jjdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl m Z mZddlmZeejZejZdZdZdZd ad adfdZd\ZZZZ Z!dZ"dt4da#ej$dZ%e&hdZ'Gdde(Z)Gdde(Z*dgdZ+dhdZ,did#Z-djd%Z.dkd'Z/dld+Z0dmd0Z1dnd1Z2dod3Z3dnd4Z4dpd7Z5dqd;Z6drdBZ7dsdCZ8dtdEZ9dudIZ:dvdLZ;dwdOZdxdRZ?dydSZ@dzdTZAd{dUZBd{dVZCd{dWZDd{dXZEd|dZZFd}d[ZGd~d\ZHdd^ZIddd`ZJddaZKGdbdcejLZMdd{ddZNeOdekre jPeNdSdS)aThe publish gate, for every package that pins this one. Written for three packages - invisible_core, invisible_playwright and invisible_firefox; the last was deleted on 2026-08-18, and the gate below is unchanged by that, because it was never named to a fixed count of consumers - see "one gate on purpose" below. Importable, so `python -m invisible_core.release` works wherever the core is installed - which is everywhere, since every consumer pins it exactly. It used to be a script in the core's repo, so the consumers had no gate at all: on 2026-07-27 invisible-playwright 0.4.4 reached the index built from a tree that predated the fix it was supposed to carry, uploaded by a bare `twine upload` of whatever happened to be in a directory. A PyPI filename is never re-uploaded, so that artifact is wrong forever and the only remedy was 0.4.5. `publish` builds and uploads WHAT IT JUST BUILT. That is the property which makes that failure impossible, and it is the reason to use this rather than twine - not the digests, not the ledger, but that the bytes uploaded are the bytes the gate looked at. Which project is gated comes from the pyproject.toml at --project-root, so this file names no package. ) annotationsN)datetimetimezone)PathzPUBLISHED.jsonz CHANGELOG.mdzinvisible-coreinvisible_coreroot'Path'return'tuple[str, str]'c$t|dz } ddl}|d5}||}dddn #1swxYwYn(#t$r}t d|d||d}~wwxYwt |didpd }|st |d |d id id idididpg}|rt|dj n| dd}||fS)a(distribution name, wheel package name) read from the project itself. From pyproject rather than from an argument: a name passed on the command line is a second place for it to be wrong, and this gate exists to stop that class of mistake. zpyproject.tomlrNrbz cannot read : projectnamez declares no [project] nametoolhatchbuildtargetswheelpackages-_) rtomllibopenload Exception GateBrokenstrgetstriprreplace) r cfg_pathrfhcfgexcdistrpkgs FC:\Projects\Muse2API\.venv\Lib\site-packages\invisible_core/release.pyresolve_project_identityr+CsDzz,,HD ]]4  #B,,r""C # # # # # # # # # # # # # # # DDD999C99::CD swwy"%%))&117R 8 8 > > @ @D CHAAABBB##''4488"EEC 2&&ss7B'7'7JNKM $, H$x{   $,,sC2H2HC 9s:AA AAAAA B%A;;B)rrhttps://pypi.org/pypi//jsonz^(\d+)\.(\d+)\.(\d+)$>.hgtags .hgignore .gitignore.gitattributesceZdZdZdS)rz4The gate could not form an opinion. Never a refusal.N__name__ __module__ __qualname____doc__r*rrys>>>>r=rceZdZdZdS)LedgerUnavailablezJThe gate's memory is missing or unreadable. Never a pass, never a refusal.Nr7r<r=r*r?r?}sTTTTr=r?bbytesr cNtj|SN)hashlibsha256 hexdigest)r@s r* _sha256_bytesrGs >!   & & ( ((r=blobcd|vr|S |dn#t$r|cYSwxYw|ddddS)aFold CRLF and lone CR to LF for anything that is text. A checkout on Windows with autocrlf active and the same checkout on Linux hold the same content in different bytes. The ledger is checked in and travels between the two, so digesting raw bytes would make the first CI run on Linux refuse a release nobody made a change to. Binary payloads are left exactly alone: a NUL byte or a failed UTF-8 decode is the test, and both are conservative - misjudging a text file as binary costs a false alarm, the error this normalisation exists to remove, so the test errs towards text only when the bytes really do decode. THE EXACT BOUNDARY, both sides of it deliberate ----------------------------------------------- This is the only place the gate is allowed to be blind, so the width is chosen rather than inherited, and both edges are pinned by tests (test_release_gate.py, D4 and D6): lower edge - it must fold at least CRLF, or the gate cries wolf on every cross-platform release and gets switched off. upper edge - it must fold nothing ELSE. Every other whitespace difference survives: an extra space, a tab, a blank line, a trailing newline and, above all, a change of indentation. Indentation is semantic in Python, so a normalisation that stripped whitespace generally would let a re-indent - which can move a statement out of an `if` - ship under an unchanged version. THE COST, accepted knowingly ---------------------------- A lone CR is folded wherever it appears, including inside a string literal where it is DATA and not a line ending. A build whose only difference is `"a\rb"` becoming `"a\nb"` therefore reads as byte-identical here and the gate will not refuse it. The alternative is to tell a content CR apart from a line-ending CR without parsing the language the file is written in, which cannot be done; digesting raw bytes instead brings back the false alarm on every CRLF checkout, which is the worse failure because it ends with the gate turned off. Source that genuinely needs a bare CR should write the escape `\r` rather than embed the byte, and then it is ordinary text and is digested like any other. utf-8   )decodeUnicodeDecodeErrorr#)rHs r* normaliserQsuP$  G   << ' ' / /u = ==s  --whlrdict[str, str]c i}tj|5}d|D}t|dkrt |jd||dddddz}|D]}|r|j }||dkr+| |rd|t|dz}tt| |||< dddn #1swxYwY|st |jd|S) anpath -> sha256 of each member's normalised bytes. Hashed here rather than copied out of RECORD: RECORD carries the raw byte digest, which is exactly the number a CRLF/LF flip moves. RECORD itself is skipped - its bytes are a function of every other member, so including it would just re-report the same differences a second time, un-normalised. c<g|]}|d|S)z.dist-info/RECORDendswith.0ns r* z"wheel_manifest..s*SSSa1::>Q3R3RSSSSr=rz%: expected exactly one RECORD, found r/z /Nz: the wheel holds no files)zipfileZipFilenamelistlenrrrsplitinfolistis_dirfilename startswithrGrQread)rRoutz record_names dist_infoinfors r*wheel_manifestrlsC   ?SS1::<<SSS |   ! !]]|]]^^ ^ O**32215; JJLL ? ?D{{}} =D|A&&y)) >%S^^__(==%it &=&=>>CII ? ??????????????? BCH@@@AAA JsDD55D9<D9sdistci}tj|d5}|D]}|sd|jvr!|jdddn|j}|t vrR||}|jtt| ||< dddn #1swxYwY|st|jd|S)zFpath -> sha256 for every regular file, top-level version dir stripped.zr:gzr\rNz : no files) tarfiler getmembersisfilersplitSDIST_NONCONTENT extractfilerGrQrfr)rmrgtfmemberrr%s r*sdist_manifestrws<C eV $ $ <mmoo < z"manifest_digest..s5DDa))HQK))DDDDDDr=rK)joinsortedrGencode)rxrHs` r*manifest_digestrsK 99DDDD6(3C3CDDD D DD W-- . ..r=oldnewdict[str, list[str]]cdtfdzDtz tz dS)Nc3@K|]}||k|VdSrCr<)rYr}rrs r*r~z!diff_manifests..s5QQA#a&@P@P!@P@P@P@PQQr=changedaddedremoved)rkeys)rrs``r*diff_manifestsrsQQQQQSXXZZ#((**%<QQQQQ SXXZZ/00#((**sxxzz122  r=outdirisolatedbooltuple[Path, Path]c tjdddddt|t|g}|s|ddt j|dd }|jd krd|jp|jpd d d}td d |zdzt|d}t|d}t|dkst|dkrtd|d|d||d |d fS)N-mrz--wheelz--sdistz--outdirr.z--no-isolationT)capture_outputtextrriz4the build failed, so there is nothing to compare: z z8 If the backend is missing: pip install build hatchlingz*.whlz*.tar.gzrz$expected one wheel and one sdist in z, got  )sys executabler insert subprocessrun returncodestderrstdoutr" splitlinesrrlistglobr`)r rrcmdproctailwhlstarss r* _build_oncers[ >4)Y s6{{CII /C ( 1&''' >#d > > >D ! 0t{0b7799DDFFsttL Ckk$ J K    G$$ % %D  J'' ( (D 4yyA~~Ta[[[d[[UY[[\\\ 7DG r=ctj|5}d|Dd}||dd}dddn #1swxYwY|D]]}|dr0|dddcS|sn^t|j d) Nc<g|]}|d|Sz.dist-info/METADATArVrXs r*r[z'_version_from_wheel..*MMMa1::6K+L+LMMMMr=rrKr#zVersion::rz: METADATA declares no Version) r]r^r_rfrOrrerrr"rr)rRrhrmetalines r*_version_from_wheelr s0   7MM1::<<MMMaPvvd||""7I66777777777777777!! ??: & & 1::c1%%a(..00 0 0 0zz||  E  @@@ A AAAA//A36A3 list[str]ctj|5}d|Dd}||dd}dddn #1swxYwYg}|D]n}|snW|drA|| dddo|S)Nc<g|]}|d|SrrVrXs r*r[z"_requires_dist..rr=rrKr#zRequires-Dist:rr) r]r^r_rfrOrr"reappendrr)rRrhrrrgrs r*_requires_distrs$   7MM1::<<MMMaPvvd||""7I66777777777777777 C!!66zz||  E ??+ , , 6 JJtzz#q))!,2244 5 5 5 JrcH tj|5}tj|t dd}dddn #1swxYwYt|ddS#t$rYdSwxYw)zGArchaeology for the ledger entry: which engine this core was sealed to.z /seal.jsonrKNtagr) r]r^jsonloadsrfPKG_NAMErOr r!r)rRrhdatas r*_seal_tag_from_wheelr&s _S ! ! OQ:aff%<%<%<==DDWMMNND O O O O O O O O O O O O O O O488E2&&''' rrs5BAA% B%A))B,A)-%B B! B! self_checkdictc tjd5}t|}t||dz |\}}t |t |t |dt|idt|i|j |j d}t|dd|dd<t|dd|dd<|rt||d z |\}} t|t| } } t| |ddkrGt|dd| } td | d | d z| d zdt| |ddkrFt|dd| } td| d | d z| d zdddn #1swxYwY|S)zBBuild and describe the artifact. Raises GateBroken, never refuses.zinvisible-core-gate-prefixafiles)versionseal_tag requires_distrrmwheel_filenamesdist_filenamerdigestrmr@zwtwo builds of the SAME tree produced different wheels, so a digest comparison proves nothing here. unstable entries: rrrzW pin the build backend, or re-run with --single-build if you accept the weaker check.zKtwo builds of the SAME tree produced different sdists. unstable entries: N) tempfileTemporaryDirectoryrrrrrrlrwrrrr) r rrtdtmprRrmrkwhl2sdist2w2s2ds r*inspectr0sb  $,B C C C Wr2hh sSy(;; U*3//,S11+C00~c223~e445!h#j  #2$w-2H"I"IW h"1$w-2H"I"IW h  W'tS3YAALD&#D))>&+A+ABr""d7mH&==="4=#92>> /+,Y> V+,Y----.whl` and an sdist is `-.tar.gz`, with the distribution name escaped so that it can never itself contain a hyphen (PEP 427). So the version is recoverable from the name without guessing, and it is a SECOND, independent witness of what the entry claims to be - which is the whole point of reading it. rz.whlNrr-rz.tar.gz)rWr`rrra)rrdpartsstems r*_version_in_filenamerXs g~~  (( 43v;;,'--c22u::??uQxx4   Y ' 't $c)nn_$ %D%(D[[4;;sA  q ! !d:r=pathiintentryobjectNonec6|d|d}t|ts't|dt|jd|d}t|t r|st|ddD]}||}t|tst|d|d |d t|d tr|d st|d|d |d t|dt r|dst|d|d |dd|d D}|r"t|d|d |d|dd|d}||} t| t r| st|d|d |dt|| } | t|d|d |d| d|d | |krt|d|d|d| d| d t|d } | |dkr7t|d|d |d|dddd|d | ddd! dS)"aA present-but-malformed entry is GATE BROKEN, never a violation. Without this, an entry missing its 'wheel' key blew up inside the diff and the caller reported something violation-shaped. The operator then reads "the content changed" and starts hunting a change that does not exist, which is the exact failure mode that gets gates disabled. Say the record is unusable, and say which record. Two of the checks below are not shape checks, they are CONSISTENCY checks, and both close a measured hole: * the version string is the key everything else is looked up by (_entry_for matches on it and nothing else), so on its own it is a claim with no witness. Editing released[0].version from 18.0.0 to 17.9.0 made a drifted 18.0.0 build look like it had never been published and exited 0 PUBLISH ALLOWED, while every other single-field corruption in this file yields exit 2. The recorded filenames carry the version too, so the entry can be made to corroborate itself. * a digest that does not match the file table it sits next to means the entry disagrees with itself, and there is no way to tell which half is right. Overwriting both digests with garbage while leaving the tables intact used to read as "nothing to release", because the verdict was computed from the tables and only the digests were printed. z : released[]z is z, not an objectrz has no 'version' string)rrm (z ) has no 'a' record, so there is nothing to compare this build against. The ledger is written only by `version_gate.py record`; a hand edit or a bad merge is the usual cause. Restore it from git history rather than re-recording, or the record of what was actually published is lost.rz): 'z.files' is missing or emptyrz.digest' is missingcBg|]\}}t|t|Sr<) isinstancer )rYkvs r*r[z#_validate_entry..s+MMMTQ*Q:L:LMqMMMr=z".files' has non-string hashes for Nr- _filenamez'. `record` always writes it, and it is the only thing in the entry that corroborates the version string - without it one edited field turns a published version into an unpublished one. Restore the entry from git history.z' is z, which is not a z. filename this gate can read a version out of.z: the entry says version z but its 'z, which was built as a . The two cannot both be right, so this record cannot say what was published. An edited version string is the usual cause, and on its own it would make a drifted build look like it had never been released. Restore the entry from git history rather than re-recording it.z .digest' is z but the 'z".files' table beside it hashes to z. The entry contradicts itself and there is no way to tell which half is the record of what shipped, so this gate will not compare against either. Restore the entry from git history.) rrrtyper8r!r itemsrr) rrrwhererrrHbadkeyrddeclared recomputeds r*_validate_entryrlsD2 $ $ $ $ $E eT " "NELLtE{{';LLLMMMii ""G gs # #=7=E;;;<<<!/@/@yy~~$%% CBBGBBsBBBCC C $((7++T22 X$w- XVVVVcVVVWW W$((8,,c22 P$x. PNNNNcNNNOO OMMT']0022MMM  /....c..$'G..// /99S>>(C(( L LKKGKKsKKKLL L (X66  GGGGGGG8GGGGGHH H w  GG7GGGGGG4<GGGHH H%T']33 h ' '??G????$x.":M????;Ecrc????@@ @ (S/@/@r=c|s"t|dtd|jd t j|d}n'#t$r}t|d|dd}~wwxYwt|tst|d | d tkr/t|d | d d tt| d tst|dt|d D]\}}t||||S)aRead the ledger, or raise. It NEVER invents one. An absent file used to return an empty ledger, and `check` then announced "this is release 1" and exited 0. That is the gate's single piece of offline memory failing open: a --ledger typo, a deleted file, a shallow checkout or a bad merge each disarmed it while a real content change sat in the tree. Missing and unreadable are now the same hard stop, and it is a stop the operator cannot mistake for a pass. a: NO LEDGER. This file is the gate's only offline memory of what was already published. Without it the gate cannot tell a first release from a release whose content moved under a version that did not, so it refuses to guess. Usual causes, in order: a typo in --ledger; a checkout that did not bring the repo root; the file deleted or lost in a merge. If this really is the first release ever, create it with printf '{"schema": z, "released": []}' > "zC" and run `check --first-release` - which says so out loud, once.rKencodingz: UNREADABLE LEDGER (z). Restore it from git history. Do not delete it to move on: an absent ledger is this same failure, and re-recording would overwrite the record of what was actually published.Nz0: UNREADABLE LEDGER (top level is not an object)schemaz: ledger schema is z, this gate understands releasedz: ledger has no 'released' list)existsr? LEDGER_SCHEMArrr read_textrrrr!r enumerater)rrerrs r* load_ledgerrs ;;== Q P P)6 P PPTy P P P Q Q Q8z$..'.::;; 888 7 7! 7 7 788 88 dD ! ![4 Y Y YZZZ xx]**  (:(:        dhhz**D 1 1J4 H H HIIId:.//((5a'''' Ks(A!! B+BBrc||jdz}|tj|dddzdt j||dS)Nz.tmpr,T)indent sort_keysrzrKr) with_suffixsuffix write_textrdumpsosr#)rrrs r* write_ledgerrs`   4;/ 0 0CNN4:d1===DwNWWWJsDr=ledgerr dict | NonecV|dD]}|d|kr|cS dS)Nrrr!)rrrs r* _entry_forr s@ J  55  w & &HHH ' 4r=rtuple[int, int, int] | Nonect|}|r>t|dt|dt|dfndS)Nrr,r-) _VERSION_REmatchr)rms r*_parse_versionrsJ!A01 ;C!IIs1Q4yy#ad)) , ,t;r=labelrc hg}dD],}||D]!}|d|dd|d|"-|S)Nr z<8rr)r)rrlineskindr}s r* _report_diffrsd E/884 8 8A LL6666%66166 7 7 7 7 8 Lr=a Two remedies are legal, and exactly one of them fits: 1. A core-only fix against the SAME engine bump CORE_REVISION in src/invisible_core/_version.py (it is the only hand-edited number in the package). {cur} -> {next_rev} Never reset it: pip compares with != , not <. 2. The engine moved roll a new seal (a new firefox-N tag in src/invisible_core/seal.json). The version follows the tag on its own, no hand edit. Then re-run: python scripts/version_gate.py check a Publishing this as-is is a no-op for every installed copy: pip's satisfaction check is name plus version, never content, so nobody who already has {cur} would ever receive these bytes. Bump `version` in pyproject.toml - {cur} -> {next_rev} - and note the change in CHANGELOG.md. Never reuse a version: a PyPI filename can never be re-uploaded, so a wrong artifact stays wrong forever. Then re-run: python -m invisible_core.release check c"t|}tdkr7|r|dd|ddzdnd}t||S|r|dd|dd|ddznd }t||S) Nrr.rz.0zthe next revision)curnext_revr,zthe next version)rrREMEDYformatCONSUMER_REMEDY)rr}nxts r*_remedyr%swA###()B1$$!q$$$$/B}}3}777)* BQqT % %AaD % %1Q4!8 % % %0BC  ! !g ! < <tSt1||}|rtd?|d@t!|dAdr8t3|t%|t|} | t&kr| Std-t&St5|d d|d d}t5|dd|dd}|d d |d d kp|dd |dd k}|stdB|dCtdDtdEtdF|d1d2tdGtdHtdIt6StdJtdK|dL|d1dMdtdN|d d dd dO|d d dd tdP|dd dd dO|dd dd tdQt9d |t9d|zD]}t|tdRtdStdT|Utt=|tS)VNrr GATE BROKEN: filerrrz (seal )r wheel rrr rz entries sdist rmz ledger z (rz published)cLg|]!}d|ddv|"S)@;r)rr)rYrs r*r[zcmd_check..Ts0 G G G!qwws||A0F0FA0F0F0Fr=rzE RELEASE REFUSED: a dependency is declared as a direct URL reference.ra A public index rejects this metadata outright (HTTP 400), and a direct reference carries no version specifier, so `pip check` has nothing to compare and reports a broken environment as healthy. Declare a real specifier instead, for example name==X.Y.Z. first_releaseFz: RELEASE REFUSED: the ledger records no published version.z. parses and is empty. That is either the firstzA release ever, or a ledger that lost its entries - and this gatez@ cannot tell those apart, so it will not guess in the directionz that lets everything through.z. If nothing has ever been published, say so:z8 python scripts/version_gate.py check --first-releasez> If something HAS been published, restore the ledger from gitzA history. Do not re-record: `record` would write today's digestszA as if they were what shipped, and the real record is then gone.zG FIRST RELEASE DECLARED - the operator states nothing is published yet.z@ The ledger is empty, so there is no earlier content to comparezC against. This gate starts guarding the moment `record` writes thez> first entry, and --first-release must never be passed again.zD Nothing local can check this claim, so the index is asked, always:z PUBLISH ALLOWEDz2 RELEASE REFUSED: --first-release was passed, but z already records z published version(s): published_atzat an unrecorded timez3 The flag exists to be used exactly once. Drop it.c3K|]}||V dSrCr<)rYr}s r*r~zcmd_check..s/  1    r=c3\K|]'}t|ddV(dS)rrNrr!rYrs r*r~zcmd_check..s8ZZ!i(<(<==ZZZZZZr=)defaultrc34K|]}t|VdSrC)r )rYxs r*r~zcmd_check..s(11Q#a&&111111r=z* RELEASE REFUSED: version went BACKWARDS. z < z, already published.zC CORE_REVISION was reset, or the seal tag moved down. pip comparesz= with != , not <, so a version that goes backwards is not anz= upgrade for anybody and the index will not accept it twice.z VERSION z< HAS NEVER BEEN PUBLISHED - it moved since the last release. verify_indexz RELEASE REFUSED: z( is already published and its content iszD byte-identical to what was published. There is nothing to release,z9 and the index refuses a filename it has already served.z published z> (exit 5, not 1: a no-op, not a refusal. A caller that treatsz? every non-zero alike reports a red release for a tag that isz1 simply pointing at something already shipped.)z> RELEASE REFUSED: the content changed but the version did not.z version z (published ? wheel  -> sdist z1 Files that differ from the published artifact:zC Publishing this as-is is a no-op for every installed copy: pip'szC satisfaction check is name plus version, never content, so nobodyz5 who already has {v} would ever receive these bytes.)r)rr r!r$rrr single_buildrprintrr EXIT_BROKEN DIST_NAMEr` EXIT_REFUSEDr'_verify_first_releaser)EXIT_OKr!rmaxrr  _verify_indexrEXIT_ALREADY_PUBLISHEDrrr)r#r ledger_pathrrkrrsealurlsr6rcrnewesthipriorwdiffsdiffrrs r* cmd_checkrX?s ! " " * * , ,D"4((K  % %FtdmDDU@UVVV  !a!! 33339oG  D Y " " " "D&H&8&8&8&8&8b IJJJ ZT']8,SbS1 Z ZSgw9O5P5P Z Z Z[[[ ZT']8,SbS1 Z ZSgw9O5P5P Z Z Z[[[ Jk J Jc&*<&=&= J J JKKK H GtO, G G GD  VWWW  A ***     M N N N * "t_e44 O P P P R{RRR S S S U V V V T U U U 3 4 4 4 C D D D L M M M R S S S U V V V U V V V  XYYY PQQQ STTT NOOO TUUU ">$#7#7 8 8 ==I !"""t_e,, QKQQRRR R3vj'9#:#:RRRSSS # ] ]A [9[[!%%@W*X*X[[[ \ \ \ \ CDDD  ! !C   ZZvjGYZZZ   (,...  #,,11&11111B dddBddd e e e W X X X Q R R R Q R R R  vw ' 'E } `7```aaa 4 / / wt(<(<>Nt>T>TUUBW}}  !""" 5>'2DM'4J K KE 5>'2DM'4J K KEW~h'4=+BBF.*d7mH.EE  & UGUUUVVV TUUU IJJJ QUYY~7NOOQQRRR NOOO OPPP ABBB%% KLLL Q' Q Q .#0N0N Q Q QRRR [%.23B37 [ [T']8=TUXVXUX=Y [ [\\\ [%.23B37 [ [T']8=TUXVXUX=Y [ [\\\ >???We,,|GU/K/KK d  PQQQ OPPP A H H7 H S STTT ''   A$$ B.$BBBc |t|j}t|}t |} t ||j|j }n<#t$r/}td|tj tcYd}~Sd}~wwxYw|d}t||}||dd|ddkr7|dd|ddkrt|dtStd |d tj td |dddd d |dddd tj td|dddd d |dddd tj tdt!|dd|ddtdt!|dd|ddzD]}t|tj tdtj tdtj tdtj t"S|d||dt'jt*jd|d|d|d|d|dd|ddt3||td|d|td|ddtd|ddt5||t7|tS) Nr+r,r-rrrrmz: already recorded with these exact digests, nothing to do.z REFUSED: z1 is already in the ledger with DIFFERENT digests.rBrrCrDrz? Recording over it would erase the record of what was actuallyzC published - and it is exactly the drift `check` exists to refuse,z: made invisible in one command. Bump the version instead.rrz%Y-%m-%dT%H:%M:%SZrrr)rrr8rrrrrmcLt|ddpdS)Nrr)rrrr;)rs r*zcmd_record..s".y"9M9M*N*N*[R[r=)rz recorded z in r0r2)rr r!r$rrrrErrFrrrGr rKrrrIrrnowrutcstrftimesortr_align_changelog_dater)) r#r rOrrkrrrUrs r* cmd_recordrbs8 ! " " * * , ,D"4((K  % %FtdmDDU@UVVV  !a!! 33339oG vw ' 'E  >( #tG}X'> > >gx(DM(,CCC WXXX Y Y YN T'TTT:     0eGnX6ss;00gx("-0069j B B B B 0eGnX6ss;00gx("-0069j B B B B!'>%.:Q:>w-:P,R,RSS#G^E'N7>> NrYc  t|j} t||j|j }n<#t $r/}td|tj tcYd}~Sd}~wwxYwttj |d|d|dd|ddt|dd t|dd |d d d tS)Nr+r,r-rrrrrmrr)rr wheel_digest sdist_digest wheel_entries sdist_entriesrr,)r)rr r!rrrErrFrrrGrrr`rK)r#r rkrs r*cmd_showrh s' ! " " * * , ,DtdmDDU@UVVV  !a!! 3333 $* ?$W h/W h/T']7344T']7344o.    NsA A?$A:4A?:A?c  t|}n1#ttf$rtdtjwxYw|t krtdtj|St|j }tj d5}t|} t|||j \}}nH#t$r;}td|tjtcYd}~cdddSd}~wwxYwtjdd d t!|t!|g}|jrd |jg|d d <|jrVtd tdd|ztdt cdddStdd|zt)j|} | jdkrRtd| jdtjtdtjtcdddS dddn #1swxYwYt/|S)acheck -> upload -> record, in one command, so the gate cannot be skipped. This exists because the first version of this gate was wired to nothing: `grep -rn version_gate` over the whole workbench found the script, its test and a comment, and an operator running `twine upload dist/*` by hand would never have touched it. A gate that depends on somebody remembering it is a runbook note wearing a gate's clothes. So the upload lives INSIDE the gate rather than beside it. `check` runs first, in-process; on anything other than exit 0 this returns that exit code unchanged and twine is never reached. The artifacts uploaded are the ones the gate just built and digested, from a temporary directory, so there is no window in which a stale dist/ gets shipped instead of the thing that was checked. `record` runs only after twine returns 0, because the ledger is a record of what reached the index and not of what we intended to send. z. upload NOT attempted: the gate could not run.r-z- upload NOT attempted: the gate did not pass.zinvisible-core-publish-rr,Nrtwineupload --repositoryr.zB --dry-run: the gate passed, and this is the upload it authorises:rrz0 Nothing was uploaded and nothing was recorded.z gate passed, uploading: rz upload FAILED (twine exit z). Nothing recorded: thezE ledger records what reached the index, never what we tried to send.)rXr?rrFrrrKrr r!rrrrrGrr repositorydry_runrrrrrb) r#rRr rrrRrmrrrs r* cmd_publishro s" t__ z * ?cjQQQQ   W}} >SZPPPP ! " " * * , ,D  $,E F F F"b $T64=AAJC    %!%%CJ 7 7 7 7       ~tWhC#e**M ? 9&8C!H <  W X X X &388C==( ) ) ) D E E E /#((3--?@@@~c"" ?a   ZZZZz # # # # Yz # # # #-" #. d  sS.A&I7CI D$D?DIDBI7B II!Iurlcddl}ddl} |j|d5}t j|d}dddn #1swxYwYnb#|jj $r-}|j dkricYd}~Std|d|d d}~wt$r}td|d|d d}~wwxYwt|tr)t|d itstd|d |d iS) aBThe index's `releases` map for this distribution: version -> file records. THE ONE place this module opens the index. Every reader below is a view of this call, so the versions the gate cross-checks and the upload date a changelog heading is aligned to cannot come from two fetches that disagree. A 404 is an answer, not a failure: the project has never been published. Anything else that goes wrong is NOT an answer, and the caller must never be able to read it as an empty index - that is the fail-open shape this whole file exists to avoid. rN)timeoutrKizindex cross-check failed: rr/releasesz& did not answer with a releases object) urllib.errorurllib.requestrequesturlopenrrrfrOerror HTTPErrorcoderrrrr!)rpurllibr6rrs r*_index_releasesr}XsC ^ # #C # 4 4 8:affhhoog6677D 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 < !CCC 6S==IIIIIIAaAA3AAABBB CCCAaAA3AAABBBC dD ! !-DHHZ4L4Ld)S)S-,c,,,-- - 88J # ##sRA8:A, A8,A00A83A04A88C B/CB// C<CCc:tt|S)zHEvery version the index serves for this distribution. Raises GateBroken.)rr})rps r*_index_versionsrus /#&& ' ''r=ct||pg}d|D}|rt|ddndS)aThe date the index records for `version`, "YYYY-MM-DD", or None. The EARLIEST `upload_time_iso_8601` among that version's files, truncated to its date. That is UTC, and it is the same field reduced the same way that the consumer's changelog gate compares a heading against (`min(f["upload_time_iso_8601"] for f in files)[:10]`). Reading it from here rather than from a clock is what makes the two unable to disagree. crg|]4}t|t|d,|d5S)upload_time_iso_8601)rrr!)rYfs r*r[z&_index_upload_date..sYHHHAAt$$H)*/E)F)FHa&'HHHr=N )r}r!min)rrprstampss r*_index_upload_daterzse C $ $W - - 3EHHHHHF% /3v;;ss  4/r= index_urlc  |tz }|sdS t|| n3#t$r&}t dtd|dYd}~dSd}~wwxYw %t dtdt d|ddS|}|d}tj d tj |zd z}| |}|t dtd |d dS| d  kr t dtd|d ddS| fd|d} t| t|ks&Jt| t|f| d|dksJ| d|dksJ|| t dtd|d| d d d dS)aGive the CHANGELOG heading for `version` the date the index recorded. Run straight after the ledger is written, which is the first moment the fact EXISTS. Before the upload lands, a heading dated by the person writing it is a prediction of a timestamp, and the prediction is wrong whenever the author is east of UTC late in the day: 0.16.2 of the wrapper was headed 2026-09-16 (Rome) against an upload at 2026-09-15T23:21Z, and the consumer's e2e gate went red on main. 0.6.0 had been a day out before that, which is why the gate's own docstring says dates are compared at all. Nothing here invents a date. If the index cannot be reached, or does not serve this version yet, the file is left exactly as it is and the reason is printed: the consumer's gate is still the net, and a date written confidently from the wrong source is worse than a heading nobody touched. Nr1z( NOT aligned: the index did not answer (z&). The heading keeps whatever it says.z' NOT aligned: the index does not serve rzM yet, so there is no upload date to copy. The heading keeps whatever it says.rKz(?m)^(##[ \t]*\[z#\][ \t]*-[ \t]*)(\d{4}-\d{2}-\d{2})z has no `## [z*] - YYYY-MM-DD` heading, nothing to align.r,z heading for z already reads rc4|dzS)Nr)group)rrecordeds r*r\z'_align_changelog_date..s X 5r=rLrMrrCz', from the index's upload_time_iso_8601)CHANGELOG_NAMEis_filerrrFrH read_bytesrOrecompileescapesearchrsubrr`count write_bytes) r rrrrrawrheadingfoundrrs @r*raras . D <<>>%gy99  5>551555 6 6 6 5>5555$555 6 6 6  //  C ::g  Dj,ry/A/AAABCCG NN4 E } #>##### $ $ $ {{1~~!! S>SSSSSSSTTT ++5555t < < C CG L LC s88s3xx   #c((CHH!5    99W  7!3!3 3 3 3 3 99U  syy// / / / /S  ?~ ? ?G ? ?u{{1~~ ? ?  ? ? ?@@@@@s4 A$AA$ Path | Nonec p t|}n<#t$r/}td|tjt cYd}~Sd}~wwxYw||vr1tdt d|dtdtStdt d|d t|d  |-d t| d gDndn#t$rdYnwxYwtfd |D}|rttdt|dt dtdd |ztdtdtdtdtStS)zJOptional ONLINE cross-check. The ledger is a claim; the index is the fact.r,r-Nz+ RELEASE REFUSED: the index already serves rrz> A version number can never be reused, not even after a yank. index cross-check: z is not on the index (z versions published)c8h|]}|dS)rrr<s r* z _verify_index..s$WWW!QUU9%%WWWr=rc3$K|] }|v|V dSrCr<)rYrrs r*r~z _verify_index..s-@@Aax.?.?a.?.?.?.?@@r=z"RELEASE REFUSED: the index serves  version(s) of z! that the ledger does not record:r, zB Those were published outside this gate, so there is no record ofz? what shipped under them and a re-release with different byteszA would go unnoticed. Back-fill them from the artifacts the indexz> actually serves - not from today's tree, which has moved on.)rrrFrrrGrHrIr`rr!rrrrK)rrpr publishedrgapsrs @r*rMrMs>#C((  !a!! 3333) SYSSSSSTTT NOOO  3) 3 3g 3 3)nn 3 3 3444)XW{6/B/B/F/FzSU/V/VWWWW/3  @@@@@@@@@  GGG Bs4yyBBBBB C C C &499T??* + + + V W W W S T T T U V V V R S S S  Ns, A $AA A 01C"" C10C1c t|}nW#t$rJ}td|tjtdtjt cYd}~Sd}~wwxYw|rtdtdt |dtdtd d |dd zt |d krd nd ztdtdtdtdtStdtdtdtS)aThe FORCED cross-check behind --first-release. Never optional. "Nothing has ever been published" is the one claim in this gate that an index can settle outright, and it is also the one claim that turns the gate off completely: with an empty ledger there is no earlier content, so a real content change sails through. Measured - `check --first-release` on an empty ledger and a modified tree exited 0, and `publish --first-release --dry-run` went on to print the twine command it authorised. The recipe that gets an operator into that state is the printf load_ledger itself prints when the ledger is missing, so it is the documented path rather than an exotic one. Hence: on that branch the index is asked, always, and it must serve NO version at all. An index that cannot be reached is exit 2 (no opinion), not exit 0 - which costs nothing real, because release 1 is being run on a machine that is about to upload to that same index. r,r-aX --first-release forces this cross-check: the claim is that NOTHING has been published, and the index is the only thing that can settle it. With an empty ledger there is no content to compare against either, so passing here would mean the gate checked nothing at all. Run it where the index is reachable - the upload needs that anyway.NzG RELEASE REFUSED: --first-release says nothing has ever been published,z but the index already serves rrrrz ...rzA So the ledger is empty because it was LOST, not because this iszD release 1. Restore it from git history. Do not re-record: `record`zC would write today's digests as if they were what shipped, and thez/ record of what actually shipped is then gone.rz! has no published version, so thez first-release claim holds.) rrrFrrrGr`rHrrIrK)rprrs r*rJrJs" #C((  !a!! 3333 V :       XYYY [I[[y[[[\\\ ftyy2A2///S^^a=O=O66UWXYYY QRRR TUUU STTT ?@@@ N) N N NOOO ())) Ns A&?A!A&!A&ceZdZdZdZdS)_ParseraArgparse exits 2 on a usage error. In this gate 2 means EXIT_BROKEN. So `version_gate.py chekc` and "the gate could not reach a verdict" were the same number, and a caller reading the exit code could not tell a typo from a broken gate. `EXIT_USAGE = 3` had been declared for exactly this and used nowhere - open item 5 in `18-gate-inventory.md`, alongside the note that a documented code which cannot happen is a false entry in the contract. Wired rather than deleted, because the ambiguity is real: `doctor` already uses 2 for "a check could not be made", and A3 in that same document warns that anything treating 2 as an argparse error will misread it. c|tjtj|jd|dt t )Nz : error: rz) print_usagerrwriteprog SystemExit EXIT_USAGE)selfmessages r*ryz _Parser.error&sO $$$ DI;;;;;<<<$$$r=N)r8r9r:r;ryr<r=r*rrs-  %%%%%r=rc|!ttjddnt|}tdd}|dt t d|ddd td |d d d |dd d|d}d}| dd}||| t| dd}|||ddd|dd d| t| dd}|d dd!| t| d"d#}| t||}|j||dgz} t#t%|j\aan<#t,$r/} t/d$| tj%t2cYd} ~ Sd} ~ wwxYwt(d&d'ad(t(d)a ||S#t:$r/} t/d*| tj%t<cYd} ~ Sd} ~ wt,$r/} t/d$| tj%t2cYd} ~ Sd} ~ wwxYw)+Nrzversion_gate.pyzIRefuse to publish a core whose content changed but whose version did not.)r descriptionz--project-rootz/r/z --isolated store_truezAbuild in an isolated env (needs index access; default is offline)actionrz--single-buildz/skip the build-twice reproducibility self-checkr)destc|ddd|ddd|ddd dS) Nz--verify-indexrz?also ask the index whether this version already exists (online)rz--first-releasezstate that nothing has ever been published. Only legal against an empty ledger, only ever once, and always cross-checked against the index.--index-json-urlzthe index JSON API to cross-check against (default: this project's own, derived from its pyproject name). Point it at the index a --repository upload actually lands on.r) add_argument)sps r* _gate_flagszmain.._gate_flags;s (^  ` ` ` ),@  A A A *DF  G G G G Gr=checkzthe gate (default))r)fnpublishzCcheck, then upload, then record - the only supported way to releaserlz'a twine repository alias, e.g. testpypiz --dry-runz?run the gate and print the upload it authorises, upload nothingrecordz->VXXXNN:tU{UUUWWWNN< []]]NN#LIKKK    & &CGGG0 w%9::AKNNNNNiN    y(B C CAKNNNNN>46_N```NN;|Y[[[NNkN""" x&deeA NN%t*+++NNjN!!! v$CDDANNhN <<  D x||DG9,--6tDrs.#"""""  '''''''' T(^^ # # % % , txzz      ,BO>{JC)BBBbj122 9UUUVV????????UUUUU UUU )))).>.>.>.>b<&//// * B B B B    ####P;;;;(N@N@N@N@b((((V <<<< ( ====DDDD KKKKEEEEPCCCCL&5555p$$$$:(((( 0 0 0 05@5@5@5@p*****Z''''T%%%%%h%%%%(\\\\\~ z CHTTVVr=