fix(release): require selected extras in SBOM closure; restore galaxy travel floor

Two outstanding Codex review findings on PR 148:

1. _declared_dependencies() now includes every marker-applicable
   requirement from the [all] and [test] extras (the groups the release
   workflow installs before capturing the SBOM), evaluating PEP 508
   environment markers against the capture interpreter via
   packaging.markers. A truncated SBOM containing only the core
   dependency can no longer pass the closure check.

2. Restored the Complete Galaxy orbital-travel floors from .00005 back
   to .001: 96ff9b6 had restored them but the change was lost in the
   following commit's rewrite of the file.

Added focused regression tests for both extras-closure behavior and
marker-inapplicable extras being correctly not required.

Author: Coding-Dev-Tools

scripts/release_evidence.py

@@ -21,9 +21,11 @@
     tomllib = None
 
 try:  # Prefer the installed packaging module when available.
+    from packaging.markers import InvalidMarker, Marker
     from packaging.specifiers import InvalidSpecifier, SpecifierSet
     from packaging.version import InvalidVersion, Version
 except ImportError:  # pragma: no cover - fallback for environments without top-level packaging
+    from pip._vendor.packaging.markers import InvalidMarker, Marker
     from pip._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
     from pip._vendor.packaging.version import InvalidVersion, Version
 
@@ -37,6 +39,10 @@
 _PACKAGE_LOCK_LINE = re.compile(r"([A-Za-z0-9][A-Za-z0-9_.-]*)==([^\s]+)\Z")
 _IMAGE_DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
 _BUILDER_IMAGE = "github-hosted:ubuntu-latest/python-3.11"
+# Extras installed by the release workflow (`.github/workflows/release.yml` runs
+# `pip install ... ".[all,test]"` before capturing the SBOM), so the captured
+# closure must include every marker-applicable requirement they declare.
+_RELEASE_EXTRAS = ("all", "test")
 _BUILDER_TOOLCHAIN = {
     "build": "1.5.0",
     "pip": "26.2",
@@ -271,10 +277,13 @@ def _version_satisfies(version: str, specifier: str) -> bool:
 
 
 def _declared_dependencies(root: Path) -> dict[str, str | None]:
-    """Return {canonical_name: specifier} from pyproject.toml [project].dependencies.
+    """Return {canonical_name: specifier} required in the captured SBOM closure.
 
-    Only core runtime dependencies are validated against the SBOM closure.
-    Optional extras are intentionally excluded.
+    Covers [project].dependencies plus every requirement declared by the extras
+    the release workflow installs (``_RELEASE_EXTRAS``).  PEP 508 environment
+    markers are evaluated against the running interpreter, which in the release
+    workflow is the same environment that captures the SBOM; requirements whose
+    markers do not apply are not required.
     """
     pyproject = root / "pyproject.toml"
     try:
@@ -288,9 +297,18 @@ def _declared_dependencies(root: Path) -> dict[str, str | None]:
         except (KeyError, ValueError):
             parsed = {}
         project = parsed.get("project", {}) if isinstance(parsed, dict) else {}
-        core = project.get("dependencies", []) if isinstance(project, dict) else []
-        if isinstance(core, list):
-            requirements.extend(item for item in core if isinstance(item, str))
+        if isinstance(project, dict):
+            core = project.get("dependencies", [])
+            if isinstance(core, list):
+                requirements.extend(item for item in core if isinstance(item, str))
+            extras = project.get("optional-dependencies", {})
+            if isinstance(extras, dict):
+                for extra in _RELEASE_EXTRAS:
+                    group = extras.get(extra)
+                    if isinstance(group, list):
+                        requirements.extend(
+                            item for item in group if isinstance(item, str)
+                        )
     else:
         project = re.search(r"(?ms)^\[project\]\s*(.*?)(?=^\[|\Z)", raw)
         if project is not None:
@@ -299,13 +317,38 @@ def _declared_dependencies(root: Path) -> dict[str, str | None]:
             )
             if deps_block is not None:
                 requirements.extend(re.findall(r'"([^"]+)"', deps_block.group(1)))
+        extras_table = re.search(
+            r"(?ms)^\[project\.optional-dependencies\]\s*(.*?)(?=^\[|\Z)", raw,
+        )
+        if extras_table is not None:
+            for extra in _RELEASE_EXTRAS:
+                group = re.search(
+                    r"(?m)^" + re.escape(extra) + r"\s*=\s*\[(.*?)\]",
+                    extras_table.group(1), re.DOTALL,
+                )
+                if group is not None:
+                    requirements.extend(re.findall(r'"([^"]+)"', group.group(1)))
     deps: dict[str, str | None] = {}
     for requirement in requirements:
         if not isinstance(requirement, str) or not requirement.strip():
             continue
         name, specifier = _parse_requirement(requirement)
-        if name:
-            deps[_canonical_package_name(name)] = specifier
+        canonical = _canonical_package_name(name)
+        if not canonical or canonical == PACKAGE:
+            continue
+        marker_text = requirement.split(";", 1)[1].strip() if ";" in requirement else ""
+        if marker_text:
+            try:
+                applies = Marker(marker_text).evaluate()
+            except InvalidMarker as exc:
+                raise EvidenceError(
+                    "pyproject.toml declares an unparsable environment marker: "
+                    + marker_text
+                ) from exc
+            if not applies:
+                continue
+        if canonical not in deps or deps[canonical] is None:
+            deps[canonical] = specifier
     return deps
 
 def _python_sbom_packages(document: dict[str, Any]) -> set[tuple[str, str]]:

tests/e2e/graph-engine.spec.js

@@ -2270,10 +2270,10 @@ test('served Complete Galaxy uses the lightweight all-body orbit path instead of
       expect(after.diagnostics.lastRelationCorrections).toBe(0);
       expect(phases.every(phase => phase.global.count === 3335 && phase.global.missing === 0
         && phase.global.nonFinite === 0 && phase.global.frozen === 0 && phase.global.totalFrozen === 0
-        && phase.global.minTravel > .00005), JSON.stringify(phases.map(phase => phase.global))).toBe(true);
+        && phase.global.minTravel > .001), JSON.stringify(phases.map(phase => phase.global))).toBe(true);
       expect(phases.every(phase => phase.local.count === 2960 && phase.local.missing === 0
         && phase.local.nonFinite === 0 && phase.local.frozen === 0 && phase.local.totalFrozen === 0
-        && phase.local.minTravel > .00005), JSON.stringify(phases.map(phase => phase.local))).toBe(true);
+        && phase.local.minTravel > .001), JSON.stringify(phases.map(phase => phase.local))).toBe(true);
       expect(phases.every(phase => phase.carrierCount === 375 && phase.systemCount === 375
         && phase.carrierFailures.length === 0 && phase.carrierMaxError < 1e-8),
       JSON.stringify(phases.map(phase => ({ count: phase.carrierCount, error: phase.carrierMaxError,

tests/test_release_evidence.py

@@ -617,6 +617,41 @@ def test_release_evidence_rejects_prerelease_versions_against_pep440_floors(tmp_
         _build(root, dist, inputs=inputs)
 
 
+def test_release_evidence_requires_selected_extra_dependencies(tmp_path):
+    """The closure must include requirements from the extras the workflow installs."""
+    root = _root(tmp_path)
+    (root / "pyproject.toml").write_text(
+        '[project]\nname = "engraphis"\nversion = "1.2.3"\n'
+        'dependencies = ["alpha-package>=1.0"]\n'
+        "[project.optional-dependencies]\n"
+        "all = ['extra-dep>=1.0; python_version >= \"3.9\"']\n"
+        "test = ['test-dep>=0.1']\n",
+        encoding="utf-8",
+    )
+    dist = _dist(root)
+    inputs = _release_inputs(root, dist)
+    # SBOM and lock carry only the core dependency; extra-dep/test-dep are missing.
+    with pytest.raises(EvidenceError, match="missing declared dependencies"):
+        _build(root, dist, inputs=inputs)
+
+
+def test_release_evidence_ignores_extra_dependencies_with_inapplicable_markers(tmp_path):
+    """Extras requirements whose environment marker excludes this interpreter are
+    not required, mirroring what pip installs in the capture environment."""
+    root = _root(tmp_path)
+    (root / "pyproject.toml").write_text(
+        '[project]\nname = "engraphis"\nversion = "1.2.3"\n'
+        'dependencies = ["alpha-package>=1.0"]\n'
+        "[project.optional-dependencies]\n"
+        "all = ['future-dep>=1.0; python_version < \"3.9\"']\n"
+        "test = ['legacy-dep>=0.1; python_version < \"3.9\"']\n",
+        encoding="utf-8",
+    )
+    dist = _dist(root)
+    evidence = _build(root, dist)
+    assert evidence["environment_lock"]["package_count"] == 2
+
+
 def test_release_evidence_rejects_sbom_with_mismatched_root_purl(tmp_path):
     """An SBOM whose metadata.component PURL names a different package must fail."""
     root = _root(tmp_path)