Astetik

Migration describes retained argument mappings, breaking behavior, explicit preparation, result/export changes and preserving historical environments. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Reference/Migration.md

Live GitHub repository metadata has has_issues=true; issues are the documented bug and contribution tracker. Evidence: https://api.github.com/repos/autonomio/astetik https://github.com/autonomio/astetik/issues https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/SUPPORT.md

On 2026-10-02 the user confirmed there were no private vulnerability reports in the preceding 12 months. The repository security advisory API returned an empty list. There are therefore no resolved reported vulnerabilities in that period requiring reporter credit. The public advisory result alone would not establish the private history; this answer relies explicitly on the human confirmation. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/SECURITY.md https://api.github.com/repos/autonomio/astetik/security-advisories https://github.com/autonomio/astetik/blob/a296fbd7a09e55ca9f002caa4b6499defc74b638/SECURITY.md

CLAUDE and Ruff configuration define Python naming/public API/docstring/style and maintainability standards. Contributions must follow them. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CLAUDE.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CONTRIBUTING.md

Actual lint gate passes pinned Ruff with no retained findings and strict ratchets; configuration relaxation is checked against protected base. Evidence: https://github.com/autonomio/astetik/actions/runs/36914968410 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_checks_lint.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/governance/check_ruff_ratchet.py

This project builds a pure Python wheel/sdist, not its own native binaries. It does not compile third-party NumPy/SciPy/Pillow binaries. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Developer/Packaging.md

The wheel/sdist retain Python source modules; the package audit checks their contents and no installation strip stage removes debugging source. Evidence: https://github.com/autonomio/astetik/actions/runs/36914931308 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/scripts/package_audit.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml

Hatch builds the declared Python package in one graph. No project-owned recursive native build with cross-subdirectory dependencies is present. Evidence: https://github.com/autonomio/astetik/actions/runs/36914931308 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_checks_packaging.yml

Actual packaging run at merged source head5db38b5 reports two artifacts identical across two fixed-epoch builds. Evidence: https://github.com/autonomio/astetik/actions/runs/36914931308 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_checks_packaging.yml

Standard pip wheel/source installation and pip uninstall are supported. Actual built-wheel installs/imports outside checkout passed on Python3.11,3.12,3.13. Evidence: https://github.com/autonomio/astetik/actions/runs/36914931308 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CONTRIBUTING.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Developer/Packaging.md

Standard Python packaging delegates destination choice to pip virtual environments and --target/--prefix conventions; there is no custom installer replacing them. Outside-checkout installation is tested. Evidence: https://github.com/autonomio/astetik/actions/runs/36914931308 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Developer/Packaging.md

CONTRIBUTING gives conventional virtualenv, pip extras and hashed gate-tool setup; Documentation gives Node/npm/Chromium setup. Actual CI uses those dependencies. Evidence: https://github.com/autonomio/astetik/actions/runs/36969583737 https://github.com/autonomio/astetik/actions/runs/36914968410 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CONTRIBUTING.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Developer/Documentation.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/requirements/ci/gate-tools.txt

Python runtime/extras/build requirements and documentation package lock are computer-processable; CI toolchain inputs are hashed requirement files. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs-site/package.json https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs-site/package-lock.json https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/requirements/ci/runtime-env.txt

Required lint runs pip-audit for declared runtime and docs npm audits; weekly Dependabot update configuration monitors packages/actions. Actual master documentation and lint audit jobs passed. Evidence: https://github.com/autonomio/astetik/actions/runs/36969583737 https://github.com/autonomio/astetik/actions/runs/36914968410 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/dependabot.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_checks_lint.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/governance/check_dependency_vulnerabilities.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/vuln_exceptions.json

Externally maintained Python/Node dependencies use standard package managers and declared bounds/locks. There is no mandatory project fork of runtime libraries. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs-site/package.json https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/dependabot.yml

The modern compiler uses supported Python3.11+ APIs and dependency bounds; actual scientific CI passes3.11/3.12/3.13. Deprecated legacy helpers fail explicitly rather than executing old unsafe behavior. This does not certify every upstream API forever. Evidence: https://github.com/autonomio/astetik/actions/runs/36969583737 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Reference/Migration.md

Scientific contracts run on each protected master push and PR, reporting pass/fail; actual merged-master run passed. Evidence: https://github.com/autonomio/astetik/actions/runs/36969583737 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/ci.yml

In origin/master since2026-04-02,15 non-merge fix commits were found.12 add new regression test functions still retained at current master (80%). Deleted test files were not counted as retained coverage. The full suite on their merged source passed1099 tests. Evidence: https://github.com/autonomio/astetik/actions/runs/36914931313 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/tests/test_replay_source_identity.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/tests/test_snapshot_json_boundary.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/tests/test_numeric_option_identity.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/tests/test_publication.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/governance/tests/test_repository_law.py

Coverage artifact from actual successful merged-source run36914931313 reports4444/4945 covered statements=89.8685540950455%; this meets Silver80%. Its88.120371% combined line/branch percent is a different measure. Evidence: https://github.com/autonomio/astetik/actions/runs/36914931313 https://api.github.com/repos/autonomio/astetik/actions/runs/36914931313/artifacts https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/budgets.json https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_checks_tests.yml

Slice law requires tests proving every capability assertion and a future regression gate; developer workflow says behavior changes need meaningful regression protection. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CLAUDE.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/ISSUE_TEMPLATE/slice.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Developer/README.md https://github.com/autonomio/astetik/blob/a296fbd7a09e55ca9f002caa4b6499defc74b638/CONTRIBUTING.md

Contribution instructions route to the constitution and developer workflow, including the capability-tests and regression protection requirement. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CONTRIBUTING.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CLAUDE.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Developer/README.md https://github.com/autonomio/astetik/blob/a296fbd7a09e55ca9f002caa4b6499defc74b638/CONTRIBUTING.md

Python source is checked using pinned Ruff with no retained findings and strict Pyright with an error/warning budget of zero. Docs diagnostics are fatal. There is no native compiler warning surface. Python runtime warnings are not globally ignored by the library; practical third-party exceptions must be explicit. Evidence: https://github.com/autonomio/astetik/actions/runs/36914968410 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/budgets.json https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CLAUDE.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/governance/check_ruff_ratchet.py

Actual runtime uses allowlisted declarations, fail-loud error recovery, immutable result sealing, no-overwrite atomic publication, safe YAML and JSON parsing. Runtime has no shell/network authentication privileges. Required CI credentials are bounded. The assurance-case prose should tie these mechanisms to design principles explicitly. The user explicitly confirmed the primary maintainer has secure-design and common coding-security knowledge on 2026-10-02; this is a human attestation, not an audited certificate. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_manifest_load.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_snapshot_parse.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_result_atomic.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_result.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/audit_master_ruleset.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Developer/Security-Assurance-Case.md https://github.com/autonomio/astetik/blob/a296fbd7a09e55ca9f002caa4b6499defc74b638/docs/Developer/Security-Assurance-Case.md

Project integrity digests use hashlib.sha256. No MD5/SHA1 security mechanism or home-grown cipher was found in runtime. Repository delivery uses platform HTTPS/signing primitives. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_json.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_source_file.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_result.py

Scientific runtime does not process auth credentials or private keys. Maintainer workflows receive replaceable external GitHub Secrets/OIDC credentials separate from source, configuration and artifacts; token rotation needs no compilation. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/SETUP.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/audit_master_ruleset.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_publish_pypi.yml

Scientific runtime does not communicate over a network; project maintenance/publishing tooling uses HTTPS GitHub/PyPI endpoints or GH CLI defaults. No insecure transport bypass was found in audited project source. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/scripts/create_release.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_publish_pypi.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/governance/ruleset_gate.py

Runtime does not use TLS. Maintenance/publishing HTTPS uses supported Python3.13 stdlib/GH/PyPI platform TLS stacks rather than implementing SSL/TLS. Its runtime-only answer is N/A. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CONTRIBUTING.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_publish_pypi.yml

Runtime does not use TLS. Publishing code uses urllib.request.urlopen default validating context; GH tools use their ordinary HTTPS defaults. No unverified SSL context, verify=False or CERT_NONE was found. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_publish_pypi.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/governance/ruleset_gate.py

Runtime sends no HTTP private headers. Maintainer authentication is delegated to GH CLI/GitHub Actions/PyPI OIDC HTTPS clients; project code does not send credentials through an unverified custom TLS context. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_publish_pypi.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/audit_master_ruleset.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/governance/ruleset_gate.py

Runtime allowlists kinds/options/manifests; retained JSON rejects duplicate/nonfinite/invalid schema values; type, source identity, artifact binding and no-overwrite publication are covered by actual passing tests. Evidence: https://github.com/autonomio/astetik/actions/runs/36914931313 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_spec.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_manifest_load.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/astetik/_snapshot_parse.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/tests/test_snapshot_json_boundary.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/tests/test_replay_artifact_bindings.py https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/tests/test_numeric_option_identity.py

Project-owned distributable runtime is memory-managed Python; it builds no native executable and hosts no authentication/web service. Compiler flags/service response headers therefore have no applicable owned runtime surface. Least privilege alone is explicitly not counted as hardening. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/SECURITY.md https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml

Actual merged-master Python CodeQL run succeeded; its queries analyze security weakness classes. Required PR CodeQL is independently configured with no retained new findings. Evidence: https://github.com/autonomio/astetik/actions/runs/36969583672 https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/.github/workflows/pr_checks_codeql.yml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/CLAUDE.md

This project owns Python/JavaScript source and does not produce memory-unsafe C/C++ modules. Third-party native scientific dependencies are separately maintained; no project-native sanitizer/fuzzer claim follows. Evidence: https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/pyproject.toml https://github.com/autonomio/astetik/blob/5db38b5fc054292a2dc3d6e592746f4815e23bf2/docs/Developer/Security-Assurance-Case.md