feat: P1: Run truthful opt-in Ruff lint and format checks#283
Merged
Conversation
Implements #258. Adds `python.ruff-lint` and `python.ruff-format` as validation-python-owned warning checks with `defaultScopes: []`. They activate only through explicit selection or `.opcore/config` `validation.checks.defaults`; `checks.disabled` wins. Unrequested and disabled checks emit non-execution capability receipts, report skipped runs, never probe or invoke Ruff, and never degrade enforced coverage. `python.source-hygiene` is unchanged. Execution reuses the #246 canonical Python project context, the #209 graph import closure, and a shared #245-style exact after-state workspace primitive (`python-execution-workspace.ts`) with sanitized HOME/XDG/TMP/PATH runtime. Lint runs `ruff check --output-format=json --no-fix --no-cache --force-exclude` and consumes strict JSON; format runs bounded `ruff format --check --no-cache --force-exclude` batches and refines exit-1 batches by file without parsing human prose. Target-applicable `.ruff.toml`, `ruff.toml`, and `[tool.ruff]` configuration plus its recursive `extend` closure require non-symlink realpath evidence and are materialized without mutating source, config, lockfiles, environments, or caches. Extends `PythonValidationCapabilityRun` into a portable Ruff receipt variant with project key, context fingerprint, after-state manifest fingerprint, source/config paths, cwd, portable executable/argv, tool provenance, termination, duration, and diagnostic counts, plus runtime and JSON-schema state-machine invariants that reject contradictory or incomplete failure-state execution evidence. Status, scan, doctor, metrics, and ASP reporting are activation-aware: missing Ruff degrades only while a Ruff check is active, the `python.ruff_lint_findings`/`python.ruff_format_findings` signals derive only from executed receipts, and ASP executes and reports only selected check ids. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
tomdps
force-pushed
the
zeroshot/ruby-surge-41
branch
from
July 24, 2026 04:00
9270c2e to
333c1b8
Compare
This was referenced Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #258.
Summary
Adds real, read-only, opt-in Ruff lint and format validation over the exact after-state, without relabeling
python.source-hygieneor degrading users who did not enable Ruff.python.ruff-lintandpython.ruff-formatvalidation-python checks withdefaultScopes: []. They activate only through explicit selection or.opcore/configvalidation.checks.defaults;checks.disabledwins. Unrequested →not_applicable, disabled →disabled; neither state probes, invokes, or degrades enforced coverage, and both emit non-execution capability receipts on skipped runs.ruff check --output-format=json --no-fix --no-cache --force-exclude; format runs boundedruff format --check --no-cache --force-excludebatches, refining exit-1 batches per file without parsing human prose. No fix/write/format-mutation mode is ever invoked..ruff.toml/ruff.toml/[tool.ruff]config plus its recursiveextendclosure require non-symlink realpath evidence and are materialized without mutating source, config, lockfiles, environments, or caches.PythonValidationCapabilityRungains a portable Ruff receipt variant (project key, context fingerprint, after-state manifest fingerprint, source/config paths, cwd, portable executable/argv, tool provenance, termination, duration, diagnostic counts) with runtime + JSON-schema state-machine invariants that reject contradictory or incomplete failure-state execution evidence.python.ruff_lint_findings/python.ruff_format_findingsderive only from executed receipts; ASP executes and reports only the selected check ids.Verification
npm run build,npm run lintnode --test tests/validation-python.test.mjs tests/opcore-metrics.test.mjs tests/opcore-facade.test.mjs tests/validation-runner.test.mjs tests/validation-cli.test.mjs tests/asp-provider.test.mjs tests/contracts.test.mjs tests/schema-contracts.test.mjs tests/conformance.test.mjs tests/opcore-agent-gate.test.mjs tests/validation-overlays.test.mjsnode --test tests/installed-bins.test.mjs(packed publicopcorewith a pinned real Ruff 0.6.9, proving no source/config/lock/environment/cache mutation and after-state parity)zeroshot cmdproof check opcore-ciNo Python readiness/parity, ASP authority, old-tool replacement, security/SAST, all-stack, automatic-fix, or blended-score claim is made.
🤖 Generated with Claude Code