STV_PR_010: Source archives include execution logs despite exclusion
Source and authority: Audit finding PRSA-004. The owner authorized the
next fix after committing PRSA-001 through PRSA-003; baseline Cause: Hatch combines archive excludes with VCS ignores. The root rule retaining execution logs negated the intended test-execution exclusion. Actual old archives contain logs; the initial new regression fails against the previous configuration. No exposed credential was reported by the audit. Expected outcome and fix: Select source-package inputs explicitly and independently of VCS negations. Keep implementation/browser sources, built assets, full legal materials and build inputs. Local tools and execution evidence stay in Git/local storage. Exclude bytecode and caches within selected directories. Original test records and archives are unchanged. See Technology stack and dependency decisions for the boundary. Traceability: Existing distribution obligations Deliver the reusable extension (STV_SYS_009), Package for the pinned tool... (STV_SWR_042), Expose an installable entry... (STV_SWR_046); packaging configuration and the existing build hook own this boundary. No requirement, component allocation, browser asset, version or state-machine transition changes. Regression and review: Actual source archive respe... (STV_TC_SY_051) inspects actual tar members with root/nested ignore negations and local-only sentinels. It checks a wheel rebuilt from the archive. The existing installed-wheel case checks the real development build in an isolated offline Sphinx host. Evidence and exact commands: PRSA-004 source archive boundary verification. The refined packaging policy and new case design await owner review; requirement verification and prior concept acceptance are not promoted. Disposition: Fixed with scoped actual-archive and offline installed-wheel verification (two passing cases). The expected old-configuration failure is retained. Owner review and eventual release qualification remain separate. |