fix(deps): make installs without dev dependencies work

[Marc-cn]

Summary

An install without the development dependencies does not work on main. That covers the "Quick install" in docs/install/from-source.md (uv tool install --editable ...) and, as far as I can tell, any install from a built wheel. Two separate causes:

1. tree-sitter-language-pack 1.6.3 has no importable module. It is the newest release inside the >=1.5,<1.8 range (there is no 1.7), so a fresh resolve picks it. The import guard in threat_model/parsing.py then reports "tree-sitter-language-pack is not installed", the baseline handlers fail to register, and darnit audit ends in an AuthorityViolation traceback on the first plugin step type.
2. packaging is not declared. darnit/sieve/cel_evaluator.py imports celpy.c7nlib, which does from packaging.version import Version. cel-python 0.5.0 does not declare packaging. The guard reports "cel-python not installed" and every control with an expr is ERROR.

Neither shows up in the workspace or in CI: uv.lock pins tree-sitter-language-pack 1.5.0, and packaging arrives with pytest.

Changes:

• packages/darnit-baseline/pyproject.toml: cap tree-sitter-language-pack at <1.6.3.
• packages/darnit/pyproject.toml: add packaging>=23.0.
• uv.lock: the two specifier lines only. Locked versions are unchanged.
• CHANGELOG entry under Fixed.

Closes #441.

Related: #268 (support for 1.8 and newer).

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Framework Changes Checklist

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed (dependency metadata only, no behavior change)
• Ran uv run python scripts/validate_sync.py --verbose and it passes

Testing

• Tests pass locally (uv run pytest tests/ -v): 5138 passed, 26 skipped (same as main)
• Added tests for new functionality (none; see Additional Notes)
• Linting passes (uv run ruff check .)

Each release of tree-sitter-language-pack from 1.5.0 to 1.8.1, installed on its own with tree-sitter 0.26.0 on RHEL 10.2 (x86_64, Python 3.12), parsing a one-line Python snippet:

Version	Result
1.5.0, 1.6.0, 1.6.1, 1.6.2	works
1.6.3	ModuleNotFoundError: No module named 'tree_sitter_language_pack'
1.8.0, 1.8.1	the API change in #268

The documented install, into an empty tool directory, then darnit audit --framework openssf-baseline --tags level=1 on a one-file repository:

	Result
main	AuthorityViolation traceback
cap only	runs; 0 pass, 12 error ("cel-python not installed")
cap and packaging	26 controls, 2 pass, 10 error: identical to the dev workspace

I saw 1.6.3 fail on Linux x86_64 with Python 3.12. @mlieberman85 reproduced it on macOS with Python 3.14, so it is not Linux-only.

AI assistance

• No AI assistance was used
• AI assistance was used

Claude Fable 5.1 diagnosed both causes with me, wrote the two dependency changes. I ran every command and checked the results myself. The commit carries an Assisted-by: Claude:claude-fable-5-1.

Additional Notes

• No automated test: the suite runs in the dev environment, where both problems are invisible. A CI job that installs without dev dependencies and runs one audit would catch this class of bug. Happy to add one if wanted.
• Both import guards report "not installed" for any ImportError, which pointed at the wrong cause both times. Including the original exception text in the message would help. Not changed here.
• <1.6.3 and not !=1.6.3: every version it allows has been tested. Whichever you prefer.

[mlieberman85]

Thanks, this reproduces exactly as described and the fix checks out. I also reproduced the tree-sitter half on macOS with Python 3.14, since 1.6.3 ships a cp314 mac wheel with the same _native/ layout. So it isn't Linux-only.

1. Please add Closes #441. Core imports packaging itself (core/composition.py:363, config/framework_schema.py:1403), so could the pyproject comment say that rather than only celpy?
2. While you're there, could you fix the stale comment at framework_schema.py:1401-1402 and the CLAUDE.md note that says packaging is undeclared?
3. Yes please to the non-dev install + one-audit CI job, here or as a follow-up. release-smoke.yml only checks --version/imports, and our container is python:3.12-slim + pip install darnit-mcp, which is exactly the combination that resolves 1.6.3.

I'd like this in before #559 cuts 0.2.0.

Drafted with Claude Code; reviewed and posted by me.

[Marc-cn]

Thanks for checking on macOS, I added that to the description.

Pushed a second commit with your points:

• Closes #441 added.
• The pyproject.toml comment now says core uses packaging itself for PEP 440 constraints (core/composition.py, config/framework_schema.py), with the celpy import as the second reason.
• Fixed the stale comment in framework_schema.py and the CLAUDE.md note.

CI job: yes. I'll open it as a follow-up PR so this one can go in before 0.2.0. Plan: install the built wheels into a clean python:3.12-slim-style environment with no dev dependencies, run one darnit audit and fail on a traceback or on "not installed".

Drafted with Claude; reviewed and posted by me.