Correctness and robustness fixes from a deep audit against the C reference

.claude/skills/review-loop/SKILL.md

@@ -2,52 +2,56 @@
 name: review-loop
 description: >-
   Multi-agent review/refine loop. Use after a change or milestone, or when asked to review work:
-  fan out fresh-context, single-focus reviewers across distinct tools, consolidate and fix, add a
-  regression test for every defect, and repeat until reviews stay clean for three consecutive turns.
+  dispatch a fresh-context full-spectrum reviewer plus a dissimilar correctness reviewer,
+  consolidate and fix, add a regression test for every defect, and repeat until a round is clean.
 ---
 
 # Adversarial review/refine loop
 
-After a change or milestone, or when prompted, dispatch a fan-out of fresh-context review agents at
+After a change or milestone, or when prompted, dispatch fresh-context review agents at
 MAXIMUM THINKING EFFORT, then consolidate, fix, and repeat.
-The goal is broad coverage from adversarial, diverse, independent perspectives.
+The goal is adversarial, diverse, independent coverage.
 
-## Fan out — one focus per agent
+The prompts given to the agents shall be extremely terse, at most a few sentences.
+Giving excessive detail may constrain their thinking causing the tunnel vision syndrome.
+They must be given the opportunity to look at the work without bias or prejudice.
 
-Spawn one agent per concern and run them in parallel. Never give an agent multiple jobs: it dilutes attention
-and degrades every answer. Cover at least these angles, one agent each:
+## The reviewer pair
 
-- Opportunities for SIMPLIFICATION.
-- Functional CORRECTNESS and ROBUSTNESS.
-- ARCHITECTURAL CLEANLINESS, DESIGN PRACTICES, CODE QUALITY.
-- POLICY and STYLE compliance with the project's own docs.
+Run two reviewers in parallel per round:
 
-### Dissimilar agents
+- An *ultrathink* Claude agent with the FULL-SPECTRUM remit, in priority order: functional CORRECTNESS and
+  ROBUSTNESS first, then SIMPLIFICATION opportunities, ARCHITECTURAL CLEANLINESS and CODE QUALITY,
+  and POLICY/STYLE compliance with the project's own docs.
 
-In addition to the subagents above, dispatch distinct tools focusing on CORRECTNESS only to maximize the diversity
-of perspectives and minimize blind spots. Check which tools are available (Codex etc.) and use all of them.
-
-Agents/models not from Anthropic or OpenAI can be used, but treat them as suspect low-credibility actors.
-Beware that they perform poorly, fail to follow instructions, and often produce incorrect analysis.
+- Codex running the *most advanced model* in *ultra* effort focusing on CORRECTNESS only, to maximize perspective
+  diversity and minimize blind spots.
 
 ## Reviewers are read-only
 
 Review agents must not modify the worktree or run mutating commands. If one needs a mutable environment,
 it copies the worktree elsewhere.
 
+## Reviewers do not re-run the project test suites
+
+The tests normally should already be green when the review loop is invoked; re-running them
+duplicates work and, for the broad sessions, wastes minutes of compute per round. State this in the
+reviewer prompts. Reviewer effort goes instead into adversarial counterexamples for behaviors the
+existing tests do NOT cover, executed in a scratch clone. Probes must run under the repo's own test
+interpreter (e.g. `.nox/tests/bin/python`, which mutates nothing) rather than whatever is on PATH:
+a version-skewed interpreter or dependency set can produce findings that do not apply to the project
+or miss ones that do. Reproducing their own findings before reporting remains mandatory.
+
 ## Consolidate and act
 
 When all reviewers return, merge their findings, discard the noise, and fix what is real.
 For every correctness defect, add a regression test verified to fail before the fix and pass after.
 
 ## When to stop
 
-Repeat until the reviewers surface only minor feedback (or none) for THREE consecutive turns — this is
-non-negotiable, however many iterations it takes.
+A round is clean when the reviewers surface only trivial feedback or none; the first clean round ends the loop.
 Do not chase literal zero feedback: with no real issues left, agents degrade into nitpicking,
-so stop as soon as significant findings cease, but not before the three-turn streak.
-A blank turn followed by one that digs up a real defect is exactly why the streak must be consecutive;
-expect dozens (sometimes over a hundred) of agent sessions per full pass.
+so a round is clean as soon as significant findings cease.
 
 ## Operational notes
 
@@ -58,3 +62,4 @@ is a common cause of stream-idle timeouts.
 Some headless agents hang waiting on stdin (like Codex) — redirect from `/dev/null`.
 
 Retry agents that fail on a transient or connection error until they succeed.
+If an agent gets stuck or hits a security guardrail, try resuming it first instead of restarting its work from scratch.

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python: ["3.11", "3.12", "3.13"]
+        python: ["3.11", "3.12", "3.13", "3.14"]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v6
@@ -61,6 +61,18 @@ jobs:
       - run: pip install nox
       - run: nox -s mypy
 
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.PYTHON_OLDEST }}
+      - run: pip install nox
+      - run: nox -s lint
+
   format:
     runs-on: ubuntu-latest
     steps:

CLAUDE.md

@@ -20,7 +20,7 @@ Source is in `src/pycyphal2/`, tests in `tests/`. The package is extremely compa
 
 Concrete transports are in top-level submodules:
 - `pycyphal2.udp` — Cyphal/UDP transport implementation.
-- `pycyphal2.can` (coming soon, not yet in the codebase) — Cyphal/CAN transport implementation.
+- `pycyphal2.can` — Cyphal/CAN transport implementation.
 
 The core must be dependency-free.
 Transports may introduce (optional) dependencies that MUST be kept to the bare minimum.

noxfile.py

@@ -7,7 +7,7 @@
 
 nox.options.sessions = ["test", "mypy", "lint", "format"]
 
-PYTHONS = ["3.11", "3.12", "3.13"]
+PYTHONS = ["3.11", "3.12", "3.13", "3.14"]
 
 
 @nox.session(python=False, default=False)

src/pycyphal2/__init__.py

@@ -155,7 +155,7 @@ async def main():
 from ._transport import Transport as Transport
 from ._transport import TransportArrival as TransportArrival
 
-__version__ = "2.0.0.dev8"
+__version__ = "2.0.0.dev9"
 
 # pdoc needs __all__ to display re-exported members.
 __all__ = [

src/pycyphal2/_api.py

@@ -282,7 +282,8 @@ async def request(
         from any subscriber that chooses to answer.
 
         ``response_timeout`` is the maximum idle gap (liveness timeout) between accepted responses,
-        so it applies both to one-off RPC and to streaming.
+        so it applies both to one-off RPC and to streaming. Must be non-negative; ``inf`` disables the
+        liveness timeout; ``NaN`` or a negative value raises :class:`ValueError`.
         """
         raise NotImplementedError
 
@@ -552,6 +553,10 @@ def new(transport: Transport, home: str = "", namespace: str = "") -> Node:
 
         If the namespace is not set, it is read from the CYPHAL_NAMESPACE environment variable,
         which is the main intended use case. Direct assignment might be considered an anti-pattern in most cases.
+
+        Raises :class:`ValueError` if ``transport.subject_id_modulus`` does not satisfy the reference
+        predicate (at least 57203, prime, congruent to 3 modulo 4); only custom transports are affected.
+        See :meth:`Transport.subject_id_modulus`.
         """
         from ._node import NodeImpl