Finish Python 3.15 quality gates and deployment acceptance

.github/workflows/architecture-boundaries.yml

@@ -73,7 +73,7 @@ jobs:
           python -m pytest tests/test_tool_runner_contract.py tests/test_tools.py
           tests/test_effect_completion_fencing.py
           --junitxml=artifacts/runner-contract.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: architecture-boundaries

.github/workflows/architecture-ports.yml

@@ -74,7 +74,7 @@ jobs:
           tests/test_batch_secret_release.py tests/test_tools.py tests/test_webhook_domain_events.py
           tests/test_read_projection_cache_transports.py tests/test_read_projection_cache_unit.py
           tests/issue_78_80 --junitxml=artifacts/architecture-ports.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: architecture-ports-evidence

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [0, 1, 2, 3]
+        shard: [0, 1, 2, 3, 4, 5, 6, 7]
     services:
       postgres:
         # Recovery jobs explicitly install matching PostgreSQL 16 client tools.
@@ -69,13 +69,17 @@ jobs:
           bwrap --version
           sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict
       - name: Install the complete dependency set
-        run: python -m pip install -e '.[dev]'
+        run: |
+          python -m pip install uv==0.12.20
+          uv sync --locked --extra dev --python "$(command -v python)"
+          echo "$GITHUB_WORKSPACE/.venv/bin" >> "$GITHUB_PATH"
+          uv pip check
       - name: Check real tool isolation before running shards
         run: python scripts/check_tool_sandbox.py
       - name: Compile all new modules
-        run: python -m compileall -q src
+        run: python -W error -m compileall -q src
       - name: Run core, business and security tests
-        run: python scripts/ci_shards.py run ${{ matrix.shard }} 4
+        run: python scripts/ci_shards.py run ${{ matrix.shard }} 8
       - name: Require every transport and actual tokenizer
         if: matrix.shard == 0
         env:
@@ -86,7 +90,7 @@ jobs:
         run: |
           python -m build
           python scripts/check_package_artifacts.py dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: rewrite-verification-${{ matrix.shard }}
@@ -100,12 +104,12 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8.0.1
         with:
           pattern: rewrite-verification-*
           merge-multiple: true
       - name: Require complete disjoint test evidence
-        run: python scripts/ci_shards.py check 4
+        run: python scripts/ci_shards.py check 8
       - name: Require all tests, conformance and build jobs to succeed
         env:
           SHARD_RESULT: ${{ needs.shards.result }}

.github/workflows/client-boundary.yml

@@ -63,7 +63,7 @@ jobs:
           "$client_python" -I "$GITHUB_WORKSPACE/scripts/check_client_install.py" --minimal-install \
               > "$GITHUB_WORKSPACE/artifacts/client-install.json"
           "$client_python" -m pip list --format=json > "$GITHUB_WORKSPACE/artifacts/client-packages.json"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: client-boundary

.github/workflows/client-part-bytes.yml

@@ -68,7 +68,7 @@ jobs:
           python -m pytest -q
           tests/test_client_part_bytes.py tests/test_client.py
           --junitxml=artifacts/client-part-bytes.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: client-part-bytes-evidence

.github/workflows/collaboration-list-bounds.yml

@@ -64,7 +64,7 @@ jobs:
           tests/test_collaboration_resources.py tests/test_collaboration_resource_surfaces.py
           tests/test_proposals.py
           --junitxml=artifacts/work-list-regressions.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: collaboration-list-evidence

.github/workflows/deployment-rehearsal.yml

@@ -0,0 +1,103 @@
+name: Deployment rehearsal
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: deployment-rehearsal-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+jobs:
+  installed-server:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+          allow-prereleases: true
+      - name: Install isolated rehearsal prerequisites
+        run: |
+          sudo apt-get update -qq
+          sudo env NEEDRESTART_MODE=l apt-get install -y -qq postgresql-16 postgresql-client-16 openssh-server age git-lfs bubblewrap apparmor-profiles
+          echo /usr/lib/postgresql/16/bin >> "$GITHUB_PATH"
+          sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict
+          sudo install -d -m 0755 /run/sshd
+          python -m pip install uv==0.12.20
+          uv sync --locked --extra dev --python "$(command -v python)"
+      - name: Build and install the exact wheel with locked server dependencies
+        run: |
+          mkdir -p artifacts
+          uv run --locked --extra dev python -m build
+          uv run --locked --extra dev python scripts/check_package_artifacts.py dist
+          uv export --locked --extra server --no-dev --no-emit-project --format requirements-txt --output-file artifacts/server-dependencies.lock
+          python -m venv "$RUNNER_TEMP/msg-installed-server"
+          server_python="$RUNNER_TEMP/msg-installed-server/bin/python"
+          uv pip sync --python "$server_python" --require-hashes artifacts/server-dependencies.lock
+          uv pip install --python "$server_python" --no-deps dist/*.whl
+          uv pip check --python "$server_python"
+          "$server_python" -m pip list --format=json > artifacts/server-packages.json
+          sha256sum dist/* artifacts/server-dependencies.lock > artifacts/release-sha256.txt
+          echo "MSG_REHEARSAL_PYTHON=$server_python" >> "$GITHUB_ENV"
+      - name: Install the same wheel as a locked client-only distribution
+        run: |
+          uv export --locked --no-dev --no-emit-project --format requirements-txt --output-file artifacts/client-dependencies.lock > /dev/null
+          python -m venv "$RUNNER_TEMP/msg-installed-client"
+          client_python="$RUNNER_TEMP/msg-installed-client/bin/python"
+          uv pip sync --python "$client_python" --require-hashes artifacts/client-dependencies.lock
+          uv pip install --python "$client_python" --no-deps dist/*.whl
+          uv pip check --python "$client_python"
+          "$client_python" -m pip list --format=json > artifacts/client-packages.json
+          sha256sum artifacts/client-dependencies.lock >> artifacts/release-sha256.txt
+          mkdir -p "$RUNNER_TEMP/msg-rehearsal-outside"
+          cd "$RUNNER_TEMP/msg-rehearsal-outside"
+          "$RUNNER_TEMP/msg-installed-client/bin/msg" --help > "$GITHUB_WORKSPACE/artifacts/client-help.txt"
+          "$client_python" -I "$GITHUB_WORKSPACE/scripts/check_client_install.py" --minimal-install > "$GITHUB_WORKSPACE/artifacts/client-install.json"
+      - name: Rehearse startup, restart, signed clients, read-only diagnostics and worker
+        run: |
+          mkdir -p "$RUNNER_TEMP/msg-rehearsal-outside"
+          cd "$RUNNER_TEMP/msg-rehearsal-outside"
+          "$MSG_REHEARSAL_PYTHON" -I "$GITHUB_WORKSPACE/scripts/check_installed_server.py" > "$GITHUB_WORKSPACE/artifacts/installed-server.json"
+      - name: Exercise real isolated OpenSSH and Git revocation boundaries
+        run: |
+          cd "$RUNNER_TEMP/msg-rehearsal-outside"
+          "$MSG_REHEARSAL_PYTHON" -I "$GITHUB_WORKSPACE/scripts/check_isolated_sshd.py" > "$GITHUB_WORKSPACE/artifacts/isolated-sshd.json"
+      - name: Run the installed official isolated selftest without development dependencies
+        run: |
+          cd "$RUNNER_TEMP/msg-rehearsal-outside"
+          "$MSG_REHEARSAL_PYTHON" -I -m msg.daemon selftest > "$GITHUB_WORKSPACE/artifacts/installed-selftest.json"
+          "$MSG_REHEARSAL_PYTHON" -I - <<'PY'
+          import json, os
+          from pathlib import Path
+          report = json.loads((Path(os.environ['GITHUB_WORKSPACE']) / 'artifacts/installed-selftest.json').read_text())
+          assert report['ok'] is True and report['cleaned_up'] is True
+          assert report['checks']['market_e2e'] is True
+          PY
+      - name: Record the exact source and interpreter
+        if: always()
+        run: |
+          mkdir -p artifacts
+          python - <<'PY'
+          import json, os, platform, subprocess
+          from pathlib import Path
+          def git(*args):
+              return subprocess.check_output(['git', *args], text=True).strip()
+          Path('artifacts/source.json').write_text(json.dumps({
+              'commit': git('rev-parse', 'HEAD'), 'tree': git('rev-parse', 'HEAD^{tree}'),
+              'run_id': os.environ['GITHUB_RUN_ID'], 'python': platform.python_version(),
+              'scope': 'disposable installed wheel; no production access',
+          }, indent=2) + '\n')
+          PY
+      - uses: actions/upload-artifact@v7.0.1
+        if: always()
+        with:
+          name: deployment-rehearsal
+          path: |
+            artifacts/
+            dist/
+          if-no-files-found: error

.github/workflows/git-transport-boundaries.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Preserve real HTTP, SSH, bundle, LFS and publication fences
         run: |
           python -m pytest tests/test_git_http_push.py tests/test_native_git_read_only.py tests/test_git_lfs.py tests/test_lfs_shared_gc_quota.py tests/test_ssh_rss.py tests/test_extensions.py tests/test_storage_layout.py tests/test_effect_completion_fencing.py tests/issue_78_80/test_lfs_integrity.py tests/issue_78_80/test_lfs_migration_contract.py --junitxml=artifacts/git-regressions.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: git-transport-boundaries-${{ github.sha }}

.github/workflows/hosting-authority.yml

@@ -60,7 +60,7 @@ jobs:
           python -m pip install -e '.[dev]'
       - name: Exercise revoked keys and restorable ownership rights
         run: python -m pytest tests/test_hosting_runtime_authority.py --junitxml=artifacts/authority.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: hosting-authority-evidence

.github/workflows/hosting-readonly.yml

@@ -67,7 +67,7 @@ jobs:
           python -m pytest tests/test_hosting*.py tests/test_cli_hosting.py
           tests/test_extensions.py::test_hosting_publish_is_explicit_versioned_on_service_origin
           --junitxml=artifacts/hosting.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: hosting-readonly-evidence

.github/workflows/integration-regressions.yml

@@ -92,7 +92,7 @@ jobs:
               'requested_database_locale': os.environ['TEST_DATABASE_LOCALE']}, indent=2) + '\n')
           PY
       - name: Preserve reviewed public source even when tests fail
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: integration-regression-source-${{ matrix.locale }}
           path: |
@@ -151,7 +151,7 @@ jobs:
           tests/test_webhook_overlap.py tests/test_webhook_domain_events.py
           tests/test_webhook_delivery.py tests/test_webhook_identity.py
           --junitxml=artifacts/integration-regressions.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: integration-regression-evidence-${{ matrix.locale }}

.github/workflows/issue-recovery.yml

@@ -76,7 +76,7 @@ jobs:
           tests/test_backup_retirement_cli.py tests/test_recovery_policy_v2.py
           tests/test_recovery_authority_reconcile.py tests/test_complete_recovery_proof.py
           --junitxml=artifacts/recovery-current.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: issue-recovery-evidence

.github/workflows/lease-list-bounds.yml

@@ -65,7 +65,7 @@ jobs:
           tests/test_collaboration_surfaces.py tests/test_collaboration_resources.py
           tests/test_collaboration_resource_surfaces.py
           --junitxml=artifacts/lease-list-regressions.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: lease-list-evidence

.github/workflows/market-boundaries.yml

@@ -59,7 +59,7 @@ jobs:
       - name: Preserve all published checkout and recovery semantics
         run: |
           python -m pytest tests/test_orders.py tests/test_managed_checkout.py tests/test_checkout_decision_integrity.py tests/test_market_contracts.py tests/test_market_integration.py tests/test_market_recovery.py tests/test_market_account_scope.py tests/test_market_71.py tests/test_market_72.py tests/test_money_core.py tests/test_market_redemption.py tests/test_bounty.py tests/test_store_foundation.py --junitxml=artifacts/market-regressions.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: market-boundaries-${{ github.sha }}

.github/workflows/metadata-session-boundary.yml

@@ -58,7 +58,7 @@ jobs:
       - name: Preserve PostgreSQL locks, migration and recovery regressions
         run: |
           python -m pytest tests/test_postgres.py tests/test_security_storage_rollback.py tests/test_security_rollback_fences.py tests/test_ledger_accounts.py tests/test_ledger_account_isolation.py tests/test_ledger_migration_json.py tests/test_ledger_migration_references.py tests/test_recovery_safety_units.py tests/test_recovery_metadata.py --junitxml=artifacts/metadata-regressions.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: metadata-session-${{ github.sha }}

.github/workflows/python-quality.yml

@@ -0,0 +1,67 @@
+name: Python quality
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: python-quality-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+          allow-prereleases: true
+      - name: Install the locked development environment
+        run: |
+          python -m pip install uv==0.12.20
+          uv lock --check --python "$(command -v python)"
+          uv sync --locked --extra dev --python "$(command -v python)"
+          uv pip check
+      - name: Require zero Ruff errors and warnings, and exact formatting
+        run: |
+          mkdir -p artifacts
+          uv run --locked --extra dev ruff check . --output-format json > artifacts/ruff.json 2> artifacts/ruff.stderr
+          test ! -s artifacts/ruff.stderr
+          uv run --locked --extra dev ruff format --check . > artifacts/format.txt 2> artifacts/format.stderr
+          test ! -s artifacts/format.stderr
+          uv run --locked --extra dev python -W error -m compileall -q src tests conformance scripts
+      - name: Record source and toolchain evidence
+        if: always()
+        run: |
+          mkdir -p artifacts
+          uv run --locked --extra dev python - <<'PYTHON'
+          import importlib.metadata, json, os, pathlib, platform, subprocess
+          def git(*args):
+              return subprocess.check_output(['git', *args], text=True).strip()
+          pathlib.Path('artifacts/quality-source.json').write_text(json.dumps({
+              'commit': git('rev-parse', 'HEAD'),
+              'tree': git('rev-parse', 'HEAD^{tree}'),
+              'run_id': os.environ['GITHUB_RUN_ID'],
+              'python': platform.python_version(),
+              'ruff': importlib.metadata.version('ruff'),
+              'uv': subprocess.check_output(['uv', '--version'], text=True).strip(),
+              'uv_build_requirement': 'uv_build==0.12.20',
+          }, indent=2) + '\n')
+          PYTHON
+      - name: Preserve a suggested safe Ruff patch after failure
+        if: failure()
+        run: |
+          uv run --locked --extra dev ruff check . --fix --no-unsafe-fixes > artifacts/fix-suggestions.txt 2>&1 || true
+          uv run --locked --extra dev ruff format . >> artifacts/fix-suggestions.txt 2>&1
+          git diff --binary > artifacts/quality-fixes.patch
+      - uses: actions/upload-artifact@v7.0.1
+        if: always()
+        with:
+          name: python-quality
+          path: artifacts/
+          if-no-files-found: error

.github/workflows/recovery-safety.yml

@@ -69,7 +69,7 @@ jobs:
             tests/test_backup_drill.py \
             tests/test_backup_daemon.py \
             --junitxml=artifacts/recovery-safety.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: recovery-safety-verification

.github/workflows/storage-session.yml

@@ -77,7 +77,7 @@ jobs:
           tests/test_ledger_migration_references.py tests/test_recovery_safety_units.py
           tests/test_recovery_metadata.py
           --junitxml=artifacts/storage-session.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: storage-session-evidence

.github/workflows/token-delivery-boundary.yml

@@ -74,7 +74,7 @@ jobs:
           tests/test_credential_recovery_window.py tests/test_client_token_delivery.py
           tests/test_batch_secret_release.py tests/test_security_patch_regressions.py
           --junitxml=artifacts/token-delivery-boundary.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: token-delivery-boundary-evidence

.github/workflows/transfer-status.yml

@@ -73,7 +73,7 @@ jobs:
           tests/test_transfer_status_cursors.py tests/test_transfer.py
           tests/test_transfer_endpoint.py tests/test_read_only_evidence.py
           --junitxml=artifacts/transfer-status.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: transfer-status-evidence

.gitignore

@@ -15,3 +15,4 @@ dist/
 .coverage
 htmlcov/
 .legacy-ledger/
+/artifacts/