개선(deps): Bump pyproc from 0.0.14 to 0.0.22

[dependabot]

Bumps pyproc from 0.0.14 to 0.0.22.

Changelog

Sourced from pyproc's changelog.

0.0.22 - 2026-08-15

Added

• The owned CPython WASI kernel now powers the default product and pyproc/wasi. bootCpythonWasiKernel opens a worker-owned CPython WASI kernel with Promise-first commands, ordered output events, retry identity, generation fences, structured terminal errors, hard interrupt truth, and idempotent close. Root boot(), WebComputer, and installed Control compose the same verified engine through KernelFactory and KernelMachine.
• ValueEnvelope v1 removes live Python objects from the v2 value boundary. Finite scalars, bigint, bytes, lists, canonical string maps, verified artifact spill, and generation-bound application references cover kernel values and the v2 ASGI and IPC seams with explicit limits.
• Kernel checkpoint v2 keeps reactive memory ownership inside the WASI worker. Engine and environment-bound descriptors seal opaque full or 64KiB page-delta artifacts, reject busy or incompatible boundaries before restore, compact at bounded depth, and fence generations.
• KernelVfs v1 adds immutable roots and crash-consistent OPFS volumes to the owned kernel. Intent, marker, HEAD CAS, adoption recovery, owner epochs, typed devices, and checkpoint root pairing reject partial objects, stale writers, forbidden resources, and corrupt candidates.
• Hostcall ABI v1 connects the static CPython module to an authority broker. A dedicated SAB record and worker-only atomic wait carry byte requests through /hostcall; stable receipts prevent duplicate external sends, preserve uncertain outcomes, bound streamed responses, and block unsafe checkpoints. Core no-op, clock, entropy, and terminal providers ship behind the same authority boundary.
• Product host capability ports extend the owned kernel without browser handles in Python. Explicit HTTP credit streams, socket relay, process, GPU, clipboard, framebuffer, and ASGI opcodes share destination-aware authority, exact effect boundaries, receipt replay, cancellation truth, and checkpoint resource classification through injected adapters.
• PyProc Eyes now returns task-conditioned situations. The existing automation.observe operation accepts representation: "apx.situation" and typed focus requirements. It returns a canonical SituationCapsule with explicit known, conflicted, unknown, and stale claims, bounded probes, and broker-issued affordances.
• Proof-carrying actions bind authority to observed state. JavaScript and Python clients expose situate() and actAffordance(). An actionContext binds the capability to its session, situation, world, document epoch, action, risk, destination, expiry, and expected transition, and stale bindings fail before the effect.
• Verified Change Loop turns repository experience into a replayable verdict. Strict Experience Contracts, exact environment observation, deterministic structural and behavioral rules, bounded perceptual review, atomic Evidence Packs, comparison, and effect-free replay are available through Control, MCP, JavaScript, Python, and CLI entrances.
• Hibernating Machine Fleet bounds live execution owners. createMachineFleet in pyproc/machine registers durable Web Computers, issues owner-epoch leases, admits only within a hot limit, commits and verifies exact generations before terminating adapters, and cold-resumes in fresh Workers. WebComputer.suspend() and resume() expose the same single-computer lifecycle. Unsafe effects, stale leases, commit failures, environment drift, and cleanup failures fail closed.
• Execution Memory makes exact execution state the handoff unit. An opt-in Control manifest adds immutable session revisions, compare-and-swap HEAD, real .pymachine capture, SituationCapsule and Automation Recording boundaries, Evidence Pack-gated completion, retention reachability, and signed handoff with separate permission approval. JavaScript, Python, MCP, and direct pyproc/control registry paths share the same revision digest.
• Rehearse-Commit Transactions separate preparation from one-shot external effects. Exact intents, effect-free rehearsal receipts, externally signed approval grants, durable commit leases, terminal effect results, and Evidence Pack-gated receipts share one immutable revision chain. JavaScript, Python, MCP, Control, and CLI entrances use the same fail-closed coordinator and never resend after the durable sending boundary.
• Transactional AppSpace pairs cooperative application state with the Python Machine. Exact app identity,

... (truncated)

Commits

• 0a47a0a 수정: Windows Execution Memory 경로 권한 정규화
• b4a76dc 문서: 0.0.22 최종 수정 계약 기록
• 4049b5d 테스트: Windows 설치 MCP 검증 이식성 강화
• b353fb8 수정: MCP long poll 종료 경계 완결
• f10d0aa 수정: 네이티브 입력 줄바꿈 계약 고정
• a312e78 수정: Windows 성능 게이트 변동폭 반영
• 2268455 수정: 교차 플랫폼 릴리스 게이트 복구
• 5a554a4 기능: 독립 CPython 커널 제품 전환 완성
• 5269943 기능: 증거 운반 Motor 완성
• 65235b2 실험: Windows Motor 네이티브 경로를 실기로 검증
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: landing. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[eddmpython]

머지하지 않고 닫는다. pyproc 0.0.22 는 landing 이 사용하는 공개 API 를 제거한 breaking 릴리즈다.

호환성 게이트 4 개(gate-a, gate-b, landing, compatibility)가 전부 실패했고 원인은 타입 해석 단계다.

Module '"pyproc"' has no exported member 'PyprocMachine'
Module '"pyproc"' has no exported member 'ReactiveController'
Module '"pyproc"' has no exported member 'AsgiServer'
Module '"pyproc"' has no exported member 'Runtime'
Module '"pyproc"' has no exported member 'WheelCache'
'indexURL' does not exist in type 'CpythonWasiBootOptions'

경계는 0.0.21 과 0.0.22 사이다. 0.0.21 을 올린 #113 은 같은 게이트 4 개가 전부 통과했다.
CPython WASI kernel 교체가 들어간 지점과 일치한다.

이 버전으로 올리려면 버전 숫자 교체가 아니라 landing 의 pyproc 호출부 마이그레이션이 필요하고,
UI 변경이므로 렌더 눈검수까지 동반해야 한다. 별도 작업으로 다룬다.

dependabot 설정에 ignore 는 걸지 않는다. ignore 는 보안 업데이트에도 적용되어 해당 패키지의
보안 패치 경로를 함께 닫는다(이번에 nanoid 경보에서 실측). 소음보다 보안 경로를 우선한다.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.