peter
4aaaaa7860
The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").
Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.
Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).
One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.
32 lines
1.5 KiB
Plaintext
32 lines
1.5 KiB
Plaintext
fastapi>=0.115,<1.0
|
||
uvicorn[standard]>=0.30,<1.0
|
||
sqlalchemy>=2.0,<2.1
|
||
psycopg[binary]>=3.2,<4.0
|
||
alembic>=1.13,<2.0
|
||
pydantic>=2.7,<3.0
|
||
pydantic-settings>=2.3,<3.0
|
||
authlib>=1.3,<2.0
|
||
httpx>=0.27,<1.0
|
||
feedparser>=6.0,<7.0
|
||
apscheduler>=3.10,<4.0
|
||
py3langid>=0.3,<1.0
|
||
itsdangerous>=2.1,<3.0
|
||
cryptography>=50.0.0,<51
|
||
argon2-cffi>=23.1,<26
|
||
# Download center: yt-dlp does the extraction/download; ffmpeg (OS-level in the Dockerfile)
|
||
# does the merge + postprocessing. The [default] extra pulls yt-dlp-ejs (the challenge-solver
|
||
# scripts Deno runs for YouTube's n-signature). yt-dlp is release-often (YouTube changes), so
|
||
# keep the floor loose and bump it when extraction breaks.
|
||
yt-dlp[default]>=2025.5.22
|
||
# Browser impersonation (`impersonate`) for Facebook downloads made with the user's cookie: some
|
||
# links answer a signed-in plain request with "Cannot parse data" and only parse as Chrome
|
||
# (measured). The range is YT-DLP's, not ours — yt-dlp 2026.07.04 imports curl_cffi only in
|
||
# 0.10.x–0.15.x and silently reports every target "unavailable" outside it. Move it when bumping
|
||
# yt-dlp; `tests/test_facebook_impersonation.py::test_the_locked_curl_cffi_can_impersonate_chrome`
|
||
# fails the gate if the locked pair can no longer impersonate.
|
||
curl_cffi>=0.10,<0.16
|
||
# PO Token provider plugin: talks to the bgutil sidecar (brainicism/bgutil-ytdlp-pot-provider)
|
||
# to mint YouTube Proof-of-Origin tokens on demand, bypassing "confirm you're not a bot" and
|
||
# unlocking high-quality formats. Pin to match the sidecar image tag (versions must align).
|
||
bgutil-ytdlp-pot-provider==1.3.1
|