fix: secure SDK transport and align resource contracts

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      python-dependencies:
+        patterns: ['*']
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: SDK validation
+on:
+  pull_request:
+  push:
+    branches: [development]
+permissions:
+  contents: read
+jobs:
+  sdk:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ['3.11', '3.12', '3.13', '3.14']
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: ${{ matrix.python }}
+      - run: python -m pip install -c requirements.lock . pytest==9.2.0 pytest-asyncio==1.4.1 ruff==0.17.3 build==1.6.1
+      - run: python -m ruff check extend tests tools
+      - run: python -m pytest -q
+      - run: python -m build
+      - name: Verify installed wheel without source imports
+        run: |
+          python -m pip install --force-reinstall dist/*.whl
+          python tools/test_installed_wheel.py
+      - name: Check runtime wheel advisories in an isolated environment
+        run: |
+          python -m venv /tmp/runtime-check
+          /tmp/runtime-check/bin/python -m pip install dist/*.whl
+          /tmp/runtime-check/bin/python tools/check_advisories.py

.github/workflows/release.yml

@@ -1,65 +1,65 @@
-name: Release Stage Build
-
+name: Publish reviewed SDK
 on:
-  push:
-    branches:
-      - main
-
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Reviewed version tag reachable from development (for example v3.0.0)
+        required: true
+        type: string
 permissions:
-  contents: write
-
+  contents: read
+concurrency:
+  group: sdk-release-${{ inputs.tag }}
+  cancel-in-progress: false
 jobs:
   build:
+    if: github.ref == 'refs/heads/development'
     runs-on: ubuntu-latest
-
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
-          python-version: 3.11
-
-      - name: Install dependencies
-        run: sudo apt-get install make
-
-      - name: Create virtual environment
-        run: make venv
-
-      - name: Build package
-        run: |
-          set -x
-          source venv/bin/activate
-          rm -rf build dist *.egg-info
-          make build ENV=stage
-
-      - name: Extract Version from version file
-        id: get_version
-        run: |
-          VERSION=$(grep -Po '^__version__\s*=\s*"\K[^"]+' extend/__version__.py)
-          echo "Version extracted: $VERSION"
-          echo "version=$VERSION" >> $GITHUB_OUTPUT  
-
-      - name: Create GitHub Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
-          tag_name: v${{ steps.get_version.outputs.version }}
-          release_name: v${{ steps.get_version.outputs.version }}
-          draft: false
-          prerelease: false
-
-      - name: Install Twine
+          python-version: '3.11'
+      - name: Validate and check out the reviewed release tag
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
         run: |
-          source venv/bin/activate
-          pip install twine
-
-      - name: Upload to PyPI
+          python -c "import os,re; assert re.fullmatch(r'v[0-9]+\.[0-9]+\.[0-9]+', os.environ['RELEASE_TAG'])"
+          git fetch origin "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+          git merge-base --is-ancestor "$RELEASE_TAG^{commit}" origin/development
+          git checkout --detach "$RELEASE_TAG"
+          python -c "import ast,os,pathlib; version=ast.literal_eval(ast.parse(pathlib.Path('extend/__version__.py').read_text()).body[0].value); assert 'v'+version == os.environ['RELEASE_TAG']"
+      - run: python -m pip install . pytest==9.2.0 pytest-asyncio==1.4.1 ruff==0.17.3 build==1.6.1
+      - run: python -m ruff check extend tests tools
+      - run: python -m pytest -q
+      - run: python -m build
+      - name: Validate the built wheel and its runtime graph
         env:
-          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+          RELEASE_TAG: ${{ inputs.tag }}
         run: |
-          source venv/bin/activate
-          twine upload dist/* -u __token__ -p $PYPI_API_TOKEN
+          python -m venv /tmp/release-wheel
+          /tmp/release-wheel/bin/python -m pip install -c requirements.lock dist/*.whl pytest==9.2.0 pytest-asyncio==1.4.1
+          /tmp/release-wheel/bin/python -I -c "import extend,os; assert 'v'+extend.__version__ == os.environ['RELEASE_TAG']"
+          /tmp/release-wheel/bin/python tools/test_installed_wheel.py
+          python -m venv /tmp/release-runtime
+          /tmp/release-runtime/bin/python -m pip install -c requirements.lock dist/*.whl
+          /tmp/release-runtime/bin/python tools/check_advisories.py
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: sdk-distributions
+          path: dist/*
+          if-no-files-found: error
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: sdk-distributions
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1

.gitignore

@@ -22,6 +22,7 @@ wheels/
 
 # Virtual environments
 venv/
+.venv/
 env/
 ENV/
 test_env/
@@ -70,3 +71,6 @@ share/python-wheels/
 .installed.cfg
 *.egg
 MANIFEST
+
+# Private live test configuration and reconciliation journals
+.live-tests/

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+- Make the default test suite offline, with full source and installed-wheel CI coverage.
+- Replace ambient live tests with explicit fixtures, opt-in writes, cleanup journals, and bounded automatch completion checks.
+- Add origin-constrained DELETE transport for resource cleanup; mutations are never retried.
+
 All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),