build(account-unification): resync uv lockfile

[seonghobae]

Summary

• regenerate the account-unification uv lockfile from the protected main pyproject pins
• align coverage 7.15.4 and setuptools 84.0.0 without changing runtime or source behavior
• retain the normally merged MCP OAuth documentation child as part of this stacked successor head

Verification

• Exact current head: 036eb5f425c29296b0d5b9fb2666897417487983
• Base: ce207dfd42975db61c82a5963e206fc1db14ac2b
• Local account-unification suite: 748 passed
• Coverage: 2,734 statements and 738 branches at 100%/100%
• Interrogate: 100%; Ruff; compileall; uv lock check; git diff check; Semgrep security audit: 0 findings
• actionlint -ignore SC2016 passed; the unignored SC2016 is an intentional nested bash -c quoting case in the pre-existing hourly workflow
• Hosted Checks and independent review must be re-established for the exact current head; no runtime MCP implementation is claimed

Stack note

• PR docs: define MCP-compatible OAuth authorization boundary #115 was normally squash-merged into the lockfile branch at ancestor ec91eb3af436ac7fa5e682d31d78cd5b01782d01.
• The current exact diff intentionally contains the lockfile change plus the MCP OAuth ADR/doctoring documentation and follow-up contract hardening.
• Predecessor approval and Checks are invalid after each head change. Any approval or merge decision must bind only to 036eb5f425c29296b0d5b9fb2666897417487983.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 46 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e053cbb7-5310-442b-95aa-b89c09a98eee

📥 Commits

Reviewing files that changed from the base of the PR and between ec91eb3 and 31dd486.

⛔ Files ignored due to path filters (2)

• services/account_unification/requirements.lock is excluded by !**/*.lock
• services/account_unification/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (11)

• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/hourly-product-development.yml
• CHANGELOG.md
• docs/TRACEABILITY.md
• docs/adr/0013-mcp-oauth-client-authorization.md
• docs/doctoring/mcp-oauth-authorization.md
• docs/operations/oidc-rp-reconciliation.md
• services/account_unification/pyproject.toml
• services/account_unification/requirements-dev.txt
• tests/test_documentation_contract.py

📝 Walkthrough

Walkthrough

MCP OAuth 클라이언트 인가에 대한 ADR과 검증 문서를 추가했습니다. Keycloak, Keyverse, LineageWeave의 권한 경계와 리소스 바인딩을 정의했습니다. 런타임 구현 증거가 없음을 gap-not-claimed로 기록했습니다.

Changes

MCP OAuth 클라이언트 인가

Layer / File(s)	Summary
인가 계약과 설계 기록 docs/adr/0013-mcp-oauth-client-authorization.md, docs/doctoring/mcp-oauth-authorization.md, docs/adr/README.md	MCP OAuth 인가 범위와 표준 요구사항을 정의했습니다. ADR-0013을 Proposed 상태로 색인에 추가했습니다.
Discovery와 보호 리소스 계약 docs/adr/0013-mcp-oauth-client-authorization.md	Keycloak discovery의 issuer·endpoint 일치 조건을 정의했습니다. LineageWeave가 protected-resource metadata와 canonical resource URI를 소유하도록 지정했습니다.
공개 클라이언트와 리소스 바인딩 docs/adr/0013-mcp-oauth-client-authorization.md	authorization code, S256 PKCE, 정확한 redirect URI, state, 최소 scope, 단일 resource 및 토큰 바인딩 검증을 요구했습니다. device authorization과 동적 등록은 제외했습니다.
토큰 상태와 구현 증거 docs/adr/0013-mcp-oauth-client-authorization.md, docs/TRACEABILITY.md	폐기·비활성화 검증, 필수 거부 테스트, 감사 정책 및 구현 증거 기준을 기록했습니다. 현재 런타임 증거 상태를 gap-not-claimed로 표시했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to ec91e

The PR updates authorization design and traceability documents but still omits required issuer-binding, JWT validation, and current MCP/RFC 9207 details. This leaves the documented security contract incomplete and requires owner follow-up before merge; the dependency lockfile change itself does not add runtime behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 PR의 주요 변경인 account-unification 서비스의 uv.lock 재생성을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/account-unification-lock-20260819

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review the exact current head only. Focus on the lockfile consistency repair and whether it safely unblocks ; do not transfer predecessor evidence or self-approve the author.

[seonghobae]

Correction: review the exact current head f02acf9 only. Focus on the lockfile consistency repair and whether uv sync locked succeeds safely. Do not transfer predecessor evidence or self-approve the author.

[seonghobae]

Exact-head review request (2026-08-20):

Head f02acf93367a40dbfb23a73985017dca8d42ff39 was revalidated against protected base ce207dfd42975db61c82a5963e206fc1db14ac2b. The PR is limited to services/account_unification/uv.lock; local uv lock --check passed, and the current hosted Checks are terminal-success except intentional skipped jobs.

@opencode-agent please perform an independent review of this exact head. Do not approve based on this request alone; approval must be a normal independent review.

[seonghobae]

Please independently review exact current head f02acf9 only. This lock refresh is the prerequisite for PR #105: it updates the account-unification lock to the current pyproject requirements. All hosted Checks are terminal-success; do not transfer predecessor evidence, self-approve, or merge without the normal protected latest-pusher and current-head review gates.

[seonghobae]

Independent exact-head review requested for f02acf9. This lockfile-only prerequisite unblocks the stale uv --locked failures on Dependabot PRs #105-#110 after normal branch refresh. Current exact-head terminal Checks are 22 success and 8 skipped; no current-head approval is present. A review-only merge-scheduler dispatch was sent with auto-merge and branch updates disabled. Please review this exact SHA; do not transfer stale approval or self-approve.

[seonghobae]

@opencode-agent please review exact current head f02acf9. All four required Checks are successful; independently verify the lockfile-only prerequisite before any protected merge.

[seonghobae]

Exact-head review request for f02acf93367a40dbfb23a73985017dca8d42ff39. This dependency-only PR regenerates the account-unification uv lockfile to match the protected-main pins; current terminal Checks for this exact head are all successful (ci, SAST Semgrep, Security Scan, CodeQL). Please perform the independent formal review at this exact head. Do not self-approve, merge, or enable auto-merge.

[seonghobae]

@opencode-agent Please review exact current head f02acf93367a40dbfb23a73985017dca8d42ff39 independently. Required Checks are terminal-success, but no qualifying approval exists. Revalidate the lockfile resynchronization and current protected-branch requirements; bind any review to this SHA only and do not self-approve or merge.

[seonghobae]

@cwl-noema-review Please review exact current head f02acf93367a40dbfb23a73985017dca8d42ff39 against main. Validate the lockfile resynchronization and current terminal Checks; bind evidence to this SHA only and do not self-approve or merge.

[seonghobae]

Current-head review request: Lockfile refresh prerequisite has 23 successful Checks and no queued run, but no formal review is recorded. Please obtain an independent current-head review on this exact SHA before any protected merge. Exact SHA: f02acf93367a40dbfb23a73985017dca8d42ff39.

[seonghobae]

@opencode-agent Please independently review exact current head f02acf93367a40dbfb23a73985017dca8d42ff39. All required Checks are terminal-success, but no formal approval is recorded. Bind any review to this SHA only; do not transfer approval, self-approve, or merge.

[seonghobae]

@opencode-agent review exact current head f02acf93367a40dbfb23a73985017dca8d42ff39. Re-evaluate the complete dependency-lock change, security and regression behavior on this SHA only; publish fresh evidence and approval or actionable findings. Do not transfer predecessor review state, modify the branch, or merge.

[seonghobae]

Exact-head local verification for f02acf93367a40dbfb23a73985017dca8d42ff39 (detached worktree; no source changes):

• uv sync --locked --extra dev
• uv run pytest -o addopts='' --disable-warnings: 742 passed
• uv run coverage run --branch --source=app -m pytest -q && uv run coverage report --show-missing --fail-under=100: 100% (2,734 statements, 738 branches)
• uv run interrogate .: 100%, passed
• uv run ruff check .: passed
• uv run python -m compileall -q app tests: passed
• git diff --check: passed

The worktree is clean. This is validation evidence only; no approval or merge action was taken.

[seonghobae]

Independent review request for exact current head f02acf9 against main@ce207dfd42975db61c82a5963e206fc1db14ac2b. All hosted required Checks currently pass, but no formal review exists. Please verify the locked dependency graph, full CI/coverage/security results, and stack compatibility at this SHA only. Do not transfer predecessor review, self-approve, or merge.

[seonghobae]

Independent local lock verification for exact head f02acf93367a40dbfb23a73985017dca8d42ff39:

• In an isolated detached worktree, uv lock --check completed successfully from services/account_unification.
• Parsed pyproject.toml and uv.lock agree on project metadata and the requested resolutions (coverage==7.15.4, setuptools==84.0.0).
• No source or test files are changed by this PR; no additional patch was identified.

This is verification evidence, not a formal approval. Protected merge still requires an independent approval and exact-head protected gates.

[seonghobae]

@opencode-agent please perform an independent substantive review of exact current head f02acf93367a40dbfb23a73985017dca8d42ff39 against protected base ce207dfd42975db61c82a5963e206fc1db14ac2b. Read the complete lockfile/dependency diff, verify exact-head checks and supply-chain impact, and publish a current-head verdict. No stale approval transfer or self-approval.

[seonghobae]

Update to the prior exact-head request: after rechecking the live rollup (22 successful, 8 skipped, 0 failures) at f02acf93367a40dbfb23a73985017dca8d42ff39, protected squash auto-merge is now armed. It remains blocked on the required independent approval; no approval was created or bypassed, and no merge has occurred.

[seonghobae]

Exact-head review request: f02acf93367a40dbfb23a73985017dca8d42ff39 against base ce207dfd42975db61c82a5963e206fc1db14ac2b has 23 successful and 8 skipped Checks, with no queued or terminal failure result. Please provide an independent substantive review of the exact head. Protected squash auto-merge remains armed but cannot transition until required independent approval is recorded; no bypass or self-approval is used.

[seonghobae]

@opencode-agent please perform a fresh independent substantive review against exact head f02acf93367a40dbfb23a73985017dca8d42ff39 and base ce207dfd42975db61c82a5963e206fc1db14ac2b. This is the lockfile-refresh root of the dependent stack; review the full current diff and do not reuse predecessor-head approval or Checks.

[seonghobae]

@cwl-noema-review please perform a fresh independent substantive review of exact current head f02acf9 against protected base ce207df. Read the complete lockfile diff, verify dependency/export consistency and supply-chain impact, and publish a verdict bound only to this SHA. Do not reuse predecessor-head evidence.

[seonghobae]

@opencode-agent @cwl-noema-review Please perform a fresh independent substantive review of exact successor head ec91eb3af436ac7fa5e682d31d78cd5b01782d01 against protected base ce207dfd42975db61c82a5963e206fc1db14ac2b. The head changed normally when stacked PR #115 merged into the root branch; read the complete combined lockfile plus MCP OAuth documentation diff, verify dependency and documentation consistency, and publish a verdict bound only to this SHA. Do not reuse predecessor approval or Checks, self-approve, bypass, or merge.

[seonghobae]

Exact-head successor verification

• Exact current head: ec91eb3af436ac7fa5e682d31d78cd5b01782d01
• Exact base: ce207dfd42975db61c82a5963e206fc1db14ac2b
• The head is the normal squash merge result of docs: define MCP-compatible OAuth authorization boundary #115 plus the lockfile root change; predecessor f02acf9 evidence is discarded.
• Detached merged-tree verification: root documentation contract 5 passed; account-unification tests 742 passed; statement/branch coverage 2734/738, 100%/100%; interrogate 100%; Ruff and git diff --check passed.
• Hosted checks for the successor head are newly queued and independent review is still required. No merge claim is made.

[seonghobae]

Exact-head remediation pushed: current head is d2f48232fff1505c3274fe4296ca21cece5db102 against unchanged protected base ce207dfd42975db61c82a5963e206fc1db14ac2b.

Validated current findings from the exact predecessor head: RFC 9207 callback issuer recording/exact comparison (including error responses and missing-iss policy), RFC 9068 typ/required claims/signature/algorithm rejection, current MCP 2026-07-28 traceability, APA references, changelog, and operator handoff.

Local verification on this exact tree: root documentation contract 6 passed; account-unification pytest 742 passed; coverage 2,734 statements / 738 branches at 100%/100%; Interrogate 100%; Ruff; compileall; uv lock --check; and git diff --check. Hosted Checks and independent review must be re-established for this new head; no approval, merge, bypass, or force merge is claimed.

[seonghobae]

@opencode-agent @cwl-noema-review Please perform a fresh independent substantive review against exact current head d2f48232fff1505c3274fe4296ca21cece5db102 and base ce207dfd42975db61c82a5963e206fc1db14ac2b. Read the complete combined lockfile plus MCP OAuth documentation diff, verify RFC 9207 issuer/error-response handling, RFC 9068 token contract, documentation provenance, and supply-chain impact. Bind any verdict only to this SHA; do not reuse predecessor approval or Checks, self-approve, bypass, or merge.

[seonghobae]

Current-head verification and review disposition

• Repository: ContextualWisdomLab/keyverse
• Exact head: 036eb5f425c29296b0d5b9fb2666897417487983
• Exact base: ce207dfd42975db61c82a5963e206fc1db14ac2b
• The only successor change is the one-line setup-uv cache comment correction; runtime behavior is unchanged.
• Local exact-head verification: 748 passed; statement coverage 100% (2,734/2,734); branch coverage 100% (738/738); interrogate 100%; ruff, compileall, uv lock --check, git diff --check, and Semgrep security audit (0 findings) passed. actionlint -ignore SC2016 passed; the unignored SC2016 is an intentional nested bash -c quoting case in the pre-existing hourly workflow.
• Devin observations on predecessor 4c7963b: lockfile consistency and documentation-contract test were confirmed; the stale v9 comment was valid and is corrected in 036eb5f.
• Predecessor CodeRabbit findings/reviews are not reused. Fresh hosted Checks for 036eb5f are still queued and reviewDecision is empty; no qualifying approval is present.

Decision: WAIT_AND_REMEDIATE / normal protected path. No force merge or bypass is authorized.

[seonghobae]

Current-head review disposition update

• Exact head is now 31dd486cb97ca215da451151f618a954a07b0ea5.
• Devin\x27s finding on predecessor 036eb5f was valid: the root tests/test_documentation_contract.py was not executed by CI.
• Fixed in 31dd486 by adding a dedicated repository-root CI step: uv run --project services/account_unification pytest tests/test_documentation_contract.py -q.
• Exact-head local result: documentation contracts 6 passed; account suite 748 passed; statement/branch coverage 100%/100% (2,734/738); interrogate, ruff, compileall, lock check, diff check, actionlint (known nested-shell SC2016 excluded), and Semgrep (0 findings) passed.
• Fresh hosted Checks and independent review for 31dd486 are pending; no qualifying approval exists. No merge or bypass action is being taken.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Fresh review disposition for 31dd486cb97ca215da451151f618a954a07b0ea5

Devin\x27s current-head observation confirms that the CI documentation-contract step correctly overrides the service default working directory with github.workspace, uses the service project environment, and resolves the repository-root test path. This is informational confirmation; no source finding remains. Current unresolved substantive findings: 0. Required hosted Checks remain pending and no independent approval is recorded, so the PR stays on the normal protected path and is not merged or bypassed.

[seonghobae]

Exact-head Checks disposition

• PR build(account-unification): resync uv lockfile #112 exact head: 31dd486cb97ca215da451151f618a954a07b0ea5
• Exact Strix run: 32491042785, job 96798506300
• The failure is not a reported vulnerability: the run recorded Vulnerabilities 0, then Strix-owned Caido bootstrap failed after retries because 127.0.0.1:48080 was unavailable, and the required gate correctly failed closed.
• The central fail-closed repair is being handled in .github PR #1153; do not reuse this failed run as a source verdict or bypass protection.

Decision: WAIT_AND_REMEDIATE. Re-run the exact current head after the central control-plane repair is normally merged and its required Checks/reviews are satisfied. No source change or force merge is authorized for this lockfile PR from this infrastructure failure.