Code Analysis Python Explicit Imports

Python explicit import call validation

Validated 2026-11-07 under explicit maintainer instruction. Draft #1252 extends fixed Draft #1250, preserving the parent's team contribution history. It is not merged or a release.

The baseline already supports module-level from module import handler as run. The observed remaining gap was an explicit function-local import followed by a direct call. The candidate reuses the lexical event scanner and existing direct-definition resolver, accepting only a unique unconditional import before a call in the same function block. Parameters and other binding events prevent a target; unsupported targets stay unknown.

Fixed evidence

• Baseline: 764a53907f8c5209280f100a4901bd457dd982e0.
• Source-first freeze: 7428fa2e36335f27c02d5d86a49663db7236efe4 before analyzer execution. Manifest records source hashes, exact calls/imports/definitions and reasonable unknowns.
• Implementation: 474c9a4f7048c989e0f6aab77a0540076613b383.
• Final source/package tested: 8b1ed343bb335c4d93a5f7bdb7e2ae6746011ffa.
• Review/evidence head: 93378351dc97768fd7e0882a50f32ecc7a34e2a6; compared with the tested revision, it changes no archify/ or ZIP bytes.
• Click 8.1.8: 934813e4d421071a1b3db3973c02fe2721359a6e; Jinja 3.1.6: 15206881c006c79667fe5154fe80c01c65410679. No previous use was found in tracked Code Analysis tuning benchmarks; unrecorded use is not excluded. This is a finite selected study, not a blind holdout.

Full fixed-revision report and reproduction commands · Frozen manifest.

Same ten selected calls	Correct targets	Wrong targets	Missed expected targets	Omitted calls	Expected explicit unknowns
Fixed #1250	2	0	3	0	5
Candidate source	5	0	0	0	5
Extracted ZIP	5	0	0	0	5

Three recovered calls: Click termui.py:280 → _termui_impl.py:362 pager, termui.py:709 → _termui_impl.py:611 open_url; Jinja environment.py:942 → debug.py:14 rewrite_traceback_stack. Their explicit imports are at 278, 707 and 940. The baseline's two successful module-level targets remain correct. Five unknowns remain: Click's global callback cache, platform-dependent decorated alias and builtin; Jinja's parameter/conditional callback and member dispatch. Exact coordinates and valid target navigation are checked in the per-unit receipts.

Real positive alias coverage is absent from this selected sample. Synthetic regression cases cover from helper import handler as run, direct imports, same-line imports, same-name parameters, rebinding/later writes, use-before-import, conditional imports, guarded calls, closure/header and class/method boundaries. They are not counted as real-project target successes. Eight other targets were source-checked after the candidate diff and remain outside the frozen score.

Validation and failures

• Baseline/source/ZIP: 9 normal CLI invocations each, 27 total, all exit 0; no project code executes. Candidate source/ZIP raw facts match byte-for-byte for both projects. Seven saved questions match after only raw-facts and installed-workflow path normalization. Exact CLI arguments/exits agree after entrypoint/output-path normalization.
• All 156 packaged Code Analysis files match source bytes; 15 Python call tests pass directly from the final extracted package. Forty-nine focused source tests pass.
• Final full module suite: 343 pass / 1 fail / 0 skipped. ts-snapshot.test.mjs:89 fails with Missing expected exception at both baseline and candidate; cause remains unestablished. Initial revision-stale task fixtures and a wrong expected test line were repaired; their failure logs are retained.
• First ZIP file audit found 13 stale task-fixture files because the archive preceded fixture regeneration. That archive was rejected and replaced; its old SHA-256 and local artifacts are identified in the report. The final ZIP was rebuilt and the source/ZIP CLI matrix rerun.
• Final ZIP SHA-256: 1248b19f0b283d0effe91ac8446244db702e287c7064eb8f4e1947643c5ca499; two canonical builds are byte-identical. Build: official Node 22.23.2 / zlib 1.3.1-e00f703. Runtime: Node 22.23.3 / Python 3.13.16. Eight npm advisories were reported; dependencies were not changed.
• Per-unit source results, packaging parity, retained full-suite failure.

No new browser/Windows/runtime-project execution evidence, general Python accuracy, runtime dispatch claim or downstream Agent benefit is established. Global/nonlocal, closure imports, class-local imports, conditional/repeated imports, parameter collisions, other writes, decorated/duplicate/reexported targets and dynamic/member calls remain unknown. Remote CI is tracked on the Draft and remains separate from these local results; human review is pending.