[argszero]

Summary

MANIFEST.in pointed its recursive-include at harness2/third_party, a path that has
never existed — the tracked overlay tree is at the repository root — so setuptools
silently shipped no third_party/ files in the sdist, and dependencies/ASSETS.json was
never listed. The resulting archive omitted all 47 assets that
dependencies/ASSETS.json hashes, every one of which lives under third_party/.

Both consequences were measured on the artifact built from 1cfe254:

• find third_party -type f | wc -l inside the unpacked sdist printed 0.
• python3 scripts/check_provenance.py, run inside the sdist that ships it, exited 1 with
  Provenance check failed: [Errno 2] No such file or directory: '.../dependencies/ASSETS.json'.

Two lines of MANIFEST.in plus a regression test. No package code changes.
docs/SETUP.md's "Wheel installations" section stays true — a wheel still ships the
package only; this makes the sdist a complete source tree, which is what a conda
feedstock or pip install --no-binary :all: builds from (context: #106).

Changes

• MANIFEST.in: recursive-include third_party * (was harness2/third_party), and
  dependencies/ASSETS.json added to the existing include line.
• tests/test_packaging.py: asserts that every recursive-include root exists, that every
  path hashed by dependencies/ASSETS.json is present in the tree and selected by the
  manifest, and that the manifest itself ships. Hermetic — it reads two files and builds
  nothing.

Related Issue

Closes #144. Context: #106.

Tests

• Existing tests pass
• New tests added

python3 -m unittest discover -s tests -v → 8 tests, OK (5 existing + 3 new).

The new tests fail against upstream/main's manifest (3 failures, the first naming
harness2/third_party) and pass with this change, so they bite rather than merely
accompany it.

End-to-end after the fix:

$ uv build --sdist && tar xzf dist/harness2-0.1.0.tar.gz && cd harness2-0.1.0
$ find third_party -type f | wc -l
48
$ python3 scripts/check_provenance.py
PASS: 47 release asset checksums    # exit 0

The sdist grows by about 388 KB, the size of third_party/.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.