Publish curated ITWorx_MCP_Hub source from ce7b7c333c5b287456ad4a19c90a4e9b4ee02dcf

scripts/contextforge_candidate_recipe.py

@@ -113,6 +113,18 @@ def _table_range(text: str, table: str) -> tuple[int, int, str]:
     return start, end, text[start:end]
 
 
+def binary_postgres_pyproject(source_text: str) -> str:
+    """Select the pinned binary adapter without requesting a source-only C build."""
+    import tomllib
+
+    source = tomllib.loads(source_text)
+    postgres = source.get("project", {}).get("optional-dependencies", {}).get("postgres")
+    original = '"psycopg[c,binary]>=3.3.4"'
+    if postgres != ["psycopg[c,binary]>=3.3.4"] or source_text.count(original) != 1:
+        raise CandidateRecipeError("upstream PostgreSQL adapter contract changed")
+    return source_text.replace(original, '"psycopg[binary]>=3.3.4"', 1)
+
+
 def candidate_pyproject(source_text: str) -> str:
     """Apply the narrowly scoped candidate-only dependency resolution policy."""
     try:
@@ -137,7 +149,7 @@ def candidate_pyproject(source_text: str) -> str:
     }:
         raise CandidateRecipeError("upstream uv source override shape changed")
 
-    text = source_text.replace("\r\n", "\n")
+    text = binary_postgres_pyproject(source_text).replace("\r\n", "\n")
     source_start, source_end, source_table = _table_range(text, "tool.uv.sources")
     source_lines = source_table.strip().splitlines()
     expected_source_lines = [
@@ -319,6 +331,8 @@ def _read_lock_manifest() -> dict[str, Any]:
         payload = json.loads(_require_file(LOCK_MANIFEST).decode("utf-8"))
     except (json.JSONDecodeError, UnicodeDecodeError) as exc:
         raise CandidateRecipeError("candidate lock manifest is invalid JSON") from exc
+    if not isinstance(payload, dict):
+        raise CandidateRecipeError("candidate lock manifest is not an object")
     expected = _make_manifest(
         source_hashes=SOURCE_HASHES,
         production_hash=str(
@@ -337,6 +351,11 @@ def _read_lock_manifest() -> dict[str, Any]:
 def verify_lock_contents(manifest: dict[str, Any]) -> None:
     production = _require_file(LOCK_DIR / "production-requirements.lock").decode("utf-8")
     build_tools = _require_file(LOCK_DIR / "build-tools.lock").decode("utf-8")
+    if re.search(r"(?im)^psycopg-c==", production):
+        raise CandidateRecipeError("candidate lock contains a source-only PostgreSQL adapter")
+    for name in ("psycopg", "psycopg-binary"):
+        if not re.search(rf"(?im)^{name}==3\.3\.4(?:[ ;\\]|$)", production):
+            raise CandidateRecipeError("candidate PostgreSQL binary adapter pin changed")
     for requirement in CONSTRAINTS:
         name, version = requirement.split("==", 1)
         match = re.search(rf"(?im)^{re.escape(name)}==([^ ;\\]+)", production)
@@ -404,7 +423,7 @@ def transform_containerfile(containerfile: bytes, expected_hash: str | None = No
         raise CandidateRecipeError("upstream dependency-copy anchor count changed")
     text = text.replace(
         LOCK_COPY_ANCHOR,
-        LOCK_COPY_ANCHOR
+        "COPY pyproject.itworx-candidate.toml /app/pyproject.toml\n"
         + "COPY contextforge-candidate-production-requirements.txt /tmp/contextforge-production-requirements.txt\n"
         + "COPY contextforge-candidate-build-tools.txt /tmp/contextforge-build-tools.txt\n",
         1,
@@ -422,7 +441,7 @@ def transform_containerfile(containerfile: bytes, expected_hash: str | None = No
     && /app/.venv/bin/python -m pip install --disable-pip-version-check --no-cache-dir --require-hashes --only-binary=:all: -r /tmp/contextforge-production-requirements.txt \\
     && /app/.venv/bin/python -m pip install --disable-pip-version-check --no-cache-dir --no-deps --no-build-isolation ".[redis,postgres,observability,granian,plugins,llmchat]" \\
     && /app/.venv/bin/python -m pip check \\
-    && /app/.venv/bin/python -c "import importlib.metadata as md; assert md.version('mcp') == '1.30.0'; assert md.version('PyJWT') == '2.15.0'; assert md.version('urllib3') == '2.8.0'" \\
+    && /app/.venv/bin/python -c "import importlib.metadata as md; import psycopg; assert psycopg.pq.__impl__ == 'binary'; assert md.version('psycopg') == md.version('psycopg-binary') == '3.3.4'; assert md.version('mcp') == '1.30.0'; assert md.version('PyJWT') == '2.15.0'; assert md.version('urllib3') == '2.8.0'" \\
     && /app/.venv/bin/python -m pip uninstall --yes pip setuptools wheel \\
     && (find /app/.venv -name "*.dist-info" -type d \\
         \\( -name "pip-*" -o -name "setuptools-*" -o -name "wheel-*" \\) \\
@@ -440,10 +459,12 @@ def prepare_source(source_dir: Path) -> None:
     manifest = _read_lock_manifest()
     verify_lock_contents(manifest)
     transformed = transform_containerfile(source["Containerfile"])
+    project = binary_postgres_pyproject(source["pyproject.toml"].decode("utf-8"))
 
     for source_name, target_name in LOCK_OUTPUT_NAMES.items():
         _write_atomic(source_dir / target_name, _require_file(LOCK_DIR / source_name))
     _write_atomic(source_dir / "Containerfile.itworx-candidate", transformed)
+    _write_atomic(source_dir / "pyproject.itworx-candidate.toml", project.encode("utf-8"))
 
 
 def print_build_args() -> None: