
     uses: scitex-ai/.github/.github/workflows/ci-sif-matrix.yml@main
     with:
       suite: dev-release

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/.github/workflows/pytest-matrix-on-ubuntu-py3-11-3-12-3-13.yml

@@ -20,9 +20,12 @@ jobs:
     # exec-in-sif.sh run-in-sif.sh command, owned PostgreSQL and [all,dev].
     # GitHub validates permission ceilings for every nested job, including
     # the SAC coverage leg; keep this grant local to the actual shared call.
+    # The shared evidence leg also needs actions:read (job inventory); without
+    # it the whole workflow fails at startup with zero jobs.
     permissions:
       contents: read
       id-token: write
+      actions: read
     uses: scitex-ai/.github/.github/workflows/ci-sif-matrix.yml@main
     with:
       suite: matrix

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scitex-dev
-Version: 0.62.3
+Version: 0.62.4
 Summary: Shared developer utilities for the SciTeX ecosystem
 Author-email: Yusuke Watanabe <ywatanabe@scitex.ai>
 License-Expression: AGPL-3.0-only
@@ -12,7 +12,7 @@ Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: scitex-config>=0.3.0
-Requires-Dist: scitex-logging>=0.1.0
+Requires-Dist: scitex-logging>=0.2.3
 Requires-Dist: click>=8.0.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: tomli>=2.0; python_version < "3.11"

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/docs/ci-runner-membership-policy.md

@@ -78,3 +78,12 @@ registers, starts, stops, moves, or reconfigures runners.
 Source publication, group-policy readback, and actual job execution remain
 distinct qualification steps. Older generic HPC/per-repository ensure
 commands are not the deployment path for this organization-only pool.
+
+The separately reviewed `hub-codeql-security-analysis.yml@refs/heads/main`
+definition is independently optional. It qualifies its whole protected current
+source and the admission workflow at that same revision. Adding it preserves
+all original finite profiles, the zero-or-pair SDK bundle, the zero-or-seven Hub
+validation bundle and the optional original Dev publisher. Existing 31-definition
+selection remains valid without CodeQL; CodeQL cannot authorize partial Hub
+validation, a leaf caller, a foreign revision or any other workflow. This source
+observer does not change the runner group or prove live CodeQL job admission.

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/pyproject.toml

@@ -44,7 +44,7 @@ keywords = ["scitex", "developer-tools", "documentation", "llm-friendly", "mcp"]
 #   textual        — the TUI dashboard (was [tui])
 dependencies = [
     "scitex-config>=0.3.0",
-    "scitex-logging>=0.1.0",
+    "scitex-logging>=0.2.3",
     "click>=8.0.0",
     "pyyaml>=6.0",
     'tomli>=2.0; python_version < "3.11"',
@@ -233,6 +233,11 @@ scitex-dev = "scitex_dev"
 [project.entry-points."scitex_dev.skills"]
 scitex-dev = "scitex_dev"
 
+# Project auditors operate on repository paths, independently of AST linters.
+# Each provider returns rule five-tuples and checks(repo, violation_cls, out).
+[project.entry-points."scitex_dev.audit.project"]
+scitex-dev = "scitex_dev._runtime_gitignore_plugin:get_plugin"
+
 # Federated scheduled-job providers. Each entry point loads to a callable
 # returning `list[scitex_dev.jobs.JobSpec]`; `scitex_dev.jobs.discover_jobs()`
 # aggregates them. scitex-dev's own built-ins are merged via an INTERNAL
@@ -363,8 +368,17 @@ Repository = "https://github.com/scitex-ai/scitex-dev"
 Documentation = "https://scitex-dev.readthedocs.io/"
 
 [tool.setuptools_scm]
-# Empty body: derive version from latest git tag (vX.Y.Z → X.Y.Z).
+# Derive version from latest vX.Y.Z release tag (vX.Y.Z → X.Y.Z).
 # Eliminates pyproject↔tag drift; release flow is `git tag vX.Y.Z && git push --tags`.
+# tag_regex restricts versioning to v* release tags so fleet archive/* retention
+# tags (slashed paths/dates, e.g. archive/three-days-rule/...), which are
+# reachable from HEAD and unparseable by the default regex, are ignored instead
+# of breaking editable installs (ValueError: Can't parse version from tag).
+tag_regex = '^v(?P<version>\d+\.\d+\.\d+.*)$'
+# Make `git describe` itself ignore non-release tags (fleet archive/* retention
+# tags are nearer than the last v* tag on feature lines, so describe would
+# otherwise hand setuptools-scm the archive tag to parse).
+git_describe_command = 'git describe --dirty --tags --long --match "v*"'
 
 [tool.setuptools.packages.find]
 where = ["src"]

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/src/scitex_dev/_cli/_utils.py

@@ -35,12 +35,12 @@ def handle_result(
     """
     if as_json:
         out = file or sys.stdout
-        print(result.to_json(), file=out)
+        write_stream(result.to_json(), out)
     elif result.success:
         out = file or sys.stdout
         data = result.data
         if isinstance(data, (dict, list, tuple)):
-            print(json.dumps(data, indent=2, default=str), file=out)
+            write_stream(json.dumps(data, indent=2, default=str), out)
         else:
             write_stream(data, out)
     else:

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/src/scitex_dev/_cli/audit/_config/_skip_rules.py

@@ -117,6 +117,8 @@ def parse_skip_rules(raw: object) -> list[SkipRule]:
             rule_id = str(rule).strip()
             if not rule_id:
                 raise _fail("an entry has an empty rule id")
+            if rule_id == "PS-220":
+                raise _fail("PS-220 is mandatory and cannot be deferred")
             entries.append(SkipRule(rule_id, _clean_reason(reason, rule=rule_id)))
         return entries
 
@@ -135,7 +137,11 @@ def parse_skip_rules(raw: object) -> list[SkipRule]:
             rule_id = str(item.get("rule") or "").strip()
             if not rule_id:
                 raise _fail(f"position {idx} has no `rule` key")
-            entries.append(SkipRule(rule_id, _clean_reason(item.get("reason"), rule=rule_id)))
+            if rule_id == "PS-220":
+                raise _fail("PS-220 is mandatory and cannot be deferred")
+            entries.append(
+                SkipRule(rule_id, _clean_reason(item.get("reason"), rule=rule_id))
+            )
         return entries
 
     raise _fail(f"expected a mapping or list, got {type(raw).__name__}")

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/src/scitex_dev/_cli/audit/_project/_audit.py

@@ -24,36 +24,36 @@ import click
 # `from scitex_dev._cli.audit._project._audit import X` keep working
 # after the split.
 from ._checks import (
-    _check_docs_structure,
-    _check_empty_test_dirs,
-    _check_loose_top_level_tests,
-    _check_mirror,
-    _check_placeholder_tests,
-    _check_tests_subdir_convention,
-    _check_top_level,
-    _suggest_test_location,
-    _test_has_src_match,
-    check_codecov_target,
+    _check_docs_structure as _check_docs_structure,
+    _check_empty_test_dirs as _check_empty_test_dirs,
+    _check_loose_top_level_tests as _check_loose_top_level_tests,
+    _check_mirror as _check_mirror,
+    _check_placeholder_tests as _check_placeholder_tests,
+    _check_tests_subdir_convention as _check_tests_subdir_convention,
+    _check_top_level as _check_top_level,
+    _suggest_test_location as _suggest_test_location,
+    _test_has_src_match as _test_has_src_match,
+    check_codecov_target as check_codecov_target,
 )
 from ._constants import (
-    _FORBIDDEN_TOP_DIRS,
-    _JUNK_FILE_RE,
-    _KNOWN_TEST_SUBDIRS,
-    _META_TESTS_AT_ROOT,
-    _MIRROR_EXEMPT_CATEGORIES,
-    _PRIVATE_TEST_RE,
-    _PUBLIC_TEST_RE,
-    _WALK_BLACKLIST_RE,
-    _is_blacklisted,
+    _FORBIDDEN_TOP_DIRS as _FORBIDDEN_TOP_DIRS,
+    _JUNK_FILE_RE as _JUNK_FILE_RE,
+    _KNOWN_TEST_SUBDIRS as _KNOWN_TEST_SUBDIRS,
+    _META_TESTS_AT_ROOT as _META_TESTS_AT_ROOT,
+    _MIRROR_EXEMPT_CATEGORIES as _MIRROR_EXEMPT_CATEGORIES,
+    _PRIVATE_TEST_RE as _PRIVATE_TEST_RE,
+    _PUBLIC_TEST_RE as _PUBLIC_TEST_RE,
+    _WALK_BLACKLIST_RE as _WALK_BLACKLIST_RE,
+    _is_blacklisted as _is_blacklisted,
 )
 from ._discovery import (
-    _has_py,
-    _import_name,
-    _is_git_ignored,
-    _resolve_repo_root,
-    _resolve_repo_root_with_rule,
-    _src_pkg_dir,
-    _tests_root,
+    _has_py as _has_py,
+    _import_name as _import_name,
+    _is_git_ignored as _is_git_ignored,
+    _resolve_repo_root as _resolve_repo_root,
+    _resolve_repo_root_with_rule as _resolve_repo_root_with_rule,
+    _src_pkg_dir as _src_pkg_dir,
+    _tests_root as _tests_root,
 )
 from ._registry import RULES, Rule
 from ._violation import Violation
@@ -118,6 +118,7 @@ def audit_project(
     violations: list[Violation] = []
 
     from ._resolved_tree import resolved_context, surface_resolved_tree
+
     resolved_ctx = resolved_context(repo_root)
     if repo_root is None:
         if json_out:
@@ -212,7 +213,9 @@ def audit_project(
         violations = kept
 
     violations = [
-        v for v in violations if cfg.applies(v.rule) and v.rule not in cfg.skip
+        v
+        for v in violations
+        if v.rule == "PS-220" or (cfg.applies(v.rule) and v.rule not in cfg.skip)
     ]
 
     # Severity filtering: print everything ≥ the requested floor.

scitex_dev-0.62.4/src/scitex_dev/_cli/audit/_project/_check_no_print.py

@@ -0,0 +1,19 @@
+"""Compatibility imports for the logging-owned PS-220 project auditor.
+
+The owning distribution supplies rule metadata and detection through
+``scitex_dev.audit.project``. Existing direct imports remain supported;
+the project runner invokes the discovered provider exactly once.
+"""
+
+from scitex_logging._output._auditor import (
+    PRINT_FORBIDDEN_RULES,
+    _DEFAULT_SEVERITY as _DEFAULT_SEVERITY,
+    check_ps220_no_print,
+    resolve_ps220_severity,
+)
+
+__all__ = [
+    "PRINT_FORBIDDEN_RULES",
+    "check_ps220_no_print",
+    "resolve_ps220_severity",
+]

scitex_dev-0.62.4/src/scitex_dev/_cli/audit/_project/_logging_backend.py

@@ -0,0 +1,8 @@
+"""Compatibility aliases for logging's exact stdlib backend proof."""
+
+from scitex_logging._output._backend import (
+    is_logging_backend_call,
+    owns_logging_backend,
+)
+
+__all__ = ["is_logging_backend_call", "owns_logging_backend"]

scitex_dev-0.62.4/src/scitex_dev/_cli/audit/_project/_plugins.py

@@ -0,0 +1,214 @@
+"""Load owner-provided project-auditor rules and checks.
+
+Providers in ``scitex_dev.audit.project`` expose ``get_plugin()`` returning
+``{"rules": [(code, section, description, severity, slug)], "checks": [...]}``.
+Each check accepts ``(repo_root, violation_class, violations)``. Providers
+may also supply ``registry_checks`` accepting the explicit ``scitex_dir``
+instead of a repository root. Registry checks run once in the host registry
+auditor; they never scan a user's home during the per-project audit loop.
+Providers must not import the project registry or Violation: both are assembled after
+discovery, and the engine supplies the violation class when invoking checks.
+
+The same validated bundle is used for registration and invocation. A broken
+provider or duplicate declaration aborts discovery; dropping a declared
+audit check would otherwise make a failing project appear compliant.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping, MutableMapping
+from dataclasses import dataclass
+from functools import lru_cache
+from importlib import import_module, metadata
+from typing import Any
+
+_GROUP = "scitex_dev.audit.project"
+_BUILTIN_VALUE = "scitex_dev._runtime_gitignore_plugin:get_plugin"
+_LOGGING_VALUE = "scitex_logging._audit_plugin:get_plugin"
+
+
+class ProjectPluginError(RuntimeError):
+    """A declared project-auditor provider cannot safely be activated."""
+
+
+@dataclass(frozen=True)
+class _PluginBundle:
+    rules: tuple[tuple[str, str, str, str, str], ...]
+    checks: tuple[Callable, ...]
+    registry_checks: tuple[Callable, ...] = ()
+
+
+def _entry_points():
+    """Read the group on both Python 3.9 and selectable metadata versions."""
+    points = metadata.entry_points()
+    if hasattr(points, "select"):
+        return points.select(group=_GROUP)
+    return points.get(_GROUP, ())
+
+
+def _payload(provider: Callable, name: str) -> Mapping:
+    try:
+        if not callable(provider):
+            raise TypeError("entry point must load a callable get_plugin")
+        payload = provider()
+        if not isinstance(payload, Mapping):
+            raise TypeError("get_plugin must return a mapping")
+        for key in ("rules", "checks"):
+            if key not in payload or not isinstance(payload[key], (list, tuple)):
+                raise TypeError(f"{key!r} must be a list or tuple")
+        if "registry_checks" in payload and not isinstance(
+            payload["registry_checks"], (list, tuple)
+        ):
+            raise TypeError("'registry_checks' must be a list or tuple")
+        return payload
+    except Exception as exc:
+        raise ProjectPluginError(f"{_GROUP} provider {name!r}: {exc}") from exc
+
+
+def _discover(points) -> _PluginBundle:
+    rules: list[tuple[str, str, str, str, str]] = []
+    checks: list[Callable] = []
+    registry_checks: list[Callable] = []
+    rule_owners: dict[str, str] = {}
+    check_owners: dict[str, dict[tuple, str]] = {
+        "checks": {},
+        "registry_checks": {},
+    }
+    providers = []
+    builtin_present = False
+    logging_present = False
+    provider_owners: dict[str, str] = {}
+    for point in sorted(points, key=lambda ep: (ep.name, ep.value)):
+        name = f"{point.name} ({point.value})"
+        if point.value in provider_owners:
+            raise ProjectPluginError(
+                f"{_GROUP}: duplicate provider {name!r}; "
+                f"already declared by {provider_owners[point.value]!r}"
+            )
+        provider_owners[point.value] = name
+        try:
+            provider = point.load()
+        except Exception as exc:
+            raise ProjectPluginError(
+                f"{_GROUP} provider {name!r} could not load: {exc}"
+            ) from exc
+        is_logging = point.name == "scitex-logging" and point.value == _LOGGING_VALUE
+        providers.append((name, provider, is_logging))
+        builtin_present |= point.value == _BUILTIN_VALUE
+        logging_present |= is_logging
+    if not logging_present:
+        raise ProjectPluginError(
+            f"{_GROUP}: mandatory scitex-logging provider {_LOGGING_VALUE!r} "
+            "is absent. Install matching scitex-logging and scitex-dev builds "
+            "that declare the logging auditor entry point; auditing cannot "
+            "report success without PS-220 coverage."
+        )
+    if not builtin_present:
+        # An editable/source checkout may have older installed metadata. Use
+        # the same owner provider, never a second copy of its rule/check logic.
+        try:
+            provider = import_module("scitex_dev._runtime_gitignore_plugin").get_plugin
+        except Exception as exc:
+            raise ProjectPluginError(
+                f"{_GROUP} built-in provider {_BUILTIN_VALUE!r} could not load: {exc}"
+            ) from exc
+        providers.append((_BUILTIN_VALUE, provider, False))
+    for name, provider, is_logging in providers:
+        payload = _payload(provider, name)
+        if is_logging and (
+            not any(
+                isinstance(rule, tuple)
+                and len(rule) == 5
+                and rule[0] == "PS-220"
+                and rule[3] == "E"
+                for rule in payload["rules"]
+            )
+            or not payload["checks"]
+        ):
+            raise ProjectPluginError(
+                f"{_GROUP} provider {name!r}: mandatory PS-220 error rule "
+                "and runnable project check are required"
+            )
+        for rule in payload["rules"]:
+            if (
+                not isinstance(rule, tuple)
+                or len(rule) != 5
+                or not all(isinstance(field, str) for field in rule)
+                or not all(field.strip() for field in rule[:3])
+                or rule[3] not in {"E", "W", "I"}
+            ):
+                raise ProjectPluginError(
+                    f"{_GROUP} provider {name!r}: invalid five-field rule {rule!r}"
+                )
+            code = rule[0]
+            if code == "PS-220" and not is_logging:
+                raise ProjectPluginError(
+                    f"{_GROUP}: PS-220 belongs to scitex-logging, not provider {name!r}"
+                )
+            if code in rule_owners:
+                raise ProjectPluginError(
+                    f"{_GROUP}: duplicate rule {code!r} from {name!r}; "
+                    f"already declared by {rule_owners[code]!r}"
+                )
+            rule_owners[code] = name
+            rules.append(rule)
+        for scope, destination in (
+            ("checks", checks),
+            ("registry_checks", registry_checks),
+        ):
+            owners = check_owners[scope]
+            for check in payload.get(scope, ()):
+                if not callable(check):
+                    raise ProjectPluginError(
+                        f"{_GROUP} provider {name!r}: {scope} check {check!r} "
+                        "must be callable"
+                    )
+                module = getattr(check, "__module__", None)
+                qualname = getattr(check, "__qualname__", None)
+                identity = (module, qualname) if module and qualname else (id(check),)
+                if identity in owners:
+                    raise ProjectPluginError(
+                        f"{_GROUP}: duplicate check {check!r} in {scope!r} from {name!r}; "
+                        f"already declared by {owners[identity]!r}"
+                    )
+                owners[identity] = name
+                destination.append(check)
+    return _PluginBundle(tuple(rules), tuple(checks), tuple(registry_checks))
+
+
+@lru_cache(maxsize=1)
+def _installed_plugins() -> _PluginBundle:
+    return _discover(_entry_points())
+
+
+def load_plugins(*, entry_points_iter: Callable | None = None) -> _PluginBundle:
+    """Return validated rules/checks, caching normal installed discovery.
+
+    ``entry_points_iter`` supplies real entry-point objects for an isolated
+    test or embedding host. Injected discovery bypasses the process cache.
+    The runtime owner is present even when its metadata predates it.
+    Logging is a required installed provider; absent or stale metadata fails.
+    """
+    if entry_points_iter is not None:
+        return _discover(entry_points_iter())
+    return _installed_plugins()
+
+
+def register_plugin_rules(
+    registry: MutableMapping,
+    rule_class: Callable,
+    *,
+    plugins: _PluginBundle | None = None,
+) -> None:
+    """Merge rules atomically, refusing collisions with engine-owned IDs."""
+    plugins = load_plugins() if plugins is None else plugins
+    collisions = set(registry).intersection(rule[0] for rule in plugins.rules)
+    if collisions:
+        raise ProjectPluginError(
+            f"{_GROUP}: rules already registered by the engine: {sorted(collisions)!r}"
+        )
+    additions: dict[str, Any] = {rule[0]: rule_class(*rule) for rule in plugins.rules}
+    registry.update(additions)
+
+
+__all__ = ["ProjectPluginError", "load_plugins", "register_plugin_rules"]

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/src/scitex_dev/_cli/audit/_project/_print_discriminator.py

@@ -1,47 +1,9 @@
 # -*- coding: utf-8 -*-
-"""The PS-220 bucket-five discriminator — is this `print(...)` a MESSAGE?
-
-Split out of `_check_no_print.py` (which owns the file walk, the exemption
-handling and the rule tuple) so the classification logic is one cohesive,
-separately-testable responsibility.
-
-A blanket ban on `print` would be wrong, and would get worked around rather
-than followed. Where output IS the product — a `--json` payload, piped data,
-a value a shell consumes — routing it through a logger would CORRUPT it,
-because scitex-logging writes every console record to STDERR. So the
-carve-out is a design constraint, not a concession, and it is decided
-STRUCTURALLY (from the AST) rather than by an honour-system comment:
-
-* ALWAYS FLAG — `print(..., file=sys.stderr)`. scitex-logging owns stderr; a
-  hand-rolled stderr write is exactly the unstructured, unfilterable output
-  the mandate removes.
-* ALWAYS FLAG — a stdout `print` whose payload is a string literal or an
-  f-string. That is human prose by construction — but prose is the DETECTOR,
-  not the hazard, and stating it as the hazard loses the argument. THE HAZARD
-  IS THAT LIBRARY CODE WRITES UNCONDITIONALLY TO STDOUT: a caller who imports
-  the module cannot silence, redirect or capture it — no flag, no handler, no
-  level. `log.info(...)` keeps the output for everyone who wants it and hands
-  control to the caller.
-
-  Worth stating explicitly because the weaker framing was in the finding
-  message and it lost. scitex-db objected (2026-08-10) that `_inspect.py`'s
-  whole job is rendering a table for a human, so "this is prose, therefore a
-  message" reads as the rule firing where no hazard exists. On that framing
-  they were right and the rule could not defend itself. They then supplied
-  the argument above — against their own position — and converted. A rule
-  whose stated reason can be beaten by a competent maintainer is one people
-  route around, which is the same "gets ignored" failure as too-low a
-  severity arriving by a different door.
-* SPARE — a stdout `print` (no `file=`, or `file=sys.stdout`) whose sole
-  positional argument is a serializer call (`json.dumps(...)`, `.to_json()`,
-  `.model_dump_json()`) or a variable holding an already-rendered payload.
-* FLAG EVERYTHING ELSE. An undecidable destination or an undecidable payload
-  is NOT evidence of safety. Unknown must never read as safe.
-
-Destinations and payload variables are resolved within the ENCLOSING FUNCTION
-when they are plain local names, so the common real-world shape
-``out = file or sys.stdout; print(payload, file=out)`` classifies correctly
-instead of falling into "undecidable".
+"""Legacy output-shape introspection and logging-owned strict enforcement.
+
+Destination, prose, and serializer helpers remain available to existing
+callers. They do not exempt any builtin print. ``should_flag`` is a direct
+compatibility alias to the owning logging distribution's strict rule.
 """
 
 from __future__ import annotations
@@ -263,39 +225,7 @@ def payload_is_explicitly_requested(tree: ast.AST, call: ast.Call) -> bool:
     return arg.id in _required_parameters(function)
 
 
-def should_flag(tree: ast.AST, call: ast.Call) -> tuple[bool, str]:
-    """Apply the bucket-five discriminator. Returns `(flag, why)`."""
-    dest = destination(tree, call)
-    if dest == STDERR:
-        return True, (
-            "writes to stderr, which scitex-logging owns — use "
-            "`log.warning(...)` / `log.error(...)` instead"
-        )
-    if dest == UNKNOWN:
-        return True, (
-            "writes to an undecidable destination (`file=` is not resolvably "
-            "stdout or stderr), so it cannot be shown to be machine-readable "
-            "stdout"
-        )
-    if dest == INJECTED:
-        return False, ""
-    if payload_is_machine_readable(tree, call):
-        return False, ""
-    if payload_is_explicitly_requested(tree, call):
-        return False, ""
-    if len(call.args) == 1 and is_prose(call.args[0]):
-        return True, (
-            "writes unconditionally to stdout from library code, so a caller "
-            "importing this module cannot silence, redirect or capture it — "
-            "there is no flag, no handler and no level. `log.info(...)` keeps "
-            "the output for everyone who wants it and hands control to the "
-            "caller"
-        )
-    return True, (
-        "prints an undecidable payload to stdout; only a serializer call "
-        "(`json.dumps(...)`, `.to_json()`, `.model_dump_json()`) or a variable "
-        "holding a rendered payload is treated as machine-readable output"
-    )
+from scitex_logging._output._auditor import should_flag
 
 
 __all__ = [

{scitex_dev-0.62.3 → scitex_dev-0.62.4}/src/scitex_dev/_cli/audit/_project/_rules/__init__.py

@@ -241,6 +241,11 @@ _SLUGS: dict[str, str] = {
 
 # Apply the overrides — replace each tagged Rule with a promoted copy that
 # carries both the (optional) severity override and the (optional) slug.
+# PS-220 has NO special case here: its mandatory error tier comes from the
+# merged rule itself (logging provider declares error), and the table owns
+# any change. A hardcoded `"E" if rule.code == "PS-220"` would make an
+# injected/test override a silent no-op — the exact failure class this
+# module's ordering tests pin (see test__registry_severity_overrides.py).
 def _patch(rule: Rule) -> Rule:
     sev = _SEVERITY_OVERRIDES.get(rule.code, rule.severity)
     slug = rule.slug or _SLUGS.get(rule.code, "")
@@ -305,13 +310,7 @@ for _c, _sec, _msg, _sev, _slug in (
 ):
     RULES[_c] = Rule(_c, _sec, _msg, _sev, _slug)
 
-# hook-bypass: line-limit
-# PS-220 — `print(...)` in scitex source (enforce scitex-logging). Co-located
-# rule, merged on the same terms as HOOK_RULES / URL_DEP_RULES / VERSION_FLAG.
-from .._check_no_print import PRINT_FORBIDDEN_RULES as _PRINT_FORBIDDEN_RULES  # noqa: E402
-
-for _c, _sec, _msg, _sev, _slug in _PRINT_FORBIDDEN_RULES:
-    RULES[_c] = Rule(_c, _sec, _msg, _sev, _slug)
+# PS-220 metadata is registered by the mandatory logging-owned provider.
 
 # PS-221 — [all]-closure on public optional-dependency extras (co-located
 # rule, merged on the same terms as URL_DEP_RULES / HOOK_RULES).
@@ -431,6 +430,12 @@ from .._check_hook_rules import HOOK_RULES_RULES as _HOOK_RULES_RULES  # noqa: E
 for _c, _sec, _msg, _sev, _slug in _HOOK_RULES_RULES:
     RULES[_c] = Rule(_c, _sec, _msg, _sev, _slug)
 
+# Owner-provided project checks share the existing Rule and override rails.
+# Keep this registration before the single final severity/slug pass below.
+from .._plugins import register_plugin_rules as _register_plugin_rules  # noqa: E402
+
+_register_plugin_rules(RULES, Rule)
+
 
 # hook-bypass: line-limit
 # ---------------------------------------------------------------------------