Delete ci

ci/README.md

@@ -1,111 +0,0 @@
-# Provider-artifact Redis chaos CI
-
-Run 147 makes the Run 146 live Redis gate reproducible without changing the
-provider-artifact public API.
-
-The portable entrypoint is:
-
-```bash
-python _hf_spaces_proxy/ci/run_redis_chaos.py --mode all
-```
-
-It is intentionally **fail closed**: Redis 7/8 `redis-server`, `pytest`, and the
-pinned `redis-py` cluster client must exist. The entrypoint sets the mandatory
-no-skip flags for the live tests itself.
-
-Modes:
-
-- `standalone` — executes the Run 146 real-Lua/restart tests plus the Run 147
-  standalone binary smoke.
-- `cluster` — bootstraps six real Redis nodes (3 primaries + 3 replicas), assigns
-  all 16,384 slots without `redis-cli`, races two OS processes for one lifecycle
-  reservation, kills the primary that owns the `{provider-artifact}` slot, waits
-  for replica promotion, and proves terminal non-replay plus new lifecycle work.
-- `all` — runs both gates.
-
-For exact Redis-major CI, build the included `redis-chaos.Dockerfile` from the
-repository root. It copies `redis-server` from the selected official Redis
-bookworm image into a Python image, installs the proxy's pinned requirements,
-and runs the portable entrypoint. Reference GitHub Actions and CircleCI job
-fragments are included beside this file for Redis 7.4.11 and 8.2.9.
-
-The container examples are read-only and grant Redis writable storage only via
-bounded `/tmp` and `/var/tmp` tmpfs mounts. They drop Linux capabilities and set
-`no-new-privileges`.
-
-The chaos gate never needs production Redis URLs, credentials, provider tokens,
-prompts, generated media, or ZIP contents. Every Redis process binds only to
-loopback inside the disposable CI container.
-
-
-## Run 148 release attestation output
-
-For release CI, invoke the same gate with a destination outside the source tree:
-
-```bash
-python _hf_spaces_proxy/ci/run_redis_chaos.py --mode all \
-  --attestation-dir /secure/evidence \
-  --source-revision "$SOURCE_REVISION" \
-  --redis-image 'redis:8.2.9-bookworm@sha256:7d1e4ce8b9395088377ab382d1f6cfdbd13b3690795198a0399ab8d683064d6d'
-```
-
-Run Redis 7 and Redis 8 separately so release evidence contains all four required
-major/mode combinations. `--redis-image` must contain both the reviewed version tag
-and an immutable SHA-256 index digest. Attestation output inside the source tree is
-rejected to avoid self-referential source subjects.
-
-The emitted JSON is a canonical **subject**, not a self-authenticating signature. The
-parent CI must cryptographically sign/attest it, verify the signer identity, and only
-then create a sanitized signature-verification record. GitHub Actions reference jobs
-show this with the SHA-pinned `actions/attest` action plus `gh attestation verify`;
-the verification command additionally pins the exact `GITHUB_SHA` and `GITHUB_REF`,
-derives the signing-workflow identity from `GITHUB_WORKFLOW_REF`, pins its signer
-digest, and rejects self-hosted-runner attestations. CircleCI environments should use
-the organization's approved Sigstore/KMS/HSM flow,
-then call `redis_chaos_attestation.py signature-record` only after that verifier exits
-successfully.
-
-## Run 149 promotion handoff
-
-Redis chaos and schema-v2 evidence are inputs to the transactional promotion layer;
-they are not permission to publish arbitrary rebuilt bytes. Parent CI should run
-`security/promote_release.py prepare`, sign/verify the emitted canonical statement
-with the approved release trust root, create a sanitized signature record bound to the
-actual verifier output, and run `promote_release.py finalize`. Upload/publish only the
-exact receipt-listed objects from the final promotion directory.
-
-
-## Run 151 post-publication handoff
-
-After Run 150 publishes the receipt-authorized objects, use
-`security/finalize_publication.py prepare` with credentials that are distinct from the
-publisher and read-only for the release target. Cryptographically sign/attest the
-resulting `publication-attestation.json`, verify the exact expected signer identity with
-the organization's release trust root, and create the sanitized signature-verification
-record only after that verifier succeeds.
-
-Then run `finalize_publication.py finalize` with the same independent verifier identity
-and a create-only final-record binder. The finalizer re-reads every release object after
-signature verification and permits the binder to attach only the fixed deterministic
-`release-publication-record.json` to the original target. GitHub deployments should use
-a read-only release-asset verifier identity distinct from the upload identity; object
-stores and registries should use equivalent separate read-only principals. Do not place
-signing keys, publisher tokens, verifier tokens, signed URLs, or raw credential-bearing
-provider output in the generated evidence.
-
-## Run 152 transparency witness handoff
-
-After Run 151 creates and binds `release-publication-record.json`, submit those exact
-bytes to the approved append-only transparency service using
-`security/witness_publication.py`. CI must provide a previously trusted checkpoint for
-the same log, a log submitter identity, a separate read-only primary verifier, and the
-configured witness quorum. The default policy requires at least two distinct witness
-identities operated by at least two distinct operators.
-
-The primary verifier and every witness must independently verify the log checkpoint
-signature, exact entry inclusion, integrated entry, and consistency from the pinned
-previous checkpoint. Do not satisfy quorum with aliases sharing one credential or one
-mutable trust root. After quorum, the release-evidence anchor may create-only attach the
-deterministic witnessed record and must read it back before success. Persist the emitted canonical `accepted-transparency-checkpoint.json` for the next
-release only after this gate succeeds; pass those exact bytes back as the next
-`--previous-checkpoint`.

ci/circleci.redis-chaos.reference.yml

@@ -1,68 +0,0 @@
-# Reference CircleCI job fragment. Merge under the parent repository's jobs/workflows keys.
-# The jobs emit canonical Run 148 attestations. Before production promotion, an
-# organization-approved cryptographic signer/verifier MUST create the paired
-# *.signature-verification.json records consumed by verify_release_evidence.py.
-version: 2.1
-
-jobs:
-  provider_artifact_redis_chaos_7:
-    machine:
-      image: ubuntu-2404:current
-    resource_class: medium
-    steps:
-      - checkout
-      - run:
-          name: Redis 7.4.11 standalone + cluster live-Lua chaos gate
-          command: |
-            REDIS_IMAGE='redis:7.4.11-bookworm@sha256:71da9275c5f3fcb97d0fa0c8c5b36cc995327265420f17a04bfd544f458059f7'
-            mkdir -p /tmp/redis-chaos-evidence
-            docker build \
-              -f scikitplot/_externals/_sphinx_ext/_sphinx_ai_assistant/_hf_spaces_proxy/ci/redis-chaos.Dockerfile \
-              --build-arg REDIS_IMAGE="$REDIS_IMAGE" \
-              -t scikitplot-redis-chaos:7 .
-            docker run --rm --read-only \
-              --tmpfs /tmp:rw,nosuid,nodev,noexec,size=256m \
-              --tmpfs /var/tmp:rw,nosuid,nodev,noexec,size=256m \
-              --mount type=bind,src=/tmp/redis-chaos-evidence,dst=/evidence \
-              --cap-drop ALL --security-opt no-new-privileges \
-              scikitplot-redis-chaos:7 --mode all \
-              --attestation-dir /evidence \
-              --source-revision "$CIRCLE_SHA1" \
-              --redis-image "$REDIS_IMAGE"
-      - store_artifacts:
-          path: /tmp/redis-chaos-evidence
-          destination: redis-chaos-evidence-7
-
-  provider_artifact_redis_chaos_8:
-    machine:
-      image: ubuntu-2404:current
-    resource_class: medium
-    steps:
-      - checkout
-      - run:
-          name: Redis 8.2.9 standalone + cluster live-Lua chaos gate
-          command: |
-            REDIS_IMAGE='redis:8.2.9-bookworm@sha256:7d1e4ce8b9395088377ab382d1f6cfdbd13b3690795198a0399ab8d683064d6d'
-            mkdir -p /tmp/redis-chaos-evidence
-            docker build \
-              -f scikitplot/_externals/_sphinx_ext/_sphinx_ai_assistant/_hf_spaces_proxy/ci/redis-chaos.Dockerfile \
-              --build-arg REDIS_IMAGE="$REDIS_IMAGE" \
-              -t scikitplot-redis-chaos:8 .
-            docker run --rm --read-only \
-              --tmpfs /tmp:rw,nosuid,nodev,noexec,size=256m \
-              --tmpfs /var/tmp:rw,nosuid,nodev,noexec,size=256m \
-              --mount type=bind,src=/tmp/redis-chaos-evidence,dst=/evidence \
-              --cap-drop ALL --security-opt no-new-privileges \
-              scikitplot-redis-chaos:8 --mode all \
-              --attestation-dir /evidence \
-              --source-revision "$CIRCLE_SHA1" \
-              --redis-image "$REDIS_IMAGE"
-      - store_artifacts:
-          path: /tmp/redis-chaos-evidence
-          destination: redis-chaos-evidence-8
-
-workflows:
-  redis_chaos_reference:
-    jobs:
-      - provider_artifact_redis_chaos_7
-      - provider_artifact_redis_chaos_8

ci/github-actions.redis-chaos.reference.yml

@@ -1,81 +0,0 @@
-# Reference job. Merge into the parent repository workflow rather than running this file directly.
-name: redis-chaos-reference
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  id-token: write
-  attestations: write
-
-jobs:
-  provider-artifact-redis-chaos:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 25
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - redis_major: 7
-            redis_image: redis:7.4.11-bookworm@sha256:71da9275c5f3fcb97d0fa0c8c5b36cc995327265420f17a04bfd544f458059f7
-          - redis_major: 8
-            redis_image: redis:8.2.9-bookworm@sha256:7d1e4ce8b9395088377ab382d1f6cfdbd13b3690795198a0399ab8d683064d6d
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Build isolated digest-pinned Redis chaos image
-        run: |
-          docker build \
-            -f scikitplot/_externals/_sphinx_ext/_sphinx_ai_assistant/_hf_spaces_proxy/ci/redis-chaos.Dockerfile \
-            --build-arg REDIS_IMAGE='${{ matrix.redis_image }}' \
-            -t scikitplot-redis-chaos:ci .
-      - name: Run standalone + cluster live-Lua chaos gate and emit canonical evidence
-        run: |
-          mkdir -p "$RUNNER_TEMP/redis-chaos-evidence"
-          docker run --rm \
-            --read-only \
-            --tmpfs /tmp:rw,nosuid,nodev,noexec,size=256m \
-            --tmpfs /var/tmp:rw,nosuid,nodev,noexec,size=256m \
-            --mount "type=bind,src=$RUNNER_TEMP/redis-chaos-evidence,dst=/evidence" \
-            --cap-drop ALL \
-            --security-opt no-new-privileges \
-            scikitplot-redis-chaos:ci \
-            --mode all \
-            --attestation-dir /evidence \
-            --source-revision '${{ github.sha }}' \
-            --redis-image '${{ matrix.redis_image }}'
-      - name: Cryptographically attest canonical Redis chaos evidence
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
-        with:
-          subject-path: '${{ runner.temp }}/redis-chaos-evidence/*.json'
-      - name: Verify signatures and emit sanitized release records
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -eu
-          signer_workflow="${GITHUB_WORKFLOW_REF%@*}"
-          test -n "$signer_workflow"
-          for attestation in "$RUNNER_TEMP"/redis-chaos-evidence/redis-chaos-redis${{ matrix.redis_major }}-*.json; do
-            gh attestation verify "$attestation" \
-              -R "$GITHUB_REPOSITORY" \
-              --source-digest "$GITHUB_SHA" \
-              --source-ref "$GITHUB_REF" \
-              --signer-workflow "$signer_workflow" \
-              --signer-digest "$GITHUB_SHA" \
-              --deny-self-hosted-runners \
-              --format json >/dev/null
-            stem="${attestation%.json}"
-            python scikitplot/_externals/_sphinx_ext/_sphinx_ai_assistant/_hf_spaces_proxy/ci/redis_chaos_attestation.py \
-              signature-record \
-              --attestation "$attestation" \
-              --output "${stem}.signature-verification.json" \
-              --source-revision '${{ github.sha }}'
-          done
-      - name: Upload signed Redis chaos release evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: redis-chaos-evidence-${{ matrix.redis_major }}
-          path: '${{ runner.temp }}/redis-chaos-evidence/'
-          if-no-files-found: error
-          retention-days: 7

ci/redis-chaos.Dockerfile

@@ -1,19 +0,0 @@
-# Reproducible Run 147 Redis chaos image.
-# Build from the repository root so the complete scikitplot package is copied.
-# Example:
-#   docker build -f scikitplot/_externals/_sphinx_ext/_sphinx_ai_assistant/_hf_spaces_proxy/ci/redis-chaos.Dockerfile \
-#     --build-arg REDIS_IMAGE=redis:8.2.9-bookworm@sha256:7d1e4ce8b9395088377ab382d1f6cfdbd13b3690795198a0399ab8d683064d6d -t sphinx-ai-redis-chaos:8 .
-ARG REDIS_IMAGE=redis:8.2.9-bookworm@sha256:7d1e4ce8b9395088377ab382d1f6cfdbd13b3690795198a0399ab8d683064d6d
-FROM ${REDIS_IMAGE} AS redis_runtime
-
-FROM python:3.13-slim-bookworm
-COPY --from=redis_runtime /usr/local/bin/redis-server /usr/local/bin/redis-server
-WORKDIR /workspace
-COPY scikitplot/_externals/_sphinx_ext/_sphinx_ai_assistant/_hf_spaces_proxy/requirements.txt /tmp/proxy-requirements.txt
-RUN python -m pip install --no-cache-dir -r /tmp/proxy-requirements.txt pytest
-COPY . /workspace
-ENV PYTHONPATH=/workspace \
-    PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1
-ENTRYPOINT ["python", "scikitplot/_externals/_sphinx_ext/_sphinx_ai_assistant/_hf_spaces_proxy/ci/run_redis_chaos.py"]
-CMD ["--mode", "all"]

ci/redis_chaos_attestation.py

@@ -1,189 +0,0 @@
-"""
-Canonical Redis chaos attestation payloads for Run 148 release evidence.
-"""
-
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-import logging
-import re
-import sys
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any
-
-HERE = Path(__file__).resolve().parent
-EXTENSION_ROOT = HERE.parents[1]
-SECURITY = EXTENSION_ROOT / "_hf_spaces_proxy" / "security"
-if str(SECURITY) not in sys.path:
-    sys.path.insert(0, str(SECURITY))
-
-from source_tree import source_tree_sha256  # noqa: E402
-
-logger = logging.getLogger(__name__)
-
-SCHEMA_VERSION = 1
-PREDICATE_TYPE = (
-    "https://scikit-plots.org/attestations/provider-artifact-redis-chaos/v1"
-)
-TOOL_NAME = "scikitplot-provider-artifact-redis-chaos"
-TOOL_VERSION = "148"
-_REVISION = re.compile(r"^[0-9a-f]{40}(?:[0-9a-f]{24})?$")
-_IMAGE = re.compile(r"^redis:[A-Za-z0-9._-]+@sha256:[0-9a-f]{64}$")
-
-
-class AttestationError(RuntimeError):
-    """Attestation inputs violate the fail-closed Run 148 contract."""
-
-
-def validate_source_revision(  # ruff: ignore[undocumented-public-function]
-    value: str,
-) -> str:
-    rendered = str(value or "").strip().lower()
-    if _REVISION.fullmatch(rendered) is None:
-        raise AttestationError("SOURCE_REVISION_INVALID")
-    return rendered
-
-
-def validate_redis_image(  # ruff: ignore[undocumented-public-function]
-    value: str,
-) -> str:
-    rendered = str(value or "").strip()
-    if _IMAGE.fullmatch(rendered) is None:
-        raise AttestationError("REDIS_IMAGE_NOT_DIGEST_PINNED")
-    return rendered
-
-
-def _outside_source_tree(path: Path) -> Path:
-    target = path.expanduser().resolve()
-    root = EXTENSION_ROOT.resolve()
-    if target == root or root in target.parents:
-        raise AttestationError("ATTESTATION_OUTPUT_INSIDE_SOURCE_TREE")
-    return target
-
-
-def build_attestation(  # ruff: ignore[undocumented-public-function]
-    *,
-    mode: str,
-    redis_major: int,
-    redis_image: str,
-    source_revision: str,
-    generated_at: datetime | None = None,
-) -> dict[str, Any]:
-    if mode not in {"standalone", "cluster"}:
-        raise AttestationError("REDIS_CHAOS_MODE_INVALID")
-    if redis_major not in {7, 8}:
-        raise AttestationError("REDIS_MAJOR_INVALID")
-    revision = validate_source_revision(source_revision)
-    image = validate_redis_image(redis_image)
-    now = (generated_at or datetime.now(timezone.utc)).astimezone(timezone.utc)
-    return {
-        "schemaVersion": SCHEMA_VERSION,
-        "predicateType": PREDICATE_TYPE,
-        "generatedAt": now.isoformat(timespec="seconds").replace("+00:00", "Z"),
-        "subject": {
-            "sourceRevision": revision,
-            "sourceTreeSha256": source_tree_sha256(EXTENSION_ROOT),
-        },
-        "redis": {
-            "major": redis_major,
-            "image": image,
-            "mode": mode,
-        },
-        "result": {"status": "pass"},
-        "tool": {"name": TOOL_NAME, "version": TOOL_VERSION},
-    }
-
-
-def write_attestation(  # ruff: ignore[undocumented-public-function]
-    directory: Path,
-    *,
-    mode: str,
-    redis_major: int,
-    redis_image: str,
-    source_revision: str,
-) -> Path:
-    root = _outside_source_tree(directory)
-    root.mkdir(parents=True, exist_ok=True)
-    target = root / f"redis-chaos-redis{redis_major}-{mode}.json"
-    payload = build_attestation(
-        mode=mode,
-        redis_major=redis_major,
-        redis_image=redis_image,
-        source_revision=source_revision,
-    )
-    target.write_text(
-        json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8"
-    )
-    return target
-
-
-def _sha256(path: Path) -> str:
-    h = hashlib.sha256()
-    with path.open("rb") as handle:
-        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
-            h.update(chunk)
-    return h.hexdigest()
-
-
-def write_signature_verification_record(  # ruff: ignore[undocumented-public-function]
-    attestation: Path,
-    output: Path,
-    *,
-    source_revision: str,
-) -> Path:
-    revision = validate_source_revision(source_revision)
-    source = attestation.expanduser().resolve()
-    if not source.is_file() or source.is_symlink():
-        raise AttestationError("ATTESTATION_FILE_INVALID")
-    target = _outside_source_tree(output)
-    target.parent.mkdir(parents=True, exist_ok=True)
-    payload = {
-        "schemaVersion": 1,
-        "verified": True,
-        "verifiedAt": (
-            datetime.now(timezone.utc)
-            .isoformat(timespec="seconds")
-            .replace("+00:00", "Z")
-        ),
-        "attestationSha256": _sha256(source),
-        "sourceRevision": revision,
-        "signerIdentityVerified": True,
-    }
-    target.write_text(
-        json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8"
-    )
-    return target
-
-
-def main(  # ruff: ignore[undocumented-public-function]
-    argv: list[str] | None = None,
-) -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    sub = parser.add_subparsers(dest="command", required=True)
-    sig = sub.add_parser(
-        "signature-record",
-        help="emit sanitized record only after an external signature verifier succeeds",
-    )
-    sig.add_argument("--attestation", type=Path, required=True)
-    sig.add_argument("--output", type=Path, required=True)
-    sig.add_argument("--source-revision", required=True)
-    args = parser.parse_args(argv)
-    try:
-        if args.command == "signature-record":
-            write_signature_verification_record(
-                args.attestation,
-                args.output,
-                source_revision=args.source_revision,
-            )
-            return 0
-        raise AttestationError("COMMAND_INVALID")
-    except (AttestationError, OSError) as exc:
-        logger.error("[run148] FAIL: %s", exc)
-        return 2
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

ci/run_redis_chaos.py

@@ -1,208 +0,0 @@
-# Authors: The scikit-plots developers
-# SPDX-License-Identifier: BSD-3-Clause
-
-"""
-Mandatory Redis lifecycle chaos gate for CI.
-
-This entrypoint is intentionally standard-library only. It validates the Redis
-server major, verifies that the configured Python can import the pinned Redis
-client, and then executes the live Redis lifecycle doctors with skip-as-failure
-environment flags enabled.
-
-Run from any working directory::
-
-    python _hf_spaces_proxy/ci/run_redis_chaos.py --mode all
-
-The test suite itself starts disposable standalone/cluster Redis processes. No
-Redis authority URL, password, provider token, prompt, or generated bytes are
-printed by this runner.
-"""
-
-from __future__ import annotations
-
-import argparse
-import logging
-import os
-import re
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-_CI_DIR = Path(__file__).resolve().parent
-if str(_CI_DIR) not in sys.path:
-    sys.path.insert(0, str(_CI_DIR))
-from redis_chaos_attestation import write_attestation  # noqa: E402
-
-_SUPPORTED_REDIS_MAJORS = {7, 8}
-_TRUE = {"1", "true", "yes", "on"}
-logger = logging.getLogger(__name__)
-
-
-def _extension_root() -> Path:
-    return Path(__file__).resolve().parents[2]
-
-
-def _repo_pythonpath() -> Path:
-    # .../scikitplot/_externals/_sphinx_ext/_sphinx_ai_assistant/_hf_spaces_proxy/ci
-    # parents[6] is the directory containing the top-level scikitplot package.
-    return Path(__file__).resolve().parents[6]
-
-
-def _resolve_binary(explicit: str, env_name: str, default_name: str) -> str:
-    candidate = str(explicit or "").strip() or os.environ.get(env_name, "").strip()
-    if candidate:
-        path = Path(candidate).expanduser()
-        if not path.is_file() or not os.access(path, os.X_OK):
-            raise RuntimeError(f"{env_name} does not name an executable file")
-        return str(path.resolve())
-    found = shutil.which(default_name)
-    if not found:
-        raise RuntimeError(f"required executable is unavailable: {default_name}")
-    return found
-
-
-def _redis_major(binary: str) -> int:
-    result = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true]
-        [binary, "--version"],
-        capture_output=True,
-        text=True,
-        timeout=10,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise RuntimeError("redis-server --version failed")
-    rendered = (result.stdout or "") + " " + (result.stderr or "")
-    match = re.search(r"(?:v=|Redis server v=)(\d+)(?:\.|\b)", rendered)
-    if not match:
-        match = re.search(r"\b(\d+)\.\d+(?:\.\d+)?\b", rendered)
-    if not match:
-        raise RuntimeError("could not determine redis-server major version")
-    major = int(match.group(1))
-    if major not in _SUPPORTED_REDIS_MAJORS:
-        raise RuntimeError(
-            f"unsupported redis-server major {major}; expected Redis 7 or 8"
-        )
-    return major
-
-
-def _verify_python_runtime(python: str) -> None:
-    code = (
-        "import pytest, redis; "
-        "from redis.asyncio.cluster import RedisCluster; "
-        "print(getattr(redis, '__version__', 'unknown'))"
-    )
-    result = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true]
-        [python, "-c", code],
-        capture_output=True,
-        text=True,
-        timeout=20,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise RuntimeError(
-            "CI Python must provide pytest, redis, and redis.asyncio.cluster.RedisCluster"
-        )
-
-
-def _run_pytest(*, python: str, redis_server: str, mode: str) -> None:
-    root = _extension_root()
-    env = os.environ.copy()
-    existing = env.get("PYTHONPATH", "").strip()
-    repo_path = str(_repo_pythonpath())
-    env["PYTHONPATH"] = repo_path if not existing else repo_path + os.pathsep + existing
-    env["RUN146_REDIS_SERVER"] = redis_server
-    env["RUN147_REDIS_SERVER"] = redis_server
-
-    if mode == "standalone":
-        env["RUN146_REDIS_CHAOS_REQUIRED"] = "1"
-        env["RUN147_REDIS_STANDALONE_REQUIRED"] = "1"
-        command = [
-            python,
-            "-m",
-            "pytest",
-            "-q",
-            "-p",
-            "no:cacheprovider",
-            "tests/_hf_spaces_proxy/_utils/test__provider_artifact_lifecycle__redis_chaos.py",
-            "tests/_hf_spaces_proxy/ci/test_run_redis_chaos.py",
-            "-k",
-            "live_redis or live_standalone",
-        ]
-    elif mode == "cluster":
-        env["RUN147_REDIS_CLUSTER_REQUIRED"] = "1"
-        command = [
-            python,
-            "-m",
-            "pytest",
-            "-q",
-            "-p",
-            "no:cacheprovider",
-            "tests/_hf_spaces_proxy/ci/test_run_redis_chaos.py",
-            "-k",
-            "live_cluster",
-        ]
-    else:  # pragma: no cover - argparse constrains this
-        raise RuntimeError("unsupported chaos mode")
-
-    result = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true]
-        command,
-        cwd=root,
-        env=env,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise RuntimeError(f"Redis {mode} chaos gate failed")
-
-
-def main(  # ruff: ignore[undocumented-public-function]
-    argv: list[str] | None = None,
-) -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument(
-        "--mode", choices=("standalone", "cluster", "all"), default="all"
-    )
-    parser.add_argument("--redis-server", default="")
-    parser.add_argument("--python", default=sys.executable)
-    parser.add_argument("--attestation-dir", type=Path)
-    parser.add_argument("--source-revision", default="")
-    parser.add_argument("--redis-image", default="")
-    args = parser.parse_args(argv)
-
-    try:
-        redis_server = _resolve_binary(
-            args.redis_server, "RUN147_REDIS_SERVER", "redis-server"
-        )
-        major = _redis_major(redis_server)
-        _verify_python_runtime(args.python)
-        modes = ("standalone", "cluster") if args.mode == "all" else (args.mode,)
-        if args.attestation_dir is not None and (
-            not args.source_revision or not args.redis_image
-        ):
-            raise RuntimeError(
-                "attestation output requires --source-revision and digest-pinned --redis-image"
-            )
-        for mode in modes:
-            logger.info("[run147] Redis %s %s chaos gate", major, mode)
-            _run_pytest(python=args.python, redis_server=redis_server, mode=mode)
-            if args.attestation_dir is not None:
-                logger.info(
-                    "[run147] writing Redis %s attestation for mode=%s", major, mode
-                )
-                write_attestation(
-                    args.attestation_dir,
-                    mode=mode,
-                    redis_major=major,
-                    redis_image=args.redis_image,
-                    source_revision=args.source_revision,
-                )
-        logger.info("[run147] PASS Redis %s mode=%s", major, args.mode)
-        return 0
-    except (OSError, RuntimeError, subprocess.SubprocessError) as exc:
-        # Never include Redis URLs or secret environment values in failures.
-        logger.error("[run147] FAIL: %s", exc)
-        return 2
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())