P1: Add Python file-length and function-metrics parity

[tomdps]

Parent

Tracking parent #291; epic #243. This is one vertical implementation slice.

Goal

Add first-class Python equivalents of typescript.file-length and typescript.function-metrics over the exact validation after-state, with stable Python metric semantics, canonical project/interpreter provenance, configurable thresholds, and no source/environment mutation.

Dependencies

• P0 — Make Python syntax validation compiler-truthful #244 compiler-truth syntax
• P0 — Resolve Python projects, interpreters, environments, and tools canonically #246 canonical Python project/interpreter context
• Hypothetical (validate pre-write) evaluation must be comprehensive — graph-backed checks are silently skipped #197 exact hypothetical file-view/graph lifecycle
• fix(python): make ruff and pytest toolchain status honest #211 accepted optional-tool tranche

Required behavior

1. Register python.file-length and python.function-metrics as Python-owned checks with manifests, check ids, package exports, validation-policy composition, CLI/ASP/status/metrics projection, fixtures, docs, and packed contents updated together.
2. python.file-length reads only ValidationFileView after-state .py/.pyi inputs, uses the shared physical-line contract, preserves explicit/changed/staged/all/overlay behavior, and emits deterministic ranged/provenanced findings at the configured maximum.
3. python.function-metrics analyzes .py executable definitions with the exact interpreter selected by P0 — Resolve Python projects, interpreters, environments, and tools canonically #246 through one versioned, isolated, machine-readable AST metrics protocol. It covers module/nested functions, async functions, methods, properties, and lambdas where the AST has a complete source span; .pyi function metrics are explicitly not_applicable, not silently passed.
4. Define and test stable metric semantics: physical source span; parameter count including positional-only, positional-or-keyword, keyword-only, *args, and **kwargs; cyclomatic base 1 plus Python branch/boolean/conditional/comprehension/match/exception constructs; nested definitions do not add complexity to the enclosing function.
5. Group execution by canonical Python project context and bind interpreter argv/version, project key/fingerprint, protocol version, exact input paths/content hashes, limits, duration/outcome, and normalized diagnostics. No ambient interpreter fallback, parser library, venv/config/cache mutation, install, or network.
6. Use checked-in positive integer defaults aligned with the current TypeScript thresholds unless evidence justifies a Python-specific value. Parse Python-specific overrides through packages/validation-policy; invalid, zero, negative, fractional, duplicate, or unknown settings fail config validation.
7. Bound files, aggregate bytes, protocol output, process tree, timeout, and cleanup consistently with existing Python compiler/checker runners. Malformed/partial/version-mismatched output, syntax rejection, timeout, signal, crash, extra paths, or missing project evidence is typed non-pass, never zero findings.
8. Preserve diagnostic source ranges, codes, category/severity, metric/observed/allowed values, and fine-grained run outcomes through contracts, sorting/fingerprints, reports, ASP mapping, and installed receipts.

Acceptance criteria

• File length covers empty, one-line, LF/CRLF/final-newline, exact threshold, one-over, .py, .pyi, created/updated/deleted overlay, and all supported scopes.
• Function metrics cover sync/async/nested/method/property/lambda, decorators, multiline signatures, positional-only/keyword-only/variadic params, if/elif, loops, try/except, boolean chains, conditional expressions, comprehensions, match, nested-definition exclusion, exact/one-over thresholds, and syntax-invalid input.
• Root/nested/multi-project contexts use the correct selected interpreter and remain deterministic when two projects use different Python versions.
• Missing interpreter, malformed protocol, timeout, crash/signal, output cap, path escape, duplicate/missing result, and cleanup failure produce exact non-pass outcomes with no source/config/lock/environment/cache changes or orphan process.
• Check registry, default/explicit policy, scan/status/measure/ASP, deterministic fingerprints, and packed public install expose identical check/outcome/provenance facts.
• TypeScript/Rust behavior is unchanged and no readiness/parity wording is added.

Observable outcomes

• Clean success carries positive interpreter/protocol/project evidence; zero diagnostics alone is not proof.
• Findings identify the exact file/function and observed/allowed metric.
• Disabled/not-applicable/tool-unavailable/invalid/timeout/crash/resource states remain distinct.

Non-goals

• Ruff complexity as a hidden substitute
• dead-code or import-policy changes
• semantic inspect/edit
• automatic refactoring or threshold tuning
• public Python readiness claims

Verification

Run focused behavior first, then repository proof:

• npm run build
• focused validation-python metrics/file-length, policy, contracts/schema, reporting, ASP, and installed-bin tests
• npm run lint
• npm run pack:check
• configured zeroshot cmdproof prove opcore-ci

Attach exact interpreter/protocol/config/argv/cwd/source hashes, normalized result examples, process cleanup, before/after repository cleanliness, and packed-install evidence.

Execution rule

Implement only after a JIT review against current dev. Keep exactly one implementation run active. PR base is dev; require green checks, clean scoped diff, merged PR, closed child, #291/#243 checklist update, focused reproductions, and opcore-ci proof before advancing. Do not claim Python readiness/parity, ASP authority, old-tool replacement, security/SAST, all-stack support, automatic fixes, or a blended score.