fix(ci): test every currently supported Python minor

[seonghobae]

Python support contract — ACTIVE DRAFT

This Draft keeps advertised CPython support and permanent CI evidence gapless without bypassing the protected stack.

Fresh exact stack — 2026-09-09

• protected main: 5913c4bad79d6bc29d7cc1c624abb7db2ea6a77c;
• dependency root test(recovery): cover stale evidence registry cleanup #233: 01d231fde23b82e2ced258d7bfcb4721ed75706d;
• direct predecessor/base branch build(deps): align setup-uv 10.0.1 exact-pin contract #325 (fix/setup-uv-10-acceptance-contract): exact 8181acba247ea30b566788542cd0c29b0c7b7506;
• exact current head: f4a5df0e597341b2ba12aef1e61f68bf7f7f96fb;
• state: Draft, open, mechanically mergeable;
• fresh compare from exact build(deps): align setup-uv 10.0.1 exact-pin contract #325: merge base exactly 8181acb..., 11 ahead / 0 behind;
• PR-relative semantic delta is exactly three files: .github/workflows/ci.yml, tests/test_python_support_contract.py, tests/test_workflow_contracts.py.

The pre-reconciliation head 8de00aee07cf5a0a32d091f6b4819de2e5849bbd was diverged from current #325 (its merge base was the older 0378fdeb...), so its prior GREEN could not be transferred to the current stack.

Reconciliation RED → minimal repair

The first ordinary, non-force ancestry reconciliation ce403380ab27e69721fdaddb45be4201fc22fa9a deliberately made current #325 an ancestor but retained the old child tree. Fresh compare exposed the resulting real RED: relative to current #325 it reintroduced the retired repository-local .github/workflows/hourly-maintenance.yml, reverted the current concurrency contract, and carried unrelated release-workflow differences. That tree was not accepted as a valid restack.

The repair remained non-destructive:

• 33dc647cd087f0b030eef27ac2fed7d5cff6ba93 rebuilt from the current build(deps): align setup-uv 10.0.1 exact-pin contract #325 tree and reapplied only the Python-support delta, thereby preserving current parent concurrency and the invariant that central PR maintenance is not duplicated locally;
• f4a5df0e597341b2ba12aef1e61f68bf7f7f96fb restores the exact pre-existing tests/test_python_support_contract.py blob rather than silently reformatting the regression fixture during reconciliation.

No force push, destructive rebase, protected-main write, self-approval, gate weakening, or stale check transfer occurred. The branch ref moved only through ordinary descendants.

Bounded contract

requires-python >=3.10 is backed by a permanent, explicit CPython unit-test matrix covering every governed minor through the quality-gate interpreter: Python 3.10, 3.11, 3.12, 3.13, and 3.14. The dedicated regression test derives the expected gapless minor sequence from project metadata and the quality-gate version and requires the permanent CI matrix to match it exactly.

The inherited current-parent workflow contract is preserved: PR workflow concurrency uses ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}, cancellation is limited to pull_request, and .github/workflows/hourly-maintenance.yml remains absent because central .github owns reusable PR maintenance.

Exact-current validation boundary

Exact current head f4a5df0e597341b2ba12aef1e61f68bf7f7f96fb is repository-native GREEN:

• CI 34362731007: completed / success;
• Release Acceptance 34362730546: completed / success.

Fresh formal review inventory is empty and fresh inline review-thread inventory is empty. Workflow success is not independent approval, protected-main integration, or immutable-release authority. Repository tag and GitHub Release collections remain empty.

Integration boundary

Keep Draft while predecessor #325 and dependency root #233 are unintegrated. After prerequisites reach protected main, reconcile descendants only by ordinary non-force ancestry, prove the same three-file semantic delta against the then-current direct parent/base, and reacquire every current exact-head/current-base required CI/security/SAST/coverage/docstrings/package/SBOM/provenance/review/thread/release gate before normal merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}