[Marc-cn]

Renames the darnit-reproducibility plugin to darnit-amber, the name agreed in #677 for the scientific-reproducibility work.

• package darnit_amber, distribution darnit-amber
• framework and MCP server name amber (darnit audit -f amber)
• AmberImplementation, amber.toml, design doc docs/design/amber-attestation-system.md
• control ids (RE-*), handler names (repro_*) and the audit_reproducibility MCP tool are unchanged
• CHANGELOG entry under Unreleased → Changed (BREAKING)

Redone on top of today's main as a single mechanical commit; the earlier version no longer applied. Full suite: 5245 passed, 18 skipped. #678 (Amber run bundles) stacks on this.

Assisted by Claude Code

[mlieberman85]

This now conflicts with 0.1.1 and 044: reproducibility.toml gained effects/ceiling declarations, and its tests reference the framework by name. Before merge:

1. packaging/pypi/public-packages.txt still lists darnit-reproducibility, so the release preflight and build fail.
2. Upgrade path: pip install -U darnit-mcp would leave darnit-reproducibility installed and failing to load. It needs a final darnit-reproducibility release that depends on darnit-amber, or the distribution name kept.
3. Update the tests that still expect the reproducibility framework name (test_plan_contract.py and the 044 reproducibility tests), and docs/getting-started/using-skills.md.
4. Add a CHANGELOG entry (breaking) and a linked issue or decision record.
5. Rebase after #519 lands; its Dockerfile loop and smoke matrix need the new name.

Drafted with Claude Code; reviewed and posted by me.

[Marc-cn]

Rebased on main as one mechanical commit (the earlier version no longer applied); CI green. @mlieberman85 could you review and merge? #678 goes on top once this lands.

[mlieberman85]

Thanks Marco. The rename itself is clean. No old names are left outside the CHANGELOG, the TOML stays under src/darnit_amber/ and loads through importlib.resources, the entry points and lockfile line up, and public-packages, release.yml and the smoke script are all renamed. Locally: ruff clean, validate_sync passes, 5268 passed / 18 skipped.

Still open from my Oct 6 review:

1. Upgrade path (item 2). I installed darnit-mcp 0.1.1 from PyPI, then upgraded to this branch's wheels. darnit-reproducibility 0.1.1 stays installed. Every darnit list and darnit audit then logs Failed to load implementation reproducibility: ... unexpected keyword argument 'default_authority', and darnit audit -f reproducibility fails with a dry_run_command was removed error that doesn't mention the rename. Please either ship a transitional darnit-reproducibility (no entry points, depends on darnit-amber) and keep darnit-mcp depending on it for one release, or keep the distribution name.
2. docs/getting-started/using-skills.md lines 61, 66 and 150 still say reproducibility as the module name.
3. CHANGELOG: please add migration steps, not just the new names: uninstall darnit-reproducibility (or note the transitional release), and rename reproducibility to amber in -f, MCP client configs, [plugins].allowed, and [[compose]] source.
4. #519 became #674, which still uses darnit-reproducibility in the smoke matrix, the import check, the publish job and the docs. Whichever of the two lands second needs the rename; let's agree on the order. darnit-amber will also need a pending Trusted Publisher on PyPI before the first release under #674.

Nits, not blocking: the baseline_capture.py docstrings still call the framework reproducibility; the new display name has an em-dash; the commit trailer should be Assisted-by: Claude:<model> per AI_POLICY.

---

Drafted with AI assistance (Claude), reviewed and filed by me. Measurements quoted were executed and verified.

[Marc-cn]

Thanks, four addressed in the force-pushed commit (096f9a1).

1. Upgrade path. Added a transitional darnit-reproducibility package: no entry points, depends on darnit-amber, and darnit-mcp depends on it for this release. So upgrading darnit-mcp replaces the old plugin instead of leaving it installed next to the new one. The old import path still works with a DeprecationWarning. It's wired into public-packages.txt, CI, the smoke script, and a new publish-darnit-reproducibility job in release.yml.

I tested your scenario in a fresh venv (darnit-mcp 0.1.1 from PyPI, then this branch's wheels): darnit list shows only amber, no failed-to-load line, and -f reproducibility gives a clear "framework not found".

2. using-skills.md - the three remaining references are now amber.

3. CHANGELOG- the BREAKING entry now lists the migration steps (uninstall, -f amber, serve --framework, MCP configs, [plugins].allowed, [[compose]] source, Python import).

4. Nits fixed: baseline_capture.py docstrings, the em-dash in the display name, and the commit trailer.

Order with #674: both are mine, so easiest is to merge this first and I'll rebase #674 and rename there - it only touches release.yml, so it's small. One thing to flag: darnit-amber has no PyPI project yet.

Local run: 377 passed, 1 skipped; ruff and validate_sync.py clean.

Assisted by Claude Code

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

Dependency analysis recommends DO NOT PROCEED, but every flagged package is a newly added entry in test fixture requirements files, which lowers urgency. Fixes exist for the numpy findings (lock_plus_loose_repo pins numpy 1.0 with 7 advisories including CVE-2019-6446; compound_repo has unpinned numpy with 8 advisories) via pip install numpy==1.26.4, and for requests 2.31.0 (CVE-2024-47081, CVE-2024-35195, CVE-2026-25645) via pip install requests==2.34.2. These are actionable and introduced by this PR, so we strongly recommend applying them before merging, unless the fixtures deliberately model vulnerable or loose pins, in which case state that in the PR description. The click 8.0 and 8.1.7 finding (PYSEC-2026-2132, CVE-2026-7246) has no fix and is not actionable, so it is not counted against the PR. Also verify that click 8.0 and numpy 1.0 are real registry versions, and note the end-of-life flags on numpy 1.26.4 and 1.26. Code analysis is clean apart from an informational zizmor notice at release.yml line 310 suggesting PyPI Trusted Publishing instead of the long-lived PYPI_API_TOKEN. The job has contents: read only and actions pinned to commit SHAs, so this is optional hardening and not exploitable. Overall, the actionable dependency advisories warrant addressing first.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Dependency Mitigations

• numpy has advisories in two fixtures: lock_plus_loose_repo/requirements.txt pins numpy 1.0 (7 advisories, including CVE-2019-6446 with EPSS percentile 0.98066), and compound_repo/requirements.txt has no version pin (8 advisories). The vulnerabilityFixReport gives a fix for both. Run: pip install numpy==1.26.4. If these fixtures intentionally model loose or unpinned dependencies, leave them as they are and say so in the PR description.
• requests 2.31.0 (tests/darnit_amber/fixtures/version_pinned_repo/requirements.txt) has 3 advisories (CVE-2024-47081, CVE-2024-35195, CVE-2026-25645). Dependency path: requests@2.31.0 -> sigstore@4.5.0 -> darnit-core@0.1.1 -> darnit-mcp@0.1.1. Run: pip install requests==2.34.2. The report lists no dep_bumps for this fix.

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 05acb26, performed at: 2026-11-04T19:54:03Z

Found this helpful? Give it a 👍 or 👎 reaction!

[Marc-cn]

Rebased again on today's main (05acb26, conflicts in CHANGELOG and test_plan_contract.py from #603/#676; the smoke script's framework list is renamed too). Your Oct 30 items are all in: transitional darnit-reproducibility with darnit-mcp depending on it for one release, using-skills.md, CHANGELOG migration steps.

On Kusari Inspector's "do not proceed": every flagged file is a pin-classifier fixture (old or unpinned numpy is what those fixtures test) moving from tests/darnit_reproducibility/ to tests/darnit_amber/; git diff -M --name-status origin/main...HEAD shows all 17 requirements/lock files as R100, byte-identical to main. Nothing new is added to the tree.

Ready for the re-review; #678 is rebased on this head.