P0 — Harden Python type checking and configuration semantics

[tomdps]

Parent

EPIC #243. Tracking parent only: implementation was delivered sequentially by #256 and #257.

Goal

Make python.types one production, fail-closed authority per canonical Python project. A project runs configured/explicit mypy or Pyright over the exact after-state; it never runs both, guesses brand precedence, abandons a configured-but-missing authority, parses undocumented prose, or reports zero diagnostics without execution evidence.

Accepted prerequisites

• P0 — Resolve Python projects, interpreters, environments, and tools canonically #246 — canonical project/interpreter/config/tool context (complete)
• fix(python): share import resolution between validation and graph #209 — canonical Python import/source closure (complete)
• Hypothetical (validate pre-write) evaluation must be comprehensive — graph-backed checks are silently skipped #197 — exact overlay/file-view graph state accepted in PR feat: Hypothetical (validate pre-write) evaluation must be comprehensive — graph-backed checks are silently skipped #276, merged to dev as 9b2e740923b1023db45589ed19c25bde44d8939d

#197 established one disposable exact graph session per before/after ValidationFileView, complete-universe refusal, fail-closed exact graph errors, and shared graph-core Python import materialization. Both type-authority implementation slices are now merged into dev.

Delivery graph

• P0: Make mypy the exact authoritative Python type gate #256 — authority algorithm, shared capability receipt/materializer, documented mypy JSON, exact cleanup and packed proof
• P0: Complete the authoritative Python type gate with Pyright #257 — documented Pyright JSON, recursive config/execution environments, mixed-project completion, and parent closure

Strict order completed: #197 accepted -> #256 -> #257 -> close #245 -> #211.

Parent contract

1. Exactly one authority is selected per PythonProjectContext.contextFingerprint; config ambiguity is invalid_config, configured missing is tool_unavailable, both available without authority is ambiguous, and no fallback runs.
2. Checker input is one complete ValidationFileView after-state: source/config/plugins/stubs/support files and project semantics match the equivalent on-disk tree.
3. Machine protocols and exits are parsed fail-closed; clean, findings, unavailable, invalid, timeout, unsupported, crash/protocol/tool failure, and disabled states carry per-project execution provenance.
4. Every project result is retained and deterministically aggregated; a failure in one does not erase siblings.
5. Validation never installs/syncs an environment, rewrites config, mutates source/lock/cache/environment files, or leaks temp roots.
6. Real pre-provisioned tools and clean packed public opcore execution are mandatory; shims alone are not completion evidence.

Original acceptance mapping

Capability	Owner	Evidence
Authority algorithm and source-safe capability receipt	#256 defines; #257 completes mixed-provider cases	PR #278 and PR #279
mypy config/plugin/stub/namespace/strict semantics and JSON protocol	#256	PR #278, merged to dev as 40020b0b4ff054551c76ae58b8fe5379fd68aec22
Pyright extends/execution-environment/stub/extra-path semantics and JSON protocol	#257	PR #279, merged to dev as 2d4e920e0b08a989953486b261327ed7496c328b
Exact overlay, manifest fingerprint, no mutation, cleanup, packed proof	both children	PR #278 / #279 focused and installed-artifact evidence
One request with different authorities in different projects	#257	PR #279 mixed-authority regression matrix

Closure evidence

• Both child PRs merged to dev; P0: Make mypy the exact authoritative Python type gate #256 and P0: Complete the authoritative Python type gate with Pyright #257 are closed.
• Focused real mypy and Pyright executions, exact after-state materialization, cleanup, failure mappings, mixed-project aggregation, ASP/product propagation, and packed public install paths passed in the child deliveries.
• Final GitHub check for PR feat(validation-python): complete Pyright authority #279 passed in 20m55s with CodeQL and provenance green.
• Configured opcore-ci proof passed on final P0: Complete the authoritative Python type gate with Pyright #257 head: sha256:33b6a13738283d84ddb33d721835a0943fa92d6a24976945478b0aaf73cd675d.
• No Python readiness/parity, ASP authority, old-tool replacement, security/SAST, all-stack, automatic-fix, or blended-score claim is made. P2 — Ship honest Python readiness, setup, receipts, and cross-platform cutover #251 owns release/readiness evidence.