chore: ruff + mypy strict + import-linter + commitizen config

pyproject.toml

@@ -33,10 +33,142 @@ dependencies = [
     "pydantic>=2.11.0",
 ]
 
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.3.0",
+    "pytest-asyncio>=0.25.0",
+    "pytest-timeout>=2.3.0",
+    "pytest-cov>=7.1.0",
+    "mypy>=1.15.0",
+    "ruff>=0.11.0",
+    "import-linter>=2.0.0",
+    "pre-commit>=4.0.0",
+    "commitizen>=4.0.0",
+    "pyyaml>=6.0.3",
+]
+
 [project.urls]
 Homepage = "https://github.com/constk/harness-python-react"
 Repository = "https://github.com/constk/harness-python-react"
 Issues = "https://github.com/constk/harness-python-react/issues"
 
 [tool.uv]
 package = false
+
+[tool.ruff]
+target-version = "py314"
+line-length = 88
+exclude = [".claude/worktrees"]
+
+[tool.ruff.lint]
+select = [
+    "E",    # pycodestyle errors
+    "W",    # pycodestyle warnings
+    "F",    # pyflakes
+    "I",    # isort
+    "N",    # pep8-naming
+    "UP",   # pyupgrade
+    "B",    # flake8-bugbear
+    "SIM",  # flake8-simplify
+    "TCH",  # flake8-type-checking
+    "S",    # flake8-bandit (security checks — SQL injection, hardcoded crypto, etc.)
+    "RUF",  # ruff-specific rules
+]
+
+[tool.ruff.lint.per-file-ignores]
+"src/models/**" = ["TCH003"]  # Pydantic needs runtime imports for type annotations
+"eval/**" = ["TCH001", "S101"]  # parametrize imports; pytest asserts are idiomatic
+"tests/**" = ["S101"]  # pytest asserts are idiomatic (rewritten for rich errors)
+".claude/hooks/**" = ["S603", "S607"]  # hook scripts intentionally run git/uv/npx from PATH
+
+[tool.ruff.lint.isort]
+known-first-party = ["src"]
+
+[tool.mypy]
+python_version = "3.14"
+strict = true
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = true
+disallow_incomplete_defs = true
+check_untyped_defs = true
+no_implicit_optional = true
+warn_redundant_casts = true
+warn_unused_ignores = true
+
+[[tool.mypy.overrides]]
+module = [
+    "opentelemetry.*",
+]
+ignore_missing_imports = true
+
+[tool.importlinter]
+# See docs/BOUNDARIES.md for the rationale and the full dependency graph.
+root_package = "src"
+
+[[tool.importlinter.contracts]]
+name = "src layers flow one-way (api/eval -> agent -> tools -> data -> observability -> models)"
+type = "layers"
+layers = [
+    "src.api | src.eval",
+    "src.agent",
+    "src.tools",
+    "src.data",
+    "src.observability",
+    "src.models",
+]
+
+[[tool.importlinter.contracts]]
+name = "src.models depends on nothing in src/"
+type = "forbidden"
+source_modules = ["src.models"]
+forbidden_modules = [
+    "src.agent",
+    "src.api",
+    "src.data",
+    "src.eval",
+    "src.observability",
+    "src.tools",
+]
+
+[tool.commitizen]
+# Restricts the tool to the 7 prefixes DEVELOPMENT.md documents as allowed.
+# Commitizen's default ships the full conventional-commits spec (12+ types
+# including perf:, style:, build:, ci:, revert:) — narrower project policy
+# prevents tool-vs-doc drift.
+#
+# `release:` is project-specific and used only on develop -> main release PRs.
+name = "cz_customize"
+
+[tool.commitizen.customize]
+schema = "<type>(<scope>): <subject>"
+schema_pattern = '^(feat|fix|docs|test|refactor|chore|release)(\([\w\-]+\))?!?:\s.+'
+bump_pattern = '^(feat|fix|refactor)'
+bump_map = {feat = "MINOR", fix = "PATCH", refactor = "PATCH", chore = "PATCH", docs = "PATCH", test = "PATCH"}
+example = "feat: add an example feature"
+info = "See docs/DEVELOPMENT.md#commit-messages for the allowed prefixes."
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+asyncio_mode = "auto"
+timeout = 30
+markers = [
+    "eval: evaluation harness tests (require LLM API key)",
+    "integration: tests that touch real external systems (slower than unit; split into own CI job)",
+]
+
+[tool.coverage.run]
+source = ["src"]
+# src/eval/ is the agent-quality harness; exercised by eval/ via the nightly
+# workflow, not by tests/ unit tests. Counting it here would inflate misses.
+omit = ["src/eval/*"]
+
+[tool.coverage.report]
+fail_under = 75
+show_missing = true
+skip_covered = false
+exclude_also = [
+    "if TYPE_CHECKING:",
+    "raise NotImplementedError",
+    'if __name__ == "__main__":',
+]