build(deps): refresh dev, build-backend and publish locks; uv 0.13.1, pydantic 2.14.1

.github/dependabot.yml

@@ -17,11 +17,12 @@ updates:
       interval: weekly
     open-pull-requests-limit: 5
     ignore:
-      # `# via cyclonedx-bom`, which requires chardet<6.0,>=5.1. cyclonedx-bom
-      # 7.3.1 is the latest release overall, not merely the latest 7.x, so no
-      # release accepts chardet 6 or above. Closed #407 on this. Major updates
-      # only: 5.x movement is still legitimate, and this reopens on its own if
-      # cyclonedx-bom ever lifts the cap.
+      # `# via cyclonedx-bom`, which requires chardet!=6.*,<8,>=5.1 since 7.5.0
+      # (7.3.1 capped it at <6.0, which is why #407 was closed). chardet 7.x is
+      # admitted and locked; 6.* is excluded and 8 is beyond the cap, so a
+      # semver-major bump here can only ever be unsatisfiable. Major updates
+      # only: movement within 7.x is still legitimate, and this is worth
+      # revisiting if cyclonedx-bom ever lifts the <8 cap.
       - dependency-name: "chardet"
         update-types: ["version-update:semver-major"]
       # `# via pydantic`, which pins it *exactly* rather than as a range:

CHANGELOG.md

@@ -48,6 +48,7 @@
 - **`diff --application` reads tools bound as objects.** An MCP server or toolset (Google ADK `McpToolset`; OpenAI Agents SDK `MCPServerStdio`, `MCPServerSse`, `MCPServerStreamableHttp` in `mcp_servers=`), an agent exposed as a tool (SDK `agent.as_tool(...)`, ADK `AgentTool(agent=...)`, and a repository helper that returns one from its single `return`), a hosted or built-in tool (SDK `WebSearchTool`, `FileSearchTool`, `CodeInterpreterTool`, `ComputerTool`; ADK `google_search`, `built_in_code_execution`, `load_memory`) and the SDK's `function_tool(f)` are bindings of their agent, where they used to read as an unresolved tool or "assigned a value, not a function definition". A row's side carries `object`: an MCP server's transport, the URL's host or the program's file name, the names of the credentials it sends and its tool filter; the agent an agent tool wraps; a built-in's name. A changed host, command, transport, credential name, filter or wrapped agent is a `changed` row. A URL's path or query, a header value and a command's arguments are digested (`endpoint_sha256`), never printed. Identity is the import, never the spelling: a same-named local function, a shadowed, reassigned or patched import, a vendored `google/adk` package and another package's `load_memory` are not built-ins. A helper whose return cannot be resolved, an `.as_tool` on a value not identified as an agent, an object changed after it is built, and an `mcp_servers=` member that is not an MCP server stay named limits; a part of an object's identity that is not read (a host from a builder's parameter) leaves the binding present but makes a change to it `not_established`. An SDK agent's `mcp_servers=`, which the comparison did not read before, is read member by member. Read for `diff --application` only: `scan` reads what it did. `application_comparison_schema_version` 0.3 → 0.4. On the 49-PR development corpus (`benchmark/application-q2/`) against `main` at `7c160cfb`, every status is unchanged, pull requests with any row go from 9 to 10, and no row is dropped: cuppibla/adk_tutorial#9's `update_plan` is now an established `added` row (its base `google_search` was unresolved), buriro-ezekia/cinescout-ai#9 gains a `not_established` row naming the base MCP toolset's host, transport and `Authorization` source, and 24 (adk_tutorial#7) and 41 (Lling0000/OpenCMO#41) limits are gone. zendah21/capstone_project#3 is `compared` with `load_memory`, `inspect_schema` and `execute_sql` added. On 131 open SDK/ADK pull requests every status is unchanged; 7 gain rows (14 new rows, 2 of them `not_established`, and 3 candidate removals now established, all checked against source), and 2 gain a named `mcp_servers` limit where a server list was not read before, as 2 development members do. What remains a limit: a helper with more than one `return`, an agent tool whose agent has no literal name, a re-exported built-in, a pydantic settings class, and #874's caller-supplied lists. (#910, #866)
 - **`diff --application` names what a bound tool reaches beyond HTTP.** A side's `reach` gains `effects`: what the tool's own code, and its helpers within the same bound, reaches through a recognised database (`sqlite3`, `psycopg2`, `psycopg`, `asyncpg`, `pymysql`, SQLAlchemy, `pymongo`, `redis`), process (`subprocess`, `os.system`, `os.exec*`, `asyncio.create_subprocess_*`), file (`open`, `pathlib`, `shutil`, `os.remove` and the like), cloud SDK (`boto3`, `google.cloud` storage, firestore and bigquery, Vertex AI Memory Bank) or messaging library (`smtplib`, `slack_sdk`, `twilio`), recognised by its import and method, never by a name. Each effect names its family, operation (`read`, `write`, `execute` or `unknown`), library, call and location and, where it can be read, the program, table, bucket, collection, key or path, a SQL statement's leading keyword, the database engine or cloud service, the host and credential names read off the client's construction, and the model-supplied parameters. A SQL statement, a command's arguments and a path outside the repository are digested (`value_sha256`), never printed. A literal SQL statement or file mode decides read or write; a `SELECT` that writes into a table, runs a second statement or calls a function outside SQL's own read functions (a quoted or schema-qualified name included), or a BigQuery query given a job configuration, is not taken as a read, and one that splices in a value the read does not name is a read and a limit. boto3 operations are read off their verb. A write supports `write`, running a process `code_execution` and sending a message `external_communication`, as a new `source_library_call` claim of the same effect assessment; `read` still needs everything reached to read and nothing unresolved. A method outside the tables, a statement or mode that is not a literal, a read through a client built elsewhere or with an object the read does not see into, and a process started elsewhere are named limits; a write to a file opened elsewhere (`print(..., file=LOG)`) is named where it is made, and printing to an object the read cannot name is a limit. What a helper returns is read one call past the helper bound, so the lazily built pool a query runs on is named; the call itself stays a limit. `application_comparison_schema_version` stays `0.4`, unreleased, with `reach.effects` added. On the 49-PR development corpus (`benchmark/application-q2/`) against `main` at `2c8ecf71`, every status and row is unchanged; row sides whose effect evidence is `unknown` go from 359 to 300 of 362, and sides that name at least one call or effect from 2 to 129 (on established rows, 0 to 44 of 129), in 5 pull requests. xju2/hepagent#72's `request_slurm_interactive` names `tmux` run through `subprocess.run` (`code_execution`); Tiendat2703/MIS_TALENT#7's and #8's `load_service_catalog` name a Postgres `SELECT` through `psycopg2`, and stay `write (provisional)` because other calls are unread; JinyanSu1/Agentic-AI-Scientist#2 and VidulaWickramasinghe/O.R.I.O.N#126 name process runs and file reads and writes. Five sides become `read` (structural), each checked against source. On 131 open SDK/ADK pull requests every status, row and effect evidence is unchanged and no library effect is named; two limits are gone (TencentCloud/CubeSandbox#1508's `Path.cwd()` and the `is_file()` on it). jpka/attest#3's Memory Bank is not named: its `MemoryBank` is a repository class over its own REST client, which the read does not follow into. (#913)
 - **The pre-commit example pin names the published release.** `.pre-commit-hooks.yaml`'s copyable example said `rev: v0.12.0`, and `docs/integrations.md` and `examples/pre-commit/README.md` said `rev: v1.0.0` (twice), after `v1.2.0` was published. All four now name `v1.2.0`, and `.pre-commit-hooks.yaml` is a registered distribution surface (`pre_commit_hook`, `executable_pin`). A repository-wide sweep in `tests/test_distribution_surface_parity.py` fails when any `rev:` that follows this repository's URL names another tag, so the release runbook's step 8 moves them with the other pins. Hook execution and default installation are unchanged. Refs #796.
+- **The published verifier `0.21` and agent-boundary-result `v3` schemas now declare a capability row closed.** The locked development closure moves to pydantic 2.14, which reflects an enclosing model's `extra="forbid"` in the JSON Schema of a standard-library dataclass it contains; `CapabilityDiffRow` therefore gains `additionalProperties: false` in both files. Validation is unchanged: the same model already rejected an unknown row key under pydantic 2.13, and no emitted artifact, schema version or contract version moves. A consumer that validates a row against these schemas and relied on the object being open now rejects an unknown key, as the producing model always did.
 - Move the published-release pins, examples and adoption prompts to `v1.2.0` (contract 41) now that it is published, re-capture the README and quickstart `diff` answers from the published `1.2.0`, and re-measure the pilot ledger's Route H dry run on it. No schema or contract change. (#778)
 
 ## 1.2.0 - 2026-09-30

constraints/build-backend.txt

@@ -48,15 +48,15 @@ pathspec==1.1.1 \
     --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \
     --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189
     # via hatchling
-pluggy==1.6.0 \
-    --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
-    --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+pluggy==1.7.0 \
+    --hash=sha256:7dd7b0d8832ba3cb632c306926ded123429211b83641b35dc5c41ad2d34f9bec \
+    --hash=sha256:d1eaa46ebb595891b860ab086b4d09c8588af65ebd4361b8e8f4bb8920b90ba8
     # via hatchling
-tomlkit==0.15.1 \
-    --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
-    --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
+tomlkit==0.15.2 \
+    --hash=sha256:05562412163a3037b94497385fb7f9204c637bc605af7a48199e41cf2272f437 \
+    --hash=sha256:83e32755ba1d20d9340bd069ee97e9f6232ba2346b63ffcba425de01f7e327a6
     # via hatchling
-trove-classifiers==2026.6.1.19 \
-    --hash=sha256:ab4c4ec93cc4a4e7815fa759906e05e6bb3f2fbd92ea0f897288c6a43efd15b3 \
-    --hash=sha256:c5132b4b61a829d11cfbd2d72e97f20a45ed6edb95e45c5efdeb5e00836b2745
+trove-classifiers==2026.9.21.13 \
+    --hash=sha256:0a9ebc8d4e2f3e8a22848c5258033035bec17a3012ac3fea16dbaa764489eb71 \
+    --hash=sha256:8b1ff4f9c191b1040b71c37f1e445ab99732911e3cd91de52838453a854d7a17
     # via hatchling