outcome-receipts/pyproject.toml at main · ghzhost/outcome-receipts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "outcome-receipts"
version = "0.2.0"
description = "Draft funder outcome reports where every number is a receipt, with a fail-closed grounding gate."
readme = "README.md"
requires-python = ">=3.12"
license = { file = "LICENSE" }
authors = [{ name = "Chelsea Kelly-Reif" }]
keywords = [
  "nonprofit",
  "grant-reporting",
  "outcomes",
  "provenance",
  "hallucination",
  "human-services",
]
classifiers = [
  "Development Status :: 4 - Beta",
  "Intended Audience :: Developers",
  "License :: OSI Approved :: Apache Software License",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Topic :: Scientific/Engineering :: Information Analysis",
]
dependencies = []

[project.optional-dependencies]
bedrock = ["boto3>=1.35,<2"]

[project.scripts]
receipts = "outcome_receipts.cli:main"

[dependency-groups]
dev = [
  "babel>=2.18",
  "pytest>=8",
  "pytest-cov>=5",
  "mypy>=1.18",
  "ruff>=0.15",
  "pip-audit>=2.10",
  "hypothesis>=6",
  "mutmut>=2.5",
]

[project.urls]
Homepage = "https://github.com/ChelseaKR/outcome-receipts"
Documentation = "https://github.com/ChelseaKR/outcome-receipts/tree/main/docs"

# pip is a transitive dependency of pip-audit (via pip-api), never a direct
# one, so a lockfile-only bump cannot pin it: uv re-resolves to whatever
# pip-api's range allows on the next `uv lock`. PYSEC-2026-3721 (pip < 26.2)
# is fixed upstream; this override is the floor until pip-api's own
# constraint moves past 26.2 and the override becomes redundant, not wrong.
[tool.uv]
override-dependencies = ["pip>=26.2"]

[tool.hatch.build.targets.wheel]
packages = ["src/outcome_receipts"]

[tool.ruff]
line-length = 100
src = ["src", "tests"]
target-version = "py312"

[tool.ruff.lint]
select = ["E", "W", "F", "I", "UP", "B", "SIM", "S", "C90", "RUF"]
ignore = ["E501"]

[tool.ruff.lint.mccabe]
max-complexity = 10

[tool.ruff.lint.per-file-ignores]
# S101 (assert) is pytest's own idiom, not a security-relevant use of assert in
# shipped code; every other rule in the select set still applies to tests/.
"tests/*" = ["S101"]

[tool.mypy]
python_version = "3.12"
strict = true
files = ["src", "tests"]

[tool.pytest.ini_options]
minversion = "8.0"
testpaths = ["tests"]
addopts = """
-q \
--strict-markers \
--strict-config \
--import-mode=importlib \
--cov=outcome_receipts \
--cov-branch \
--cov-report=term-missing \
--cov-fail-under=90
"""

[tool.coverage.run]
source = ["outcome_receipts"]
branch = true

[tool.coverage.report]
fail_under = 90
show_missing = true

# Mutation testing is scoped to the invariant core — the grounding gate and the
# metric engine that feeds it. A surviving mutant here is a change to that core
# no test noticed, which is exactly where an undetected regression would break
# the "no invented number" promise. Run opt-in via `make mutation`; it is slow
# and deliberately kept out of `make verify`.
[tool.mutmut]
paths_to_mutate = "src/outcome_receipts/grounding.py,src/outcome_receipts/engine.py"
tests_dir = "tests/"
# Run the suite through the project venv so the mutated package (installed
# editable) is the one under test; the bare `python` on PATH may be a different
# interpreter without the package. `-o addopts=` neutralizes the project-wide
# coverage addopts so a coverage-threshold failure is never mistaken for a
# killed mutant.
runner = ".venv/bin/python -m pytest -x -q -o addopts= --assert=plain -p no:cacheprovider"