targetprocess-py 0.1.0__tar.gz → 0.2.0__tar.gz

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/.coderabbit.yaml

@@ -124,11 +124,14 @@ reviews:
         Items/Next/Prev envelope — are kept as recorded so a cassette still
         exercises real parsing, pagination and filter behaviour
         (docs/testing.md). On a write-path cassette the REQUEST body is
-        recorded as sent and is deliberately not field-scrubbed: its
-        Name/Description values are synthetic strings the test invented,
-        carrying the recording ticket's reference as a prefix, and must NOT
-        be flagged. Do flag a request body carrying text that reads as
-        having come off the live instance rather than being invented.
+        recorded as sent and is deliberately not field-scrubbed, save the Name
+        of each CustomFields entry (in one entity, or every item of a bulk
+        array), which is the tenant's configuration and is scrubbed to the
+        "Sanitised Name" placeholder as every Name in a response body is: its
+        other Name/Description values are synthetic strings the test invented,
+        carrying the module's recording prefix, and must NOT be flagged. Do
+        flag a request body carrying text that reads as having come off the
+        live instance rather than being invented.
     - path: ".github/workflows/**"
       instructions: |
         GitHub Actions CI — high blast radius. Validation jobs run on pull

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/.env.example

@@ -11,6 +11,10 @@ TP_DOMAIN=example.tpondemand.com
 # Fetch it from your TP instance's account settings; never share or commit it.
 TP_TOKEN=your-api-token
 
+# The project the write examples target when --project-id is not given. Set it
+# to a throwaway/sandbox project on your own instance; never production.
+TP_SANDBOX_PROJECT_ID=
+
 # Comma-separated allow-list of project ids the write examples may modify.
 # Only set this for a throwaway/sandbox project; never production.
 # Required by examples/create_bug.py and examples/bulk_updates.py.

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/.github/dependabot.yml

@@ -17,6 +17,14 @@
 # mypy --strict, pytest with --cov-fail-under=90, the pre-commit hook suite,
 # duplication detection, CodeQL, CodeRabbit review) decide whether a bump is safe
 # before it reaches main.
+#
+# Every commit-message prefix below (prefix and prefix-development alike) must
+# be a type the commit-msg hooks accept — the type-enum in .commitlintrc.json,
+# enforced by conventional-pre-commit — because CI lints each pull request's
+# title as a commit message and squash merge makes that title the commit on
+# main, so a prefix outside that set leaves every update from that ecosystem
+# unmergeable. The uv ecosystem uses build; pre-commit and github-actions both
+# use ci.
 version: 2
 
 updates:
@@ -42,8 +50,8 @@ updates:
     labels:
       - "dependencies"
     commit-message:
-      prefix: "deps"
-      prefix-development: "deps-dev"
+      prefix: "build"
+      prefix-development: "build"
       include: "scope"
     groups:
       # Test/lint/type tooling moves together: a mypy or ruff bump is judged by

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: uv sync --all-extras
@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - run: uv sync --all-extras
       - run: uv run pre-commit run --all-files --hook-stage pre-commit --show-diff-on-failure
       - run: uv run pre-commit run --all-files --hook-stage pre-push --show-diff-on-failure
@@ -80,7 +80,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - run: uv export --all-extras --no-emit-project --format requirements-txt --quiet -o requirements-audit.txt
       - run: uvx pip-audit --strict --no-deps --disable-pip --progress-spinner off -r requirements-audit.txt
 
@@ -95,7 +95,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - run: uv build
       - run: uvx twine==7.0.0 check --strict dist/*
       - name: Smoke-test the built wheel in a clean environment

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/.github/workflows/commit-message.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - run: uv sync --all-extras
       - name: Check the pull request title as a commit message
         run: |

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/.github/workflows/release.yml

@@ -42,7 +42,7 @@ jobs:
       # before building it.
       - name: Assert the tagged commit is on main
         run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - run: uv build
       - run: uvx twine==7.0.0 check --strict dist/*
       # The version is read from the package, not the tag (see

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/.pre-commit-config.yaml

@@ -82,7 +82,7 @@ repos:
   # line above sets up; CI runs the same two over a pull request's title,
   # since squash merge makes the title the commit on main.
   - repo: https://github.com/compilerla/conventional-pre-commit
-    rev: v4.3.0
+    rev: v4.4.0
     hooks:
       - id: conventional-pre-commit
         name: commit message follows Conventional Commits

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/CHANGELOG.md

@@ -7,6 +7,71 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-09-17
+
+The first beta release.
+
+### Added
+
+- `users.logged_user()`: resolves the user the client's credential
+  authenticates as with one `GET /api/v1/Users/LoggedUser`, returning the
+  `User` model, cached per client instance. `RequestHandler.logged_user()` is
+  the fixed-path read beneath it.
+- `update()` and `update_many()` take an opt-in, keyword-only `verify=True`:
+  after the write each entity is re-read with one independent GET narrowed to
+  the requested keys, the re-read model is returned instead of TargetProcess's
+  own echo, and a requested field that is not observed raises the new
+  `VerificationError`, which carries every mismatch and survives a pickle
+  round trip. A verified write refuses, before sending, a `CustomFields` entry
+  that is not a mapping with a string `Name`. The default path is unchanged.
+- `set_custom_field(id, name, value)` on every typed manager sets a
+  custom-field value by name, or clears it when `value` is `None`, sending
+  `{"CustomFields": [{"Name": ..., "Value": ...}]}`. It re-reads the entity by
+  default and raises `VerificationError` when the value, or the clear, did not
+  land, or no field of that name came back.
+- `entity_states.for_workflow(workflow_id)`, `entity_states.resolve(name, *,
+  workflow_id)` and `entity_states.final_states(workflow_id)`: the states of
+  one workflow, a state name resolved within that workflow (raising
+  `NotFoundError` or `AmbiguousMatchError` rather than guessing), and the
+  workflow's final states.
+- `entity_state_levels(id)` and `advance_state(id, *, to, team_to=None,
+  verify=True)` on the six work-item managers, through their new shared base
+  `AssignableResource`: a work item's project-workflow and team-workflow
+  entity states read together as `StateLevels` (of two `LevelState`s), and
+  moved as one transition - each target resolved within its own level's
+  workflow, one write where both levels share a workflow, and the new
+  `SplitTransitionError`, which survives a pickle round trip, raised before
+  any write when a distinct team level would be left behind.
+
+### Changed
+
+- Development status moves from Alpha to Beta (the
+  `Development Status :: 4 - Beta` classifier), and the README states what
+  1.0.0 requires.
+- `list()` refuses, before any request is sent, a `where=` filter naming a
+  nested collection path TargetProcess accepts and silently ignores -
+  currently `Assignments.*` on the assignable collections (`UserStory`,
+  `Bug`, `Task`, `Feature`, `Epic`, `Request`, and `Assignable` through
+  `entities`), which answer HTTP 200 with the unfiltered rows. The
+  `ValueError` names the join-entity route: query `assignments` by
+  `GeneralUser.Id`.
+- Every query-parameter name the request handler puts on an entity-API
+  request is declared in one allowlist (`QUERY_PARAMETERS`), and a name
+  outside it is refused before the request is built rather than sent for
+  TargetProcess to ignore. The `access_token` the transport merges in at
+  send time is not part of the allowlist.
+- The relation examples in the `relations` and `relation_types` docstrings,
+  and the relations read in `scripts/live_smoke.py`, use the current
+  `Inbound`/`Outbound` names in place of the deprecated `Master`/`Slave`: the
+  create, the `Outbound.Id` filter and the include.
+
+### Fixed
+
+- `ReadOnlyViolation` raised with an operation and a resource now survives a
+  pickle round trip with its message and attributes; it used to come back
+  with the generic readonly-mode message. Every library exception now pickles
+  through one mechanism on `TargetProcessError`.
+
 ## [0.1.0] - 2026-09-08
 
 The first public release.
@@ -97,5 +162,6 @@ The first public release.
 - Log scrubbing redacts the `access_token` query parameter and `Authorization`
   header values from the library's own log records.
 
-[Unreleased]: https://github.com/man8/targetprocess-py/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/man8/targetprocess-py/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/man8/targetprocess-py/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/man8/targetprocess-py/releases/tag/v0.1.0

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/CONTRIBUTING.md

@@ -22,15 +22,16 @@ unacceptable behaviour to louis@man8.com.
 
 ## Development setup
 
-Requires [uv](https://docs.astral.sh/uv/). `.python-version` pins the
-development interpreter (3.13); the library itself supports 3.12 and 3.13, and
-CI runs the test suite on both.
+Requires [uv](https://docs.astral.sh/uv/). `.python-version` and
+`.tool-versions` both pin the development interpreter (3.13); the library
+itself supports 3.12 and 3.13 (`requires-python >=3.12` in `pyproject.toml`),
+and CI runs the test suite on both.
 
 ```bash
 git clone https://github.com/man8/targetprocess-py.git
 cd targetprocess-py
 uv sync --all-extras
-uv run pre-commit install   # installs both the pre-commit and pre-push hooks
+uv run pre-commit install   # installs the pre-commit, commit-msg and pre-push hooks
 ```
 
 ## Quality gates
@@ -52,17 +53,83 @@ package build run in CI.
 | Dependency vulnerabilities | `pip-audit` over the locked environment (CI) |
 | Package build | `uv build` and `twine check` (CI) |
 
-Also enforced: a 1000-line / 256 KiB ceiling per tracked file
-(`scripts/check_large_files.py`), issue references on debt markers
-(`scripts/check_todos.py`), no internal references in tracked files
-(`scripts/check_internal_refs.py`) or in commit messages
-(`scripts/check_commit_message.py`), a cyclomatic-complexity ceiling of 10 (ruff
-`C901`), and copy-paste detection above 3% (`.jscpd.json`, CI only).
+Every hook that names no stage — `ruff-check`, `ruff-format`, the three
+repository checks (file size, debt markers, internal references) and the
+upstream `pre-commit-hooks` set (large added files, YAML and TOML validity,
+merge-conflict markers, private keys, end-of-file and trailing whitespace) —
+runs at both the commit and the push stage. `mypy --strict src` is pinned to
+the push stage alone, being too slow to gate every commit and meaningful only
+over the whole package. Ruff and mypy run through `uv run`, so the hook
+versions are exactly the ones pinned in `uv.lock`, with no second pin to
+drift.
+
+Also enforced:
+
+- A 1000-line / 256 KiB ceiling per tracked file
+  (`scripts/check_large_files.py`). `uv.lock` and the integration cassettes
+  are exempt, as generated artefacts whose size is not a design decision.
+- An issue reference on every debt marker (`scripts/check_todos.py`): a
+  `TODO`, `FIXME`, `HACK` or `XXX` with no reference is debt nobody owns,
+  since it never reaches a board. Markdown is not scanned — a marker in
+  prose is documentation about markers, not debt in a code path.
+- No internal references in tracked files (`scripts/check_internal_refs.py`)
+  or in commit messages (`scripts/check_commit_message.py`).
+- A cyclomatic-complexity ceiling of 10 (ruff `C901`).
+- Copy-paste detection above 3% duplication over Python sources
+  (`.jscpd.json`). Node-only tooling, so it runs in CI rather than requiring
+  a Node toolchain on every dev machine.
+
+The internal-references check matches a generic shape — an upper-case key of
+two to six characters, a dash, and up to six digits — rather than a list of
+keys, since publishing that list would leak the very thing the check exists to
+keep out. Matching is case-sensitive: lower-cased, the same shape also matches
+a locked dependency version and a GUID fragment. `EXCLUDED_PREFIXES` excuses
+the public standards designations that share the shape. Prose is scanned
+here, unlike the debt-marker check above, because the hook runs over every
+tracked text file. `ALLOWED_PATHS` permits a file by path alone — an entry
+exempts references only, so a session URL or trailer is refused there too —
+and it lapses as soon as the file stops carrying a reference, which
+`tests/test_internal_refs.py` asserts. The commit-message hook refuses the
+same shape with the same exclusions.
 
 Coverage is branch coverage over `src/`, gated at 90%. A change that drops
 coverage below the gate is not mergeable; add tests with the change rather than
 after it.
 
+`.github/workflows/ci.yml` runs five job definitions — six job runs, since
+`test` is a two-value matrix — on every push to `main` and every pull
+request: `test` (`uv sync`, `ruff check`, `ruff format --check`,
+`mypy --strict`, `pytest` with the coverage gate, over a Python 3.12/3.13
+matrix with `UV_PYTHON` overriding the `.python-version` pin per leg);
+`quality` (`pre-commit run --all-files` at both the `pre-commit` and
+`pre-push` stages, which also proves the hook configuration itself still
+works); `duplication` (jscpd); `audit` (`pip-audit` over `uv.lock` exported
+with every extra and its hashes, failing the job on any known
+vulnerability); and `build` (`uv build`, `twine check --strict`, and an
+import of the built wheel from a clean environment).
+
+`.github/workflows/release.yml` builds the distributions on a `v*` tag,
+refuses a tag whose commit is not on `main` or whose name disagrees with the
+wheel's version, and publishes to PyPI by trusted publishing (OIDC) under the
+`pypi` GitHub environment. No token is stored; the environment's protection
+rules are the manual gate on a publish.
+
+One check runs outside CI, since it needs a live instance and a real token
+that CI has neither of: `scripts/check_model_coverage.py` diffs each model's
+declared aliases against its type's `/api/v1/{collection}/meta` and reports
+coverage per model in both directions — a field TP declares that the model
+does not, and a field the model declares that TP does not. It is GET-only;
+`--fail-under` turns it into a gate for a caller who does have both a live
+instance and a token. Three further conditions fail a run besides a coverage
+shortfall: a declared field absent from `/meta`; a dead `EXCLUDED` or
+`KNOWN_DEVIATIONS` entry — recorded to keep a decision visible, and stale as
+soon as that decision changes; and a `/meta` body reporting no properties at
+all, which is a failed measurement rather than full coverage. `--validate`
+additionally fetches real records and parses them through each model — the
+check `/meta` alone cannot make, since it says which properties exist and
+not what TP puts in them — and a model whose sample cannot be fetched is
+reported as not checked and fails the run.
+
 ## Tests
 
 - Unit tests live in `tests/` (one file per model, resource or component) and
@@ -104,9 +171,12 @@ after it.
     body rather than a fixture teardown a later refactor could move outside the
     cassette.
   - **Everything sent is synthetic.** `_scrub_request` neutralises the host and
-    the token but nothing field-level, so a request body is recorded as sent:
-    a write-path test may only send text it invented, never a value copied off
-    the live instance.
+    the token but nothing field-level, save the name of each custom field in a
+    JSON request body (one entity, or every item of a bulk array), which is the
+    tenant's configuration and is scrubbed to the placeholder as every `Name` in
+    a response body is. So a request body is otherwise recorded as sent: a
+    write-path test may only send text it invented, never a value copied off the
+    live instance.
   - **Org-level state is read, never written.** Where a surface needs an
     existing Role, Team, RelationType or project membership, the test reads it
     live and uses it. Creating one would be a write outside the sandbox.
@@ -160,9 +230,10 @@ after it.
 
 - Ruff enforces PEP 8, pep8-naming, Google-convention docstrings on the public
   API, and the complexity ceiling. There are two documented naming exceptions:
-  the PascalCase accessors in `models.py` (a per-file ignore in
-  `pyproject.toml`) and the `ReadOnlyViolation` name (a `noqa` at its
-  declaration). Add a third only with the same kind of justification.
+  the PascalCase accessors in `_base.py` (a per-file ignore in
+  `pyproject.toml`; `models.py` is the re-export surface) and the
+  `ReadOnlyViolation` name (a `noqa` at its declaration). Add a third only
+  with the same kind of justification.
 - Prose (docs, comments, docstrings) uses British English, and identifiers
   follow suit where a spelling choice exists. Field names that mirror the
   TargetProcess wire format keep TP's spelling and casing.
@@ -222,6 +293,27 @@ feat!: require an explicit mode on the client
   session that produced the change, are welcome: they say how the change was
   made.
 
+## Releasing
+
+A release is a pull request followed by a tag.
+
+1. In a pull request, set `__version__` in `src/targetprocess/__init__.py`
+   (the only version string; the build reads it). Move the `[Unreleased]`
+   entries in `CHANGELOG.md` under a `## [X.Y.Z] - YYYY-MM-DD` heading dated
+   the release day, and update the link references at its foot. When the minor
+   version changes, update the supported-versions table in `SECURITY.md`. When
+   the development status changes, update the classifier in `pyproject.toml`
+   and the README's Development Status section.
+2. Once it has merged, a maintainer creates a signed, annotated tag on that
+   commit on `main` and pushes it:
+   `git tag -s vX.Y.Z -m "targetprocess-py X.Y.Z" <commit>`, then
+   `git push origin vX.Y.Z`.
+3. `.github/workflows/release.yml` builds and checks the distributions, then
+   waits for a maintainer to approve the `pypi` environment deployment. Once
+   approved it publishes to PyPI and creates the GitHub Release from the
+   version's CHANGELOG section.
+4. Confirm the new version on PyPI and its GitHub Release.
+
 ## Reporting a vulnerability
 
 See [SECURITY.md](SECURITY.md). Do not open a public issue for a suspected

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: targetprocess-py
-Version: 0.1.0
+Version: 0.2.0
 Summary: A Python library for the TargetProcess v1 REST API
 Project-URL: Homepage, https://github.com/man8/targetprocess-py
 Project-URL: Repository, https://github.com/man8/targetprocess-py
@@ -11,7 +11,7 @@ Author-email: Louis Mandelstam <louis@man8.com>
 License: MIT
 License-File: LICENSE
 Keywords: api,async,asyncio,client,httpx,pydantic,rest,sdk,targetprocess
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 4 - Beta
 Classifier: Framework :: AsyncIO
 Classifier: Framework :: Pydantic :: 2
 Classifier: Intended Audience :: Developers
@@ -326,16 +326,33 @@ See [SPEC.md](SPEC.md) for the full specification, including detailed architectu
 
 ## Development Status
 
-**Current Status**: Alpha - core library complete
-
-- ✅ Project structure and configuration
-- ✅ Exception hierarchy
-- ✅ Client safety modes (handler-layer + resource-layer enforcement)
-- ✅ HTTP transport layer (access_token / Basic auth)
-- ✅ API request/response handling (RequestHandler + ResponseParser), retry/backoff, rate limiting
-- ✅ Entity models (42 model classes: the `Entity`/`NamedEntity`/`GeneralEntity`/`AssignableEntity` base chain, 6 nested shapes (`EntityRef`, `EntityTypeRef`, `UserRef`, `RefWithImportance`, `CustomFieldValue`, `CustomFieldConfig`), and 32 concrete entity types across the assignable, planning, organisational, workflow and configuration, join, supporting, and custom-field groups), each declaring its type's full `/meta` field surface
-- ✅ Resource managers (typed + generic)
-- ✅ Recorded integration test suite against a real TargetProcess instance
+**Current status**: Beta. The core library is complete and tested against a
+real TargetProcess instance. The public surface may still change between 0.x
+minor releases; every change is recorded in [CHANGELOG.md](CHANGELOG.md).
+
+### What 1.0.0 requires
+
+1.0.0 will be released once all of the following hold:
+
+1. At least one comprehensive production integration is built on the library
+   and has been stable through the beta period.
+2. No open issue labelled `bug` remains unless explicitly deferred past 1.0.0,
+   and every known case where TargetProcess silently ignores all or part of a
+   request has been resolved: the library refuses it before sending, verifies it
+   after the write, or SPEC.md documents it as a limitation.
+3. The public surface is frozen: SPEC.md's Public API Surface matches
+   `targetprocess.__all__`, a Semantic Versioning promise for that surface is
+   stated, and a deprecation policy is written.
+4. Documentation and the recorded test cassettes are current: every public
+   resource manager is documented in [docs/USAGE.md](docs/USAGE.md), the
+   `KNOWN_DEVIATIONS` table in `scripts/check_model_coverage.py` has been
+   re-checked against a live instance, and the recorded test cassettes have no
+   open hygiene issues.
+5. CI tests every Python version `pyproject.toml` claims.
+6. The last beta release needed no breaking change to the public surface.
+7. The release carries the `Development Status :: 5 - Production/Stable`
+   classifier, a CHANGELOG section for 1.0.0, a `v1.0.0` tag on `main`, and is
+   published to PyPI through the release workflow.
 
 ## Requirements
 
@@ -359,6 +376,7 @@ in [`.env.example`](.env.example) (the committed template) and the
 | --- | --- |
 | `TP_DOMAIN` | TargetProcess instance domain |
 | `TP_TOKEN` | API token (sent as the `access_token` query parameter) |
+| `TP_SANDBOX_PROJECT_ID` | Default target project for the write examples |
 | `TP_WRITE_ALLOWED_PROJECT_IDS` | Project id allow-list for the write examples |
 
 For local development, copy the template to `.env` (which is gitignored) and

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/README.md

@@ -287,16 +287,33 @@ See [SPEC.md](SPEC.md) for the full specification, including detailed architectu
 
 ## Development Status
 
-**Current Status**: Alpha - core library complete
-
-- ✅ Project structure and configuration
-- ✅ Exception hierarchy
-- ✅ Client safety modes (handler-layer + resource-layer enforcement)
-- ✅ HTTP transport layer (access_token / Basic auth)
-- ✅ API request/response handling (RequestHandler + ResponseParser), retry/backoff, rate limiting
-- ✅ Entity models (42 model classes: the `Entity`/`NamedEntity`/`GeneralEntity`/`AssignableEntity` base chain, 6 nested shapes (`EntityRef`, `EntityTypeRef`, `UserRef`, `RefWithImportance`, `CustomFieldValue`, `CustomFieldConfig`), and 32 concrete entity types across the assignable, planning, organisational, workflow and configuration, join, supporting, and custom-field groups), each declaring its type's full `/meta` field surface
-- ✅ Resource managers (typed + generic)
-- ✅ Recorded integration test suite against a real TargetProcess instance
+**Current status**: Beta. The core library is complete and tested against a
+real TargetProcess instance. The public surface may still change between 0.x
+minor releases; every change is recorded in [CHANGELOG.md](CHANGELOG.md).
+
+### What 1.0.0 requires
+
+1.0.0 will be released once all of the following hold:
+
+1. At least one comprehensive production integration is built on the library
+   and has been stable through the beta period.
+2. No open issue labelled `bug` remains unless explicitly deferred past 1.0.0,
+   and every known case where TargetProcess silently ignores all or part of a
+   request has been resolved: the library refuses it before sending, verifies it
+   after the write, or SPEC.md documents it as a limitation.
+3. The public surface is frozen: SPEC.md's Public API Surface matches
+   `targetprocess.__all__`, a Semantic Versioning promise for that surface is
+   stated, and a deprecation policy is written.
+4. Documentation and the recorded test cassettes are current: every public
+   resource manager is documented in [docs/USAGE.md](docs/USAGE.md), the
+   `KNOWN_DEVIATIONS` table in `scripts/check_model_coverage.py` has been
+   re-checked against a live instance, and the recorded test cassettes have no
+   open hygiene issues.
+5. CI tests every Python version `pyproject.toml` claims.
+6. The last beta release needed no breaking change to the public surface.
+7. The release carries the `Development Status :: 5 - Production/Stable`
+   classifier, a CHANGELOG section for 1.0.0, a `v1.0.0` tag on `main`, and is
+   published to PyPI through the release workflow.
 
 ## Requirements
 
@@ -320,6 +337,7 @@ in [`.env.example`](.env.example) (the committed template) and the
 | --- | --- |
 | `TP_DOMAIN` | TargetProcess instance domain |
 | `TP_TOKEN` | API token (sent as the `access_token` query parameter) |
+| `TP_SANDBOX_PROJECT_ID` | Default target project for the write examples |
 | `TP_WRITE_ALLOWED_PROJECT_IDS` | Project id allow-list for the write examples |
 
 For local development, copy the template to `.env` (which is gitignored) and

{targetprocess_py-0.1.0 → targetprocess_py-0.2.0}/SECURITY.md

@@ -4,7 +4,8 @@
 
 | Version | Supported |
 | --- | --- |
-| 0.1.x | Yes |
+| 0.2.x | Yes |
+| 0.1.x | No |
 | Pre-release commits before 0.1.0 | No |
 
 Security fixes are released as a patch on the latest minor version. Once a new