pyproject.toml

[build-system]
requires = ["hatchling>=1.27"]
build-backend = "hatchling.build"

[project]
name = "afterward"
version = "0.1.0"
description = "California training programs, their reported outcomes, and the occupations they lead to."
readme = "README.md"
requires-python = ">=3.12,<3.15"
license = { file = "LICENSE" }
authors = [{ name = "Afterward contributors" }]
keywords = ["california", "workforce", "wioa", "training", "labor-market", "government"]
classifiers = [
  "Development Status :: 2 - Pre-Alpha",
  "Intended Audience :: End Users/Desktop",
  "License :: OSI Approved :: Apache Software License",
  "Operating System :: OS Independent",
  "Programming Language :: Python :: 3",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Topic :: Sociology",
]
dependencies = [
  "httpx>=0.28,<1",
  "typer>=0.15,<1",
]

[project.optional-dependencies]
# The optional runtime AI service (`afterward.ask`, ADR 0003). An extra rather than a core
# dependency because the pipeline and the static site need none of it: `make data` and
# `make web-build` run without a model provider installed, and a machine that only rebuilds
# the dataset should not have to carry an HTTP framework and an SDK for a service it never
# starts. `make install` installs it so `make verify` tests it.
ask = [
  "anthropic>=0.125,<2",
  "fastapi>=0.115,<1",
  "pydantic>=2.9,<3",
  "uvicorn>=0.30,<1",
]
# Amazon Bedrock through the same SDK (`AFTERWARD_AI_PROVIDER=bedrock`). Separate because it
# pulls in boto3, which nothing else here needs.
ask-bedrock = [
  "anthropic[bedrock]>=0.125,<2",
]

[project.urls]
Documentation = "https://github.com/ChelseaKR/afterward#readme"
Issues = "https://github.com/ChelseaKR/afterward/issues"
Source = "https://github.com/ChelseaKR/afterward"

[project.scripts]
afterward = "afterward.cli:main"

[dependency-groups]
dev = [
  "bandit[toml]>=1.8.3",
  # Independent structural validation of the demonstration CTDL export (`make ctdl-validate`).
  # A dev dependency because the export is a demonstration artifact built by an operator, not
  # something the site or the pipeline needs at runtime. Consumed only; never modified here.
  "ctdl-validate>=0.1,<1",
  "mypy>=1.18",
  "pip-audit>=2.9",
  "pre-commit>=4.2",
  "pytest>=8.3",
  "pytest-cov>=6.0",
  "respx>=0.22",
  "ruff>=0.15",
]

[tool.hatch.build.targets.wheel]
packages = ["src/afterward"]

[tool.ruff]
target-version = "py312"
line-length = 100
extend-exclude = ["STANDARDS", "data"]

[tool.ruff.lint]
select = ["E", "F", "I", "B", "S", "UP", "SIM", "C90", "RUF"]

[tool.ruff.lint.mccabe]
# Ruff's default, stated so the ceiling is a commitment rather than an accident.
max-complexity = 10

[tool.ruff.lint.per-file-ignores]
# E501: CSV fixtures must stay byte-accurate to the real EDD export header.
"tests/*" = ["S101", "E501"]
# B008: typer.Option in a default is the framework's documented idiom.
"src/afterward/cli.py" = ["B008"]
# B008: FastAPI's `Depends`/`Body` defaults are the framework's documented idiom, as typer's are.
"src/afterward/ask/service.py" = ["B008"]

[tool.mypy]
python_version = "3.12"
strict = true
# All three Python surfaces, not just the package.
#
# This read `files = ["src"]` until 2026-08-28, so `scripts/` -- the eight gate scripts
# that decide whether a dataset may be backed up, packaged or published -- and `tests/` -- 1,240
# cases -- were never type-checked at all, while the README's Code Quality row said
# "mypy --strict" without saying which third of the repository it meant. A gate script is
# exactly the code that must not be wrong, and a test that does not type-check can assert
# something other than what it appears to.
files = ["src", "scripts", "tests"]

# `scripts/` is strict with no relaxation: it is the gates.

[[tool.mypy.overrides]]
# Test fixtures are ad-hoc dicts and lists built to stand in for feed payloads. Requiring a
# generic parameter on every one of them buys 48 annotations and no safety -- the errors that
# matter in a test are a wrong argument type, an attribute that does not exist, and a call to
# something untyped, and those all stay on. Nothing else is relaxed here, and `src/` and
# `scripts/` are not relaxed at all.
module = "tests.*"
disallow_any_generics = false
warn_return_any = false

[tool.pytest.ini_options]
testpaths = ["tests"]
addopts = "-q --strict-markers --strict-config --import-mode=importlib"

[tool.coverage.run]
# Branch coverage, because that is what CQ-08 asks for and what this pipeline needs.
#
# Until 2026-08-15 this file set a floor and never set a mode, so coverage.py measured
# statements while `docs/ROADMAP.md` cited a control that names branches. The gap was not
# academic here: this pipeline's job is classification and its hardest code is branchy --
# the IPEDS-style negative sentinels, suppressed versus reported versus not-applicable, and
# the competency-based `-1` that produced a real bug (commit 904c231, "-1 on program length
# means competency-based, not suppressed"). Statement coverage reports a branchy function as
# fully covered when only one side of each test was ever taken, which is exactly how that
# bug's shape hides.
branch = true

[tool.coverage.report]
# Floor, not target: measured 94.75% branch on 2026-08-28 (92.12% on 2026-08-21, and
# 91.62% on 2026-08-15 when branch mode was first turned on -- the pipeline gained code and
# tests between each pair of measurements). Applies when tests run with coverage
# (`make test`); raising it is welcome, lowering it needs a reason. 85 is CQ-08's floor for
# an application.
fail_under = 85

[tool.bandit]
exclude_dirs = ["tests", "data"]