peter
4aaaaa7860
The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").
Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.
Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).
One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.
66 lines
1.7 KiB
Plaintext
66 lines
1.7 KiB
Plaintext
# Pinned dependency lock for reproducible builds (SEC-5). GENERATED — do not hand-edit.
|
|
# Source of truth is requirements.txt (the floor ranges); regenerate after editing it with:
|
|
# docker run --rm -v "$PWD":/b python:3.12-slim sh -c 'pip install -q -r /b/requirements.txt && pip freeze --exclude pip --exclude setuptools --exclude wheel' | sort
|
|
# The prod Dockerfile + Dockerfile.test install THIS file; the gate's pip-audit (scripts/check.sh)
|
|
# scans it, blocking. A security fix may be ONE pin bumped in place instead of a full
|
|
# regeneration, which would move every other package too — then `pip install -r requirements.lock && pip check` must
|
|
# pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177).
|
|
APScheduler==3.11.3
|
|
Authlib==1.7.2
|
|
Mako==1.4.1
|
|
MarkupSafe==3.0.3
|
|
PyYAML==6.0.3
|
|
Pygments==2.21.0
|
|
SQLAlchemy==2.0.52
|
|
alembic==1.19.1
|
|
annotated-doc==0.0.5
|
|
annotated-types==0.8.0
|
|
anyio==4.14.2
|
|
argon2-cffi-bindings==25.1.0
|
|
argon2-cffi==25.1.0
|
|
bgutil-ytdlp-pot-provider==1.3.1
|
|
brotli==1.2.0
|
|
certifi==2026.7.22
|
|
cffi==2.1.1
|
|
charset-normalizer==3.5.1
|
|
click==8.4.2
|
|
cryptography==50.0.0
|
|
curl_cffi==0.15.0
|
|
fastapi==0.141.1
|
|
feedparser-sgmllib==2.1.0
|
|
feedparser==6.0.14
|
|
greenlet==3.5.5
|
|
h11==0.16.0
|
|
httpcore==1.0.9
|
|
httptools==0.8.0
|
|
httpx==0.28.1
|
|
idna==3.18
|
|
itsdangerous==2.2.0
|
|
joserfc==1.7.4
|
|
markdown-it-py==4.2.0
|
|
mdurl==0.1.2
|
|
mutagen==1.48.1
|
|
numpy==2.5.2
|
|
psycopg-binary==3.3.4
|
|
psycopg==3.3.4
|
|
py3langid==0.3.0
|
|
pycparser==3.0
|
|
pycryptodomex==3.23.0
|
|
pydantic-settings==2.15.0
|
|
pydantic==2.13.4
|
|
pydantic_core==2.46.4
|
|
python-dotenv==1.2.3
|
|
requests==2.34.2
|
|
rich==15.0.0
|
|
starlette==1.6.0
|
|
typing-inspection==0.4.4
|
|
typing_extensions==4.16.0
|
|
tzlocal==5.4.4
|
|
urllib3==2.8.0
|
|
uvicorn==0.52.3
|
|
uvloop==0.22.1
|
|
watchfiles==1.2.0
|
|
websockets==17.0.1
|
|
yt-dlp-ejs==0.8.0
|
|
yt-dlp==2026.7.4
|