Fix 218 (#219)

* start new dev branch; add audit file

* Sync wamp-ai/wamp-cicd submodules + bump version to 26.6.1 (#218)

Coordinated WAMP 26.6.1 release-train sync:

- Bump .ai submodule bfb4804 -> 4669dc8 (docs: README/justfile).
- Bump .cicd submodule 08c9305 -> f77ca2b: picks up the GHSA-6658
  shell-injection hardening in the shared identifiers.yml reusable
  workflow (untrusted event fields passed via env: with a fail-closed
  branch-name allowlist), plus release-notes/changelog scripts and the
  verified-artifact actions used by #212. identifiers.yml is consumed
  via @main, so the fix is already live at runtime; this aligns the
  pinned pointer and the local .cicd scripts for reproducibility.
- Bump version 25.12.2 -> 26.6.1 (pyproject.toml, src/txaio/_version.py).
- Add 26.6.1 changelog section.

No caller changes required: the identifiers.yml interface is unchanged
and the workflow structure already matches zlmdb/autobahn-python.

Note: This work was completed with AI assistance (Claude Code).

* Exclude .ai/.cicd submodules from ruff linting (#218)

The .cicd submodule bump (08c9305 -> f77ca2b) added shared scripts,
including .cicd/scripts/git_version.py, which uses a substituted
__git_version__ placeholder that trips ruff F821 ("undefined name").
The check-format recipe runs `ruff check .`, which traversed into the
submodule and failed CI.

These submodules carry their own source with their own linting/CI and
are not txaio source, so exclude them via a top-level [tool.ruff]
extend-exclude (file-discovery exclude; the [tool.ruff.lint] exclude
does not affect traversal). This keeps F821 and the other checks active
for txaio's own code, rather than globally suppressing F821 as a
workaround.

Note: This work was completed with AI assistance (Claude Code).

* Follow latest ty (venv dep) + fix ty invalid-argument-type in tx.py (#218)

The newer ty on CI (0.0.50 vs a stale local 0.0.44) flagged tx.py:297:
globalLogBeginner.beginLoggingTo(_observers) — `list[_LogObserver]` not
assignable to `Iterable[ILogObserver]`. _LogObserver provides ILogObserver
via zope.interface's @Provider, which static checkers cannot follow.

Tooling (mirrors zlmdb so local and CI track the same latest ty):
- Declare `ty>=0.0.44` in the [dev] extra ("follow latest", unpinned) and
  run it from the venv (`${VENV_PATH}/bin/ty`) instead of a global install.
- check-typing now depends on install-tools (which provides ty) + install
  (which provides twisted stubs).
- Drop the global `uv tool install ty` step (and the `ty --version` check)
  from the quality job in main.yml.

Fix:
- Localized `cast(ILogObserver, _observer)` in tx.py, keeping ty's
  invalid-argument-type rule active elsewhere (txaio keeps a tighter ignore
  set than autobahn/zlmdb, which blanket-ignore this rule).

Verified locally with ty 0.0.50 on cpy311 (twisted installed):
`just check-typing cpy311` -> All checks passed; `ruff check .` clean.

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

.ai

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2026-06-18
+Related issue(s): #218
+Branch: oberstet:fix_218

.audit/oberstet_fix_218.md

@@ -61,14 +61,15 @@ jobs:
                -LsSf https://astral.sh/uv/install.sh | sh
           echo "$HOME/.cargo/bin" >> $GITHUB_PATH
 
-      - name: Install ty (Astral type checker)
-        run: uv tool install ty
+      # ty (Astral type checker) is declared in the [dev] extra and installed
+      # into the venv via `just install-tools` below; no separate global
+      # `uv tool install ty` step is needed. This keeps local and CI on the
+      # same (latest) ty resolved from the pyproject constraint.
 
       - name: Verify toolchain installation
         run: |
           just --version
           uv --version
-          ty --version
 
       - name: Setup uv cache
         uses: actions/cache@v4

.cicd

@@ -8,6 +8,14 @@ This document contains a reverse-chronological list of changes to txaio.
     For detailed release information including wheels and artifacts,
     see :doc:`releases`.
 
+26.6.1
+------
+
+**Other**
+
+* Bumped the shared ``wamp-ai`` and ``wamp-cicd`` Git submodules to match the rest of the WAMP project group (zlmdb / autobahn-python 26.6.1) for the coordinated release. The ``wamp-cicd`` bump picks up the GHSA-6658 shell-injection hardening in the shared ``identifiers.yml`` reusable workflow (untrusted GitHub event fields are now passed via ``env:`` as quoted data with a fail-closed branch-name allowlist) (`#218 <https://github.com/crossbario/txaio/issues/218>`_)
+* Declare the ``ty`` type checker in the ``dev`` extra and run it from the project venv (dropping the separate global ``uv tool install ty`` step), so local and CI resolve the same latest ``ty``. Fixed a newly-reported ``ty`` ``invalid-argument-type`` diagnostic in ``tx.py`` (the Twisted ``ILogObserver`` is provided via ``zope.interface`` ``@provider``, which static checkers cannot follow) with a localized ``cast`` rather than a blanket rule ignore. Excluded the ``.ai`` / ``.cicd`` submodules from ``ruff`` (they carry their own linting/CI) (`#218 <https://github.com/crossbario/txaio/issues/218>`_)
+
 25.12.2
 -------
 

.github/workflows/main.yml

@@ -524,8 +524,8 @@ check-format venv="": (install-tools venv)
     "${VENV_PATH}/bin/ruff" check .
 
 # Run static type checking with ty (Astral's Rust-based type checker)
-# ty is installed as a standalone tool via `uv tool install ty`, not as a Python package
-check-typing venv="": (install venv)
+# ty is declared in the [dev] extra and installed into the venv by install-tools
+check-typing venv="": (install-tools venv) (install venv)
     #!/usr/bin/env bash
     set -e
     VENV_NAME="{{ venv }}"
@@ -542,7 +542,7 @@ check-typing venv="": (install venv)
     # - possibly-missing-attribute: sys._getframe() returns FrameType | None
     # - call-non-callable: callback type inference edge cases
     # - deprecated: abc.abstractproperty usage (fix later)
-    ty check \
+    "${VENV_PATH}/bin/ty" check \
         --python "${VENV_PATH}/bin/python" \
         --ignore unresolved-attribute \
         --ignore possibly-missing-attribute \

docs/changelog.rst

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "txaio"
-version = "25.12.2"
+version = "26.6.1"
 description = "Compatibility API between asyncio/Twisted/Trollius"
 readme = {file = "README.md", content-type = "text/markdown"}
 license = "MIT"
@@ -87,8 +87,10 @@ dev = [
 
     # Code quality
     "ruff>=0.4.0",
-    # Note: ty (Astral type checker) is installed via `uv tool install ty`
-    # It's a standalone Rust binary, not a Python package dependency
+    # ty: Astral's type checker (standalone Rust binary, shipped as a wheel).
+    # Pre-1.0 and fast-moving: we deliberately follow latest upstream releases
+    # rather than pinning, so local and CI resolve the same (newest) ty.
+    "ty>=0.0.44",
 ]
 
 all = [
@@ -127,6 +129,15 @@ line-length = 88
 indent-width = 4
 target-version = "py311"
 
+# File-discovery excludes (top-level, in addition to ruff's built-in defaults).
+# The shared wamp-ai / wamp-cicd submodules carry their own source with their own
+# linting/CI (e.g. .cicd/scripts/git_version.py uses a substituted __git_version__
+# placeholder) and must not be linted as part of txaio.
+extend-exclude = [
+    ".ai",
+    ".cicd",
+]
+
 [tool.ruff.lint]
 # Enable Pyflakes (`F`) and a subset of pycodestyle (`E`) codes by default.
 select = ["E4", "E7", "E9", "F"]

justfile

@@ -24,4 +24,4 @@
 #
 ###############################################################################
 
-__version__ = "25.12.2"
+__version__ = "26.6.1"

pyproject.toml

@@ -31,6 +31,7 @@
 import inspect
 
 from functools import partial
+from typing import cast
 
 from twisted.python.failure import Failure
 from twisted.internet.defer import maybeDeferred, Deferred, DeferredList
@@ -291,9 +292,12 @@ def start_logging(out=_stdout, level="info"):
     if out:
         _observer = _LogObserver(out)
 
-    _observers = []
+    # _LogObserver provides ILogObserver via zope.interface's @provider, which
+    # static type checkers (ty) cannot follow; cast so the observer list matches
+    # globalLogBeginner.beginLoggingTo(observers: Iterable[ILogObserver]).
+    _observers: list[ILogObserver] = []
     if _observer:
-        _observers.append(_observer)
+        _observers.append(cast(ILogObserver, _observer))
     globalLogBeginner.beginLoggingTo(_observers)