python-mcp-bootstrap v0.2.0

python-mcp-bootstrap v0.2.0

One Python floor for the bootstrap and its consumers, and the hash-pinned
runtime install becomes an upstream feature.

Highlights

• Python floor is 3.12: requires-python = ">=3.12", core.REQUIRED = (3, 12, 0),
  supported interpreters 3.12–3.15. Consumers may still raise required.
• BootstrapSpec.requirements installs project-relative, hash-pinned
  requirement files with uv pip install --require-hashes -r <file> before the
  project install, which then runs with --no-deps. Failures return
  runtime_requirements_failed (exit 5) before the project install. This is
  the upstream form of the per-consumer patch that vendored copies carried.
• CI uses the minor lines 3.12, 3.13, 3.14, 3.15 with
  check-latest: true and records the resolved patch with python -VV.
  Release and build jobs keep the exact 3.15.2 pin.
• Committed .python-version files name the 3.15 line; provisioning still
  writes the exact PIN 3.15.2, and release_check enforces that split.
• docs/version-policy.md records the shared floor/line/pin policy for all
  Python repos.
• README, CONTRIBUTING, the contract, and the integration guide document the
  single floor, vendoring as the recommended pre-install pattern, and the
  two-phase requirements install.

Release integrity

• v0.2.0 is an annotated tag. prepare-release builds from the tag, writes
  SHA256SUMS, creates a draft, uploads the assets, attests provenance, signs
  every artifact, and verifies the draft. Publishing the draft fires
  publish.yml, which verifies checksums, the full release gate, and both
  artifact attestations before publishing to PyPI last with OIDC trusted
  publishing.
• The release is immutable with seven assets: wheel, sdist, SHA256SUMS, three
  .sigstore.json bundles, and provenance.intoto.jsonl.

Artifacts

• python_mcp_bootstrap-0.2.0-py3-none-any.whl
• python_mcp_bootstrap-0.2.0.tar.gz
• SHA256SUMS, three .sigstore.json bundles, and provenance.intoto.jsonl