Manage Python with uv + 7-day minimum release age

Brewfile

@@ -14,6 +14,7 @@ brew "postgresql@17"
 brew "pre-commit"
 brew "tmux"
 brew "tree"
+brew "uv"
 brew "wget"
 brew "yq"
 brew "zsh-autosuggestions"

assimilate.sh

@@ -67,6 +67,7 @@ sym claude/statusline.sh            .claude/statusline.sh
 sym agent-instructions.md           .claude/CLAUDE.md
 sym agent-instructions.md           .codex/AGENTS.md
 sym ssh/config                      .ssh/config
+sym uv/uv.toml                      .config/uv/uv.toml
 
 # Lock down sensitive symlink targets (chmod follows the symlink to the repo file).
 chmod 600 "$HOME/.gitconfig"
@@ -112,6 +113,12 @@ else
   echo "WARN: yq or codex is unavailable — skipping Codex settings sync" >&2
 fi
 
+# Let uv manage Python when it is available. The rolling release-age window in
+# uv/uv.toml applies to package resolution, while this installs the interpreter.
+if command -v uv >/dev/null 2>&1; then
+  uv python install
+fi
+
 # Install repository security hooks when pre-commit is available (Homebrew
 # supplies it on macOS). Linux users can install pre-commit independently.
 if command -v pre-commit >/dev/null 2>&1; then

uv/uv.toml

@@ -0,0 +1,16 @@
+# uv configuration — https://docs.astral.sh/uv/reference/settings/
+#
+# Symlinked to ~/.config/uv/uv.toml by assimilate.sh (and also discovered via
+# $XDG_CONFIG_HOME, which points at this repo). Applies to every uv invocation:
+# uv lock / uv sync / uv pip install / uv run.
+
+# Supply-chain hardening: never resolve a package release younger than 7 days.
+# This is a *rolling* window (a duration, not a fixed date) that moves with the
+# clock — most malicious/compromised uploads are detected and yanked within a
+# week, so waiting buys time without much practical cost.
+exclude-newer = "7 days"
+
+# Let uv own Python version management: prefer uv-managed CPython interpreters
+# over system/pyenv ones. Install versions with `uv python install <ver>` and
+# pin per-project with a `.python-version` file.
+python-preference = "managed"