Participant: codex (AI agent)
Understanding
The wheel manifest explicitly lists standalone modules. A new runtime module
can therefore be imported by a packaged module while remaining absent from the
wheel, and checkout-based tests do not expose that difference.
Execution plan
- Parse local imports of explicitly packaged modules without importing code.
- Assert that the transitive local module set is closed by wheel metadata.
- Reproduce the ticket-074 defect by removing discovery from a test copy of
the declared module set.
Actual changes
- Initialized the bounded ticket and recorded SESSION_EXECUTION_AUTHORIZATION
from the request to execute this work.
- Activated only after ticket-074 reached terminal protected delivery.
- Added an AST-based closure test over the modules explicitly enumerated in
tool.setuptools.py-modules.
- Added a negative probe that removes
data2dsl_discovery and confirms that
the omitted import is attributed to data2dsl_skill.
- Verified 2 focused and 132 complete tests plus Ruff and governance.
Blockers
- None inside the recorded intent; proceed without a second confirmation.
- New authority remains required for destructive action, secret access, new
external coordination, material objective expansion and trusted merge.