fix(deps): bound the core dependency above

Both plugin packages required aws-durable-execution-sdk-python>=3.0.0 with
no ceiling. The lower bound exists because their entry points resolve to
factories, which core 2.x cannot call: pip accepts the resolution and the
handler fails at initialization. Without a ceiling the next core major that
changes the plugin contract reproduces that exactly.

Both are now >=3.0.0,<4, and each package's metadata test asserts the
specifier rejects the next core major as well as accepting the current one.
A second case asserts it still admits the next core patch, because a <=
ceiling looks equivalent and excludes it.

Author: ParidelPooya

packages/aws-durable-execution-sdk-python-insight/pyproject.toml

@@ -21,12 +21,15 @@ classifiers = [
   "Programming Language :: Python :: Implementation :: CPython",
 ]
 dependencies = [
-  # >=3.0.0: the first release whose `plugins` argument takes factories.
+  # >=3.0.0,<4: 3.0.0 is the first release whose `plugins` argument takes
+  # factories, and the ceiling is the same reasoning applied forwards -- the next
+  # core major that changes the plugin contract would install and then fail at
+  # handler initialization exactly as 2.x does below.
   # `workflow_insight()` returns a factory, which core 2.x cannot call, so an
   # install resolved against 2.x fails at handler initialization. 3.0.0 also
   # carries the invocation-hook fields this plugin reads
   # (InvocationInfo.execution_input / InvocationEndInfo.execution_result).
-  "aws-durable-execution-sdk-python>=3.0.0",
+  "aws-durable-execution-sdk-python>=3.0.0,<4",
 ]
 
 [project.optional-dependencies]

packages/aws-durable-execution-sdk-python-insight/tests/test_package_metadata.py

@@ -16,6 +16,7 @@
 import tomllib
 from pathlib import Path
 
+from packaging.specifiers import SpecifierSet
 from packaging.version import Version
 
 
@@ -48,7 +49,7 @@ def _core_dependency_lower_bound() -> str:
         dependencies = tomllib.load(pyproject)["project"]["dependencies"]
 
     bounds = [
-        dependency.removeprefix(CORE_DISTRIBUTION + ">=")
+        dependency.removeprefix(CORE_DISTRIBUTION + ">=").split(",", 1)[0]
         for dependency in dependencies
         if dependency.startswith(CORE_DISTRIBUTION + ">=")
     ]
@@ -76,3 +77,46 @@ def test_core_dependency_bound_matches_the_core_major_in_this_repository() -> No
 
     assert _major(lower_bound) == _major(core_version)
     assert Version(lower_bound) <= Version(core_version)
+
+
+def test_core_dependency_excludes_the_next_core_major() -> None:
+    """A lower bound alone is the same defect one major later.
+
+    The lower bound exists because this package's entry points resolve to plugin
+    factories, which the core major below cannot call: pip accepts the resolution
+    and the handler fails at initialization. Without a ceiling the next core major
+    that changes the plugin contract reproduces exactly that, so the specifier has
+    to reject it rather than only reject what came before.
+    """
+    with (PACKAGE_ROOT / "pyproject.toml").open("rb") as pyproject:
+        dependencies = tomllib.load(pyproject)["project"]["dependencies"]
+    specifiers = [
+        SpecifierSet(dependency.removeprefix(CORE_DISTRIBUTION))
+        for dependency in dependencies
+        if dependency.startswith(CORE_DISTRIBUTION)
+    ]
+    assert len(specifiers) == 1
+
+    core_major = _major(_core_version())
+    assert specifiers[0].contains(_core_version(), prereleases=True)
+    assert not specifiers[0].contains(f"{core_major + 1}.0.0", prereleases=True)
+
+
+def test_core_dependency_admits_a_later_core_patch() -> None:
+    """The ceiling belongs on the major, not on the version built here.
+
+    A ``<=`` ceiling looks equivalent and is not: it excludes the next core patch,
+    so the first core patch release puts this claim out of date for a change that
+    cannot have touched the plugin contract.
+    """
+    with (PACKAGE_ROOT / "pyproject.toml").open("rb") as pyproject:
+        dependencies = tomllib.load(pyproject)["project"]["dependencies"]
+    specifier = next(
+        SpecifierSet(dependency.removeprefix(CORE_DISTRIBUTION))
+        for dependency in dependencies
+        if dependency.startswith(CORE_DISTRIBUTION)
+    )
+
+    core = Version(_core_version())
+    next_patch = f"{core.major}.{core.minor}.{core.micro + 1}"
+    assert specifier.contains(next_patch, prereleases=True)

packages/aws-durable-execution-sdk-python-otel/pyproject.toml

@@ -22,11 +22,14 @@ classifiers = [
   "Programming Language :: Python :: Implementation :: PyPy",
 ]
 dependencies = [
-  # >=3.0.0: the first release whose `plugins` argument takes factories.
+  # >=3.0.0,<4: 3.0.0 is the first release whose `plugins` argument takes
+  # factories, and the ceiling is the same reasoning applied forwards -- the next
+  # core major that changes the plugin contract would install and then fail at
+  # handler initialization exactly as 2.x does below.
   # DurableInstrumentationPluginProvider was removed in 3.0.0, and this package's
   # entry points resolve to factories, so core 2.x accepts the install and then
   # fails at handler initialization.
-  "aws-durable-execution-sdk-python>=3.0.0",
+  "aws-durable-execution-sdk-python>=3.0.0,<4",
 ]
 
 [project.entry-points."aws_durable_execution.plugins"]

packages/aws-durable-execution-sdk-python-otel/tests/test_package_metadata.py

@@ -2,13 +2,14 @@
 import tomllib
 from pathlib import Path
 
+from packaging.specifiers import SpecifierSet
 from packaging.version import Version
 
 
 PACKAGE_ROOT = Path(__file__).resolve().parents[1]
 REPOSITORY_ROOT = PACKAGE_ROOT.parents[1]
 CORE_DISTRIBUTION = "aws-durable-execution-sdk-python"
-CORE_DEPENDENCY = "aws-durable-execution-sdk-python>=3.0.0"
+CORE_DEPENDENCY = "aws-durable-execution-sdk-python>=3.0.0,<4"
 TEST_OTEL_DEPENDENCIES = {
     "opentelemetry-sdk>=1.20.0",
     "opentelemetry-propagator-aws-xray",
@@ -112,7 +113,7 @@ def _core_dependency_lower_bound() -> str:
         "dependencies"
     ]
     bounds = [
-        dependency.removeprefix(CORE_DISTRIBUTION + ">=")
+        dependency.removeprefix(CORE_DISTRIBUTION + ">=").split(",", 1)[0]
         for dependency in dependencies
         if dependency.startswith(CORE_DISTRIBUTION + ">=")
     ]
@@ -157,3 +158,48 @@ def test_layer_sdk_pin_matches_the_core_version_in_this_repository() -> None:
         pinned_version = tomllib.load(metadata_file)["layer"]["sdk-version"]
 
     assert pinned_version == _core_version()
+
+
+def test_core_dependency_excludes_the_next_core_major() -> None:
+    """A lower bound alone is the same defect one major later.
+
+    The lower bound exists because this package's entry points resolve to plugin
+    factories, which the core major below cannot call: pip accepts the resolution
+    and the handler fails at initialization. Without a ceiling the next core major
+    that changes the plugin contract reproduces exactly that, so the specifier has
+    to reject it rather than only reject what came before.
+    """
+    dependencies = _load_pyproject(PACKAGE_ROOT / "pyproject.toml")["project"][
+        "dependencies"
+    ]
+    specifiers = [
+        SpecifierSet(dependency.removeprefix(CORE_DISTRIBUTION))
+        for dependency in dependencies
+        if dependency.startswith(CORE_DISTRIBUTION)
+    ]
+    assert len(specifiers) == 1
+
+    core_major = _major(_core_version())
+    assert specifiers[0].contains(_core_version(), prereleases=True)
+    assert not specifiers[0].contains(f"{core_major + 1}.0.0", prereleases=True)
+
+
+def test_core_dependency_admits_a_later_core_patch() -> None:
+    """The ceiling belongs on the major, not on the version built here.
+
+    A ``<=`` ceiling looks equivalent and is not: it excludes the next core patch,
+    so the first core patch release puts this claim out of date for a change that
+    cannot have touched the plugin contract.
+    """
+    dependencies = _load_pyproject(PACKAGE_ROOT / "pyproject.toml")["project"][
+        "dependencies"
+    ]
+    specifier = next(
+        SpecifierSet(dependency.removeprefix(CORE_DISTRIBUTION))
+        for dependency in dependencies
+        if dependency.startswith(CORE_DISTRIBUTION)
+    )
+
+    core = Version(_core_version())
+    next_patch = f"{core.major}.{core.minor}.{core.micro + 1}"
+    assert specifier.contains(next_patch, prereleases=True)

pyproject.toml

@@ -129,7 +129,7 @@ test = "pytest packages/aws-durable-execution-sdk-python-examples/test {args}"
 
 [tool.hatch.envs.test-pypi-otel]
 dependencies = [
-  "aws-durable-execution-sdk-python>=3.0.0",
+  "aws-durable-execution-sdk-python>=3.0.0,<4",
   "opentelemetry-sdk>=1.20.0",
   "opentelemetry-propagator-aws-xray",
   "pytest",