Enforce the published runtime dependency contract (#8)

Require Tomli 2.4.1 for Python 3.10 in package metadata and add a parsed PEP 508 equality test that prevents the runtime audit manifest from drifting from published dependencies.

The protected CodeQL, container, distribution, evidence-quality, and six-platform Python matrix passed.

Author: 0xmrma

pyproject.toml

@@ -13,7 +13,7 @@ requires-python = ">=3.10"
 dependencies = [
   "httpx>=0.27,<1",
   "rich>=13.7,<16",
-  "tomli>=2.0; python_version < '3.11'",
+  "tomli>=2.4.1; python_version < '3.11'",
 ]
 
 authors = [
@@ -47,6 +47,7 @@ dev = [
   "hypothesis>=6.100",
   "jsonschema>=4.22",
   "mypy>=1.11",
+  "packaging>=24.0",
   "pip-audit>=2.7",
   "pytest>=8.0",
   "pytest-cov>=5.0",

tests/test_dependency_contract.py

@@ -0,0 +1,32 @@
+from pathlib import Path
+
+from packaging.requirements import Requirement
+from packaging.utils import canonicalize_name
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # pragma: no cover - Python 3.10 CI exercises this branch.
+    import tomli as tomllib
+
+
+def _requirements_by_name(values: list[str]) -> dict[str, Requirement]:
+    requirements: dict[str, Requirement] = {}
+    for value in values:
+        requirement = Requirement(value)
+        name = canonicalize_name(requirement.name)
+        assert name not in requirements, f"duplicate dependency declaration: {name}"
+        requirements[name] = requirement
+    return requirements
+
+
+def test_runtime_audit_manifest_matches_published_dependencies():
+    project = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
+    published = _requirements_by_name(project["project"]["dependencies"])
+    audit_lines = [
+        line.strip()
+        for line in Path("requirements-audit.txt").read_text(encoding="utf-8").splitlines()
+        if line.strip() and not line.lstrip().startswith("#")
+    ]
+    audited = _requirements_by_name(audit_lines)
+
+    assert audited == published