From e49975a8e3423f2fdeb4385244de9355ae7c45f8 Mon Sep 17 00:00:00 2001
From: Ciaran Ryan-Anderson <ciaranra@gmail.com>
Date: Sat, 11 Jul 2026 15:56:18 -0600
Subject: [PATCH] Fail closed on unexpected untracked lockfiles, fix
 pecos-rslib-llvm OS classifier, and make the doctor example version-agnostic

---
 docs/user-guide/cli.md                 |  4 ++--
 python/pecos-rslib-llvm/pyproject.toml |  2 +-
 scripts/dependency-integrity-check.sh  | 16 ++++++++++++++++
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/docs/user-guide/cli.md b/docs/user-guide/cli.md
index bad4db1a6..91fff3c18 100644
--- a/docs/user-guide/cli.md
+++ b/docs/user-guide/cli.md
@@ -132,8 +132,8 @@ LLVM 21.1:
 
 Python:
   [OK] uv: uv 0.11.3
-  [OK] import pecos: v0.9.0.dev0
-  [OK] pecos_rslib: v0.2.0-dev.0
+  [OK] import pecos: v<version>
+  [OK] pecos_rslib: v<version>
 
 CUDA (optional):
   [--] CUDA: not found (optional)
diff --git a/python/pecos-rslib-llvm/pyproject.toml b/python/pecos-rslib-llvm/pyproject.toml
index 054a687a3..ac6738111 100644
--- a/python/pecos-rslib-llvm/pyproject.toml
+++ b/python/pecos-rslib-llvm/pyproject.toml
@@ -17,7 +17,7 @@ classifiers = [
     "Intended Audience :: Developers",
     "Intended Audience :: Science/Research",
     "License :: OSI Approved :: Apache Software License",
-    "Operating System :: POSIX :: Linux",
+    "Operating System :: OS Independent",
     "Topic :: Scientific/Engineering :: Physics",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.10",
diff --git a/scripts/dependency-integrity-check.sh b/scripts/dependency-integrity-check.sh
index a3b91616f..54d9a5aa5 100755
--- a/scripts/dependency-integrity-check.sh
+++ b/scripts/dependency-integrity-check.sh
@@ -349,6 +349,22 @@ if ((${#cargo_locks[@]} == 0)); then
     fail "no Cargo.lock files found"
 else
     for lockfile in "${cargo_locks[@]}"; do
+        # Fail-closed handling for lockfiles that are not tracked by git:
+        # - gitignored ones are documented generated artifacts (see .gitignore
+        #   for the per-entry rationale); CI checkouts never contain them and a
+        #   stale local copy fails --locked with a misleading error, so skip.
+        # - anything else is an unexpected lock that should either be committed
+        #   or gitignored with a rationale -- fail so it cannot slip through.
+        # (rg --files can list gitignored files under negation patterns, which
+        # is how these reach this loop at all.)
+        if ! git ls-files --error-unmatch "$lockfile" >/dev/null 2>&1; then
+            if git check-ignore -q "$lockfile"; then
+                echo "Skipping gitignored generated lockfile: $lockfile"
+                continue
+            fi
+            fail "$lockfile is untracked and not gitignored: commit it or gitignore it with a rationale"
+            continue
+        fi
         manifest="$(dirname "$lockfile")/Cargo.toml"
         if [[ ! -f "$manifest" ]]; then
             fail "$lockfile has no adjacent Cargo.toml"