2 Commits

Author	SHA1	Message	Date
Alpamys	06d8ea7cc5	chore: migrate to src-layout ... Move soup_cli/ -> src/soup_cli/ (history preserved via git mv). src-layout forces the test suite to import the installed package instead of the repo-root source tree, surfacing packaging bugs that flat-layout masks — e.g. the v0.53.8 double-shipped-fixtures regression, invisible because `pytest tests/` imports ./soup_cli directly and never from the wheel. - pyproject: packages = ["src/soup_cli"]; artifacts globs -> src/soup_cli/... The import name is unchanged, so the `soup` entry point, --cov=soup_cli, and report_to/module-path strings stay `soup_cli`. - CI / ownership: ruff lint path (ci.yml), recipe-validation `paths:` filters, CODEOWNERS patterns, and the PR-template checklist all repointed to src/soup_cli/. - tests: source-grep regression tests that read package files by repo-relative path repointed to src/soup_cli/ (64 files; 170 path literals). Lines pushed over 100 chars by the prefix were wrapped to keep ruff E501 clean. Module references (`import soup_cli`, `-m soup_cli`, mock.patch("soup_cli.x")) and the `--cov=soup_cli` coverage target are deliberately unchanged. - docs: AGENTS.md + CONTRIBUTING.md structure tree and lint commands. Verified locally: ruff clean (src/soup_cli + tests); `import soup_cli` resolves to src/soup_cli/__init__.py; built wheel ships soup_cli/data/_fixtures/*.jsonl (10 files, no duplicates, no src/ prefix); 3174 tests across every touched test file pass. Packaging-only — no version bump.	2026-05-31 12:40:06 +05:00
Alpamys	f3c40e7753	feat(security): v0.60.0 — Supply Chain Security wedge (adapter scan/sign/verify, strict-safetensors, namespace-pin, license-matrix, airgap-bundle) ... Six controls that hosted vendors structurally can't provide: - soup adapters scan: spectral backdoor scanner (rank-1 dominance + energy concentration + NaN/Inf + Frobenius outlier via robust median+MAD); pure numpy, reuses v0.57.0 adapter_diff loader - soup adapters sign / verify: Merkle-root manifest in .soup-signature.json; recursive file enumeration (catches nested tokenizer/ tamper); sigstore + ed25519 backends stub-then-live (v0.60.1) - soup adapters check-safetensors: closed 8-entry unsafe-extension allowlist; strict exit 3 for CI gating - NamespacePinStore: TOFU SQLite anti-AI-Jacking; author + created_at fingerprint compared via datetime.fromisoformat for offset-aware order; bool opt-in rejected so --allow-namespace-shift cannot be a free-for-all - License-conflict matrix: 33 SPDX-ish ids in MappingProxyType compat table; soup adapters merge --license <id> --license-override <reason> gate - soup airgap-bundle: signed tarball with deterministic dataset labeling (sorted basename, NOT argv order); TOCTOU lstat+S_ISLNK on parent + output; atomic os.replace; tarfile.data_filter for future extractall callers Test count: 9294 -> 9446 (+152 net across 6 new test files). Review-fix coverage across 5 waves (python / security / code / tdd / smoke): 0 CRITICAL + 12 HIGH + 11 MEDIUM + 6 LOW fixed before commit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-19 13:05:14 +05:00