1. Consumed Contract Ledger¶
This ledger records external contracts that aws-tui consumes and the pinned versions checked during maintenance. It is not a replacement for tests; it is a durable map of the real upstream surfaces that mocks and adapters must track.
1.1. 2026-07-01 maintenance pass¶
| Integration point | Pinned version / ref | Consumed contract | Verification method |
|---|---|---|---|
aioboto3.Session().client("s3", ...) via S3FS and MinIO seed scripts |
aioboto3==15.5.0, aiobotocore==2.25.1 from uv.lock |
Async S3 client creation accepts botocore Config, endpoint_url, and verify; client exposes paginator/object APIs used by S3FS. |
Source trace through src/aws_tui/domain/s3_fs.py, src/aws_tui/services/s3/service.py, and scripts/test-services/s3/seed.py; focused unit coverage for verify_tls; full pytest suite includes mock-backed and MinIO-marked paths where available locally. |
| Boto credential/profile and S3-compatible options | boto3==1.40.61, botocore==1.40.61 from uv.lock |
Profiles, regions, endpoint URLs, path-style addressing, TLS verification, retries, read/connect timeout configuration, and temporary session-token propagation from session_token, ${PREFIX}_SESSION_TOKEN, and aws_session_token into botocore/aioboto3 aws_session_token. |
Source trace through src/aws_tui/infra/aws_session.py, src/aws_tui/infra/connection_resolver.py, and S3 provider construction; config parser now rejects non-string connection text fields and string booleans so TOML must match the string/bool contract before values reach botocore. |
| EMR Serverless client and log-discovery contracts | botocore==1.40.61 service model, EMR Serverless API 2021-07-13 |
Operations ListApplications, ListJobRuns, GetJobRun, and StartJobRun; request fields applicationId, jobRunId, states, nextToken, maxResults; response fields applications, jobRuns, jobRun, and pagination nextToken; ApplicationState and JobRunState enums; S3 log key conventions for stdout/stderr, Spark event logs, and application-driver paths. |
Installed botocore model introspection against the locked environment plus source trace through src/aws_tui/domain/emr_serverless.py, src/aws_tui/domain/emr_logs.py, and src/aws_tui/services/emr_serverless/service.py; unit/integration coverage exercises state mapping, pagination, detail/log panes, clone-from-run, and S3 log listing. |
| Textual app/runtime API | textual==8.2.7 from uv.lock |
App launch, bindings, modal/screen stack, widgets, pilot tests, and snapshot rendering. | Full integration/snapshot test run exercises app startup, modals, focus cycling, settings flows, theme propagation, and demo mode. |
| VMx view-model helpers | vmx==3.1.0 from uv.lock |
VM lifecycle, observable state, message protocol, command disposal, and form/composite/dialog/pagination helper contracts referenced by the VM layer and docs. | Import-level compatibility smoke plus focused VM tests against the locked environment; this branch also records the VMx 3.1.0 adoption audit and keeps larger adapter replacements deferred behind that report. |
| MinIO local S3 harness | Docker image minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e; testcontainers==4.14.2 from uv.lock |
S3-compatible endpoint, readiness probe, seeded buckets/objects, path-style config, local credentials, and host port exposure. | Manual trace of scripts/test-services/s3/docker-compose.yml, seed.py, and config-snippet.toml; snippet updated to match current Settings/default-connection flows, and Compose ports now bind to 127.0.0.1 only. The MinIO integration fixture now passes the same explicit image ref to testcontainers.minio.MinioContainer(image=...), avoiding the older package default image. The Python minio==7.2.20 package is consumed by the separate testcontainers[minio] integration fixture. |
| Config, path, and secret-storage helpers | keyring==25.7.0, tomli-w==1.2.0, platformdirs==4.10.0 from uv.lock |
OS keychain get/set/delete behavior, TOML serialization for config.toml, and platform-native config/cache path resolution with legacy fallback directories. |
Source trace through src/aws_tui/infra/keychain.py, src/aws_tui/infra/config_store.py, and src/aws_tui/infra/paths.py; unit coverage exercises keyring delegation/error handling, strict TOML bool parsing/saving, private config/journal permissions, and platformdirs fallback behavior. |
| Python package build backend | hatchling==1.30.1 from uv.lock; build-system.requires constrained to hatchling>=1.21,<2 |
PEP 517 wheel/sdist build behavior, package metadata, and version-file inclusion. | Build backend installed in the locked dev environment; CI and release run uv build --no-build-isolation so artifacts do not resolve an untracked hatchling version at build time. |
| GitHub Actions CI/release/publish workflow | Immutable action SHAs resolved on 2026-07-01: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 (v4), astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 (v7 peeled commit), actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a (v7), actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 (v7), pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b (release/v1), peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c (v6); uv==0.11.19 |
Checkout, pinned uv installation, CI/build artifact upload, release artifact download, Sigstore/OIDC PyPI publishing, TestPyPI rehearsal, GitHub Release asset upload, and Homebrew tap PR creation. | git ls-remote verification of each tag/branch before pinning; YAML parse plus workflow source review; release job uses uv sync --frozen, builds without isolation, requires manual PyPI dispatch from the matching tag, checks the release tag is reachable from origin/main, creates the GitHub Release through the REST API with target_commitish set to the resolved tag SHA instead of depending on the runner's preinstalled gh CLI, and hashes the built sdist for the Homebrew bump instead of fetching PyPI's CDN. |
| Pre-commit hooks | Immutable refs resolved on 2026-07-01: pre-commit-hooks@2c9f875913ee60ca25ce70243dc24d5b6415598c (v4.6.0), ruff-pre-commit@3b3f7c3f57fe9925356faf5fe6230835138be230 (v0.15.17), taplo-pre-commit@ade0f95ddcf661c697d4670d2cfcbe95d0048a0a (v0.9.3 peeled commit); local mypy via locked env |
Formatting, linting, type checking, TOML validation, trailing whitespace, EOF, and large-file hygiene. | git ls-remote verification of each tag before pinning; local equivalent checks were run from the pyenv uv 0.11.19 shim, and CI uses setup-uv v7 with uv sync --frozen. |
1.2. Deferred contract checks¶
- External upstream documentation was not exhaustively re-queried for every library API. The concrete code paths above were checked against the locked dependency graph and strengthened with tests where this pass changed behavior.