[rmcdaniel]

Refs #303.

Package checks and release builds currently install unversioned build and twine. Pin both jobs to build 1.6.1 and twine 7.0.0, and require the existing policy preflight's PyYAML 6.0.2 to come from a wheel.

Validated locally with those exact tools: wheel and source distribution build, twine checks, exact-source release metadata comparison, and public-boundary scan pass. CI will demonstrate the same pinned package-tool installation before merge. The privileged PyPI upload job is unchanged.

[rmcdaniel]

A follow-up step in this work was policy-blocked; required CI and review remain the next actions.

[rmcdaniel]

CI identified two concrete follow-ups on the same PR: the binary-only flag needed a YAML block (now fixed), and Sonar requires wheel-only build/twine installs as well. I am fixing the install commands and checking the central policy failure before rerunning CI. No checks or review gates are being weakened.

[rmcdaniel]

Corrected head 6d5501e uses the exact centrally reviewed --only-binary :all: spelling for policy PyYAML, plus wheel-only build/twine installs. All workflow YAML parses and the current central qualification validator passes locally. This fixes the observed preflight and Sonar findings in source; CI reruns on the same PR.

[rmcdaniel]

Security exact-head PASS for 6d5501e1225b44613dc205a76286aa96da1c37af.

Relative to reviewed #312, the source delta is limited to three credential-free install commands. The ordinary package job and release build job now install exact top-level build==1.6.1 and twine==7.0.0; the central policy bootstrap keeps exact PyYAML==6.0.2. Every command applies --only-binary :all:, so top-level and transitive installation cannot execute an sdist build. The valid YAML block form is accepted by the shared policy validator.

The privileged PyPI job remains byte-unchanged: it installs nothing, executes no candidate source, retains the immutable artifact ID/digest/source-run checks, and alone holds id-token: write. Build, metadata comparison, twine check and package smoke remain in the unprivileged producer job before the bound handoff. The identical package-job command completed successfully on this head, and all 21 checks are green, including central policy, package, public boundary and target-branch qualification.

No Security blocker remains at this exact head. Any workflow or source change requires counter-review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Incorporated by release PR #314 after exact-head Security approval. The merged release contains the reviewed wheel-only tool pins, with unchanged source checks and publication gates. Closing this separate PR avoids a redundant main ancestry/CI cycle; #303 remains open until publication verifies the installed tooling path.