chore: promote qualified ECN SDK candidate

[kazazes]

Promotion record

• authoritative candidate: cf370baaef273b4f00d6dde74e3b2a7f401307a7
• public candidate commit: 4751e64c2f37f068576ec8081fb53c5010571722
• exported files: 512
• withheld internal files: 26
• export tree SHA-256: c4d42b1f0234c75be091839d4cb57b65c3acdc180af8d1e2c5eabc091811a165

Changes

• bootstrap the clean curated public distribution as one byte-preserving export
• repair clean-export exact-release verification in the authoritative upstream
• retain the canonical post-cutover PyPI installation path and verified local/offline paths
• serialize exact-release stages on the hosted fallback runner while retaining four-way execution on the qualified private runner

Evidence

• staged public checkout re-verified byte-for-byte against the authoritative export record after Git initialization
• exported Ruff and mypy gates pass (67 typed source files)
• current SHA-bound hosted exact-artifact qualification is running
• no downstream repair or transformation was applied

Publication and repository visibility remain disabled for this candidate merge.

Summary by CodeRabbit

• Documentation

  • Updated installation guidance to use the SDK release from public PyPI.
  • Clarified references to local wheels, offline wheelhouses, and platform documentation.

• Bug Fixes

  • Improved release report cleanup by safely creating missing report directories.
  • Enhanced reliability of release validation workflows.

• Chores

  • Pinned the packaging tool dependency to version 26.3 for release checks and dry-run workflows.
  • Adjusted validation workflow workers based on runner availability.
  • Added coverage for release checks and report directory handling.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change updates public SDK installation instructions, pins packaging==26.3 for public-export targets, safely creates missing report directories, and adjusts verification worker counts by runner type. Release tests cover the export commands and report reset behavior.

Changes

Release validation

Layer / File(s)	Summary
Public-export validation Makefile, scripts/verify_release.py, tests/release/test_release_checks.py	Public-export targets use packaging==26.3. Release verification loads the public-export module dynamically. Tests verify the commands and arguments.
Generated-report reset scripts/verify_release.py, tests/release/test_release_checks.py	Report reset validates missing report paths, creates required directories, rejects unsafe paths, and reports creation failures. Tests verify the reset behavior.
Verification runner selection .github/workflows/release.yml, .github/workflows/verify.yml	Workflows use four workers when HEAVY_RUNNER is configured and one worker otherwise.

Installation guidance

Layer / File(s)	Summary
Public SDK installation README.md, docs/index.md	Installation guidance directs readers to install picogrid-ecn-client==0.1.0 from public PyPI and references local-wheel, offline-wheelhouse, and platform documentation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• picogrid/ECN-SDK#55: Modifies the same public-export dependency handling.
• picogrid/ecn-sdk-python-internal#99: Modifies the same Make targets, report-reset logic, and release tests.
• picogrid/ecn-sdk-python-internal#104: Modifies VERIFY_RELEASE_JOBS in the same workflows.

Suggested reviewers: audeberc

Poem

A rabbit checks each export gate,
packaging pins the proper state.
Report paths appear when needed,
Public install steps are clearly heeded.
Hop, hop—the release is ready!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: promoting the qualified ECN SDK candidate.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/promote-qualified-candidate

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 44-49: Update the virtual-environment setup command in the README
to invoke an explicitly supported Python executable, such as python3.14, instead
of the ambiguous python command; leave the activation and package installation
commands unchanged.
- Line 49: Update the README installation example to retain the local-wheel
installation path while PyPI publication is disabled; remove or replace the
`picogrid-ecn-client==0.1.0` pip command so users are not directed to an
unavailable package version.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 58a130dc-d90a-42c9-8753-f6810fdfc6f2

📥 Commits

Reviewing files that changed from the base of the PR and between 5db03c7 and ab03241.

📒 Files selected for processing (5)

• Makefile
• README.md
• docs/index.md
• scripts/verify_release.py
• tests/release/test_release_checks.py

📜 Review details

⏰ Context from checks skipped due to timeout. (8)

• GitHub Check: Semgrep
• GitHub Check: Analyze python
• GitHub Check: Analyze javascript-typescript
• GitHub Check: Documentation links, language, and browser accessibility
• GitHub Check: Python 3.11 source suite
• GitHub Check: Python 3.14 source suite
• GitHub Check: Python 3.12 source suite
• GitHub Check: Python 3.13 source suite

🧰 Additional context used

🪛 ast-grep (0.45.1)

tests/release/test_release_checks.py

[error] 1186-1192: Command coming from incoming request
Context: subprocess.run(
["make", "--dry-run", target, "UV=uv"],
cwd=repository,
check=True,
capture_output=True,
text=True,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(subprocess-from-request)

🔇 Additional comments (5)

Makefile (1)

45-52: LGTM!

tests/release/test_release_checks.py (2)

1180-1197: LGTM!

---

2491-2508: LGTM!

docs/index.md (1)

38-38: LGTM!

scripts/verify_release.py (1)

527-533: LGTM!