The exact patch pin made every gate unrunnable on any host without that precise
build. cpython-3.12.13 is not published for linux-x86_64, so `uv sync --locked`
failed outright there and there was no local run at all — for a project whose
merge bar IS the local run, that is the failure mode that matters. It is how
test_lane_sha_verifier.py and 99 register-matrix tests sat red on clean main
without anyone seeing them.
Safe because the pin was not load-bearing for reproducibility: the committed
trace_hash / content_sha256 / lane-SHA pins were established under 3.12.13 and
reproduce byte-for-byte under 3.12.11 (119 hash-pinned tests, 118 pass; the one
failure is a stale lane roster that fails on 3.12.13 too). The minor version
stays bounded — 3.13 is a real upgrade decision, not a patch bump.
.python-version follows to "3.12" so uv resolves any patch release.
[Verification]: `uv lock` regenerated — the ENTIRE diff is one line,
requires-python "==3.12.13" -> "==3.12.*". All 217 packages resolve to
identical versions; no dependency moved. `uv sync --locked` now succeeds on
linux-x86_64, which it could not do before this change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FduW6Krm3PPQv3P5iwBYtx
#48 switched CI to 'uv sync --locked' but uv.lock was gitignored (an early
library-style choice; this repo is an application — the lock belongs in
git). Every run since failed at install: 'Unable to find lockfile'.
Un-ignore and commit the lock (217 packages, matches pyproject via
'uv lock --check'). CI now installs the exact universe local development
and all green verification ran against.
[Verification]: code tree byte-identical to the smoke-gated state
(175 passed); this commit adds a data file CI requires + one .gitignore
line removal.
