build: bump python from `cea0e60` to `a7fb1e6` in /.devcontainer by dependabot[bot] · Pull Request #423 · cdeust/Cortex

dependabot · 2026-08-10T10:30:42Z

Bumps python from cea0e60 to a7fb1e6.

cdeust · 2026-08-10T14:09:36Z

ZETETIC-REVIEW: REQUEST_CHANGES

Stakes: Low (single-line digest bump, .devcontainer/Dockerfile, dev-only image, no runtime logic change).

Digest verification (point 1)

Resolved python:3.14-slim live against registry-1.docker.io (OCI index manifest, docker-content-digest header): current tag resolves to sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc — exact match to the new digest in this diff. Python major.minor (3.14) is unchanged; only the underlying image content moved. Correct.

Blocking — comment block above the changed line is wrong (§8 source discipline)

Not introduced by this diff, but sitting directly above the line it modifies (.devcontainer/Dockerfile:19-24 region, immediately preceding the FROM):

# different python:3.13-slim.
# source: registry-1.docker.io/v2/library/python/manifests/3.13-slim,

The actual pinned tag is python:3.14-slim (confirmed above), not 3.13. Same defect class as #421/#425's shared comment block: the source: citation points at the wrong registry path — a reader re-verifying the digest would query the wrong tag. Since this diff's only content is the digest line those comments annotate, fix the two 3.13 → 3.14 references in the same commit.

Blocking — branch is stale against `origin/main`, both repo gates fail as currently constituted

origin/main is 3 commits ahead of this PR's merge-base (e88e4e21): #331, #419, #427 — the latter two shrank .craftsmanship-baseline.json and re-tightened .claude-plugin/marketplace.json. Ran both gates against the current head of this branch (189ba8f3):

python3 scripts/check_craftsmanship.py --base origin/main → exit 1, "baseline entries ADDED without a base-ref match" (7 entries the PR branch's stale baseline carries that main's shrunk baseline no longer has).
python3 scripts/check_marketplace_pins.py → exit 1, 2 stale pins (hypermnesia-mcp-viz 3.0.0 vs v3.1.0, zetetic-team-subagents 2.36.0 vs v2.37.0) — both already fixed on origin/main.
Confirmed clean baseline on origin/main itself (exit 0 both gates) — this is not pre-existing repo debt, it is this branch trailing main.

GitHub's green check ran against the PR's stale base, not current origin/main; merging as-is will red-X on the next gate run. @dependabot rebase (or a maintainer merge of main) resolves this without any manual edit beyond the comment fix above.

Required to unblock: (1) fix the two stale 3.13 references in the comment block this PR touches, (2) rebase onto current origin/main so both repo gates pass clean.

cdeust · 2026-08-10T15:08:41Z

@dependabot recreate

Bumps python from `cea0e60` to `a7fb1e6`. --- updated-dependencies: - dependency-name: python dependency-version: 3.14-slim dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

…container gate docker_smoke.sh drove the container with `printf '%s' "$REQUESTS" | docker run --rm -i ...`: printf closes its end of the pipe (the container's stdin) the instant the batch is written, before any response has been read. That is the exact anti-pattern PR #331 fixed in scripts/mcp_host_client.py for a local subprocess: closing stdin is the MCP shutdown signal (2025-06-18 SS Lifecycle -> Shutdown -> stdio), not an end-of-input marker, and mcp 2.0.0's _handle_request drops an in-flight response write rather than deliver it once EOF fires the cancel scope. Verified against jsonrpc_dispatcher.py that this cancellation path is method-agnostic, so tools/list (id=3) is exactly as vulnerable as any other request — matching this gate's observed signature ("no valid tools/list response (id=3)", empty stderr, no JSON-RPC error frame) and its history of intermittent failures on unrelated PRs and on main itself. Fix: scripts/docker_smoke_client.py drives the container the same way mcp_host_client.py drives a local server — keep stdin open until every expected response id has arrived (mcp_host_client.drain_exchange, a new generic primitive extracted from _exchange, behavior-preserving), close it only then. docker_smoke.sh now builds the image and delegates the run+exchange+assert sequence to this module; the watchdog still docker-kills the container via --cidfile on the same 60s deadline (fires at most once, never retries). Deterministic reproduction (no clock, no docker, no retries): - tests_py/infrastructure/test_stdio_eof_drain.py adds TestDockerSmokeToolsListLostBeforeDrain, using docker_smoke's own id=3/tools/list request against the real mcp 2.0.0 SDK: the write-then-close-before-drain shape drops the response (reproducing the gate's literal historical failure), the drain-then-close shape does not. - tests_py/scripts/test_docker_smoke_client.py pins that docker_smoke_client's exchange never closes stdin before both expected ids are read, for its own three-frame batch. Corroborating measurement (not the gate, since the race is probabilistic): 20/20 real `docker build` + docker_smoke.sh runs passed locally against the fixed image, versus the historical ~1-in-5 failure rate on the old script (main run at 12:29 today, PRs #423-425). Co-Authored-By: Claude <noreply@anthropic.com>

… fix git merge-base HEAD origin/main was 4 commits behind origin/main — rebased first (per PR #423-425's shared cause), then re-ran the CI's exact invocation, `check_craftsmanship.py --base origin/main`, which diffs against the base ref's baseline rather than the working tree's and caught three real violations `check_craftsmanship.py` alone (no --base) does not: - scripts/docker_smoke_client.py::main exceeded the 40-line method cap (CLAUDE.md's local tightening of coding-standards.md §4.2) — split into _build_parser()/_evaluate()/main(), each under the limit. - scripts/docker_smoke_client.py::TOOLS_LIST_ID (value 3) had no `# source:` comment — added one, same source as PROTOCOL_VERSION above it (docker_smoke.sh's original REQUESTS heredoc, where tools/list was request id=3). - tests_py/infrastructure/test_stdio_eof_drain.py grew to 318 lines, over the 300-line file cap, after the prior commit appended the docker-smoke-specific pinning test to it. Split that test class into a new sibling file, test_docker_smoke_stdio_eof_drain.py, which imports (not duplicates) _server/_GatedWriteStream/_collect from the original — both files now under the cap, no test content lost. No production logic changed: pytest (1448 passed / 35 skipped), ruff check/format, and shellcheck all still clean; the deterministic reproduction (real mcp SDK, docker_smoke's own id=3/tools/list request, write-then-close loses it / drain-then-close does not) is unchanged, just relocated. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(ci): close docker_smoke.sh's stdin-before-drain race in the bare-container gate docker_smoke.sh drove the container with `printf '%s' "$REQUESTS" | docker run --rm -i ...`: printf closes its end of the pipe (the container's stdin) the instant the batch is written, before any response has been read. That is the exact anti-pattern PR #331 fixed in scripts/mcp_host_client.py for a local subprocess: closing stdin is the MCP shutdown signal (2025-06-18 SS Lifecycle -> Shutdown -> stdio), not an end-of-input marker, and mcp 2.0.0's _handle_request drops an in-flight response write rather than deliver it once EOF fires the cancel scope. Verified against jsonrpc_dispatcher.py that this cancellation path is method-agnostic, so tools/list (id=3) is exactly as vulnerable as any other request — matching this gate's observed signature ("no valid tools/list response (id=3)", empty stderr, no JSON-RPC error frame) and its history of intermittent failures on unrelated PRs and on main itself. Fix: scripts/docker_smoke_client.py drives the container the same way mcp_host_client.py drives a local server — keep stdin open until every expected response id has arrived (mcp_host_client.drain_exchange, a new generic primitive extracted from _exchange, behavior-preserving), close it only then. docker_smoke.sh now builds the image and delegates the run+exchange+assert sequence to this module; the watchdog still docker-kills the container via --cidfile on the same 60s deadline (fires at most once, never retries). Deterministic reproduction (no clock, no docker, no retries): - tests_py/infrastructure/test_stdio_eof_drain.py adds TestDockerSmokeToolsListLostBeforeDrain, using docker_smoke's own id=3/tools/list request against the real mcp 2.0.0 SDK: the write-then-close-before-drain shape drops the response (reproducing the gate's literal historical failure), the drain-then-close shape does not. - tests_py/scripts/test_docker_smoke_client.py pins that docker_smoke_client's exchange never closes stdin before both expected ids are read, for its own three-frame batch. Corroborating measurement (not the gate, since the race is probabilistic): 20/20 real `docker build` + docker_smoke.sh runs passed locally against the fixed image, versus the historical ~1-in-5 failure rate on the old script (main run at 12:29 today, PRs #423-425). Co-Authored-By: Claude <noreply@anthropic.com> * fix(ci): satisfy the base-ref craftsmanship gate for the docker_smoke fix git merge-base HEAD origin/main was 4 commits behind origin/main — rebased first (per PR #423-425's shared cause), then re-ran the CI's exact invocation, `check_craftsmanship.py --base origin/main`, which diffs against the base ref's baseline rather than the working tree's and caught three real violations `check_craftsmanship.py` alone (no --base) does not: - scripts/docker_smoke_client.py::main exceeded the 40-line method cap (CLAUDE.md's local tightening of coding-standards.md §4.2) — split into _build_parser()/_evaluate()/main(), each under the limit. - scripts/docker_smoke_client.py::TOOLS_LIST_ID (value 3) had no `# source:` comment — added one, same source as PROTOCOL_VERSION above it (docker_smoke.sh's original REQUESTS heredoc, where tools/list was request id=3). - tests_py/infrastructure/test_stdio_eof_drain.py grew to 318 lines, over the 300-line file cap, after the prior commit appended the docker-smoke-specific pinning test to it. Split that test class into a new sibling file, test_docker_smoke_stdio_eof_drain.py, which imports (not duplicates) _server/_GatedWriteStream/_collect from the original — both files now under the cap, no test content lost. No production logic changed: pytest (1448 passed / 35 skipped), ruff check/format, and shellcheck all still clean; the deterministic reproduction (real mcp SDK, docker_smoke's own id=3/tools/list request, write-then-close loses it / drain-then-close does not) is unchanged, just relocated. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

cdeust · 2026-08-10T15:57:20Z

ZETETIC-REVIEW: APPROVE

Head reviewed: 3bbcc565 (current HEAD, dependabot/docker/dot-devcontainer/python-a7fb1e6) — recreated by dependabot after the branch's earlier incarnation failed CI on an intermittent, unrelated job. The REQUEST_CHANGES comment previously posted on this PR was against that superseded head and its own base-freshness/comment-accuracy findings no longer apply to the code at this head; it is superseded, not retracted for cause.

Move 0 — Ledger reconciliation / seen-defect check

Single hunk, single file, one line changed (digest only). No branches, no error arms, no rationalization language in the diff or the dependabot-generated description. Pass.

Stakes (Move 7)

Low — dev-only container image, digest-only bump, no runtime logic, no production path. Criterion: .devcontainer/Dockerfile is not imported by any runtime code and only affects the optional Dev Containers workflow.

What changed

- FROM python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6
+ FROM python:3.14-slim@sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc

Python major.minor unchanged (3.14 → 3.14). No other lines touched.

Verification performed on the current head

Base freshness: git merge-base pr423 origin/main = cdf084bce68d... = the tip of origin/main immediately before this branch's own base line advanced by five unrelated merges (deps: bump typer from 0.27.0 to 0.27.1 #420/build: bump python from 86f975a to 23c5939 in /docker #421/deps: bump tree-sitter-language-pack from 1.13.5 to 1.14.3 #424/ci: bump actions/attest-build-provenance from 4.1.1 to 4.2.2 #426/fix(ci): close docker_smoke.sh's stdin-before-drain race #428) that landed after this branch was cut — none of which touch .devcontainer/Dockerfile. GitHub reports MERGEABLE; no rebase is required for a clean fast-forward-equivalent merge.
Digest resolution: fetched a fresh bearer token and queried registry-1.docker.io/v2/library/python/manifests/3.14-slim directly (Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json). Live docker-content-digest header returned sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc — an exact match to the new FROM line. The tag still resolves to python:3.14-slim; no major/minor drift.
Source-comment accuracy: the digest-pin comment block (lines 17–23) is untouched by this diff and was already present, unmodified, on origin/main before this bump — verified via git show origin/main:.devcontainer/Dockerfile. It reads "different python:3.13-slim" / manifests/3.13-slim while the pinned tag is 3.14-slim — a real inaccuracy, but pre-existing and not touched or caused by this diff (confirmed byte-identical on both sides of the change except the digest line). Per this PR's own remit ("does this change break anything," not "is the repo healthy"), not blocking here; recommend a follow-up issue since it is boy-scout-eligible on the next PR that actually touches this file.
Gates: scripts/check_craftsmanship.py --base origin/main → Craftsmanship gate: OK (exit 0). scripts/check_marketplace_pins.py → All marketplace pins current (exit 0; one pre-existing NOTICE about MCP-registry propagation lag, unrelated to this diff, already tracked).
Scope: git diff origin/main...pr423 --stat shows exactly one file, one line changed — nothing foreign.
CI: current head's rollup is fully green (CI Green conclusion SUCCESS), including the previously-intermittent job.

Rules compliance

Rule	Status	Evidence	Action
§2.2 layer dependency	n/a	no code/import changed	—
§4 size limits	n/a	1-line diff	—
§8 source discipline	pass	digest re-verified live against registry, matches	—
§9 anti-patterns	pass	no dead code, no foreign diff	—

Verdict

APPROVE. Digest change verified independently against the live registry, base is fresh, both repo gates pass clean, diff is scope-clean, CI green. The pre-existing 3.13-slim comment inaccuracy is untouched by this diff and does not block; recommend filing a follow-up issue for it.

dependabot Bot added dependencies Pull requests that update a dependency file docker Pull requests that update docker code labels Aug 10, 2026

cdeust mentioned this pull request Aug 10, 2026

build: bump python from cea0e60 to a7fb1e6 #425

Closed

cdeust force-pushed the dependabot/docker/dot-devcontainer/python-a7fb1e6 branch from 189ba8f to 565e862 Compare August 10, 2026 14:17

This was referenced Aug 10, 2026

build: bump python from 86f975a to 23c5939 in /docker #421

Merged

fix(ci): close docker_smoke.sh's stdin-before-drain race #428

Merged

build: bump python from cea0e60 to a7fb1e6 in /.devcontainer

3bbcc56

Bumps python from `cea0e60` to `a7fb1e6`. --- updated-dependencies: - dependency-name: python dependency-version: 3.14-slim dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot force-pushed the dependabot/docker/dot-devcontainer/python-a7fb1e6 branch from 565e862 to 3bbcc56 Compare August 10, 2026 15:10

cdeust merged commit e3cb536 into main Aug 10, 2026
22 checks passed

cdeust deleted the dependabot/docker/dot-devcontainer/python-a7fb1e6 branch August 10, 2026 15:59

Navigation Menu

build: bump python from `cea0e60` to `a7fb1e6` in /.devcontainer - #423

build: bump python from `cea0e60` to `a7fb1e6` in /.devcontainer#423
cdeust merged 1 commit into
mainfrom
dependabot/docker/dot-devcontainer/python-a7fb1e6

dependabot Bot commented on behalf of github Aug 10, 2026 •

edited

Loading

Uh oh!

cdeust commented Aug 10, 2026

Uh oh!

cdeust commented Aug 10, 2026

Uh oh!

cdeust commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cdeust commented Aug 10, 2026

Digest verification (point 1)

Blocking — comment block above the changed line is wrong (§8 source discipline)

Blocking — branch is stale against origin/main, both repo gates fail as currently constituted

Uh oh!

cdeust commented Aug 10, 2026

Uh oh!

cdeust commented Aug 10, 2026

Move 0 — Ledger reconciliation / seen-defect check

Stakes (Move 7)

What changed

Verification performed on the current head

Rules compliance

Verdict

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 10, 2026 •

edited

Loading

Blocking — branch is stale against `origin/main`, both repo gates fail as currently constituted