0.4.0 roadmap and V04-01 qualification
This is planning and experimental evidence, not delivered 0.4.0 functionality. No version bump, release tag, distribution publication or catalogue submission is part of this change.
Source and tracking status
The requested source is Apizr_v0.4_Backlog_issues.md, containing V04-00–V04-26
and D04-01–D04-06. On 2026-09-23 it was absent from the checkout and accessible
Codex attachments (the supplied attachment contained only the task instructions).
The 33 approved fiches, exact dependencies, exclusions and acceptance criteria
therefore cannot be imported faithfully. They have not been reconstructed.
GitHub audit of Alien6-Studio/outerspace-apizr: default branch master, ADMIN
access, no open pull requests, no existing V04/D04 issues or 0.4 milestones among
all issues and open/closed milestones. Remote master matched the local starting
commit. No issue or milestone was created: full backlog availability is a required
condition for the requested bulk initialization. Existing issues/comments were not
rewritten. The mapping below explicitly records missing associations, not GitHub
issue numbers inferred from backlog identifiers.
| Backlog identifier | GitHub issue | Status |
|---|---|---|
| V04-00 | Not created/found | Pilot fiche unavailable; never considered closed |
| V04-01 | Not created/found | Scope from the task; private prototype in this PR |
| V04-02–V04-26 | Not created/found | Approved fiches unavailable |
| D04-01–D04-06 | Not created/found | Approved fiches unavailable |
When the source becomes available, preserve it under the repository's documentation conventions, reconcile real implementation with every fiche, find/create only missing issues, replace editorial dependencies with real issue links and link technical tickets to V04-00. Replace grouped missing rows with exact mappings. Do not mark V04-01 complete until reconciled with its approved fiche and all required installation evidence; this PR uses no automatic closing keyword.
Two separate milestones are required when tracking is initialized:
- 0.4.0: product, qualification and verified publication.
- 0.4.0 — Diffusion: catalogue listings and admissions. Submission is not admission.
Work cycles are not 0.3.x releases. The intended sequence is local/remote source → identified snapshot → capabilities/readiness → explicit selection/exposure plan → REST/MCP generation → executable packaging → attestation when required → OCI publication. Existing 0.3 static compilation, selection and governed execution remain foundations. Source acquisition, modern plugin lifecycle and publication must build on those operations rather than rewrite them.
Cross-cutting roadmap: guided and noninteractive CLI; official optional plugins; Apizr as an MCP server; OpenAPI/collection exports and Postman synchronization; GitHub Actions/GitLab CI; PyPI/uv/pipx/Homebrew/OCI distributions and appropriate catalogues. Only V04-01 is implemented in this change. No full plugin runtime, remote Git connector, OCI publisher, production MCP server, Postman or Attest integration is started. Exact ticket ordering awaits the approved dependencies.
Audit and baseline
Starting commit: 801563f82963f7189354672a056fd67c50e5fc08 (master, clean).
Version: 0.3.0; Python 3.11–3.14; Hatchling build; pydantic-only core dependency.
Extras: notebook, http, mcp, legacy. No applicable AGENTS.md was found.
CONTRIBUTING, dependency, validation and DCO conventions were read. Configured
identity: coopyrightdmin <admin@coopyrightcode.com>; no cryptographic signing
configuration was present. DCO sign-off does not claim a cryptographic signature.
Recent work includes verified 0.3.0 publication (#94), subprocess-deny enforcement
(#99), reproducible notebook conversion (#98), and documentation (#101/#103).
CLI commands defer optional imports. apizr.pipeline.v1 already supports explicit
trusted plugins and validates returned Context. Modern capability, readiness,
repository, graph, exposure, interface, execution and OCI modules already exist;
this work neither replaces their contracts nor duplicates compilation.
CI has Linux 3.11–3.14 and macOS 3.11/3.14 coverage, separate package floors, package/wheel checks, Docker and OCI isolation, mutation testing, DCO, dependency source/license/audit checks and strict docs. Global coverage remains at least 90%.
Baseline on macOS arm64 / Python 3.14.6 / uv 0.12.0:
uv run --locked ruff check .: pass.uv run --locked ruff format --check .: pass (440 files).uv run --locked pyright: pass, zero errors/warnings.uv run --locked pytest --cov --cov-report=term-missing: 2013 passed, 60 skipped, one pre-existing warning; 91.96% coverage.
Initial sandbox access to the existing uv cache and GitHub network was denied; rerunning with authorized access succeeded. These were environment restrictions, not repository failures. Docker/OCI image-dependent skips are not installation or isolation proofs. One filesystem-name test is skipped on this host.
V04-01 result
The ADR and reproduction instructions choose a hybrid core/included-adapter/separate-extension design using explicit uv installation. The private module performs an installed core operation then calls an independently packaged benign extension through strict versioned JSON.
Executed validation
| Command / check | Actual result |
|---|---|
uv run --locked ruff check . / ruff format --check . |
Passed |
uv run --locked pyright |
Passed, zero errors/warnings |
uv run --locked pytest tests/test_extension_probe.py tests/test_pipeline_plugins.py tests/test_optional.py -q |
27 passed |
uv run --locked pytest --cov --cov-report=term-missing |
Final stable run: 2026 passed, 60 skipped, one existing warning; 92.46% coverage |
uv build --out-dir /tmp/apizr-v04-dist |
Wheel and sdist built, version unchanged |
uv run --locked --group docs mkdocs build --strict |
Passed |
uv run --locked pre-commit run --all-files |
Passed, including newly staged files |
uv run --locked python scripts/security_mutations.py |
Baseline passed; all 20 mutations killed |
uv run --locked python scripts/smoke_installations.py /tmp/apizr-v04-dist/outerspace_apizr-0.3.0-py3-none-any.whl |
Base, notebook, http, mcp, legacy passed (Python 3.12.13) |
uv run --locked python scripts/smoke_wheel.py /tmp/apizr-v04-dist/outerspace_apizr-0.3.0-py3-none-any.whl |
Passed, including a separately installed historical pipeline plugin |
uv run --locked python scripts/smoke_container.py --python-version 3.11 |
Real Docker build/runtime passed; POST /total = 36; non-root user |
The final full suite used Python 3.14.7 / uv 0.12.17. The earlier concurrent run
had 9 failures, 2017 passes and 60 skips when Homebrew dependency upgrades and
a subsequent uv invocation changed the development venv underneath running tests
(SSL files/imports disappeared). These failures are retained as an environment
incident, not hidden as successful tests. After uv sync --locked --python
/opt/homebrew/opt/python@3.14/bin/python3.14 --group docs, the complete suite passed.
No test, quality threshold or existing contract was relaxed.
Installation evidence
Full before/after inventories and actual Homebrew receipt are checked in. Both installation proofs were rerun after strengthening the negative checks to change only the version in otherwise valid request/response messages (27 focused tests also rerun successfully). They record file hashes, modes, symlink targets, distribution versions, installed module locations, protocol result and interpreter versions.
| Installation | Actual evidence |
|---|---|
uv tool install, macOS arm64, Python 3.14.7, uv 0.12.17 |
Pass; 488 core entries identical before/after; distributions unchanged; plugin installed outside core; incompatible request/response rejected |
| Real Homebrew 6.0.19 formula, macOS arm64, Python 3.14.7, uv 0.12.17 | brew install and brew test passed; 486 formula-prefix entries identical before/after extension install/invocation; distributions unchanged |
| Linux and other supported Python versions | Reproducible workflow added; local macOS runs do not claim these CI results |
| pipx, Linux Homebrew, Windows | Not executed; remain qualification gaps |
Homebrew's first test installation upgraded existing dependencies despite
HOMEBREW_NO_AUTO_UPDATE=1: ca-certificates 2026-08-13, openssl@3 3.6.4,
readline 8.3.6, sqlite 3.53.4, xz 5.8.4, Python 3.14.7 and uv 0.12.17.
An attempted interruption arrived after installation completed. Previous kegs
were retained. The revised workstation recipe uses the development-only
--ignore-dependencies option after checking prerequisites; ordinary dependency
installation is reserved for disposable CI runners. No unsupported rollback of
shared dependencies was attempted. Homebrew also installed its test tooling.
The temporary formula/tap were removed after archiving evidence, and developer
mode (enabled by brew test) was turned back off.
The first local formula preparation hit a Gitleaks false positive on a literal
executable name. Using the formula's name accessor resolved it; both configured
secret-scanning hooks passed on the temporary tap commit. No hook was bypassed.
Acceptance status
- Satisfied from the task: ADR; minimal executable prototype; real separate package installations; strict structured response validation; incompatible protocol refusal; missing-backend diagnostic without downloads or filesystem mutation; core inventory/distribution integrity; real uv and Homebrew proof; regression tests including historical plugin/extras; reproducible CI fixtures.
- Open: reconcile with the unavailable approved V04-01 fiche, initialize exact V04/D04 issue mapping and two milestones, and review cross-platform CI evidence. No issue is closed and no other roadmap item is marked delivered.
- Tradeoff requiring review: an external uv prerequisite and trusted-code IPC rather than an in-process installer; production authorization, output bounds, cancellation and environment lifecycle belong to later approved tickets.
Prepared CI does not count as executed CI. Full acceptance and the exact next technical ticket remain open pending the original backlog.
Next recommended action: recover and reconcile the approved backlog under V04-00, then confirm V04-01 acceptance before selecting its actual dependent ticket. Do not start V04-04/V04-05 public commands from inferred requirements.