From 5f56e6966fe410eea61eb9c8637233d37ed61a97 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Fri, 29 May 2026 15:13:05 -0400
Subject: [PATCH] Manage Python with uv + 7-day rolling minimum release age

- Add uv/uv.toml with exclude-newer = "7 days" (rolling supply-chain window:
  never resolve a package release younger than a week) and
  python-preference = "managed" so uv owns Python version management
- Symlink uv/uv.toml -> ~/.config/uv/uv.toml in assimilate.sh (also discovered
  via $XDG_CONFIG_HOME)
- Add brew "uv" to the Brewfile and run 'uv python install' during assimilate
  to install a uv-managed CPython on fresh machines
---
 Brewfile      |  1 +
 assimilate.sh |  7 +++++++
 uv/uv.toml    | 16 ++++++++++++++++
 3 files changed, 24 insertions(+)
 create mode 100644 uv/uv.toml

diff --git a/Brewfile b/Brewfile
index 0d004fb..6a684e1 100644
--- a/Brewfile
+++ b/Brewfile
@@ -14,6 +14,7 @@ brew "postgresql@17"
 brew "pre-commit"
 brew "tmux"
 brew "tree"
+brew "uv"
 brew "wget"
 brew "yq"
 brew "zsh-autosuggestions"
diff --git a/assimilate.sh b/assimilate.sh
index 144911d..cedc37b 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -67,6 +67,7 @@ sym claude/statusline.sh            .claude/statusline.sh
 sym agent-instructions.md           .claude/CLAUDE.md
 sym agent-instructions.md           .codex/AGENTS.md
 sym ssh/config                      .ssh/config
+sym uv/uv.toml                      .config/uv/uv.toml
 
 # Lock down sensitive symlink targets (chmod follows the symlink to the repo file).
 chmod 600 "$HOME/.gitconfig"
@@ -112,6 +113,12 @@ else
   echo "WARN: yq or codex is unavailable — skipping Codex settings sync" >&2
 fi
 
+# Let uv manage Python when it is available. The rolling release-age window in
+# uv/uv.toml applies to package resolution, while this installs the interpreter.
+if command -v uv >/dev/null 2>&1; then
+  uv python install
+fi
+
 # Install repository security hooks when pre-commit is available (Homebrew
 # supplies it on macOS). Linux users can install pre-commit independently.
 if command -v pre-commit >/dev/null 2>&1; then
diff --git a/uv/uv.toml b/uv/uv.toml
new file mode 100644
index 0000000..d7f534b
--- /dev/null
+++ b/uv/uv.toml
@@ -0,0 +1,16 @@
+# uv configuration — https://docs.astral.sh/uv/reference/settings/
+#
+# Symlinked to ~/.config/uv/uv.toml by assimilate.sh (and also discovered via
+# $XDG_CONFIG_HOME, which points at this repo). Applies to every uv invocation:
+# uv lock / uv sync / uv pip install / uv run.
+
+# Supply-chain hardening: never resolve a package release younger than 7 days.
+# This is a *rolling* window (a duration, not a fixed date) that moves with the
+# clock — most malicious/compromised uploads are detected and yanked within a
+# week, so waiting buys time without much practical cost.
+exclude-newer = "7 days"
+
+# Let uv own Python version management: prefer uv-managed CPython interpreters
+# over system/pyenv ones. Install versions with `uv python install <ver>` and
+# pin per-project with a `.python-version` file.
+python-preference = "managed"