pyproject.toml

[build-system]
requires = ["setuptools>=84.0.0"]
build-backend = "setuptools.build_meta"

[project]
# The distribution name on PyPI, not the import name or the CLI command:
# `plumbline` (the name that would read most naturally) is already taken
# there by an unrelated, long-dormant geospatial package. `plumbline-eval`
# is free as of this decision (2026-08-22) and is a placeholder pending
# confirmation, not a claim already made — nothing has been uploaded under
# either name. The package directory stays `src/plumbline/`, `import
# plumbline` and the `plumbline` command are unaffected either way; only
# this one string, and the `pkg:pypi/...` purl in `sbom.cdx.json`
# (regenerate with `tools/build_sbom.py` after changing it), would need to
# change if a different name is chosen before the first real publish.
name = "plumbline-eval"
version = "0.2.0"
description = "Fail-closed, deterministic evaluation harness for government-facing chat systems: provenance-stamped audit reports, usable as a merge-blocking CI gate."
readme = "README.md"
requires-python = ">=3.11"
license = "Apache-2.0"
authors = [{ name = "Chelsea Kelly-Reif" }]
keywords = ["evaluation", "audit", "llm", "civic-tech", "ci-gate"]
classifiers = [
  "Development Status :: 2 - Pre-Alpha",
  "Intended Audience :: Developers",
  "Programming Language :: Python :: 3 :: Only",
  "Topic :: Software Development :: Quality Assurance",
]

[project.scripts]
plumbline = "plumbline.cli:main"

[tool.setuptools.packages.find]
where = ["src"]

# The runtime stays what it has always been: the standard library and nothing
# else. Everything below is development tooling, is never imported by
# `plumbline`, and is not installed by anyone running the harness.
[dependency-groups]
dev = [
  "ruff>=0.15.0",
  "coverage>=7.6",
  "mypy>=1.13.0",
]

[tool.ruff]
target-version = "py311"
src = ["src", "tests", "tools"]

[tool.ruff.lint]
# Ruff's default rules (pyflakes plus the pycodestyle errors that catch real
# breakage), and they are green, which is the point: `make lint` can fail
# today. The wider portfolio rule set is NOT enabled here, and pretending
# otherwise by configuring it and excluding the findings would be the badge
# this repository exists to argue against. Measured against
# `E,W,F,I,UP,B,SIM,RUF` on 2026-08-22 the codebase has 317 findings, 237 of
# them line length; against `C90` at max-complexity 10 it has 17. Both are
# recorded as open gaps in the README's conformance table. Widen this set when
# the findings are fixed, not before.
select = ["E4", "E7", "E9", "F"]

# F541 (an `f` prefix on a string with no placeholder) is cosmetic, and here it
# is not free. `audit.py` digests `src/plumbline/` into
# `harness_source_sha256`, which lands in the run id, so editing any source
# file for any reason invalidates the committed audit under `audits/`, the
# committed baseline, `proof/matrix.md` and the published page, and the suite
# fails until all four are regenerated. Regenerating this repository's own
# evidence is something to do when its behaviour changed and you can say why,
# not to remove seven redundant prefixes. Every other pyflakes rule stays on
# and stays blocking, including F401, which is what caught the four unused
# test imports removed alongside this config.
ignore = ["F541"]

[tool.mypy]
# `--strict`, not default mypy: it found 174 findings across 28 files when
# this file recorded that as the next open gap — almost all `dict` without a
# type argument in code written before mypy was wired in at all, the rest a
# missing parameter or return annotation. Fixed rather than suppressed in
# every case (no `# type: ignore`, no narrowed scope), the same posture the
# original wiring took on its own 27 default-mode errors. `mypy src/plumbline`
# is what CI runs and what is green now: `Success: no issues found in 38
# source files`.
strict = true
python_version = "3.11"
files = ["src/plumbline"]
# Not part of `--strict`: catches a branch mypy proved can never run, which
# a stale guard clause or an outdated `isinstance` check can leave behind.
warn_unreachable = true

[tool.coverage.run]
branch = true
source = ["src"]

[tool.coverage.report]
# Measured at 93% branch coverage over `src/` on 2026-08-22. The floor is set
# below the measurement so that a real regression trips it rather than routine
# noise, and above the level where the gate would be decorative.
fail_under = 90
show_missing = true