Repository navigation
Align the development Pyodide with the declared 314.0.0 target - #375
luisleo526 wants to merge 3 commits into
Conversation
Validate independent observed, target and peer version identities before glue, native oracle or release metadata writes. Preserve declaration and lock inputs and record the checked observed version in release metadata. Extend the existing pure selftest with varied matching, mismatch and invalid identities without claiming runtime or whole-gate parity proof.
Date read 2026-11-11T02:08:18+08:00. Follow CORE-TOP's 02:06 main update without rebasing or rewriting the unpublished 714d8a4 candidate. The new main fixes variable-held input string defaults. Its nine changed paths do not overlap the gate's three-file runtime-identity change. Current exact-candidate review and genuine runtime evidence remain open; the existing pure selftest result retains its original head and scope.
Pin the development dependency and its npm lock entry to 314.0.0 so the installed runtime agrees with the existing target and exact package peer. Preserve the fail-closed runtime identity guard and published declarations.
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
No issues found by static checks — no coupling regressions or blocking issues in the code graph. That is not the same as safe to merge: see what was not checked.
Not checked: tests were not run; formal verification proved 0 of 1 changed function(s) (1 not verified).
Formal verification. PR-changed functions: 0/1 verified (0 proven, 0 may-equivalent, 0 distinguished) · 1 not verified (1 vacuous).
Not verified on this run: main (vacuous: never exercised).
Graphify review — findings
Adds a runtime identity check to the gate: after loading Pyodide, checkRuntimeVersion requires the observed pyodide.version, PYODIDE_TARGET, and the npm/package.json peer dependency to be valid, exact version strings that all match. Any malformed input (ranges, v prefixes, whitespace, non-strings, leading zeros) or any mismatch throws before the archive is unpacked or glue runs, and release.json now reports that checked version instead of re-reading PYODIDE_TARGET. Extends gate/selftest.mjs with matching, mismatch, and invalid-input cases for the new helper. It runs without initializing Pyodide, so it covers the helper's rules but not the real runtime identity. Pins the pyodide devDependency and lockfile entry to 314.0.0 (down from 314.0.7), so the installed runtime has to line up with the target and peer versions.
No blocking issues surfaced.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 34 functions depend on the 34 functions this change touches.
Health — this change adds coupling hotspots:
- worse:
main()— 1 callers, 6 callees
Verification — 34 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 34 function(s) in the blast radius were not formally verified this run
Cross-repo impact
Cross-repo impact
This change impacts 2 symbol(s) across 1 peer repo(s) — blast radius over derived cross-repo edges:
- pineforge-4pass/pineforge-hpo —
python/pineforge_hpo/transpile.py(via import_moniker, heuristic),tests/python/test_transpile.py(via import_moniker, heuristic)
1 peer repo(s) in this group are not yet indexed — cross-repo impact may be incomplete.
Cross-repo linkage is derived (SCIP-moniker matches are sound; name/contract matches are heuristic) and ADVISORY — it never affects this check's conclusion.
Test selection
Test selection
516 of 516 test file(s) selected (100%) via static blast radius.
Escalated to a full run for safety (
noncode-change,uncovered-code) — the selection is not trustworthy on its own (see below). CI should run the whole suite.
tests/test_action_pins.py— full-run-safetytests/test_allow_entry_in_qualifier.py— full-run-safetytests/test_allow_entry_in_request_const.py— full-run-safetytests/test_analyzer.py— full-run-safetytests/test_analyzer_matrix_inference.py— full-run-safetytests/test_analyzer_ta_return_types.py— full-run-safetytests/test_anchor_tf_change.py— full-run-safetytests/test_anchor_time.py— full-run-safetytests/test_anchor_vwap.py— full-run-safetytests/test_array_bounds_insert_fill_slice.py— full-run-safetytests/test_array_checked_access.py— full-run-safetytests/test_array_empty_aggregates.py— full-run-safetytests/test_array_history.py— full-run-safetytests/test_array_missing_integer_index.py— full-run-safetytests/test_array_new_color_fill_and_na_size.py— full-run-safetytests/test_array_new_defaults_and_order.py— full-run-safetytests/test_array_reference_semantics.py— full-run-safetytests/test_array_retained_alias.py— full-run-safetytests/test_array_slice_view.py— full-run-safetytests/test_array_terminal_returns.py— full-run-safetytests/test_arrseg_coded_run_stops.py— full-run-safetytests/test_arrseg_review_fixes.py— full-run-safetytests/test_binop_operand_order.py— full-run-safetytests/test_block_shadow_primitive_types.py— full-run-safetytests/test_block_var_plain_siblings.py— full-run-safetytests/test_bool_na_refusal.py— full-run-safetytests/test_bool_na_refusals_2.py— full-run-safetytests/test_bool_na_values.py— full-run-safetytests/test_bool_string_inference.py— full-run-safetytests/test_builtin_name_shadow.py— full-run-safetytests/test_builtin_named_locals_compile.py— full-run-safetytests/test_builtin_named_locals_price_refusal.py— full-run-safetytests/test_builtin_named_locals_receipt.py— full-run-safetytests/test_builtin_named_locals_scope.py— full-run-safetytests/test_builtin_named_parameters.py— full-run-safetytests/test_builtin_named_parameters_reference.py— full-run-safetytests/test_calc_on_order_fills_codegen.py— full-run-safetytests/test_calendar_lambda_locals.py— full-run-safetytests/test_call_argument_order.py— full-run-safetytests/test_callable_local_histories.py— full-run-safetytests/test_callable_series_param_types.py— full-run-safetytests/test_callable_string_series_type.py— full-run-safetytests/test_callable_ta_forwarded_length.py— full-run-safetytests/test_callable_var_first_reach.py— full-run-safetytests/test_checked_settings.py— full-run-safetytests/test_ci_engine_main_touched.py— full-run-safetytests/test_closed_trade_fold.py— full-run-safetytests/test_closed_trade_fold_emission.py— full-run-safetytests/test_closed_trade_text_equals.py— full-run-safetytests/test_coded_run_stops.py— full-run-safety- … and 466 more
non-code file(s) changed (
package-lock.json,package.json) → running the full suite for safety (a code graph can't see config/fixture/data deps)
changed code file(s) with no mapped test (
gate/run-gate.mjs,gate/runtime-version.mjs,gate/selftest.mjs,package.json) — a coverage gap or a missing link — running the full suite rather than only the selected tests
Selection is safe under the controlled-regression assumption; always-run tests + a periodic full run are the backstops. Advisory — it never changes the check verdict.
Formal verification
Could not verify: Could not verify main.
The verifier did not have enough to check main, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: not verifiable: all 1 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly ReferenceError: branchItems is not defined — names the real obstacle, not a sampling gap)
· 1 more finding(s) on lines outside this diff (see the check run).
Align the development Pyodide with the declared 314.0.0 target: the dev lock now installs exactly the version the package declares as its peer and that the full gate targets, so the gate's identity check and its 268-fixture runtime parity run on the supported version.
It also carries the initialized-runtime release-identity guard that this fix builds on, with codegen main merged in.
🤖 Generated with Claude Code