[pull] master from flypythoncom:master - #7

… and modernized tooling

- Add 3 new runnable examples: pydantic-validation, mcp-server, and async-fetcher
- Add 3 new task playbooks: write-llm-evals, setup-structured-logging, manage-database-migrations
- Add 3 new depth guides: modern-typing, async-patterns, and context-budget
- Add 8 new reviewed catalog resources (Ruff, Mypy, SQLAlchemy, Alembic, Polars, DuckDB, Instructor, MCP)
- Initialize Project Radar evaluated projects list in catalog/projects/
- Add reusable templates for agent IDE rules, eval records, and API specifications
- Modernize pyproject.toml and add Makefile for unified development tasks
- Generalize example verification and test discovery across all examples
- Re-export catalog.json, content-manifest.json, and rendered bilingual READMEs

… uv modernization

- Rewrite the mcp-server example for the stateless 2026-07-28 spec: no
  initialize handshake, per-request _meta.protocolVersion validation, and
  the input_required round-trip via params.inputResponses (8 tests).
- Add bilingual migration guide guides/mcp/migrate-2026-07-28 covering the
  removals, deprecations, authorization hardening, and a migration checklist.
- Add the four official MCP/AAIF announcement sources to the reviewed catalog;
  regenerate catalog.json, README catalogs, and the content manifest (19 docs).

- Add bilingual docs/repo-plan-0.0.3 (courses/ spec, radar data model,
  radar_scan tool, contract updates, referral overhaul, FP-325~344)
- Add dual LICENSE: MIT for code/examples/tools/templates, CC BY 4.0 for
  written content — prerequisite for distributing course folders
- CURATION_POLICY: extend scope to courses + radar, add radar lifecycle
  statuses and ai_familiarity grading, update licensing section
- AGENTS.md: content ships EN+ZH in the same change; governance docs are
  English-canonical

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…ontracts

- courses/ content type with the flagship Claude Code hands-on course
  (EN+ZH lessons, three scenario skins, task contract, starter/solution,
  verify.py objective evidence, REVIEW.md record)
- tools/verify_courses.py course-contract verifier wired into Makefile and CI
- catalog/projects/ per-project YAML (7 seeds) with ai_familiarity,
  bilingual generated Radar tables, radar.json export + radar-v1 schema,
  and --target both support in export_catalog.py
- tools/radar_scan.py read-only candidate discovery (GitHub/PyPI/HN) with
  the no-verdict guarantee enforced by tests
- content-manifest schema + builder gain the course type
- course-feedback issue template; llms.txt courses and radar sections
- README course banner plus contextual flypython.com footers on every
  guide, playbook, and example per REPO_TO_WEBSITE.md

C2 'Hands-on with OpenAI Codex CLI' ships EN+ZH lessons, the same three
scenario skins and the same verified starter/solution/tests contract as C1
per the 0.0.3 plan reuse rule; REVIEW.md records the mechanical verification
with the live Codex run-through logged as pending launch evidence.

GitHub moved jxnl/instructor to 567-labs/instructor; the radar entry and the
generated radar.json/README tables now use the canonical URL so the site's
external-link gate stays green.

- C3 'One source of truth for agent rules': new stdlib rules_check.py core
  (source/pointer/copy/drift classification + CLI exit codes, 11 tests)
- C4 'From it runs to it ships': new stdlib ship_check.py core (parsed test
  counts, no-tests verdict, unverified list, atomic SHIP-RECORD.json,
  10 tests) with green/red/no-tests scenario projects
- C5 'Give your agent tools with MCP': assembled from the reviewed
  examples/mcp-server contract plus wire-format request samples
- All five courses EN+ZH with COURSE teaching contracts, scenario skins,
  TASK contracts, REVIEW records, and verify.py both-directions evidence

Planning draft for the local-first challenge/badge layer in course folders:
verify.py progress writing PROGRESS.json, badge contract and challenge
narrative (EN+ZH), gated BADGE.md artifact, SKILL.md packaging evaluation,
and verify_courses.py coverage. Carries the open 0.0.3 release mechanics
forward.

Rev 2 superseding the local-first draft: the website records progress from
deterministic checkpoint claim codes printed by verify.py (FP-411), the
challenge/badge narrative points at the site recording flow (FP-412), badge
metadata becomes structured course data (FP-413), and verify_courses.py
gains claim-code determinism coverage (FP-415). Local-only artifacts are
dropped.

CI installed an unpinned ruff, so a new ruff release (UP017, B905) has
failed every master and PR run since 2026-09-16. Pin ruff in the dev
lock (upgrades now arrive via dependabot) and fix the three findings
without changing behavior.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

contourpy 1.4.0 and numpy 2.5.3 require Python >=3.12, so the 3.11 CI
job has failed at install since the lock landed while pyproject still
declares >=3.11. Pin the newest 3.11-compatible releases via markers.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Adapted from #91 onto the current test, which has since gained a
first-party URL filter.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Mobina <mobinasafarirad@gmail.com>
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…#89)

Bumps the actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [peter-evans/repository-dispatch](https://github.com/peter-evans/repository-dispatch) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v7)

Updates `peter-evans/repository-dispatch` from 3 to 4
- [Release notes](https://github.com/peter-evans/repository-dispatch/releases)
- [Commits](peter-evans/repository-dispatch@v3...v4)

Updates `astral-sh/setup-uv` from 5 to 7
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v5...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: astral-sh/setup-uv
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: peter-evans/repository-dispatch
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

`uv sync` fails in a standalone course folder (no pyproject.toml) and,
in a full clone, syncs the root project without the `dev` extra, so
pandas is never installed. Both data-analysis courses (EN+ZH docs and
the verify.py missing-dependency hint) now create a course-local
virtual environment and install requirements.txt with pip or uv pip.
Manifest regenerated for the changed course files.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

- Delete the stale uv.lock; requirements*.lock.txt are the only lock
  files CI uses, and `uv lock --check` had already drifted.
- `make check` now runs ruff and pytest like CI; the `.PHONY` lint
  target exists for real.
- Dependabot ignores pandas/matplotlib, which course folders pin
  separately; workflows no longer trigger on the deleted `main` branch.
- README status sections stop hardcoding a master hash and point to the
  CHANGELOG; AGENTS.md describes the verifier v2 checkpoint contract;
  CHANGELOG records the 2026-10-04 CI/course-setup fixes and no longer
  claims a stale production pin; repo-plan-0.1.x reflects the deleted
  website 0.0.9 plan file and drops the stale hash.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

The root READMEs shrank from 294 to 191 lines (EN) and 275 to 176 (ZH):

- render_readmes.py now renders a condensed catalog index (learning-path
  bullets linking into the catalog pages) into the root READMEs, and the
  full 33-resource tables into the new generated catalog/README.md and
  catalog/README_cn.md.
- Badges moved directly under the title and the tagline no longer repeats
  it; the internal "Current status" section collapsed to a one-line release
  pointer with the operational detail moved to docs/REPO_TO_WEBSITE.md.
- The course-verify section now lists the three checkpoint states
  ([open]/[passed]/[pending]) instead of prose.
- The validation commands duplicated from CONTRIBUTING.md were replaced by
  a Contribute section linking to it.
- Added assets/verify-demo.svg, a terminal demo built from a real
  verify.py --attest checkpoint report, embedded in both READMEs.
- The resource-exposure test now targets the catalog READMEs; a new test
  asserts the root READMEs link to the full catalog.

Website-consumed exports (catalog.json, radar.json,
content-manifest.json) are byte-identical; no pinned-consumer change is
required by this commit.

Updates the requirements on [requests](https://github.com/psf/requests), [urllib3](https://github.com/urllib3/urllib3), [mypy](https://github.com/python/mypy), [types-pyyaml](https://github.com/python/typeshed), [types-requests](https://github.com/python/typeshed), [charset-normalizer](https://github.com/jawah/charset_normalizer), [idna](https://github.com/kjd/idna), [fonttools](https://github.com/fonttools/fonttools), [pyparsing](https://github.com/pyparsing/pyparsing), [pytz](https://github.com/stub42/pytz) and [tzdata](https://github.com/python/tzdata) to permit the latest version.

Updates `requests` from 2.32.5 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.5...v2.34.2)

Updates `urllib3` from 2.6.3 to 2.8.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.3...2.8.0)

Updates `mypy` to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.14.0...v2.3.1)

Updates `types-pyyaml` to 6.0.12.20260906
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-requests` to 2.33.0.20260906
- [Commits](https://github.com/python/typeshed/commits)

Updates `charset-normalizer` from 3.5.1 to 3.5.2
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.5.1...3.5.2)

Updates `idna` from 3.19 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.19...v3.20)

Updates `fonttools` from 4.65.0 to 4.66.1
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.65.0...4.66.1)

Updates `pyparsing` from 3.3.2 to 3.3.3
- [Release notes](https://github.com/pyparsing/pyparsing/releases)
- [Changelog](https://github.com/pyparsing/pyparsing/blob/master/CHANGES)
- [Commits](pyparsing/pyparsing@3.3.2...3.3.3)

Updates `pytz` from 2026.3.post1 to 2026.4
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](stub42/pytz@release_2026.3.post1...release_2026.4)

Updates `tzdata` from 2026.3 to 2026.4
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.3...2026.4)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:development
  dependency-group: python-dependencies
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260906
  dependency-type: direct:development
  dependency-group: python-dependencies
- dependency-name: types-requests
  dependency-version: 2.33.0.20260906
  dependency-type: direct:development
  dependency-group: python-dependencies
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: fonttools
  dependency-version: 4.66.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pyparsing
  dependency-version: 3.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pytz
  dependency-version: '2026.4'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: tzdata
  dependency-version: '2026.4'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#99)

- Lock files are now produced by `make lock` (uv pip compile --universal
  from the 3.11 floor) instead of by hand; every existing pin is kept,
  and the Windows-only colorama and <3.13 typing-extensions pins the
  manual lock missed are added. A new `lock` job runs `make lock-check`,
  which re-resolves copies of the committed locks and fails on any diff.
- tests/test_dependency_pins.py requires course/path requirements.txt
  pins to equal the CI lock, so CI tests the stack learners install.
- Validate adds Python 3.14, sets fail-fast: false, SHA-pins actions,
  moves setup-uv v7 -> v10.2.0, and pins uv 0.12.19.
- Remove notify-site.yml: WEBSITE_SYNC_TOKEN was never set, so all 32
  runs skipped the dispatch while reporting success, and the website
  builds from its own pin anyway.
- Remove mypy, its type stubs, and [tool.mypy]: never locked or run.

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…100)

- validate.yml is now one job on the Python floor and latest (3.11 +
  3.14; the universal lock resolves the versions between) running
  `make check`, the same command as local. The 9 hand-listed steps were
  a second copy of the Makefile and had already drifted once.
- lock-check folds into the 3.11 leg and shrinks to `make lock` +
  `git diff --exit-code`, which prints exactly what to commit.
- Delete the root requirements.txt and requirements-dev.txt: nothing
  referenced them, so dependencies now have one declaration
  (pyproject.toml) and two generated locks.

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Weekly group PRs were more noise than signal for this repo. `day` becomes
1 — monthly takes a day of month, not a weekday.

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Owner decision 2026-10-04: the external open-course supervision track is
the current focus; the community-course track is explicitly post-1.0.
The plan doc stays as the spec for when it is revisited.

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Bumps the python-dependencies group with 1 update: [ruff](https://github.com/astral-sh/ruff).

Updates `ruff` from 0.16.9 to 0.16.10
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.9...0.16.10)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 2972431)

Dependency and action bumps are now done by hand with make lock and
verified by make lock-check. Security alerts and security-update PRs
are repository settings and are not controlled by this file.

Co-authored-by: P小二 <xxg1413@gmail.com>

Tick the 0.0.3 TODO items that have landed, each with the repository
evidence checked on 2026-10-11, and keep FP-326, FP-332, and FP-335
open with notes on what is still missing. Replace stale master and
website-pin SHAs in both plan headers with pointers to CHANGELOG.md,
docs/REPO_TO_WEBSITE.md, and the website's content-pin.json.

Co-authored-by: P小二 <xxg1413@gmail.com>

…2-21e9

Co-authored-by: P小二 <xxg1413@gmail.com>

llms.txt listed 8 of 12 courses, pointed at a nonexistent
courses/hands-on-with-openai-codex-cli/ folder, and recommended
`uv run pytest`, which fails because pytest lives in the dev extra.
The new course lines reuse each COURSE.md summary. The new test fails
on any listed path that does not exist and on any unlisted course.

Co-authored-by: P小二 <xxg1413@gmail.com>

The /from-github landing route is live and attributes repository
traffic. The Chinese README keeps the site root because the route has
no Chinese version yet; docs/REPO_TO_WEBSITE.md records the rule.

Co-authored-by: P小二 <xxg1413@gmail.com>

…P-335

Keep the single website-hosted Skill instead of per-course skills. The
reference validator (skills-ref 0.1.1) flags two spec violations in the
live Skill, and its uv run advice for pandas courses contradicts the
course setup; both are website-side fixes. Mark FP-332 and FP-335 done
now that llms.txt and the README calls to action are fixed.

Co-authored-by: P小二 <xxg1413@gmail.com>

Bump the package version, cut the CHANGELOG [Unreleased] section into
[0.1.2], and give 0.1.1 the heading it never got when it was tagged.
Repository-only release; the data schemas are unchanged. The v0.1.2 tag
goes on the master commit that merges this change.

Co-authored-by: P小二 <xxg1413@gmail.com>

Co-authored-by: P小二 <xxg1413@gmail.com>

…ls, retry, honest eval)

Co-authored-by: P小二 <xxg1413@gmail.com>

…sses, attack replay)

Co-authored-by: P小二 <xxg1413@gmail.com>

Co-authored-by: P小二 <xxg1413@gmail.com>

… SIM117)

Co-authored-by: P小二 <xxg1413@gmail.com>

…n path, and the manifests

Co-authored-by: P小二 <xxg1413@gmail.com>