v2.7.0

[2.7.0] — 2026-09-25

Added

• House Session: hpp deliberate and hpp.deliberation/v1. A deliberation between pinned
  deciders, recorded so it can be verified and measured; the harness still calls no model. A panel
  (hpp.panel/v1) needs two model families among its participants, one judge in a lane no
  participant uses, and the roles its session type needs (plan, review, release-gate,
  incident, design). Turns (hpp.turn/v1) list what their seat had read, so the blind first
  round is checkable. tally counts grounded and ungrounded votes apart and marks a seat that did
  not answer as not judged, never as a vote against; stop applies a fixed rule (not-judged,
  grounded-convergence, paused-budget, no-new-evidence, max-rounds); record seals the
  session with the judge's decision and keeps the dissent that lost; verify re-derives the record
  from its own turns. Example: examples/house-session.
• hpp evidence mutate: does the criterion notice broken code? The criterion runs on a copy
  of the workspace, clean (it must pass, or the verdict is no-control and nothing else runs) and
  once per mutant (it must fail). Mutants are declared (hpp.mutants/v1) or generated from Python
  tokens with a fixed operator table, never inside strings or comments. A surviving mutant is a
  named blind spot; the score has no value when nothing was measured. The record is
  hpp.mutation/v1. Example: examples/criterion-sensitivity.
• hpp.decision/v1 accepts method: panel. A panel is projected as one decision record, with
  no confidence and the sealed deliberation as its raw response, so hpp decide eval measures a
  panel by the same ruler as a single decider.

---

[2.7.0] — 2026-09-25

Adicionado

• House Session: hpp deliberate e hpp.deliberation/v1. Uma deliberação entre decisores
  pinados, registrada para poder ser verificada e medida; o harness continua sem chamar modelo. Um
  painel (hpp.panel/v1) exige duas famílias de modelo entre os participantes, um juiz numa lane
  que nenhum participante usa, e os papéis que o tipo de sessão pede (plan, review,
  release-gate, incident, design). Os turnos (hpp.turn/v1) listam o que o assento tinha
  lido, então a primeira rodada cega é verificável. tally conta votos fundamentados e não
  fundamentados à parte e marca um assento que não respondeu como não julgado, nunca como voto
  contra; stop aplica uma regra fixa (not-judged, grounded-convergence, paused-budget,
  no-new-evidence, max-rounds); record sela a sessão com a decisão do juiz e guarda a
  dissidência que perdeu; verify re-deriva o registro dos próprios turnos. Exemplo:
  examples/house-session.
• hpp evidence mutate: o critério percebe código quebrado? O critério roda numa cópia do
  workspace, limpa (tem de passar, senão o veredito é no-control e nada mais roda) e uma vez por
  mutante (tem de falhar). Os mutantes são declarados (hpp.mutants/v1) ou gerados dos tokens
  Python com uma tabela fixa de operadores, nunca dentro de strings ou comentários. Um mutante
  sobrevivente é um ponto cego nomeado; o score não tem valor quando nada foi medido. O registro é
  hpp.mutation/v1. Exemplo: examples/criterion-sensitivity.
• hpp.decision/v1 aceita method: panel. Um painel é projetado como um registro de decisão,
  sem confiança e com a deliberação selada como resposta bruta, para que hpp decide eval meça um
  painel pela mesma régua de um decisor só.

v2.6.7

[2.6.7] — 2026-09-25

Changed

• Every install in the workflows is hash-pinned. The test runner (CI) and the build backend
  (release) install from committed requirements files with --require-hashes, so a job runs the
  exact packages that were reviewed, not whatever the index serves that day.

---

[2.6.7] — 2026-09-25

Alterado

• Toda instalação nos workflows é fixada por hash. O executor de testes (CI) e o backend de
  build (release) instalam a partir de arquivos de requisitos versionados com --require-hashes,
  então um job roda exatamente os pacotes revisados, não o que o índice servir naquele dia.

v2.6.6

[2.6.6] — 2026-09-25

Added

• OpenSSF Best Practices badge (passing). The project self-certified all 67 criteria of the
  passing level, each with its evidence: https://www.bestpractices.dev/projects/14830. The README
  shows the badge next to CI, release and Scorecard.

---

[2.6.6] — 2026-09-25

Adicionado

• Selo OpenSSF Best Practices (passing). O projeto se autocertificou nos 67 critérios do nível
  passing, cada um com a sua prova: https://www.bestpractices.dev/projects/14830. O README mostra o
  selo ao lado do CI, da release e do Scorecard.

v2.6.5

[2.6.5] — 2026-09-24

Added

• Published to PyPI. From this release on, pip install house-party-protocol installs the
  wheel the release workflow built and attested, uploaded by trusted publishing with no stored token.
• The provenance bundle is attached to every release as
  house_party_protocol-<version>.intoto.jsonl, so a release can be checked offline and scanners
  that look for signature files among the assets find it. v2.6.4 received it by hand.
• CI compiles every Python file with warnings as errors (python -X dev -W error -m compileall)
  before the tests, so a syntax or deprecation warning fails the build instead of scrolling past.

---

[2.6.5] — 2026-09-24

Adicionado

• Publicado no PyPI. A partir desta release, pip install house-party-protocol instala o wheel
  que o workflow de release construiu e atestou, enviado por trusted publishing sem token armazenado.
• O bundle de proveniência é anexado a toda release como
  house_party_protocol-<version>.intoto.jsonl, para que a release possa ser conferida offline e
  scanners que procuram arquivos de assinatura entre os assets o encontrem. A v2.6.4 o recebeu à mão.
• O CI compila todo arquivo Python com warnings como erro (python -X dev -W error -m compileall)
  antes dos testes, para que um warning de sintaxe ou de depreciação reprove o build em vez de passar batido.

v2.6.4

[2.6.4] — 2026-09-24

Added

• Build provenance for every release. The wheel and the sdist are attested by the release
  workflow after they were installed and run on three systems; gh attestation verify <file> --repo rusharlabs/house-party-protocol checks where the bytes came from. The identity token
  lives in a job of its own, never on the runner that downloads build packages.
• OpenSSF Scorecard. A weekly analysis (and one on every push to main and every change to
  branch protection) publishes the score and sends its findings to code scanning.
• PyPI publishing, ready and off. A trusted-publishing job uploads the release with no stored
  token once the repository variable PYPI_PUBLISH is true; until the publisher is registered
  on PyPI it does not run, and installation stays pip install git+…@<tag>.
• Live badges. The README shows the CI state, the latest release and the Scorecard score.

---

[2.6.4] — 2026-09-24

Adicionado

• Proveniência de build em toda release. O wheel e o sdist são atestados pelo workflow de
  release depois de instalados e executados em três sistemas; gh attestation verify <file> --repo rusharlabs/house-party-protocol confere de onde vieram os bytes. O token de identidade
  vive num job próprio, nunca no runner que baixa pacotes de build.
• OpenSSF Scorecard. Uma análise semanal (e uma a cada push na main e a cada mudança na
  proteção de branch) publica a nota e envia os achados ao code scanning.
• Publicação no PyPI, pronta e desligada. Um job de trusted publishing envia a release sem
  token armazenado quando a variável do repositório PYPI_PUBLISH for true; até o publisher
  ser registrado no PyPI ele não roda, e a instalação continua pip install git+…@<tag>.
• Badges vivos. O README mostra o estado do CI, a última release e a nota do Scorecard.

v2.6.3

[2.6.3] — 2026-09-24

Changed

• The site is published by a workflow. A Pages workflow deploys docs/ on every push to
  main (and on demand), with actions pinned to commits and write access to Pages only in the
  deploy job. The legacy branch builder did not run for three consecutive releases.
• A release reaches main only after its checks pass. The commit goes up on a release
  branch, the three required checks run on its pull request, and main then moves to that same
  commit — the protection rules now apply to administrators too.

---

[2.6.3] — 2026-09-24

Alterado

• O site é publicado por um workflow. Um workflow Pages publica docs/ a cada push na
  main (e sob demanda), com actions fixadas por commit e escrita no Pages só no job de deploy. O
  builder legado por branch não rodou em três releases seguidas.
• Uma release só chega à main depois que os checks passam. O commit sobe numa branch de
  release, os três checks obrigatórios rodam no pull request dela, e a main avança para esse
  mesmo commit — as regras de proteção agora valem também para administradores.

v2.6.2

[2.6.2] — 2026-09-24

Fixed

• operator-kit 1.6.2 — installing it no longer silences an existing AGENTS.md. When a project
  has both files, Claude Code reads only CLAUDE.md. claude_md_from_profile.py now writes
  @AGENTS.md into a CLAUDE.md it creates next to an existing AGENTS.md, and warns (without
  touching the file) when an existing CLAUDE.md does not import it.

---

[2.6.2] — 2026-09-24

Corrigido

• operator-kit 1.6.2 — instalá-lo não silencia mais um AGENTS.md existente. Quando um projeto
  tem os dois arquivos, o Claude Code lê só o CLAUDE.md. O claude_md_from_profile.py agora
  escreve @AGENTS.md num CLAUDE.md que ele cria ao lado de um AGENTS.md existente, e avisa (sem
  mexer no arquivo) quando um CLAUDE.md existente não o importa.

v2.6.1

[2.6.1] — 2026-09-24

Closes what the 2.6.0 reviews left open. No new instrument.

Added

• lane-kit 1.4.1 — a competition can lose a candidate. lane_board.py withdraw --task <T> --item <X>
  records why a candidate left (its lane died, the attempt was abandoned); the withdrawn item stops
  counting for readiness and selection, its lane is owed the news like a loser, and render and
  status <task> show it. Before this, one dead lane left the task undecidable and every other
  candidate unmergeable.
• A product test runs the lane board self-test with the core importable, so the branch that
  verifies an hpp evidence record is exercised in CI, not only on a developer machine.

Fixed

• continuity-kit 1.4.1: an evidence record is recognised by its file name wherever --out put
  it and with Windows separators; the templates call lane-kit's board through a {{lane_board}}
  placeholder instead of a path that resolved inside continuity-kit.
• dev-squad-kit 1.1.1: *evidence-check maps a failed recorded run to FAIL and every other
  non-pass to CONCERNS; --out for QA's own record is stated as relative and inside the workspace.
• gotcha-memory 1.0.3: the offline relabel loop checks the decider's exit code and writes no
  record for a failed call.
• operator-kit 1.6.1: rules no longer point at protocols the kit does not ship; the report
  builder reads the style keys it defines; an example path is neutral.
• The site generator and the tests agree on the pages they check, and the release links in this
  file are complete ([2.1.0] points at the release that first shipped it).

---

[2.6.1] — 2026-09-24

Fecha o que as revisões da 2.6.0 deixaram aberto. Nenhum instrumento novo.

Adicionado

• lane-kit 1.4.1 — uma competição pode perder um candidato. lane_board.py withdraw --task <T> --item <X>
  registra por que um candidato saiu (a lane morreu, a tentativa foi abandonada); o item retirado
  deixa de contar para prontidão e seleção, a lane dele recebe o aviso como um perdedor, e o
  render e o status <task> mostram isso. Antes, uma lane morta deixava a tarefa sem decisão e
  todo outro candidato sem merge.
• Um teste do produto roda o self-test do lane board com o núcleo importável, então o ramo que
  verifica um registro do hpp evidence é exercitado no CI, e não só na máquina de quem desenvolve.

Corrigido

• continuity-kit 1.4.1: um registro de evidência é reconhecido pelo nome do arquivo onde quer
  que o --out o tenha posto e com separadores do Windows; os templates chamam o board do lane-kit
  por um placeholder {{lane_board}} em vez de um caminho que caía dentro do continuity-kit.
• dev-squad-kit 1.1.1: o *evidence-check mapeia execução registrada que falhou para FAIL e
  todo outro não-passou para CONCERNS; o --out do registro próprio do QA é declarado relativo e
  dentro do workspace.
• gotcha-memory 1.0.3: o loop offline de reclassificação confere o exit code do decisor e não
  grava registro para uma chamada que falhou.
• operator-kit 1.6.1: as regras não apontam mais para protocolos que o kit não distribui; o
  construtor de relatório lê as chaves de estilo que ele mesmo define; um caminho de exemplo ficou
  neutro.
• O gerador do site e os testes concordam sobre as páginas que conferem, e os links de release
  deste arquivo estão completos ([2.1.0] aponta para a release que o trouxe primeiro).

v2.6.0

[2.6.0] — 2026-09-24

Four instruments that turn a claim into something a checker can re-derive — evidence bundles, a
retrieval ruler, a citation check and typed decisions — and the modules that use them.

Added

• Typed decisions, as evidence — the harness still calls no model. hpp decide validate checks
  an hpp.decision/v1 record made outside the harness (by a rule, a person, a local model or a
  hosted typed-decision model) and prints the value a consumer may act on; hpp decide eval
  measures any decider you name as a command, against labelled cases. Three rules carry it: a
  record is always advisory; with raise-only it may raise a declared value on the question's
  ordered options and never lower it; abstention and instrument-failure are outcomes that change
  nothing. A model record must name the pinned version that answered (aliases such as -latest are
  refused) and the hash of the raw response; the judged text never enters the record, and
  secret-like text is refused before it is hashed. The report separates coverage, selective
  accuracy, confident errors, correct and missed abstentions and instrument failures, publishes a
  coverage curve across floors when confidences exist, and computes Brier only from probabilities —
  a decider that never decides is reported as no sample, never as 0%, and the reason says how many
  cases abstained and how many failed. Version 1 measures choice questions only; numeric answers
  are refused rather than scored against a label they cannot equal.
• hpp init --decision-advisor off|typesafe|openrouter|compatible. The installer can record an
  optional advisor you declared and print how to integrate it: where YOUR key goes (your shell —
  hpp reads and writes none), how to measure it against a lexical baseline first, and how to check
  one decision. off is the default and leaves profiles recorded before this option unchanged.
• examples/typed-decisions/ — a lexical baseline, a small synthetic suite (one clear case per
  failure family, ambiguous cases that must abstain, an injection attempt, shell text with curl,
  Portuguese messages) and a stdlib HTTP adapter for a typed-decision endpoint that makes one
  attempt, keeps the raw response on disk, and maps timeouts, HTTP errors and non-JSON answers to
  instrument-failure. It refuses redirects (the key reaches one host only), sends a key only over
  https or to loopback, caps the response at 1 MiB, and with --declared writes a raise-only
  record. It is an example, not a module: it sends text off the machine only when a person runs it,
  and hpp policy check now classifies running it as MANUAL (rule decision-advisor).
• Evidence bundles — an end-to-end check whose verdict can be re-derived later; the harness still
  drives no browser and calls no model. hpp evidence run --id <name> --artifact <glob> -- <command>
  runs the criterion you declare (an end-to-end spec, a test suite, any script) with shell=False
  in its own process group, measures its exit code outside the model, hashes every file each
  declared glob matches, and writes an hpp.evidence/v1 record under .hpp/evidence/ by exclusive
  create, so no record is ever overwritten. Three rules carry it: the bundle passes only when the
  command exited 0 and every declared pattern matched a file this run wrote — a screenshot that
  was never written, or one left from an earlier run (listed as unchanged), is not evidence; the record keeps the byte count and sha256 of stdout and stderr, never the text, and
  no absolute path; a secret-like command line, a path outside the workspace, a bad id, a
  non-positive timeout and --record-event without an --artifact are refused before anything
  runs. run exits 0 passed, 1 not passed (failed, missing-artifacts, timeout,
  could-not-start) and 2 refused or event not appended; a timeout stops the whole process tree,
  not only the direct child, and --record-event appends evidence_recorded to the event log only
  when the bundle passed. hpp evidence verify <record> re-derives the record from disk: 0 valid
  for an intact record of a passed run, 1 not-evidence for an intact record of a run that did not
  pass, 2 blocked when the record was edited, contradicts itself, or an artifact changed or went
  missing. The limits are part of the contract: the self-hash makes an edit visible and is not a
  signature — anyone who can write the file can rewrite it — so a checker that must not trust the
  maker re-runs the command instead of relying on verify; run writes files, so a checker that
  must stay read-only re-runs in its own lane or with --out on its own scratch path; and a runner
  that clears its output directory at every start leaves the older record blocked, so artifacts
  that must stay verifiable belong in a per-run directory. examples/evidence/ runs the cycle
  without a browser; --break shows a failing criterion whose artifacts exist and whose verdict is
  still failed.
• Retrieval ruler — hpp retrieval eval measures a retriever apart from the answer built on it.
  The retriever is a command you declare (--retriever-command '<JSON argv>'): it reads
  {"query", "k"} as JSON on stdin and prints ranked ids, best first. The ruler scores the top k of
  each answer against the ids an hpp.retrieval-suite/v1 suite labels relevant and writes an
  hpp.retrieval-eval/v1 report with hit@k, recall@k, precision@k, MRR and nDCG@k. Three rules
  carry it: a retriever that answers and finds nothing relevant is a measured 0, while a timeout, a
  crash, a non-zero exit, output that is not JSON or a duplicate id is an instrument-failure,
  counted apart and never scored; means run over measured cases only, and with none measured they
  are null and the gate says why, never 0%; the printed order is the ranking, and a score is
  checked but never used to re-sort, because a distance and a similarity sort in opposite
  directions. The gate passes when at least one case was measured, instrument failures are at most
  --max-failures (default 0) and mean recall@k is at least --min-recall (default 0.8): exit 0
  passed, 1 failed, 2 refused input. Without --retriever-command it replays the results each case
  recorded; with it, every case runs with shell=False and a timeout (--timeout, default 10 s).
  Limits: relevance is binary per id, and nothing here judges the answer generated from what was
  retrieved. examples/retrieval/ — seven synthetic questions over ten articles and a keyword
  baseline written beside them — proves the ruler works, not any retriever's quality: the baseline
  reaches a mean recall@3 of 0.786 and the default gate fails with exit 1.
• Citation check — hpp cite check turns a claim bigger than its proof into an exit code. It
  reads an answer (--text) and the context it was written from (--context: a JSON list of
  {"id", "text"} items, or of bare ids) and checks every citation marker against the context ids,
  deterministically and without a model. The marker is [ID:<id>] unless --marker gives a regex
  with exactly one capture group. Block, exit 2: UNKNOWN_ID (a source the answer was never given),
  RANGE (one marker naming a range or a list, such as 1-3 or 1,2), EMPTY_MARKER. Warn,
  exit 1: TOO_MANY (more than --max-per-sentence markers in one sentence, default 4) and
  UNCITED_CLAIM (a sentence with a number, a percentage, a currency amount or a date and no
  marker). Exit 0 is clean. Context the answer never cites is published as a count, not a finding;
  empty text, text that is only code, secret-like text or context and an unusable marker regex are
  refused with exit 2 before any report exists. The hpp.citation-check/v1 report carries the
  sha256 of the text and of the context. Limits: it never reads a cited source — a marker that
  resolves proves the id exists, not that the source supports the sentence; the sentence splitter
  and the number detector are heuristics whose known false positives and negatives are written out
  in hpp/citations.py, and all of them are warnings, never blocks. examples/citations/ ships an
  answer that checks clean: 7 sentences, 5 markers, 4 of the 5 context ids cited.
• lane-kit 1.4.0: best-of-N between lanes, with lane_board.py compete and select.
  compete --task <T> --items A,B[,C...] declares claimed items, each from a different builder
  lane, as candidates for one task; select --task <T> --winner <item> [--reason "..."] records the
  winner, and only when every candidate is CHECKPOINT-READY with evidence (or VERIFIED) and the
  reviewer differs from every builder in lane and in model family. The losers get a terminal
  NOT-SELECTED that set can never write and that never reaches MERGED; no candidate can be
  MERGED before its task has a winner, and the winner still needs its ordinary VERIFIED first.
  select --checker-unavailable records DEFERRED for the task, never a winner. Choosing 1 of N is
  pass@N, not reliability: the winner still has to earn pass^k.
  set <item> CHECKPOINT-READY --evidence-record .hpp/evidence/<id>-<UTC>.json attaches a run
  recorded by hpp evidence run instead of pasted text, accepted only when the HPP core verifies
  it valid; without the core importable the flag exits 2 and writes nothing.

Changed

• Every command hpp runs for you has a timeout that bounds it. hpp evidence run,
  hpp retrieval eval and hpp decide eval run the declared command through one runner
  (hpp/_process.py), which stops the whole process tree on timeout, not only the direct child. A
  test runner that started a browser, or a retriever that started a helper, can no longer hold the
  wait open past the timeout by keeping the pipes.
• operator-kit 1.6.0. goal_ledger.py --readiness <goal> R2 accepts an hpp evidence record
  as evidence onl...

v2.5.8

[2.5.8] — 2026-09-23

The repository became public, and this release answers the question a public repository has to
answer: what someone — or the agent working for them — does after finding it. It also settles a
contradiction the project was shipping, where four pages opened with artwork the brand document
beside them forbids.

Added

• INSTALL_FOR_AGENTS.md, with its Portuguese pair — an install guide written for the agent
  rather than for the reader. It identifies the host, checks the preconditions instead of assuming
  them, and requires the agent to read hpp init's plan aloud before a single file is written. An
  installer that writes before you read is the failure this harness exists to prevent; installing
  it by violating it would be the worst possible first impression. A test ties its pinned command
  to the README's and to the package version, because a fourth place that teaches installation is
  the place that rots.
• The wizard names the documentation it ships. Measured before the change: CATALOG appeared
  zero times in the CLI and docs/ zero times, while hpp doctor appeared eleven — so the ruler
  could see the file and the pointer simply was not there. Whoever installed the harness finished
  at "Welcome to the party" without learning four pages of manual existed.
• The lane board in the README, as a terminal SVG, produced by driving the real state machine
  rather than by drawing a picture of one, so the image cannot drift from the behaviour.
• workflow_dispatch on the release workflow. GitHub emits no tag event when a single push
  carries more than three tags; four releases were lost that way and recovered by hand. The
  trigger demands the tag as an input, so a manual run can never publish whatever sits on the
  branch, and every gate still applies.

Changed

• The brand is one brand. The four HTML pages opened with a mark drawn a day before the
  approved lockup, while BRAND.md states of that lockup: "do not redraw, recolour or crop". The
  pages were publishing artwork the document beside them forbids. They now open with the approved
  lockup resized to 1440 px — a resize is none of the three — and the earlier vectors carry a
  tombstone naming their successor instead of being deleted.
• The repository belongs to an organization. A user account cannot have a second
  administrator: measured against this repository, admin, maintain and triage were all
  refused and write was the ceiling. Every URL was rewritten at the source.

Fixed

• The publication gate stopped reproving a tool cache. .pytest_cache, .ruff_cache and
  .mypy_cache leave the linter's universe; __pycache__ deliberately stays in it, because
  bytecode inside an emitted kit is a packaging defect, while a pytest node id that happens to
  contain secret.pem is a test name. The self-test now demands silence inside all three and
  noise for the same bytes outside them — either half alone would pass with the detector broken.

---

[2.5.8] — 2026-09-23

O repositório ficou público, e esta versão responde à pergunta que um repositório público precisa
responder: o que alguém — ou o agente que trabalha para ele — faz depois de encontrá-lo. Ela
também encerra uma contradição que o projeto vinha publicando, em que quatro páginas abriam com
uma arte que o documento de marca ao lado delas veta.

Adicionado

• INSTALL_FOR_AGENTS.md, com o par em português — um guia de instalação escrito para o
  agente, não para o leitor. Ele identifica o host, confere os pré-requisitos em vez de presumi-los
  e obriga o agente a ler em voz alta o plano do hpp init antes de um único arquivo ser escrito.
  Um instalador que escreve antes de você ler é a falha que este harness existe para impedir;
  instalá-lo violando-o seria a pior primeira impressão possível. Um teste amarra o comando pinado
  dele ao do README e à versão do pacote, porque um quarto lugar que ensina a instalar é o lugar
  que apodrece.
• O wizard nomeia a documentação que embarca. Medido antes da mudança: CATALOG aparecia zero
  vezes na CLI e docs/ zero vezes, enquanto hpp doctor aparecia onze — ou seja, a régua via o
  arquivo e o ponteiro é que não existia. Quem instalava terminava em "Welcome to the party" sem
  saber que existiam quatro páginas de manual.
• O lane board no README, como SVG de terminal, produzido dirigindo a máquina de estados de
  verdade em vez de desenhar uma figura dela, para que a imagem não possa divergir do
  comportamento.
• workflow_dispatch no workflow de release. O GitHub não emite evento de tag quando um push
  carrega mais de três; quatro releases se perderam assim e foram recuperadas à mão. O gatilho
  exige a tag como entrada, então uma execução manual nunca publica o que estiver na branch, e
  todos os portões continuam valendo.

Alterado

• A marca virou uma marca. As quatro páginas HTML abriam com um símbolo desenhado um dia antes
  do lockup aprovado, enquanto o BRAND.md diz desse lockup: "do not redraw, recolour or crop".
  As páginas publicavam arte que o documento ao lado delas veta. Agora abrem com o lockup aprovado
  redimensionado para 1440 px — redimensionar não é nenhum dos três — e os vetores anteriores
  carregam lápide com o sucessor nomeado, em vez de serem apagados.
• O repositório pertence a uma organização. Conta de usuário não aceita segundo administrador:
  medido neste repositório, admin, maintain e triage foram os três recusados, e write era o
  teto. Todas as URLs foram reescritas na fonte.

Corrigido

• O gate de publicação parou de reprovar cache de ferramenta. .pytest_cache, .ruff_cache e
  .mypy_cache saem do universo do linter; __pycache__ fica nele de propósito, porque bytecode
  dentro de um kit emitido é defeito de empacotamento, enquanto um node id do pytest que por acaso
  contém secret.pem é nome de teste. O self-test agora exige silêncio dentro dos três e ruído
  para os mesmos bytes fora deles — qualquer das metades sozinha passaria com o detector quebrado.