⬆️ chore: standardize on Python 3.13

Org-wide standardization on Python 3.13 (3.13 rather than 3.14 because
whisperx in a sibling repo caps at <3.14).

- Add .python-version pinning 3.13
- README + CLAUDE.md: document 3.13 and switch setup/run commands to uv
- Note the extractors' write-to-CWD behavior so verification runs don't
  clobber the committed JSON

No pyproject.toml exists here, so there is no requires-python to change.

Verified on 3.13: PyMuPDF 1.28.0 resolves; both extractors regenerate
output byte-identical to the committed JSON (diff clean, sha256 match);
nist_sorter reports ordering already correct; all 11 tracked .py files
compile. No test suite and no CI exist in this repo.

Author: luiscosio

.python-version

@@ -0,0 +1 @@
+3.13

CLAUDE.md

@@ -15,18 +15,30 @@ This is a web application for viewing and managing security control overlays tha
 ## Common Development Commands
 
 ### Python Data Extraction
+
+Python 3.13 (pinned in `.python-version`), managed with `uv`. Never use bare `pip` or conda.
+
 ```bash
+# One-time environment setup
+uv venv --python 3.13
+uv pip install -r requirements.txt
+
 # Extract overlay data from PDFs (requires PyMuPDF/fitz)
-python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf
-python classified_information/extract_classified_information.py classified_information/classified_information_overlay_2022.pdf
+uv run python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf
+uv run python classified_information/extract_classified_information.py classified_information/classified_information_overlay_2022.pdf
 
 # Debug specific pages
-python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf --debug-page 10
+uv run python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf --debug-page 10
 
 # Sort NIST controls naturally
-python nist_catalog/nist_sorter.py input.json output.json
+uv run python nist_catalog/nist_sorter.py input.json output.json
 ```
 
+**Extractor output paths:** `extract_*.py` write their JSON to the *current working directory* using hardcoded
+filenames, so run them from the repo root to land on the committed files. `nist_sorter.py` overwrites its input
+file when no output path is given. When regenerating output just to verify a change, run from a scratch
+directory so the committed JSON is never clobbered, then `diff` the result.
+
 ### Development
 - No build process - edit `index.html` directly
 - No package manager - pure vanilla JavaScript
@@ -93,6 +105,6 @@ No automated tests exist. Manual testing process:
 
 ## Dependencies
 
-- **Python**: PyMuPDF (fitz) for PDF extraction
+- **Python**: 3.13, PyMuPDF (fitz) for PDF extraction (see `requirements.txt`)
 - **JavaScript**: None (vanilla JS only)
 - **Deployment**: GitHub Pages

README.md

@@ -108,19 +108,26 @@ The application uses a PDF → JSON → Web pipeline:
 
 ### Extracting Data from PDFs
 
+The extractors target **Python 3.13** (pinned in `.python-version`) and depend on PyMuPDF (fitz). Set up the environment with [uv](https://docs.astral.sh/uv/):
+
 ```bash
-# Requires PyMuPDF (fitz)
-pip install PyMuPDF
+# Create the environment and install dependencies
+uv venv --python 3.13
+uv pip install -r requirements.txt
+```
 
+The extractor scripts write their JSON output to the **current working directory**, so run them from the repository root:
+
+```bash
 # Extract CNSSI 1253 overlay
-python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf
+uv run python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf
 
 # Extract Classified Information overlay
-python classified_information/extract_classified_information.py \
+uv run python classified_information/extract_classified_information.py \
     classified_information/classified_information_overlay_2022.pdf
 
 # Debug specific pages
-python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf --debug-page 10
+uv run python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf --debug-page 10
 ```
 
 ---
@@ -192,7 +199,7 @@ The site is deployed at [https://il6.sl5taskforce.org/](https://il6.sl5taskforce
 | Component | Dependency |
 |-----------|------------|
 | **Web App** | None (vanilla JavaScript) |
-| **PDF Extraction** | Python 3, PyMuPDF (`pip install PyMuPDF`) |
+| **PDF Extraction** | Python 3.13, PyMuPDF (`uv pip install -r requirements.txt`) |
 | **Deployment** | GitHub Pages |
 
 ---