fix(ci): test every currently supported Python minor

[seonghobae]

Summary

Align the installer-visible Requires-Python >=3.10 contract with permanent first-party CI evidence through the current governed quality-gate ceiling, Python 3.14. The candidate permanent unit matrix covers every current CPython minor from 3.10 through 3.14, and a deterministic repository contract test fails if any minor in that interval is omitted.

This remains a compatibility-evidence candidate only. It does not change runtime behavior, runtime dependencies, package version, or release state. Refs #113, #233, #244, #251, #252.

Exact protected / stack boundary — refreshed 2026-08-29

• protected main remains exact b84f0c94154043a3473939c01bb6471de5a129ae;
• dependency root test(recovery): cover stale evidence registry cleanup #233 remains exact 5951b7a4d779903b8924abaef2a387cae50b7f54;
• head branch is fix/python-support-matrix-b84f0c9;
• exact current head is 332112f14b3e8eef923d2e108086c25099417ac1;
• the current head is 6 commits ahead / 0 behind test(recovery): cover stale evidence registry cleanup #233, with merge base exactly test(recovery): cover stale evidence registry cleanup #233;
• relative to test(recovery): cover stale evidence registry cleanup #233, changed paths are only .github/workflows/ci.yml, tests/test_python_support_contract.py, and tests/test_workflow_contracts.py;
• protected main was never mutated.

Non-destructive merge commit 332112f14b3e8eef923d2e108086c25099417ac1 makes this candidate explicitly descend from #233. Its tree inherits #233's exact recovery-evidence registry regression instead of duplicating or independently editing that dependency. The PR base remains #233's branch, preserving dependency order.

Fresh branch-lifecycle evidence in #316 distinguishes one superseded historical ref from two still-conflicting maintenance refs. agent/bounded-jsonl-result-streaming@64662a4410ff0ff83f150d72fee07b78c4e82d5b is SUPERSEDED_RETAINED for current bounded-streaming source authority because owning Draft #58 is closed/unmerged and merged #172 is its controlled protected-main reconstruction. In contrast, agent/consolidate-maintenance-updates@feda434aa2b086d53cb642ebc3ea8b6cb6bddd74 remains source/workflow/package/container-affecting ACTIVE_WRITER evidence, and automation/ruff-0.16.1-lock@fc742fd24f228764116b4bc03c8d967c5f482526 remains overlapping ACTIVE_WRITER evidence for pyproject.toml / uv.lock. Those classifications do not make either retained branch current implementation authority or prove an actor is executing; they mean their overlapping surfaces must not be declared writer-free until a later fresh reconciliation changes the evidence. Preserve all retained refs without deletion, rename, force-update, destructive rebase, cherry-pick, or evidence transfer. Draft #229 remains the separate canonical-documentation writer and is untouched. Keep this exact #242 head stable; any future source mutation on its CI/package surface must repeat the complete then-current PR/no-PR path-overlap inventory.

RED → candidate repair

• 44bc4d1dc099254e0b12c664e1fa8417788f218a: initial RED contract exposed that advertised support and CI evidence were not mechanically aligned.
• 32465361a011b165aa4a9bcb433e552d224b2c61: refined RED derives the governed support interval from Requires-Python through the explicit Python 3.14 quality/package gate.
• 5e256ccd990012807853ea140589eadc09333407: candidate matrix adds Python 3.11 and 3.13.
• CI 32064156686: all five Python lanes reached tests but exposed the existing three-version assertion in tests/test_workflow_contracts.py.
• 911e975692e4c4a41a92138d22605a601e55bf0f: aligned that workflow assertion with the five-minor matrix.
• CI 32064759073: Python 3.11/3.12/3.13/3.14 and PostgreSQL/container lanes succeeded, but Python 3.10 failed because the new test imported stdlib tomllib, unavailable before Python 3.11.
• 2af2e2a73583e87c92bb05342ebe192511fbe110: narrow test-only repair removes that newer-stdlib dependency and uses a bounded parser for the existing [project] / requires-python setting.

Narrowing Requires-Python to >=3.11 remains rejected because no runtime incompatibility evidence justifies dropping Python 3.10.

Previous-head evidence boundary

On predecessor 2af2e2a73583e87c92bb05342ebe192511fbe110, every permanent unit lane succeeded on Python 3.10, 3.11, 3.12, 3.13, and 3.14; PostgreSQL/container smokes, compile, Ruff, and public-docstring coverage also passed. Aggregate CI then stopped at 99.96% solely on the two protected-main weak-reference callback arcs owned by #233, so downstream lock-freshness/distribution-build steps were skipped. Security, SAST, and Release Acceptance succeeded for that predecessor.

Those predecessor results do not transfer to the new stacked head.

Exact-head validation — repository-local evidence

Recorded workflow inventory for exact unchanged current head 332112f14b3e8eef923d2e108086c25099417ac1 is terminal-success at the repository-local layer:

• CI 32446022965: success;
• Security Scan 32446022989: success;
• SAST Semgrep 32446023019: success;
• Release Acceptance 32446022994: success;
• fresh formal review inventory: none.

The exact CI job materialized successful unit-test lanes for Python 3.10, 3.11, 3.12, 3.13 and 3.14, plus successful PostgreSQL/container smokes and the coverage/docstrings/lint/package job. Each CI job includes the repository's exact-source-head verification step. This recorded evidence is not promoted beyond its actual checkout/governance semantics; absence of formal review is not approval, and no predecessor evidence transfers.

Keep this exact head stable rather than manufacturing churn.

Deterministic contract

tests/test_python_support_contract.py reads authoritative pyproject.toml plus .github/workflows/ci.yml and requires one explicit Requires-Python lower bound, one explicit permanent unit-test matrix, one explicit quality/package Python minor, and a gapless same-major sequence from the installer-visible lower bound through that quality-gate ceiling. tests/test_workflow_contracts.py asserts the same five-minor matrix.

A speculative <3.15 upper bound remains rejected because it would pre-emptively exclude a future interpreter without compatibility evidence. Future CPython admission remains an explicit compatibility decision when the governed quality-gate ceiling advances.

Governance / merge boundary

Keep this PR Draft. #233 must integrate first. After that integration, reconcile/retarget this branch against then-current protected main and reacquire every exact-final-head/current-base quality, security, exact 100% owned production statement/branch coverage, public-docstring, package/lock/reproducibility/provenance/release, finding/thread, and live review gate required by governance.

Queued, pending, cancelled, skipped-required, absent, neutral, stale, predecessor, status-only, synthetic, author-only, rate-limited, infrastructure-failed, dismissed, or conclusion-null evidence is non-passing.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f507d0d-3a97-484c-971b-f78a1eef63c8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}