merge: carry the lint fixes forward

Author: claude

pyproject.toml

@@ -15,6 +15,17 @@ target-version = "py311"
 #   UP pyupgrade · C4 comprehensions · RUF ruff-native
 select = ["E", "W", "F", "I", "B", "UP", "C4", "RUF"]
 
+[tool.ruff.lint.per-file-ignores]
+# scripts/perf_baseline.py is an INSTRUMENT SOURCE: its bytes are hashed into
+# the measurement harness digest that the frozen #263 preregistration names
+# (104c384d01bf), and steps 4, 5 and 6 are bound to that same value. Rewrapping
+# a line there is not a cosmetic edit — it moves the digest and makes the frozen
+# contract point at an identity the tree no longer contains, which is exactly
+# what scripts/step7/mergegate.py exists to refuse. So the one over-long line
+# stays and the linter is told why, rather than the instrument being reformatted
+# to please it. Lift this only together with a re-binding of steps 4/5/6.
+"scripts/perf_baseline.py" = ["E501"]
+
 [tool.mypy]
 # The package is held to --strict. Tests/fuzzers are not (they lean on dynamic
 # construction and an AST oracle); ruff still covers them. The evidence tooling

scripts/step7/execbinding.py

@@ -88,7 +88,7 @@ def sha256_file(path: Path) -> str:
 
 
 def _now() -> str:
-    return datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="seconds")
+    return datetime.datetime.now(datetime.UTC).isoformat(timespec="seconds")
 
 
 def _git(repo: Path, *args: str) -> tuple[int, bytes]:

scripts/step7/hostqual.py

@@ -117,7 +117,7 @@ class QualificationRefused(Exception):
 
 
 def _now() -> str:
-    return datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="seconds")
+    return datetime.datetime.now(datetime.UTC).isoformat(timespec="seconds")
 
 
 def sha256_bytes(raw: bytes) -> str:
@@ -334,11 +334,12 @@ def validate_provisioning(doc: dict) -> list[str]:
 
     virt = doc.get("virtualization")
     if not isinstance(virt, dict):
-        return problems + ["virtualization is missing"]
+        return [*problems, "virtualization is missing"]
     is_vm = virt.get("is_vm")
     if not isinstance(is_vm, bool):
-        return problems + [f"virtualization.is_vm must be a real boolean, got {is_vm!r}: "
-                           "whether this is a VM is not a question a host may decline"]
+        return [*problems,
+                f"virtualization.is_vm must be a real boolean, got {is_vm!r}: "
+                "whether this is a VM is not a question a host may decline"]
     # Applicability is shape; the answers themselves are the predicate's business.
     for key in PROVISIONING_VM_BOOLEANS:
         value = virt.get(key, "<missing>")

tests/test_step7_hostqual.py

@@ -95,7 +95,8 @@ def refuses(call: Callable[[], object]) -> str | None:
 
 T0_FROZEN = "# T0\n\n```text\nStatus:\n  FROZEN.\n  collection_authorized: true\n```\n"
 T0_OPEN = "# T0\n\n```text\nStatus:\n  NOT_FROZEN.\n  collection_authorized: false\n```\n"
-T0_FROZEN_UNAUTHORIZED = "# T0\n\n```text\nStatus:\n  FROZEN.\n  collection_authorized: false\n```\n"
+T0_FROZEN_UNAUTHORIZED = ("# T0\n\n```text\nStatus:\n  FROZEN.\n"
+                          "  collection_authorized: false\n```\n")
 T0_OPEN_AUTHORIZED = "# T0\n\n```text\nStatus:\n  NOT_FROZEN.\n  collection_authorized: true\n```\n"
 
 # A compliant Windows snapshot, used as a fixture on every platform so the
@@ -201,7 +202,7 @@ def qualification(stratum: str = "linux", t0: dict | None = None, **overrides) -
         "environment_manifest": {"sha256": "1" * 64},
         "qualification_tool": {"sha256": "2" * 64},
         "power_snapshot": dict(COMPLIANT_POWER),
-        "predicate": {k: "pass" for k in hq.PREDICATE_KEYS},
+        "predicate": dict.fromkeys(hq.PREDICATE_KEYS, "pass"),
         "memory_metric": hq.STRATUM_METRIC[stratum],
         "qualified": True, "qualified_at": "2026-09-16T00:00:00+00:00"}
     doc.update(overrides)
@@ -368,8 +369,8 @@ def control_artifact_boundary() -> None:
             qual = path if slot == "qual" else good_q
             fresh = path if slot == "manifest" else good_m
             with fixed_power(COMPLIANT_POWER):
-                message = refuses(lambda: hq.session_eligibility(
-                    binding, qual, fresh, good_d, cand, good_link, crepo,
+                message = refuses(lambda b=binding, q=qual, f=fresh: hq.session_eligibility(
+                    b, q, f, good_d, cand, good_link, crepo,
                     quiesce_result=quiet))
             if message is None:
                 fail("hostqual-artifact-boundary", f"{label} was consumed as a real artifact")
@@ -621,7 +622,7 @@ def control_candidate_at_start() -> None:
 def control_postflight() -> None:
     with tempfile.TemporaryDirectory() as raw:
         tmp = Path(raw)
-        pre, (bpath, qpath, mpath, dpath, cpath, lpath, crepo) = session_fixture(tmp)
+        pre, (bpath, qpath, mpath, _dpath, cpath, lpath, crepo) = session_fixture(tmp)
         ppath = write(tmp, "pre.json", pre)
         probe = tmp / "probe.json"
         probe.write_text("{}", encoding="utf-8")
@@ -658,14 +659,15 @@ def control_postflight() -> None:
 def control_one_binding() -> None:
     with tempfile.TemporaryDirectory() as raw:
         tmp = Path(raw)
-        pre, (bpath, qpath, mpath, dpath, cpath, lpath, crepo) = session_fixture(tmp)
+        pre, (bpath, qpath, mpath, _dpath, cpath, lpath, crepo) = session_fixture(tmp)
         ppath = write(tmp, "pre.json", pre)
         probe = tmp / "probe.json"
         probe.write_text("{}", encoding="utf-8")
         original = json.loads(bpath.read_text(encoding="utf-8"))
         second = write(tmp, "b2.json", {**original, "bound_at": "a later moment"})
         with fixed_power(COMPLIANT_POWER):
-            mixed = hq.session_admissibility(second, qpath, ppath, mpath, cpath, probe, lpath, crepo)
+            mixed = hq.session_admissibility(second, qpath, ppath, mpath, cpath,
+                                             probe, lpath, crepo)
         if mixed["admissible"]:
             fail("hostqual-one-binding",
                  "a preflight from one binding and a postflight from another were admissible")
@@ -975,7 +977,8 @@ def qualify_cli(name: str, prov: dict) -> tuple[int, Path]:
             record = hq.session_eligibility(bpath, qpath, mpath, dpath, cpath, lpath, crepo,
                                             quiesce_result=quiet)
         if record["eligible"]:
-            fail("hostqual-negative-evidence", "a declared prohibited job left the session eligible")
+            fail("hostqual-negative-evidence",
+                 "a declared prohibited job left the session eligible")
             return
         if not any("declaration" in r for r in record["reasons"]):
             fail("hostqual-negative-evidence",
@@ -1019,7 +1022,7 @@ def control_campaign_link() -> None:
                  "a D7 payload edited after the campaign was linked to it was accepted")
             return
 
-        pre, (bpath, qpath, mpath, dpath, cpath, lpath, crepo) = session_fixture(tmp)
+        pre, (bpath, qpath, mpath, _dpath, cpath, _lpath, _crepo) = session_fixture(tmp)
         ppath = write(tmp, "pre.json", pre)
         probe = tmp / "probe.json"
         probe.write_text("{}", encoding="utf-8")