[groupthinking]

Completed exact-lock dependency diagnostic — closed without merge

Refs #2486, #2492, #2498, and issue #2490. This temporary off-main PR compared only the exact uv.lock bytes from #2486 under the proposed dependency-review and locked-Python-CI repairs. It was closed unmerged and both temporary branches were deleted after verification. It does not prove snapshot parity against current main or clear #2486's existing red check.

The final temporary base 3db6bc716e3fe8e7c03e9cf19bfd039aef89e643 combined #2492's full-tree and scoped uv snapshot workflow with #2498's locked Python CI, plus a temporary push trigger/test used only for this diagnostic. Its uv.lock was byte-identical to main at ba2777d1b008c2148d413e07cc497791966310e0. The final head 9ac578ea17c47b6109f5cd7cc271d222fb3dc0fd differed from that base only in root uv.lock, byte-identical to #2486 head b9c38d461c2cd8bccbb60024ab427fa2965d3589. The delta comprised 31 version replacements and three newly added transitive packages.

Result

• The initial hosted check was green but mislabeled all 65 changed uv dependency rows as runtime. Direct dev-only packages black, notebook, and pyjwt were among those mislabeled, so that green check was not a reliable verdict. The upstream uv detector recognizes virtual project roots; EventRelay's root uses source.editable, leaving its development reachability unclassified. The correction in draft fix: match dependency snapshots on update pull requests #2492 submits a scoped uv.lock snapshot and checks the full GitHub diff against the exact lockfiles.
• Final base run 40738262187 successfully submitted both full-tree and scoped uv snapshots. Final head run 40738274345, attempt 2 completed successfully in dependency review, evidence recording, and artifact upload at the exact head above. Its review_outcome: success artifact contains 65 uv.lock rows: 34 added and 31 removed. All package names, versions, manifests, and scopes match the exact lockfiles, including 11 development-only changed package names. Independent GitHub API readback had an empty snapshot-warning header and byte-identical diff (SHA-256 3b645b716661271d36003b1850827cb09510a7610830eeb1ddd346b58b51fa5b). No vulnerabilities were reported; ddtrace-internal has unknown license metadata.
• Attempt 1 of the final head run started before the base snapshots were available. Its dependency step exhausted the 300-second warning retry on an incomplete comparison and failed. The recorder later saved the correct 65-row diff with review_outcome: failure. The unchanged exact commit passed on attempt 2 after both base snapshots were available.
• Python 3.11 and 3.12 hosted jobs on the earlier canary head each passed 2,973 tests and failed one repository workflow guard because this diagnostic deliberately added a temporary push branch. That is a diagnostic setup failure, not a failure caused by fix: bump the uv group across 1 directory with 16 updates #2486's lockfile. Local focused workflow/snapshot tests passed 25 on the final repair; uv lock --check --offline, Ruff, and diff check passed. The earlier exact-lock local full unit selection passed 2,960 tests plus 118 subtests on each Python version with two pre-existing macOS-specific tests excluded; the offline MCP selection passed 38 tests plus 20 subtests on each.

Scope and cleanup

This is an off-main confirmation of snapshot scope and artifact accuracy. The original dependency PRs still need their bases refreshed and their hosted checks rerun after the shared repairs are merged. No approval or merge of #2486, #2487, #2492, or #2498 is claimed by this diagnostic. #2499 is closed unmerged; codex/uv-lock-parity-canary-base and codex/uv-lock-parity-canary-head were deleted. The exact hosted result and remaining main-based gate are recorded on draft #2492.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Oct 28, 2026 5:43pm UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 PR Validation

⚠️ Large PR detected (631 lines changed)

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

uv.lock

Package	Version	License	Issue Type
ddtrace-internal	0.1.0	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Python-2.0, BlueOak-1.0.0, MPL-2.0, CC0-1.0, 0BSD, MIT-CMU, Unlicense

Excluded from license check:

pkg:pypi/regex, pkg:pypi/torch, pkg:npm/caniuse-lite, pkg:npm/@sentry/nextjs, pkg:npm/@sentry/cli, pkg:npm/@sentry/cli-darwin, pkg:npm/@sentry/cli-linux-arm, pkg:npm/@sentry/cli-linux-arm64, pkg:npm/@sentry/cli-linux-i686, pkg:npm/@sentry/cli-linux-x64, pkg:npm/@sentry/cli-win32-arm64, pkg:npm/@sentry/cli-win32-i686, pkg:npm/@sentry/cli-win32-x64, pkg:npm/@sentry/bundler-plugin-core, pkg:npm/@sentry/babel-plugin-component-annotate, pkg:npm/@img/sharp-libvips-darwin-arm64, pkg:npm/@img/sharp-libvips-darwin-x64, pkg:npm/@img/sharp-libvips-linux-arm, pkg:npm/@img/sharp-libvips-linux-arm64, pkg:npm/@img/sharp-libvips-linux-ppc64, pkg:npm/@img/sharp-libvips-linux-riscv64, pkg:npm/@img/sharp-libvips-linux-s390x, pkg:npm/@img/sharp-libvips-linux-x64, pkg:npm/@img/sharp-libvips-linuxmusl-arm64, pkg:npm/@img/sharp-libvips-linuxmusl-x64, pkg:npm/@img/sharp-wasm32, pkg:npm/@img/sharp-win32-arm64, pkg:npm/@img/sharp-win32-ia32, pkg:npm/@img/sharp-win32-x64

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/accelerate	1.15.0	🟢 6.7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 24/28 approved changesets -- score normalized to 8 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 SAST 🟢 3 SAST tool is not run on all commits -- score normalized to 3
pip/aiohttp	3.14.4	Unknown	Unknown
pip/black	26.10.1	Unknown	Unknown
pip/brotli	1.2.1	🟢 7.7	Details Check Score Reason Token-Permissions ⚠️ -1 No tokens found Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow ⚠️ -1 no workflows found Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 2 Found 5/18 approved changesets -- score normalized to 2 Pinned-Dependencies ⚠️ -1 no dependencies found CII-Best-Practices ⚠️ 2 badge detected: InProgress Dependency-Update-Tool 🟢 10 update tool detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9 Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md CI-Tests 🟢 10 20 out of 20 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 16 contributing companies or organizations
pip/ddtrace	4.15.6	Unknown	Unknown
pip/ddtrace-internal	0.1.0	Unknown	Unknown
pip/filelock	4.2.1	Unknown	Unknown
pip/gitpython	3.2.1	Unknown	Unknown
pip/jupyterlab	4.6.4	Unknown	Unknown
pip/mako	1.4.2	Unknown	Unknown
pip/msgpack	1.2.3	Unknown	Unknown
pip/multidict	6.9.1	🟢 6.6	Details Check Score Reason Code-Review ⚠️ 0 Found 0/22 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts.
pip/nbconvert	7.17.2	Unknown	Unknown
pip/notebook	7.6.3	Unknown	Unknown
pip/oauthlib	4.0.0	🟢 7.8	Details Check Score Reason Maintained 🟢 10 15 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 4 Found 4/9 approved changesets -- score normalized to 4 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found SAST ⚠️ -1 internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `mistralai` organization has an IP allow list enabled, and your IP address is not permitted to access this resource. Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches Packaging 🟢 10 packaging workflow detected
pip/opentelemetry-api	1.45.1	Unknown	Unknown
pip/opentelemetry-distro	0.66b1	Unknown	Unknown
pip/opentelemetry-exporter-http-transport	0.66b1	Unknown	Unknown
pip/opentelemetry-exporter-otlp	1.45.1	Unknown	Unknown
pip/opentelemetry-exporter-otlp-common	0.66b1	Unknown	Unknown
pip/opentelemetry-exporter-otlp-proto-common	1.45.1	Unknown	Unknown
pip/opentelemetry-exporter-otlp-proto-grpc	1.45.1	Unknown	Unknown
pip/opentelemetry-exporter-otlp-proto-http	1.45.1	Unknown	Unknown
pip/opentelemetry-instrumentation	0.66b1	Unknown	Unknown
pip/opentelemetry-proto	1.45.1	Unknown	Unknown
pip/opentelemetry-sdk	1.45.1	Unknown	Unknown
pip/opentelemetry-semantic-conventions	0.66b1	Unknown	Unknown
pip/packaging	26.3	Unknown	Unknown
pip/pyjwt	2.15.0	Unknown	Unknown
pip/python-discovery	1.6.7	Unknown	Unknown
pip/tornado	6.6	Unknown	Unknown
pip/virtualenv	21.15.1	Unknown	Unknown
pip/werkzeug	3.1.9	Unknown	Unknown
pip/yarl	1.25.1	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 1/14 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases 🟢 4 3 out of the last 5 releases have a total of 3 signed artifacts.

Scanned Files

• uv.lock