fix: reject stale sc-compose Python bindings below version floor

[randlee]

Summary

• Adds a version-floor check to install.py (and the vendored plugins/sc-publish/install.py copy) that inspects installed sc-compose distribution metadata before the first sc_compose import, and rejects anything below the current minimum (1.4.1) with an explicit installed-vs-required error instead of silently running against a stale binding.
• The floor is enforced against the bootstrap pin, not a single hardcoded venv path, so any environment meeting the floor works.

Why

An ambient/global sc-compose==1.2.0 wheel produced an identical spurious unknown filter: tojson pytest failure across two separate QA rounds (sc-publish PR #48 and sc-compose Sprint Q.4 / PR #530), each time costing a reviewer a full diagnosis cycle to rule out a real regression. This is a standalone bug fix, not Phase Q sprint work — branched directly off develop.

Test plan

• Managed-renderer consumer tests: 81 passed / 7 skipped
• Vendored package tests: 78 passed / 10 skipped
• just test PASS
• git diff --check PASS

🤖 Generated with Claude Code

[randlee]

QA Findings Update

Generated: 2026-08-20
QA Pass: QA-1
Sprint/Task: SC-COMPOSE-VERSION-FLOOR-QA1 / SC-COMPOSE-VERSION-FLOOR-01
Branch: fix/sc-compose-version-floor-check
Commit: dee4b7b
PR: #531
Verdict: FAIL

Machine Status (JSON)

{
  "sprint": "SC-COMPOSE-VERSION-FLOOR-QA1",
  "task": "SC-COMPOSE-VERSION-FLOOR-01",
  "branch": "fix/sc-compose-version-floor-check",
  "commit": "dee4b7b",
  "pr": 531,
  "verdict": "FAIL",
  "deliverables": {
    "complete": 5,
    "total": 7,
    "percent": 71
  },
  "findings": {
    "blocking": 2,
    "important": 2,
    "minor": 0
  },
  "blocking_ids": ["ARCH-001", "ATM-QA-001"],
  "merge_readiness": "not ready",
  "merge_reason": "2 Blocking findings unresolved: RULE-012 vendoring-boundary violation (arch-qa) and missing CI enforcement of the new regression tests (req-qa). CI is green (14/14) but that does not offset either finding.",
  "next_action": "Revert the hand-edit to the vendored/self-installed install.py copies and route the version-floor fix upstream through sc-publish (or obtain a team-lead ruling for an explicit one-time exception); wire test_install.py into ci.yml; address the 2 Important findings in the same round.",
  "owner": "comp (via team-lead routing)"
}

Findings Summary

• Deliverables: 5/7 (71%)
• Blocking: 2
• Important: 2
• Minor: 0

Blocking Findings

• ARCH-001/ARCH-002 (arch-qa, RULE-012 boundary violation) — plugins/sc-publish/install.py:451 and root install.py:451 were hand-edited in place instead of upstreaming the fix into sc-publish and re-vendoring. Repo policy (docs/phase-Q/phase-Q-plan.md, plugins/sc-publish/README.md) explicitly forbids independently maintaining publishing logic outside the installed package. Fix: revert the hand-edit, file the version-floor requirement as an sc-publish issue/PR, re-vendor once merged upstream — or obtain an explicit team-lead ruling/ADR for a one-time authorized exception.
• ATM-QA-001 (req-qa) — New regression tests (.github/scripts/tests/test_install.py, vendored mirror) are not wired into any CI workflow (.github/workflows/ci.yml only runs test_release_artifacts.py). Fix: add an explicit pytest step for test_install.py in ci.yml.

Detailed Findings

Important

• ATM-QA-002 (req-qa) — MINIMUM_SC_COMPOSE_VERSION (1.4.1) is a hardcoded literal duplicated across 2 files (4 counting vendored copies), cross-checked only against bootstrap_sc_compose.py's own hardcoded pin, never against the actual workspace version (Cargo.toml/pyproject.toml currently read 1.5.0). Fix: derive from one canonical source, or document 1.4.1 as an intentionally pinned historical floor.
• simplification-reviewer (CONDITIONAL) — The pre-existing try/except ModuleNotFoundError block in render_template is now largely unreachable dead code since the new floor check fires first; only a narrow untested edge case still reaches it. Fix: remove or explicitly justify+test it.

Confirmed Clean

• rust-qa-agent: fmt PASS, clippy PASS; the 1 cargo-test finding is a local-environment-only gap (missing SC_LINT_SOURCE_ROOT), satisfied by CI's setup-sc-lint action — not a regression.
• Core fix behavior confirmed correct: an ambient stale sc-compose==1.2.0 wheel now produces a clear RuntimeError naming installed-vs-required version, replacing the old silent tojson filter failure.
• Both directions (too-old rejected, sufficient version accepted) and import-order (floor check before import sc_compose) are test-proven.
• No hardcoded single-venv-path test substitute found. Fail-closed with no bypass flag. No new dependency. No ATM_HOME reads or agent-team-mail-* references introduced.

Resolved Since Last Pass

• none

Merge Readiness

• Status: not ready
• Reason: 2 Blocking findings unresolved: RULE-012 vendoring-boundary violation (arch-qa) and missing CI enforcement of the new regression tests (req-qa). CI is green (14/14) but that does not offset either finding.

Next Action

• Action: Revert the hand-edit to the vendored/self-installed install.py copies and route the version-floor fix upstream through sc-publish (or obtain a team-lead ruling for an explicit one-time exception); wire test_install.py into ci.yml; address the 2 Important findings in the same round.
• Owner: comp (via team-lead routing)
  2026-08-20T20:15:55.67138Z INFO compose.command started command started
  2026-08-20T20:15:55.671476Z INFO compose.resolve attempt resolve attempt
  2026-08-20T20:15:55.671519Z INFO compose.resolve resolved resolve completed
  2026-08-20T20:15:55.671981Z INFO compose.include_expand expanded include expansion completed
  2026-08-20T20:15:55.672309Z WARN compose.validate completed validation completed with warnings
  2026-08-20T20:15:55.672531Z INFO compose.render completed render completed
  2026-08-20T20:15:55.672904Z INFO compose.command completed command completed

[randlee]

QA Findings Update

Generated: 2026-08-20
QA Pass: QA-2 (recheck)
Sprint/Task: SC-COMPOSE-VERSION-FLOOR-QA2 / sc-compose-version-floor-check
Branch: fix/sc-compose-version-floor-check
Commit: c90b1d6
PR: #531
Verdict: FAIL

Machine Status (JSON)

{
  "sprint": "SC-COMPOSE-VERSION-FLOOR-QA2",
  "task": "sc-compose-version-floor-check",
  "branch": "fix/sc-compose-version-floor-check",
  "commit": "c90b1d6",
  "pr": 531,
  "verdict": "FAIL",
  "deliverables": {
    "complete": 3,
    "total": 5,
    "percent": 60
  },
  "findings": {
    "blocking": 1,
    "important": 1,
    "minor": 0
  },
  "blocking_ids": ["ARCH-001-recheck", "ATM-QA2-001"],
  "merge_readiness": "not-ready",
  "merge_reason": "One confirmed Blocking finding (RULE-012 recurrence): the round-1 vendored-file hand-edit violation was reverted in install.py/test_install.py but reappeared in a different vendored file, .github/scripts/bootstrap_sc_compose.py, which install.py's package_files() installs byte-for-byte and which comp incorrectly claimed was consumer-owned. CI is 14/14 green but has no parity check that would catch this class of drift.",
  "next_action": "Route back to comp: file the version-floor requirement as an sc-publish upstream issue/PR (with parity test update), merge, re-vendor plugins/sc-publish/ into this repo, and confirm root/vendored bootstrap_sc_compose.py copies are byte-identical again. Consider adding a CI parity/dry-run check for sc-publish vendored-file drift.",
  "owner": "comp"
}

Findings Summary

• Deliverables: 3/5 (60%)
• Blocking: 1
• Important: 1
• Minor: 0

Blocking Findings

• ARCH-001(recheck) / ATM-QA2-001 (RULE-012) — .github/scripts/bootstrap_sc_compose.py is a byte-for-byte vendored file (covered by plugins/sc-publish/install.py's package_files(), confirmed by reading package_files() at lines 416-427), not consumer-owned code as the fix assignment claimed. The root copy has the correct new floor-check logic; the vendored copy at plugins/sc-publish/.github/scripts/bootstrap_sc_compose.py still has the old exact-match check and still imports sc_compose before verifying its version. Confirmed independently via direct diff of both files (substantial divergence, non-empty). The vendored copy's own parity test (plugins/sc-publish/.github/scripts/tests/test_publish_kit_scripts.py:122-128, test_bootstrap_pins_the_python_wheel_version) still asserts the pre-fix SC_COMPOSE_VERSION = "1.4.1" exact-match behavior as correct. No CI parity/dry-run check exists to catch root/vendored drift for this file. This reproduces round-1's ARCH-001/ARCH-002 violation class in a new file pair, not a closure of it. Required correction: file the version-floor requirement as an sc-publish issue/PR, merge it upstream (including updating the vendored parity test and adding a vendored counterpart to test_bootstrap_sc_compose.py), then re-vendor via the documented install.py flow — not a further hand-edit of either copy.

Detailed Findings

Blocking

• ARCH-001(recheck)/ATM-QA2-001 — see above. Independently confirmed by both req-qa and arch-qa, and directly re-verified by quality-mgr via diff of both bootstrap_sc_compose.py copies plus a read of test_publish_kit_scripts.py:122-128.

Important

• ATM-QA2-002 — Floor-version documentation (deliverable 4) only propagated to the root copy; the vendored copy still has an undocumented bare SC_COMPOSE_VERSION = "1.4.1" literal with no historical-pin explanation. Same root cause as the Blocking finding — resolved once the vendored copy is re-synced upstream.

Deliverable-by-deliverable

1. install.py/test_install.py (root+vendored) byte-identical to origin/develop — CLOSED, confirmed via direct git diff origin/develop, empty output.
2. Version-floor check in "consumer-owned" bootstrap_sc_compose.py — OPEN, premise false: file is vendored, not consumer-owned.
3. New test coverage wired into ci.yml on every PR — CLOSED, confirmed live (manifest-validation job green on c90b1d6, runs .github/scripts/tests directory).
4. Floor-version duplication documented/resolved — OPEN, only the root copy is documented; vendored copy is not.
5. Redundant try/except ModuleNotFoundError branch removed — CLOSED, confirmed by req-qa, arch-qa, and simplification-reviewer independently.

Resolved Since Last Pass

• Round-1 ARCH-001/ARCH-002 (install.py hand-edit of vendored package) — genuinely reverted; install.py and both test_install.py copies are confirmed byte-identical to origin/develop.
• Round-1 ATM-QA-001 (tests not wired into CI) — resolved; ci.yml now runs the full .github/scripts/tests directory on every PR.
• Round-1 simplification-reviewer finding (redundant unreachable error-path branch) — resolved; the entire hand-edit that introduced it was removed rather than patched around.
• rust-qa-agent and simplification-reviewer both returned clean PASS with 0 findings on their respective scopes this round.

Merge Readiness

• Status: not-ready
• Reason: One confirmed Blocking finding (RULE-012 recurrence): the round-1 vendored-file hand-edit violation was reverted in install.py/test_install.py but reappeared in a different vendored file, .github/scripts/bootstrap_sc_compose.py, which install.py's package_files() installs byte-for-byte and which comp incorrectly claimed was consumer-owned. CI is 14/14 green but has no parity check that would catch this class of drift.

Next Action

• Action: Route back to comp: file the version-floor requirement as an sc-publish upstream issue/PR (with parity test update), merge, re-vendor plugins/sc-publish/ into this repo, and confirm root/vendored bootstrap_sc_compose.py copies are byte-identical again. Consider adding a CI parity/dry-run check for sc-publish vendored-file drift.
• Owner: comp

[randlee]

Closing without merge. Round 1 and round 2 QA both confirmed the version-floor check is correct but repeatedly landed on vendored sc-publish files (plugins/sc-publish/install.py, then .github/scripts/bootstrap_sc_compose.py — both byte-for-byte vendored per install.py's package_files()). Per user ruling, the fix goes upstream instead: dispatched as SC-PUBLISH-VERSION-FLOOR-01 in randlee/sc-publish (branch fix/version-floor-bootstrap). This branch is confirmed zero-diff vs develop (69dd074) — nothing to merge here. sc-compose will re-vendor once the upstream fix lands, via a normal consume-update sprint (Q.3/Q.4 pattern).