ADR-338: Wire mypy --strict static analysis into ml/ build

.claude/settings.json

@@ -1,4 +1,16 @@
 {
+  "permissions": {
+    "allow": [
+      "Bash(gh api repos/*/pulls/*/reviews*)",
+      "Bash(gh pr review *)",
+      "mcp__github__pull_request_review_write",
+      "mcp__github__add_comment_to_pending_review",
+      "mcp__github__add_reply_to_pull_request_comment",
+      "mcp__plugin_github_github__pull_request_review_write",
+      "mcp__plugin_github_github__add_comment_to_pending_review",
+      "mcp__plugin_github_github__add_reply_to_pull_request_comment"
+    ]
+  },
   "enabledPlugins": {
     "dotnet@dotnet-agent-skills": false,
     "dotnet-diag@dotnet-agent-skills": true,

CLAUDE.md

@@ -66,8 +66,9 @@ significantly change a design, create or update the relevant `_doc_*.md`:
 A change is not complete until all of the following pass:
 
 1. `scripts/validate-build` — clean build, zero warnings (`dotnet build /warnaserror` is the underlying command but the script also cleans first)
-2. `scripts/validate-tests` — all unit and headless E2E tests pass
-3. Affected `_doc_*.md` files are updated
+2. `scripts/validate-ml-build` — `mypy --strict` over `ml/pipeline` and `ml/test`, zero type errors
+3. `scripts/validate-tests` — all unit and headless E2E tests pass
+4. Affected `_doc_*.md` files are updated
 
 ## Accessibility
 

Directory.Build.props

@@ -16,6 +16,10 @@
     <PackageReference Include="Microsoft.CodeAnalysis.NetAnalyzers" PrivateAssets="all" />
     <PackageReference Include="MessagePack" />
     <PackageReference Include="Nerdbank.MessagePack" />
+    <!-- Override the .NET SDK's bundled Microsoft.Build.Tasks.Git, which does not recognize
+         newer git repository extensions (e.g. relativeWorktrees) and hard-errors instead of
+         ignoring them. -->
+    <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="all" />
   </ItemGroup>
 
   <PropertyGroup>

Directory.Packages.props

@@ -26,6 +26,13 @@
     <PackageVersion Include="System.Text.Json" Version="8.0.5" />
     <!-- Development Tools -->
     <PackageVersion Include="Nerdbank.GitVersioning" Version="3.9.50" />
+    <!-- Referencing Microsoft.SourceLink.GitHub explicitly (rather than relying on the .NET
+         SDK's implicit SourceLink import) sets the PkgMicrosoft_SourceLink_Common MSBuild
+         property, which suppresses the SDK's own bundled Microsoft.Build.Tasks.Git import in
+         favor of this package's newer transitive Microsoft.Build.Tasks.Git dependency. The
+         SDK-bundled version does not recognize newer git repository extensions (e.g.
+         relativeWorktrees) and hard-errors instead of ignoring them. -->
+    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.301" />
     <PackageVersion Include="Nerdbank.MessagePack" Version="1.2.4" />
     <!-- Code Analysis -->
     <PackageVersion Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.300" />

ml/pyproject.toml

@@ -0,0 +1,6 @@
+# mypy --strict configuration (ADR-281). Scoped to ml/pipeline/ and ml/test/ only —
+# see scripts/validate-ml-build.sh/.cmd, which run `mypy --strict pipeline test` from
+# this directory so this config file is auto-discovered.
+[tool.mypy]
+files = ["pipeline", "test"]
+strict = true

ml/requirements.txt

@@ -2,3 +2,4 @@ numpy==2.5.0
 pandas==3.0.3
 tensorflow==2.21.0
 dvc==3.67.1
+mypy==2.3.0

scripts/validate-ml-build.cmd

@@ -0,0 +1,5 @@
+@echo off
+pushd %~dp0..\ml
+mypy --strict pipeline test
+if %ERRORLEVEL% neq 0 ( popd & exit /b %ERRORLEVEL% )
+popd

scripts/validate-ml-build.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+cd "$SCRIPT_DIR/../ml"
+echo 'Running mypy --strict over ml/pipeline and ml/test...'
+mypy --strict pipeline test

scripts/validate.cmd

@@ -1,12 +1,14 @@
 @echo off
 echo Checking required tools...
-for %%T in (dotnet pwsh node python3 claude) do (
+for %%T in (dotnet pwsh node python3 mypy claude) do (
     where %%T >nul 2>&1 || (
         echo ERROR: Required tool '%%T' is not installed or not on PATH.
         exit /b 1
     )
 )
 call "%~dp0validate-build.cmd"
 if %ERRORLEVEL% neq 0 exit /b %ERRORLEVEL%
+call "%~dp0validate-ml-build.cmd"
+if %ERRORLEVEL% neq 0 exit /b %ERRORLEVEL%
 call "%~dp0validate-tests.cmd"
 if %ERRORLEVEL% neq 0 exit /b %ERRORLEVEL%

scripts/validate.sh

@@ -15,7 +15,9 @@ check_tool dotnet
 check_tool pwsh
 check_tool node
 check_tool python3
+check_tool mypy
 check_tool claude
 
 "$SCRIPT_DIR/validate-build.sh"
+"$SCRIPT_DIR/validate-ml-build.sh"
 "$SCRIPT_DIR/validate-tests.sh"