pyproject.toml

[project]
name = "goldenmatch-monorepo"
version = "0.0.0"
description = "Golden Suite monorepo"
requires-python = ">=3.11"

[tool.uv]
# goldenmatch[sail] and goldenmatch[inhouse-embeddings] cannot be resolved
# TOGETHER on Python 3.13: [sail] pulls pyspark[connect] 3.5.x -> numpy<2, while
# [inhouse-embeddings] pulls onnx>=1.22 -> ml-dtypes>=0.5.4 -> numpy>=2.1. Left
# implicit, the workspace lock tries to satisfy both at once and is unsatisfiable
# on 3.13 -- which broke the Dependabot security-update resolver for pyspark
# (#1868). No CI lane installs both extras together (the sail lane installs
# [sail]; the native lane pip-installs onnx/onnxruntime directly, not the extra),
# so declaring them conflicting is free here and lets uv fork the resolution.
conflicts = [
    [
        { package = "goldenmatch", extra = "sail" },
        { package = "goldenmatch", extra = "inhouse-embeddings" },
    ],
]

[tool.uv.workspace]
members = ["packages/python/*"]
# goldenmatch-kg is EXCLUDED from the workspace on purpose: its optional framework
# extras (neo4j-graphrag, llama-index-core, graphiti-core) are heavy, fast-moving dep
# trees that would enter the main uv.lock and risk breaking `uv sync --all-packages`
# repo-wide (the documented goldenmatch[native] footgun). It is a standalone package
# built + tested by its own lane (.github/workflows/goldenmatch-kg.yml).
# goldengraph (SP4b) is EXCLUDED for the same reasons: it depends on the
# goldengraph-native engine wheel (maturin-built) + optional LLM extras, so it is
# standalone, built + tested by .github/workflows/goldengraph-pipeline.yml.
exclude = ["packages/python/goldenmatch-kg", "packages/python/goldengraph", "packages/python/golden-suite"]

[tool.uv.sources]
goldenmatch = { workspace = true }
goldencheck = { workspace = true }
goldenflow = { workspace = true }
goldenpipe = { workspace = true }
infermap = { workspace = true }
goldensuite-mcp = { workspace = true }
goldencheck-types = { workspace = true }
goldenanalysis = { workspace = true }
# goldenmatch-native is the optional compiled runtime (goldenmatch[native]).
# It's NOT a workspace member (it's a maturin/Rust crate under packages/rust/),
# so point uv at the path for dev/CI resolution. uv reads its static PEP 621
# metadata without building unless the `native` extra is actually installed; the
# published goldenmatch wheel resolves goldenmatch-native from PyPI (uv.sources
# is workspace-local, stripped from published Requires-Dist).
goldenmatch-native = { path = "packages/rust/extensions/native" }
# goldencheck-native is the optional compiled runtime (goldencheck[native]) --
# same maturin/Rust split as goldenmatch-native above. Point uv at the path for
# dev/CI resolution; the published goldencheck wheel resolves it from PyPI.
goldencheck-native = { path = "packages/rust/extensions/goldencheck-native" }
# Same pattern for goldenflow's optional compiled runtime (goldenflow[native]).
goldenflow-native = { path = "packages/rust/extensions/native-flow" }
# Same pattern for goldenanalysis's optional compiled runtime (goldenanalysis[native]).
goldenanalysis-native = { path = "packages/rust/extensions/analysis-native" }
infermap-native = { path = "packages/rust/extensions/infermap-native" }

[dependency-groups]
dev = [
    "pytest>=8",
    "pytest-xdist>=3.6",
    "pytest-asyncio>=0.23",  # required by goldenmatch + goldenflow async tests
    "pytest-timeout>=2.3",  # surfaces hung tests in CI as failures w/ stack traces (vs job timeout)
    "pytest-cov>=5.0",  # required by ci.yml's "Coverage floors" step on the goldenmatch matrix entry
    "ruff>=0.6",
    "pyright>=1.1.380",  # strict typing on goldenmatch core slice (see pyrightconfig.json)
    "hypothesis>=6.0",  # property-based tests (test_property_invariants.py + test_autoconfig_properties.py); OpenSSF Scorecard Fuzzing check
    # rapidfuzz is a TEST-ONLY parity oracle (14 test_*.py assert the owned
    # scorer matches it) -- it's rapidfuzz-free at RUNTIME (#2231 dropped it from
    # `dependencies`). It belongs in the dev group so `uv sync` installs it for
    # CI/tests while `pip install goldenmatch` stays rapidfuzz-free. Without this
    # every rapidfuzz oracle test ERROR'd at collection on main (#2231 regression).
    "rapidfuzz>=3.0",
    # jellyfish is a TEST-ONLY parity oracle too: goldenmatch owns metaphone via
    # goldenphonetic (byte-identical) at RUNTIME, but several test_*.py assert
    # against jellyfish. Same shape as rapidfuzz -- keep it in the dev group so
    # `uv sync` installs it for CI/tests while `pip install goldenmatch` is
    # jellyfish-free (soundex was already in-house; metaphone moved off it here).
    "jellyfish>=1.0",
    # scipy is a TEST-ONLY parity oracle: infermap owns its sole scipy use (a
    # 2-param Nelder-Mead Platt fit) via infermap._optimize, so `pip install
    # infermap` is scipy-free at RUNTIME. The optimizer parity test asserts the
    # owned Nelder-Mead matches `scipy.optimize.minimize` on the convex log-loss,
    # so `uv sync` installs it for CI/tests. (goldencheck[baseline] +
    # goldenmatch distributed use scipy on their own, separately.)
    "scipy>=1.11",
    # diptest is a TEST-ONLY parity oracle: goldenmatch owns Hartigan's dip
    # statistic via goldenmatch.core._dip (a byte-identical port of diptest's C
    # `dip.c`), so `pip install goldenmatch` is diptest-free at RUNTIME. The dip
    # parity test asserts the owned kernel matches `diptest.dipstat` exactly, so
    # `uv sync` installs it for CI/tests. Same shape as the oracles above.
    "diptest>=0.5.2",
    # python-dateutil is a TEST-ONLY parity oracle: goldenflow owns date parsing
    # via goldenflow-core (deterministic, dateutil-free at RUNTIME -- #dates
    # kernel), but the date parity tests assert the owned parser matches dateutil
    # on the covered format set. Same shape as rapidfuzz/jellyfish above -- keep
    # it in the dev group so `uv sync` installs it for CI/tests while
    # `pip install goldenflow` stays dateutil-free.
    "python-dateutil>=2.9",
    # transitive test deps surfaced across workspace packages:
    "httpx>=0.27",  # required by starlette.testclient (used by goldenpipe tests)
]

# NOTE: pytest-xdist (-n auto) is passed from CI rather than set as a global
# addopts, because individual packages (e.g. goldensuite-mcp) define their own
# optional [dev] extras that don't include xdist, and pytest invoked under
# those package envs would fail with "unrecognized arguments: -n".

[tool.ruff]
line-length = 100
target-version = "py311"

[tool.ruff.lint]
select = ["E9", "F63", "F7", "F", "I", "B", "UP"]
ignore = [
    # B007: unused-loop-control-variable — 76 sites of mechanical _ rename noise
    "B007",
    # B008: function-call-in-default-argument — FastAPI/Pydantic Depends()/Field() are legitimate patterns
    "B008",
    # B017: assert-raises-exception — test patterns, not production bugs
    "B017",
    # B023: function-uses-loop-variable — single intentional closure binding
    "B023",
    # B904: raise-without-from-inside-except — 110 sites; revisit as a focused PR
    "B904",
    # B905: zip-without-explicit-strict — 54 sites need per-call strict=True/False decisions
    "B905",
]