[argszero]

Summary

MANIFEST.in pointed its recursive-include at harness2/third_party, a path that has
never existed — the tracked overlay tree is at the repository root — so setuptools
silently shipped no third_party/ files in the sdist, and dependencies/ASSETS.json was
never listed. The resulting archive omitted all 47 assets that
dependencies/ASSETS.json hashes, every one of which lives under third_party/.

Both consequences were measured on the artifact built from 1cfe254:

• find third_party -type f | wc -l inside the unpacked sdist printed 0.
• python3 scripts/check_provenance.py, run inside the sdist that ships it, exited 1 with
  Provenance check failed: [Errno 2] No such file or directory: '.../dependencies/ASSETS.json'.

Two lines of MANIFEST.in plus a regression test. No package code changes.
docs/SETUP.md's "Wheel installations" section stays true — a wheel still ships the
package only; this makes the sdist a complete source tree, which is what a conda
feedstock or pip install --no-binary :all: builds from (context: #106).

Changes

• MANIFEST.in: recursive-include third_party * (was harness2/third_party), and
  dependencies/ASSETS.json added to the existing include line.
• tests/test_packaging.py: asserts that every recursive-include root exists, that every
  path hashed by dependencies/ASSETS.json is present in the tree and selected by the
  manifest, and that the manifest itself ships. Hermetic — it reads two files and builds
  nothing.

Related Issue

Closes #144. Context: #106.

Tests

• Existing tests pass
• New tests added

python3 -m unittest discover -s tests -v → 8 tests, OK (5 existing + 3 new).

The new tests fail against upstream/main's manifest (3 failures, the first naming
harness2/third_party) and pass with this change, so they bite rather than merely
accompany it.

End-to-end after the fix:

$ uv build --sdist && tar xzf dist/harness2-0.1.0.tar.gz && cd harness2-0.1.0
$ find third_party -type f | wc -l
48
$ python3 scripts/check_provenance.py
PASS: 47 release asset checksums    # exit 0

The sdist grows by about 388 KB, the size of third_party/.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[argszero]

Re-verified against the current main after this morning's merge sweep.

Rebase. The branch is now based on 6868817 (fix(jobbench): note in the trajectory when a rollout exits non-zero (#122)), the tip after 17 PRs landed on 2026-11-02. Force-pushed with lease. The change itself is unchanged: one commit, still MANIFEST.in plus tests/test_packaging.py.

The defect is still present on 6868817. MANIFEST.in line 4 reads recursive-include harness2/third_party *, but third_party/ sits at the repository root — that root has never existed, so setuptools silently ships no third_party/ files and no dependencies/ASSETS.json, and scripts/check_provenance.py cannot pass inside the sdist that ships it.

Suite, run in a clone on the rebased branch (macOS arm64, CPython 3):

Ran 73 tests in 27.3s

FAILED (errors=4, skipped=6)

The 4 errors do not come from this branch. A clean upstream/main checkout at 6868817 runs:

Ran 70 tests in 25.7s

FAILED (errors=4, skipped=6)

with the same four names, all in test_jobbench_rollout_isolation.RolloutIsolationTests: test_fence_blocks_other_rollouts_but_keeps_own_dirs_and_tmp, test_installed_commands_stay_on_path, test_later_rollout_cannot_see_earlier_installs_or_temp_files, test_retry_starts_from_a_clean_sandbox. The cause is environmental — FileNotFoundError: [Errno 2] No such file or directory: 'timeout'; this machine has no timeout binary on PATH. So this branch adds 3 tests (70 → 73) and leaves both the error and skip counts where they were. Its own tests:

Ran 3 tests in 0.001s

OK

File collision, measured today against the file lists of all 103 open PRs:

• MANIFEST.in — 1 other open PR: fix(packaging): include benchmark assets in source distributions #25
• tests/test_packaging.py — none

Nothing else in flight touches either file this PR changes, so any future conflict here would have to come from #25.