[dinakarjs]

Why

#260 exposed a hash-lock/input mismatch that green tests did not detect: the installed Cedar version differed from the editable package requirement. The maintainer adopted the regenerated locks and requested the consistency gate as a separate PR.

Change

Run python -m pip check immediately after the no-deps editable package installation in each of CI's three environments and each corresponding release-validation job. The existing credential-free release mirror stays identical except for its established coverage/OIDC exceptions. No dependency pins, runtime code, permissions or publishing triggers change.

Validation

Exact baseline 806d114, Linux/Python 3.12.14, fresh hash-locked dev environment and no-deps editable install:

• pip check passes.
• Unit suite: 790 passed, 2 hardware skips.
• Release-artifact selection: 23 passed, including test_release_validation_matches_ci.
• Ruff, mypy for both packages, configured Bandit and git diff --check pass.
• Published tree 53765c68af4d5dad1e77eef467b3636b08108b9e matches the locally validated tree.

CI and release-validation are changed together because changing CI alone breaks the existing parity test. Hosted Windows/Python matrix and independent maintainer review remain required. No live release or hardware test was performed. Prepared with Codex.

References: #260 maintainer disposition; CONTRIBUTING.md Release validation; tests/unit/test_release_artifacts.py::test_release_validation_matches_ci.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Hosted failure diagnosis: the added pip-check step passes. The security scan then fails on the existing certifi 2026.7.22 lock (PYSEC-2026-4320; fixed version 2026.10.19), causing matrix siblings to cancel. Separate PR #265 updates only the four affected certifi lock entries and clears pip-audit locally, with 843 unit/conformance tests passing and 2 hardware skips. This PR still contains only the CI/release-parity check. It needs the dependency fix incorporated through the normal maintainer flow and a fresh complete hosted run; current cancelled checks are not passes.

[carloshvp]

Reviewed exact head f49f7ba29ae2399253a440b199ba4cd77b052ead in an isolated checkout.

Approving the dependency consistency gates. Each of CI's three environments now runs python -m pip check immediately after the no-deps editable installation, and the same three checks are included in release validation. This preserves the credential-free release mirror and its existing coverage/OIDC exceptions.

Independent validation in this exact checkout with a fresh hash-locked environment: editable installation and pip check pass; all 23 release-artifact tests pass, including the CI/release parity assertion. I inspected all six insertion points and the complete whitespace-clean diff. No runtime code, pins, workflow grants or publishing triggers change.

The failed hosted job reports the inherited certifi audit finding after the added consistency check; the cancelled jobs remain unvalidated. #265 is the separate certifi repair, and the newly reported OpenTelemetry audit finding also needs its own dependency follow-up. The commit carries DCO sign-off.

Reviewed with OpenAI Codex.