Make the Python test-env bootstrap safe to auto-run so contributors and
agents no longer have to approve a fresh-worktree install every session.
* `constraints-test.txt` — pinned resolve of `.[test]` extras + their full
transitive closure (39 entries); committed lockfile becomes the
dependency-change review surface.
* `scripts/bootstrap_test_env.{sh,ps1}` — install via the lock when
present, then gate with `pip-audit` (a known CVE fails the bootstrap).
New flags: `--force`/`-Force`, `--relock`/`-Relock`,
`--no-audit`/`-NoAudit`. `--relock` without `--force` now warns
instead of silently no-op'ing.
* `tests/scripts/test_bootstrap_constraints.py` — guards the lock stays
in sync with the `[test]` extras declared in pyproject.toml.
* `CLAUDE.md` — documents that the bootstrap is pre-authorized to run
automatically and supersedes the global `/warmup` MISSING_VENV
hard-stop; dependency *changes* still land as a reviewed diff.
* `.gitattributes` — normalize `constraints-test.txt` to LF so the
PowerShell `--relock` path doesn't flip the file to CRLF.
CI still installs its own minimal `pytest`+`aiohttp` subset directly
(not yet on the lock/audit path) — noted in the CHANGELOG; CI hardening
left as a fast-follow.
Verified: `--force` rebuild from the lock → pip-audit clean → 235 tests
pass (231 + 4 new guards). bash `-n` syntax check OK; arg-error path
exits 2; `--relock` without `--force` warns + exits 0.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Solidify the Python test-env path so any agent (Claude / Codex) or
human can bootstrap with one command, and so the global preflight
skill's pip-audit branch actually runs against this repo.
scripts/bootstrap_test_env.{ps1,sh}: one-liner per platform, idempotent
(no-op if .venv exists, --force / -Force to recreate), upgrades pip,
installs project + test extras.
pyproject.toml: add pip-audit>=2.7 to [project.optional-dependencies]
test so /preflight's Python audit branch lights up.
CLAUDE.md, Hard rules: replace the inline venv-bootstrap command with
a reference to the platform script.
AGENTS.md: short "Test Environment Bootstrap" pointer (mirrors CLAUDE.md
per the Claude/Codex symmetry rule).
.gitattributes: enforce LF for *.sh (otherwise Windows CRLF breaks the
bash shebang on POSIX) and CRLF for *.ps1 (Windows convention).
Triggered by the warmup-skill Python detection added in agent-playbooks
PR #34 — projects now need a clean bootstrap path for the new check to
have a recommended remediation.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
malkuthro