release: qualify SCM 0.9.2 product runtime

[saishshinde15]

Product qualification

This rebases the release hardening work onto the current public main and aligns the Python runtime, JS SDK, docs, and release workflow at 0.9.2.

It adds durable per-user REST/MCP snapshots, same-user operation serialization, strict request validation, safe shutdown, safe CORS defaults, corrected OpenAPI routes, encrypted BYOK storage, release-gate CI, and 46 deterministic production tests.

It also fixes the demo wake-summary import and makes the dependency audit evaluate the installed third-party dependency set rather than attempting to look up the unreleased local wheel on PyPI.

Validation

venv/bin/python scripts/run_product_qualification.py --output /tmp/scm-v092-release-quality.json

Result: ready_for_release: true; full regression 489 passed, 13 skipped; production suite 46 passed. The gate also passed clean wheel installation, CLI/doctor/demo smoke, server restart durability, live REST/JS SDK smoke, twine check, dependency audit, and tracked-secret scan.

This supersedes the stale 0.9.1 qualification branch/PR.

[saishshinde15]

Follow-up: fixed Python 3.10 tomllib compatibility with the conditional tomli dependency and fallback imports. A clean Python 3.10 environment now passes the exact CI subset: 60 passed. Re-ran full qualification on the updated commit: ready_for_release: true, full regression 489 passed, 13 skipped, production suite 46 passed.

[saishshinde15]

Follow-up: fixed the full-regression CI collection failures. Optional LangChain/LangGraph script coverage now skips when its extras are absent, the legacy stress test is valid on Python 3.10/3.11, and scm doctor now reports a missing provider key before a missing optional client. Full Python 3.10 regression: 489 passed, 14 skipped. Updated full qualification: ready_for_release: true.

[Copilot]

Pull request overview

Qualifies SCM product runtime release 0.9.2 by hardening the REST/MCP runtime for durability, strict input validation, safer defaults, and by introducing deterministic “production” qualification tests plus automated release gating.

Changes:

• Add per-user snapshot persistence, bounded async ingest, and same-user operation serialization for REST/MCP engine pools.
• Tighten public API surfaces (strict request schemas, payload limits, safer CORS, corrected OpenAPI routes) and align versioning via a single runtime constant.
• Introduce credential-free product qualification runner + production tests, and wire them into CI/release workflows.

Reviewed changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/test_wake_summary_e2e.py	Makes paid-provider E2E opt-in and skips cleanly when credentials aren’t provided.
tests/test_crazy_brutal.py	Minor test string construction cleanup for special characters.
tests/test_ab_hierarchical.py	Renames helper to avoid pytest-style test_ naming for a non-test helper.
tests/production/test_security.py	Adds security-focused production qualification tests (secrets scan, CORS, BYOK crypto, token echo).
tests/production/test_recovery.py	Adds snapshot durability/recovery tests (corruption quarantine, atomic replace).
tests/production/test_performance.py	Adds bounded latency/perf tests for async ingest and health probes.
tests/production/test_contract.py	Adds contract tests for versions, schemas, OpenAPI routes, and restart durability.
tests/production/test_concurrency.py	Adds concurrency tests for engine creation, per-user serialization, backpressure, shutdown draining.
tests/production/test_api_abuse.py	Adds abuse/fuzz tests to ensure malformed inputs don’t cause 5xx and limits fail closed.
tests/production/conftest.py	Provides isolated product runtime fixtures and ensures pool/db isolation between tests.
tests/production/init.py	Declares production test package purpose.
tests/agent_with_tools/test_supervisor_team.py	Skips LangChain/LangGraph integration tests when extras aren’t installed.
src/version.py	Introduces single source of truth for runtime version (__version__).
src/sleep/sleep_cycle.py	Adjusts sleep readiness logic with explicit deep/micro selection based on pressure/idle thresholds.
src/sleep/forgetting_dynamics.py	Normalizes UTC handling and optimizes forgetting stats aggregation.
src/integrations/user_state_store.py	Adds crash-safe, checksummed, atomic per-user snapshot persistence.
src/integrations/tools.py	Tightens tool schemas, fixes OpenAPI route mapping, and sources spec version from __version__.
src/integrations/memories_api.py	Enforces strict request validation, adds backpressure handling, and routes tool calls through serialized engine operations.
src/integrations/mcp_server.py	Adds per-user operation serialization, bounded queues, persistence integration, and graceful shutdown draining.
src/core/sqlite_db.py	Improves SQLite concurrency defaults (timeouts/WAL) and adds init/memory locks.
src/cloud/accounts.py	Upgrades BYOK at-rest encryption to AES-GCM with legacy-read compatibility and schema init locking.
src/cli/main.py	Aligns CLI version reporting to runtime constant and improves provider presence reporting.
src/api/main.py	Aligns app version, adds safer CORS defaults, adds request size guard, and ensures pool shutdown on lifespan exit.
src/api/demo_router.py	Fixes wake-summary import wiring for demo router.
sdk/js/test/live-smoke.mjs	Adds live JS SDK smoke against a running REST server.
sdk/js/package.json	Bumps JS SDK version to 0.9.2.
scripts/run_product_qualification.py	Adds credential-free end-to-end qualification runner that emits JSON evidence.
scripts/installed_wheel_smoke.py	Adds smoke script validating installed-wheel behavior + REST restart durability + JS live smoke.
scm/init.py	Simplifies package init and sources __version__ from runtime constant.
README.md	Documents the release qualification gate entrypoint.
pyproject.toml	Updates dependencies, adds dev tooling for qualification, and defines pytest markers/timeouts.
docs/QUALITY_GATES.md	Documents the executable quality gates and budgets for release readiness.
docs/PUBLISH.md	Updates publishing runbook and ties it to qualification evidence.
CHANGELOG.md	Records 0.9.2 release hardening and qualification coverage.
.gitignore	Ignores generated qualification reports.
.github/workflows/release.yml	Adds tag-triggered release workflow with a prerequisite qualification job + release creation.
.github/workflows/product-qualification.yml	Adds PR/main product qualification workflow with uploaded evidence artifact.
.github/workflows/ci.yml	Expands focused CI to include production tests and wheel smoke; JS step updated.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.