[seonghobae]

Successor scope

Verified successor for #987 after its generator branch repeatedly replayed a stale snapshot and removed the canonical dependency-security owner changes.

• Predecessor exact head retained in history: 64f00aed52e553afb22a4c2989144177b97921ca.
• Canonical dependency owner: fix(deps): raise parser and TestClient security floors #822 at 23e481577af0283da512d9b2626ae27188245bdc.
• Initial successor head: f6bcf169b22b73c3f9b2be267659d2eaf33e391d.
• Current exact head after same-head Security RCA: 9f030e97165841f70bef8e28c1d0ded536a13fc4.
• Current result tree: 14bfb03cae613b6c4151dc8f614bfa3b9fe72164.

Preserved contract

• Carries the Permissions-Policy source and response tests from 🛡️ Sentinel: Permissions-Policy 보안 헤더 추가 #987.
• Carries fix(deps): raise parser and TestClient security floors #822 dependency floors, lock, regression contracts, doctoring, CHANGELOG, form-field bounds, and docs/product-technical-gap-baseline.md.
• Preserves every predecessor commit as ordinary first-parent history; no Force Push or destructive rebase.

RCA

Security run 36792861820, job 110149569373, reported 12 findings at predecessor head 64f00aed.... Exact comparison against the repaired head showed two repeated feature commits had deleted or downgraded the owner files, including the product-gap baseline and transport security contract. Re-editing the generator-owned branch had already failed repeatedly, so this isolated branch removes the active single-writer collision without discarding its valid feature delta.

Draft until fresh exact-head tests, Security, Semgrep, CodeQL, image/fuzz checks, and qualifying independent review are terminal. Queued/skipped/pending are not passing. Predecessor #987 remains open and Draft until verified complete carryover is established.

Current-head urllib3 RCA

Security Scan 36794054647, Trivy job 110153330809, found urllib3 2.7.0 affected by CVE-2026-97687/97688/97689. Test-first head 9f030e97165841f70bef8e28c1d0ded536a13fc4 adds the direct urllib3>=2.8.0,<3.0 floor, a resolver-generated 2.8.0 lock, an executable source/lock/documentation contract, and aligned CHANGELOG/doctoring/product-gap evidence. Local full pytest is 488/488 with 100% owned production statement/branch coverage; strict docs and complete exported-lock pip-audit pass. Fresh hosted tests, Security, Semgrep, repository CodeQL, container, and scorecards pass; clusterfuzzlite remains in progress and Draft-event CodeQL PR is skipped/non-passing. The PR remains Draft until terminal exact-head evidence and review admission are complete.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head Security RCA and RED→GREEN repair (2026-10-01): run 36794054647, Trivy job 110153330809, found urllib3 2.7.0 affected by CVE-2026-97687/97688/97689. Test-first tests/test_urllib3_security_floor.py failed for the missing direct floor and missing operator evidence, then passed after adding urllib3>=2.8.0,<3.0, regenerating uv.lock to 2.8.0, and updating CHANGELOG, dependency doctoring, and docs/product-technical-gap-baseline.md. New exact head is 9f030e97165841f70bef8e28c1d0ded536a13fc4 (tree 14bfb03cae613b6c4151dc8f614bfa3b9fe72164), advanced from f6bcf169... with force=false. Local evidence: targeted 10/10 security contracts; full pytest 488/488; production statements 830/830 and branches 254/254 (100%); strict MkDocs build PASS; complete exported lock pip-audit reports no known vulnerabilities; uv lock --check, Ruff, and git diff --check PASS. Fresh hosted exact-head Checks are required; predecessor or prior-head results do not transfer.