Split the Python runtime into cultcache-py, cultnet-py, cultmesh-py

One distribution named cultcache-py carried three libraries. Rust and
TypeScript layer them as cultcache < cultnet < cultmesh; Python now does
the same, one package per layer, module names unchanged so every
`from cultmesh_py import ...` keeps working.

Two imports ran against that layering and are resolved by moving code to
where the dependency direction says it lives, not by adding a shim:

- cultnet_py.interop_peer imported the Verse/peer catalog, authority
  lease, stream, and simulation-fact contracts from cultmesh_py. They are
  wire contracts a bare peer has to speak without owning a node, which is
  why cultnet-rs and cultnet-ts keep them in the net layer. They now live
  in cultnet_py.cultmesh_contracts; cultmesh_py re-exports them.
- cultcache_py.benchmark imported cultnet_py. It measures framed CultNet
  parse beside cache paths, so it and compare_csharp move to cultnet_py.
  verify checks all three packages and moves to cultmesh_py.

The single 6,693-line test module is split by what each test touches: a
test using any cultmesh_py name lands in cultmesh-py, else cultnet_py in
cultnet-py, else cultcache-py. Each suite runs with only its layer and the
layers below on the path, so a test that reaches up fails to import
rather than quietly binding the packages back together. 11 / 53 / 78 =
the same 142.

Workflows install all three; the publish job is one matrix over the
three packages keyed by tag prefix. The TS test harnesses put all three
src directories on PYTHONPATH. cultcache-py bumps to 0.2.0 because it no
longer contains cultnet_py or cultmesh_py; the new packages start at
0.1.0. Nothing was ever published, so no PyPI consumer moves.

  cultcache-py  11 tests, path: cultcache-py/src
  cultnet-py    53 tests, path: + cultnet-py/src
  cultmesh-py   78 tests, path: + cultmesh-py/src
  python -m cultmesh_py.verify -> ok, all five checks
  cultnet_py.interop_peer imports with cultmesh_py absent

Not run here: the cultnet-ts interop ring and cultcache-ts store matrix
need dotnet/kotlin peers; their PYTHONPATH change is four lines.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/cultmesh-portability.yml

@@ -77,8 +77,8 @@ jobs:
       - name: Install TypeScript workspace dependencies
         run: npm install --no-package-lock
 
-      - name: Install Python CultCache package
-        run: python -m pip install -e packages/cultcache-py
+      - name: Install Python CultLib packages
+        run: python -m pip install -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py
 
       - name: Verify explicit reactive scheduling across runtimes
         shell: pwsh

.github/workflows/cultnet-interop.yml

@@ -69,7 +69,7 @@ jobs:
         run: npm install --no-package-lock
 
       - name: Install Python package dependencies
-        run: python -m pip install -e packages/cultcache-py
+        run: python -m pip install -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py
 
       - name: Build TypeScript workspace dependencies
         run: npm run build --workspace packages/cultcache-ts

.github/workflows/publish-packages.yml

@@ -8,15 +8,18 @@ name: Publish packages
 # directly, which is already how Ghostlight, Epiphany, CodexConnector and Odin
 # consume the core stack.
 #
-# Tag a release to publish, for example `cultcache-ts-v0.13.6`. The tag's
-# version must match the version in the package manifest; the workflow refuses
-# the publish otherwise rather than shipping a mislabelled artifact.
+# Tag a release to publish, for example `cultcache-ts-v0.13.6` or
+# `cultnet-py-v0.1.0`. The tag's version must match the version in the package
+# manifest; the workflow refuses the publish otherwise rather than shipping a
+# mislabelled artifact.
 
 on:
   push:
     tags:
       - "cultcache-ts-v*"
       - "cultcache-py-v*"
+      - "cultnet-py-v*"
+      - "cultmesh-py-v*"
   workflow_dispatch:
     inputs:
       package:
@@ -26,6 +29,8 @@ on:
         options:
           - cultcache-ts
           - cultcache-py
+          - cultnet-py
+          - cultmesh-py
 
 permissions:
   contents: read
@@ -72,9 +77,16 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-  cultcache-py:
-    name: cultcache-py to PyPI
-    if: startsWith(github.ref, 'refs/tags/cultcache-py-v') || inputs.package == 'cultcache-py'
+  # The three Python packages layer cultcache-py < cultnet-py < cultmesh-py, the
+  # same way the Rust crates and npm packages do. One job shape serves all
+  # three; the matrix entry names the package and the tag prefix that releases it.
+  python:
+    name: ${{ matrix.package }} to PyPI
+    if: startsWith(github.ref, 'refs/tags/cultcache-py-v') || startsWith(github.ref, 'refs/tags/cultnet-py-v') || startsWith(github.ref, 'refs/tags/cultmesh-py-v') || endsWith(inputs.package, '-py')
+    strategy:
+      fail-fast: false
+      matrix:
+        package: [cultcache-py, cultnet-py, cultmesh-py]
     runs-on: ubuntu-latest
     timeout-minutes: 20
     environment: pypi
@@ -84,31 +96,51 @@ jobs:
       # long-lived API token is stored in the repository.
       id-token: write
     steps:
+      - name: Skip packages this run does not name
+        id: selected
+        run: |
+          if [ "${GITHUB_REF_NAME#${{ matrix.package }}-v}" != "$GITHUB_REF_NAME" ] || [ "${{ inputs.package }}" = "${{ matrix.package }}" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Check out CultLib
+        if: steps.selected.outputs.run == 'true'
         uses: actions/checkout@v4
 
       - name: Set up Python
+        if: steps.selected.outputs.run == 'true'
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
 
       - name: Verify the tag matches the manifest version
-        if: startsWith(github.ref, 'refs/tags/cultcache-py-v')
+        if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
         run: |
-          manifest="$(python -c "import tomllib,pathlib;print(tomllib.loads(pathlib.Path('packages/cultcache-py/pyproject.toml').read_text())['project']['version'])")"
-          tagged="${GITHUB_REF_NAME#cultcache-py-v}"
+          manifest="$(python -c "import tomllib,pathlib;print(tomllib.loads(pathlib.Path('packages/${{ matrix.package }}/pyproject.toml').read_text())['project']['version'])")"
+          tagged="${GITHUB_REF_NAME#${{ matrix.package }}-v}"
           if [ "$manifest" != "$tagged" ]; then
             echo "tag $GITHUB_REF_NAME does not match manifest version $manifest" >&2
             exit 1
           fi
 
+      # Lower layers install from source so a release of one package is tested
+      # against the sibling revision it was cut with, not whatever PyPI has.
+      - name: Install and test
+        if: steps.selected.outputs.run == 'true'
+        run: |
+          python -m pip install -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py
+          python -m unittest discover -s packages/${{ matrix.package }}/tests
+
       - name: Build sdist and wheel
+        if: steps.selected.outputs.run == 'true'
         run: |
           python -m pip install --upgrade build
-          python -m build packages/cultcache-py
+          python -m build packages/${{ matrix.package }}
 
       - name: Publish
-        if: startsWith(github.ref, 'refs/tags/cultcache-py-v')
+        if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          packages-dir: packages/cultcache-py/dist
+          packages-dir: packages/${{ matrix.package }}/dist