chore(release): 0.18.5 — curated-surface reduction (handle→guard, init(fail_on_exit), drop framework extras + auto_instrument)

[maltsev-dev]

chore(release): 0.18.5 — curated-surface reduction (handle→guard, init(fail_on_exit), drop framework extras + auto_instrument)

Summary

Cut v0.18.5 — the consolidated release that ships the deprecation
sweep, the 0.18.3 init/init_or_die unification, the 0.18.4
handle → guard rename plus top-level status() removal, and the
mechanical lint/type cleanup that brings ruff check src tests and
mypy src/nullrun back to green after the 1882-insertion /
15621-deletion sweep. All the substantive work landed on master via
#111 (squash aee8110); the only change in this release PR is the
version stamp + CHANGELOG consolidation + uv.lock regen.

The user-facing surface shrinks to 21 curated symbols (down 6 from
0.18.2): __version__, init, protect, shutdown, on_error,
guard, the typed exception catalog (8 classes), WorkflowKilledInterrupt,
format_user_message, set_user_message. The single user-facing
entry point for tool-call gating remains \@protect`(now wired unconditionally through/api/v1/execute); `@guarded`and`@handle`()are removed.nullrun.init_or_die()is removed in favour ofnullrun.init(fail_on_exit=True). Top-level nullrun.status()is removed in favour ofnullrun.get_runtime().status()`.

Themes

1. Public-surface reduction (cumulative since 0.18.2)

   • nullrun.handle → nullrun.guard (rename, same
     @contextmanager body) — 83421e0.
   • Top-level nullrun.status() removed; reach via
     nullrun.get_runtime().status() — 83421e0.
   • nullrun.init_or_die() removed; nullrun.init(fail_on_exit=True)
     replaces it — ccb2670.
   • nullrun.shutdown() auto-registered via atexit inside
     init() — ccb2670.
   • \@guarded`decorator dropped (was a 3-line shortcut forwith nullrun.guard():) — f1721f2`.
   • Framework-extras install groups dropped from pyproject.toml
     ([agents], [langchain], [langgraph], [llama-index],
     [crewai], [autogen]); pip install nullrun is now the only
     public install line — 57225e9.
   • auto_instrument / is_auto_instrumented removed from
     _LAZY_EXPORTS; module-level track_event alias removed;
     NullRunCallback removed from _LAZY_EXPORTS — 57225e9.

2. Internal-surface cleanup (not user-visible)

   • src/nullrun/business_impact.py narrows
     BusinessImpact.impact: Any → NoImpactPayload (the inline
     comment already documented the invariant; the only public
     ctor wires a NoImpactPayload, so the broader Any was
     masking a real no-any-return at the to_wire_dict boundary).
   • src/nullrun/__init__.py tightens _LAZY_EXPORTS annotation
     from tuple[str, str | None] → tuple[str, str] (every value
     in the table is a 2-tuple of strings; the optional was wrong).
   • 71 unused imports (F401) auto-removed across src/nullrun/ and
     tests/; 9 unused locals (F841) hand-removed in
     test_actions.py, test_ws_signed_payload.py,
     test_transport.py, test_signal_safety.py,
     test_autogen_patch.py, test_dedup.py, test_model_fallback.py,
     test_registry.py — all dead code left behind after the
     15621-line deletion sweep.

3. Documentation cleanup

   • Strips "pre-fix / post-fix", "previously / now we", "was X / is
     now Y", and "legacy" framing from public docstrings across
     runtime.py, transport.py, decorators.py, and 14 other
     modules. External ticket identifiers (DEF-, ADR-, AUDIT P*,
     IDEM-01, CLOSE-ORPHAN) preserved as anchors — 15e4fad,
     9595d6e, d0d0e72.
   • Follow-up rename sweep in docs/ and scripts/ to match the
     0.18.4 handle→guard change — bf30566.

CHANGELOG

The ## [0.18.5] - 2026-09-26 block at the top of CHANGELOG.md
consolidates the entries the original commits wrote for the never-
released 0.18.3 and 0.18.4 versions; both of those blocks are
removed from the user-facing CHANGELOG because those versions were
never shipped. The git history of aee8110 (squash of #111)
preserves the original per-commit documentation if needed for
traceability.

Cleanup

• .gitignore already covers dist_local/ and src/**/*.defect*
  from a previous release scrub; no new artifacts shipped in this
  release.
• uv.lock regenerated: prior lock was at 0.18.0 and still
  carried the framework-extras dependency tree (sse-starlette,
  textual, sympy, watchfiles, websocket-client, wrapt, yarl, …).
  The new lock reflects 0.18.5 with only the core runtime deps
  (httpx) plus [opentelemetry] and [dev] extras. +196 / −4863.

Tooling

• ruff check src tests clean.
• mypy src/nullrun clean — Success: no issues found in 36 source files.
• pytest -q clean — 1401 passed, 1 skipped in 74.60s
  (baseline at 0.18.1 was 1784 passed / 4 skipped; net −383 tests
  reflects removal of test_handle, test_protect+branches,
  test_observability, test_preflight_fail_policy,
  test_tool_params_extractor, test_units_discriminator,
  test_sensitive_extractor, test_execute_*,
  test_approval_*, test_money_hardening, test_args_pii_masked
  and friends as the surface they tested was removed).

Verification

| Check | Result |
|---|---|---|
| ruff check src tests | All checks passed |
| mypy src/nullrun | Success: no issues found in 36 source files |
| pytest -q | 1401 passed, 1 skipped in 74.60s |
| Scratch diff | clean (.gitignore covers dist_local/, src/**/*.defect*) |
| python -c "import nullrun; print(nullrun.__version__)" | 0.18.5 |
| Wire-format compatibility | unchanged from 0.18.0 |

Commits included

0ea439b fix errors (this commit, will be amended)

The substantive work for 0.18.5 landed on master via
#111 (squash aee8110) prior to this release PR; per-commit detail
lives in that PR's thread.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!