feat(heart): Colab gate — check F seeds from Google's manifest and audits every lazy import

bin/pyauto-heart

@@ -417,10 +417,13 @@ Checks:
   C  conda install flow (python=3.12) + start_here.py + welcome.py
   D  pip install "autolens[optional]" resolves and imports
   E  pip install autolens==<pinned> installs on Python 3.12 by explicit pin
-  F  Colab bootstrap simulation + one real notebook cell
+  F  Colab gate: a python3.12 venv holding Google's Colab package set, the
+     injected setup cell verbatim, an audit of every import and declared
+     dependency the --no-deps bootstrap left unmet, then one notebook cell
 
-Checks B and E require explicit interpreters on PATH. Check B requires
-python3.11, python3.12, and python3.13; Check E requires python3.12. Missing
+Checks B, E and F require explicit interpreters on PATH. Check B requires
+python3.11, python3.12, and python3.13; Check E requires python3.12, and Check F
+requires python3.12 because that is the interpreter Colab runs. Missing
 required interpreters are FAIL. A passing --find-links run is development-only
 evidence and leaves readiness STALE;
 PyPI/TestPyPI evidence is required for the release gate.

docs/release_validation.md

@@ -121,6 +121,22 @@ Check B reuses that exact TestPyPI version: it must install and import on Python
 that this release holds the floor, because an unpinned install may select an
 older compatible one instead.
 
+Check F is the Colab gate. It builds a `python3.12` venv holding the package
+set Google's Colab actually ships — resolved from the `googlecolab/backend-info`
+`pip-freeze.txt` manifest, fetched live and cached at
+`$HEART_STATE_DIR/colab_pip_freeze.txt`, with a vendored snapshot as the last
+fallback — and then runs the injected setup cell verbatim on top of it. Only the
+part of the stack's with-deps closure that Colab also ships is pre-installed, so
+the setup cell's real `pip install ... --no-deps` is observed doing what it does
+on Colab. The gate then walks the installed libraries' declared requirements,
+AST-scans every `import` in their source at any depth and imports each one for
+real: an unguarded import of a module Colab will not have, a headline `autofit`
+search that cannot be constructed, or a declared dependency that is both absent
+and imported is a **FAIL**. Version conflicts, guarded imports and never-imported
+gaps are WARNs carried in the report. Until 2026-09-15 Check F installed the
+stack **with** dependencies before running the cell, so the bootstrap's misses
+(`corner`, `optax`, `xxhash`, `blackjax`) were invisible to it and shipped.
+
 Check B then requires the unpinned install to be refused as well. That is a
 separate guarantee, and it was not met until 2026-08-19: `pip install autolens`
 on 3.11 backtracked to `2026.7.29.1` and installed a stale, JAX-less stack

health_agent/capabilities.yaml

@@ -96,7 +96,7 @@ deep_checks:
   - id: verify_install
     impl: heart/checks/verify_install.sh
     cli: "pyauto-heart verify_install"
-    measures: "pip, conda, and Colab install-path checks A-F; Check B exact release succeeds on Python 3.12/3.13 and rejects on 3.11; Check E installs historical 2026.2.26.4 on Python 3.12 because its stack has no Python 3.13 dependency wheels"
+    measures: "pip, conda, and Colab install-path checks A-F; Check B exact release succeeds on Python 3.12/3.13 and rejects on 3.11; Check E installs historical 2026.2.26.4 on Python 3.12 because its stack has no Python 3.13 dependency wheels; Check F builds a python3.12 venv holding Google's Colab package set (googlecolab/backend-info manifest), runs the injected setup cell verbatim, and fails on any unguarded import or imported-but-declared dependency the --no-deps bootstrap leaves unmet"
     gate_role: "RED if last run ready==false; STALE if find-links-only, older than 14d, or never run"
   - id: url_check
     impl: heart/checks/url_check.sh