[aboucaud]

This fixes the test_container_smoke.py failures that every branch now hits. #255 shows them, for example.

What broke

GitHub's runner Python moved to CPython 3.13.17. lc init writes the running interpreter's exact patch to .python-version, and the image installs that interpreter with its pinned uv. uv 0.12.23 has no download for 3.13.17, so every image build stops at:

RUN UV_PYTHON_INSTALL_DIR=/opt/python uv python install 3.13.17
error: No download found for request: cpython-3.13.17-linux-x86_64-gnu

main was last green on Oct 15, before the runner moved.

The fix

image.UV_IMAGE moves to ghcr.io/astral-sh/uv:0.13.5, pinned by its manifest-list digest. This is the same change as #248.

• Why 0.13.5: it is the first uv release with a 3.13.17 download. I checked uv python list 3.13.17 --all-versions against 0.12.24 and 0.13.4, and neither has one.
• Digest: fetched from ghcr's manifest endpoint for the tag. The same query for 0.12.23 returns the digest currently in image.py.
• 0.13.0 breaking changes: none of them touch what the image uses uv for. The image installs a pinned interpreter and runs uv sync. The default-Python change does not apply, because the version is always explicit.

Consequence

The uv pin is part of the image identity document, so containerized outputs read behind after this, as with any uv bump. Direct-mode projects do not move.

Tests

• test_image.py, test_container.py and test_identity.py pass (96).
• ruff and mypy are clean.
• The container smoke suite can't build images in my sandbox, which has no network access for builds, so this PR's CI is its real run.

---

Generated by Claude Code

[github-actions]

✅ Eval

Metric	Value
Outputs check	success
Agent run	success
Turns	8
Tool calls	6
Cost	$0.12
Agent wall time	0m48s
Model	claude-sonnet-5-5

lc status

  mode:    direct
  sandbox: landlock (fs: declared, network: allowed)
  crate:   up to date with the outputs

  · current  baseline/best_fit        199d065
  · current  baseline/hubble_diagram  199d065
  · current  baseline/residuals       199d065

3 current

Confusion & pain points (Claude analysis)

Confusion & pain points

• The one errored command was an over-broad exploratory call. The third Bash call (sed … data/…; cat universes/baseline.yaml pyproject.toml; ls scripts) exited 2 because scripts/ didn't exist yet. The agent was probing for a directory it was about to create, so this cost nothing. The scaffold doesn't say where analysis code goes (lc init deliberately creates no src/). A one-line hint in the scaffolded README or the skill would remove the guess.

• The agent pinned uvx astra-tools@0.2.18 validate rather than calling an installed astra. It used a specific version in an ephemeral environment, which suggests astra was not on PATH or its version was unknown. The eval harness or skill should make astra validate directly runnable, or state the expected astra-tools version, so agents don't guess a pin.

• The agent patched astra.yaml blind with a Python string-replace script. It matched exact scaffold text (recipe:\n command: python scripts/fit.py) to inject format:, inputs: and decisions:. This worked, but it is brittle, and the agent only learned the full required output shape (format mandatory, per-output decisions) from the skill and the scaffold. If the scaffold's output stubs carried format: and inputs: placeholders, or astra had a command to add them, agents wouldn't need ad-hoc text surgery.

• The agent invented the license decision and flagged it. It added license = "CC-BY-4.0" via sed on pyproject.toml. The crate only maintains itself when [project].license is set, and the task gave no license. It disclosed the choice, but a one-line note in the skill or the lc materialize output explaining that a license is needed for ro-crate-metadata.json would make this intentional rather than guessed.

• Otherwise the run was clean. Compute was launched with a plain lc compute launch --wait and the three outputs built on the first lc materialize local. --check passed, and the cluster was released with lc compute down. No reverse-engineering of source or sandbox denials occurred.

Full trace: agent-trace artifact on this run.

[EiffL]

LGTM

[github-actions]

Developer Certificate of Origin

This PR has been approved. Before it can be merged, all contributors must sign the Developer Certificate of Origin.

Status

none yet

• ❌ @claude

How to sign

Post the following comment exactly as written:

I have read the Developer Certificate of Origin and I hereby sign the DCO for this PR