Constrain release artifact builds

[blisspixel]

What changed

• select uv 0.11.17 and a committed, hash-locked Hatchling build graph
• build the source distribution first and construct the wheel from that exact artifact in CI and release
• require exactly one canonical, tag-matching wheel and source distribution before publication
• add executable constraint, package, and workflow contracts
• align README, roadmap, changelog, release, supply-chain, operational, assurance, traceability, and contributor documentation

Why

The existing reproducibility gate compared two builds inside one newly resolved toolchain window. A later release could resolve different uv or build-backend code without a repository diff, and package smoke validated only the wheel before wildcard attestation and publication.

Impact

Release-shaped builds now have reviewable executable inputs and a linear source-to-sdist-to-wheel-to-seal path. Runtime behavior, CLI, JSON, MCP, cache formats, network scope, and dependencies are unchanged. No target identities, target-owned records, or per-domain rows are included.

Validation

• uv run python scripts/check.py: 5,021 passed, 8 skipped, 90.75% branch coverage
• uv run python scripts/check.py --fast: all deterministic gates passed
• 61 focused build, workflow, traceability, and claim tests passed after independent checker review
• constrained local sdist and wheel reconstruction passed under uv 0.11.17
• uv lock --check and local release readiness passed
• validation spend: $0

[Copilot]

Pull request overview

This PR hardens recon’s release-shaped build pipeline by pinning the build toolchain (uv + Hatchling graph) and enforcing a linear, reviewable sdist→wheel build path with strict artifact-shape validation prior to publication.

Changes:

• Pin uv to 0.11.17 across workflows and add a hash-locked Hatchling backend constraint set (build-constraints.txt) exported from a dedicated PEP 735 build group.
• Update CI/release workflows to build the sdist first, then build the wheel from that exact sdist, and require a canonical tag-matching wheel+sdist pair before publish gates proceed.
• Add/extend tests and documentation to codify the executable/workflow/supply-chain contracts and traceability claims.

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
uv.lock	Adds Hatchling build graph entries and wires hatchling into a dedicated build dev group.
pyproject.toml	Pins hatchling==1.31.0, adds PEP 735 build group, and requires uv==0.11.17.
build-constraints.txt	Introduces committed, hash-locked backend dependency constraints for isolated artifact builds.
.github/workflows/ci.yml	Pins uv and updates reproducible-build job to build sdist then wheel-from-sdist twice under constraints.
.github/workflows/release.yml	Pins uv, builds sdist then wheel-from-sdist under constraints, and tightens package-smoke artifact validation.
.github/workflows/provider-drift.yml	Pins uv to the required version for workflow consistency.
.github/workflows/mutation.yml	Pins uv to the required version for workflow consistency.
tests/test_build_constraints.py	Adds tests enforcing uv version selection, exact build root, constraint completeness/hashes, and workflow uv pinning.
tests/test_package_invariants.py	Builds artifacts using build constraints and asserts the sdist includes build-constraints.txt.
tests/test_release_workflow_contract.py	Updates workflow contract tests for the new constrained sdist→wheel build and sealed artifact-pair checks.
tests/test_check_script.py	Updates CI contract assertions to expect two constrained uv build invocations.
README.md	Documents the constrained release-shaped build behavior and points to supply-chain details.
ROADMAP.md	Notes the new constrained build and sealed artifact pair behavior in the unreleased maintenance narrative.
CHANGELOG.md	Records the supply-chain/build gate changes and the stricter package-smoke artifact validation.
docs/supply-chain.md	Updates deterministic-build and sealed-gate documentation, plus constrained reproduction recipe and constraint regeneration command.
docs/traceability-matrix.md	Updates requirement→gate mapping for constrained builds and sealed artifact-pair validation.
docs/release-process.md	Updates release workflow step descriptions to reflect constrained sdist→wheel reconstruction and artifact validation.
docs/operational-contract.md	Updates operational contract statements around constrained same-job repeatability.
docs/assurance-case.md	Updates assurance mechanisms and residual-risk statement to reflect pinned uv + locked backend graph.
docs/paper-claim-map.md	Updates invariant wording around repeatability evidence to include pinned uv + locked backend graph.
docs/roadmap.md	Updates roadmap table entries to reflect the new build/release artifact constraints.
CONTRIBUTING.md	Documents the repository-wide uv version requirement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.