[bb-agent-dev]

Set patched dependency/build minimums and make Python 3.14 packaging and test coverage explicit. The base package keeps PyQt5 optional; the already-merged script-runner/Python 3.14 changes remain intact.

• Require Jinja2 >=3.1.6 and isolate setuptools >=83 through PEP 517; use validated build/twine frontends and build/check both sdist and wheel in CircleCI. Existing publishing filters and credential configuration are preserved.
• Restore all seven task-runner tests after reproducing a real cross-thread asyncio event timeout. Thread-safe gates and bounded Qt waits preserve completion, cancellation, error and queue assertions without production API changes. Tox tests the installed wheel outside the checkout.
• Record exact before/after dependency snapshots, public advisory results, Versioneer compatibility evidence, platform limits and bounded source-review trust boundaries in the validation report.

Fixes #70.

Validation on Linux x86_64 / Python 3.14.6 at commit 5d28e2f:

• python -m tox -e py314: 79 passed, including task-runner and existing script-runner regressions; license-header checker passed. Installed-wheel statement coverage is 30%, not exhaustive coverage.
• Live pip-audit 2.10.1 before: 81 public packages, zero known advisories; after: 80 public packages, zero known advisories. Both skip the unpublished local project, covered only by the bounded source review. Isolated setuptools 84.0.0 and pip 26.2.1 audited separately: zero known advisories, no skips. Clean pip check passed.
• python -m build and python -m twine check --strict: wheel and sdist passed. Both install in separate clean base/UI environments (four passing installs), with pip check, outside-checkout metadata/import checks, recursive script/template/data smoke tests and offscreen Qt initialization. Both base environments have no PyQt5.
• Clean checkout, installed metadata and module version agree: 0.9.0+4.g5d28e2f. Retained Versioneer 0.18 with its existing compatibility patches; no version or release tag invented.
• Separate read-only agent review found no blocking issues; parent reviewed the final diff. git diff --check passed; no repository pre-commit configuration is present. No UI behavior changed, so visual evidence is not applicable.

Final local artifact SHA256:

2488b507886a404274c72ec9cde66c9e5dd8c7bfba7f8ed7e707b625927cb0b9  pyqttoolkit-0.9.0+4.g5d28e2f-py3-none-any.whl
274ca109b5226fc9e67e46c3da526f006dbdd2edefa15096e83d4c613f419819  pyqttoolkit-0.9.0+4.g5d28e2f.tar.gz

Windows/macOS, other architectures/Python versions, interactive rendering and actual CircleCI execution remain unverified here. The dependency ranges remain open and need future revalidation; source review does not establish a hostile-script/template sandbox or comprehensive native/widget security coverage. Keep this PR draft for maintainer review. Tagging, publication and merging remain maintainer actions; none was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T08:25:48.943427Z	5d28e2f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🔵 Needs a closer look

Publishing workflow changes remain unverified in CircleCI and require final maintainer review.

No open issues 🎉

What changed in this PR

Updates dependency and packaging baselines for Python 3.14, addressing #70 while preserving optional PyQt5 support and production APIs.

Changes:

• Adds patched dependency minimums and isolated builds.
• Restores seven task-runner tests and tests the installed wheel outside the checkout.
• Expands CI artifact checks and documents validation results and limitations.

File	Description
tox.ini	Tests installed wheels and restores task-runner coverage.
tests/​services/​test_task_runner.py	Uses thread-safe gates and bounded Qt waits.
setup.py	Updates dependency floors and packaging extras.
README.md	Documents development and packaging commands.
pyproject.toml	Declares the isolated setuptools backend.
docs/​dependency-validation.md	Records validation evidence and remaining limits.
docs/​dependency-candidate.txt	Records updated dependency versions.
docs/​dependency-baseline.txt	Records baseline dependency versions.
.circleci/​config.yml	Builds and checks wheels and source distributions.

_{Review effort: Balanced}