Repository navigation
Conversation
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
Add the fourth Cargo workspace at languages/python with two crates: stackencrypt-core (no pyo3, depends on stack-encrypt by path) and stackencrypt-engine (the `_engine` cdylib, pyo3 0.29, abi3-py39). The pure-Python package `stackencrypt` exposes `__version__` (0.1.0, from the engine crate's manifest through maturin) and `__engine__` (the checkout's commit, `-dirty` when packages/stack-encrypt has local edits). `extension-module` is set only by maturin, so `cargo test --locked` links libpython. Tasks live in languages/python/mise.toml: build, test, test:cargo. The Cargo.lock is seeded from the root one because stack-encrypt requires a yanked cllw-ore pre-release a fresh resolve cannot select. Exclude the workspace from the root Cargo.toml; add it to the Dependabot cargo entry and the publish opt-out and lock freshness guards; update AGENTS.md and SECURITY.md. Mark ADR-0001 accepted, add the Python row to ADR-0002's host-language table, and start the Python section of docs/sdk-design-principles.md, the doc edits the spec says ride with the first PR. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… comments `-dirty` only watched packages/stack-encrypt, but the engine also takes stack-kms and stack-encrypt-derive by path, so an edit there shipped under a clean SHA. The check now covers every packages/stack-* crate. The comments listing core's future responsibilities now point at the spec instead, so they cannot drift into a second one. Refs #1382 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
ADR-0001 is recorded as accepted, with its open items listed and its kind rule amended to the spec's. ADR-0002 cites the spec, not the ADR, for the value rules. The glossary records the `_engine` naming. The Dependabot guard now reads [workspace.dependencies], which hid the Python edge. The dirty check skips fuzz corpora. The unasked release profile and rlib are gone. Refs #1382 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
yujiyokoo
force-pushed
the
feat/python-sdk-skeleton
branch
from
October 27, 2026 08:34
30e4646 to
a0ae3fc
Compare
Contributor
Mutation testing (cargo-mutants,
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The first piece of the Python SDK,
stackencrypt. It installs into avirtualenv and exposes two facts: its version (0.1.0) and the commit of
the Rust encryption engine it was built from. It encrypts nothing yet.
The point is the build path: a Rust extension built by maturin, over
the
stack-encryptcrate in this repository, importable from Python.Changes
languages/python: a fourth Cargo workspace with two crates.corehas no Python dependency, so its tests run without an interpreter.
engineis the pyo3 extension module. A pure-Python package wraps it.languages/python/mise.toml:build,test,test:cargo.Cargo.toml, Dependabot, and two repo guards know the new workspace.The Dependabot guard now also reads path dependencies declared at a
workspace root, which it missed before.
in ADR-0002, and a first Python section in the SDK design principles.
Verification
Run locally on macOS, Python 3.14:
mise run test(four pytest tests) andmise run test:cargo(two Rust tests) inlanguages/python.cargo metadata --lockedpasses in all four workspaces. The repo guardsuite and the supply-chain e2e test pass.
Not verified: Python 3.9, and any CI run. Both are #1383.
Related
Closes #1382. Refs #1341 (the spec). Stacked on #1284; retarget to
nextafter that merges.
Review notes
No Python lockfile yet, and no CI workflow: both are deferred to #1383.
The engine commit ends in
-dirtywhen apackages/stack-*crate hasuncommitted changes.
🤖 Generated with Claude Code