fix(test): install Starlette TestClient dependency

[seonghobae]

Problem

Protected develop@042b0c70531b229af3acbd0421a2f23098d848b3 pins Starlette 1.3.1, but the repository development/direct-test environment did not install httpx2. Starlette therefore fell back to deprecated httpx, and warnings-as-errors could stop TestClient collection. Suppressing that warning hid a dependency/runtime defect.

Current exact authority

• protected base: develop@042b0c70531b229af3acbd0421a2f23098d848b3
• exact head: 52dfc863d1a5d6e4e80b6366f719dd09f2aa6172
• lifecycle: Draft / source dependency repair present / exact-head hosted evidence non-passing / independent approval absent
• effective files: 8 — CHANGELOG.md, backend/pyproject.toml, backend/pytest.ini, backend/requirements-hashes.txt, backend/requirements.txt, backend/tests/test_container_dependency_pin_contract.py, backend/uv.lock, docs/doctoring/starlette-httpx2-testclient-dependency.md

The PR had drifted back to Ready even though its own authority required Draft. That lifecycle drift has been repaired without changing the product head.

Decision and preserved contract

• install the already-used httpx2==2.5.0 in the repository development/direct-test manifests;
• regenerate the immutable uv/hash lock for httpx2, httpcore2, and truststore;
• remove only the matching Starlette fallback warning suppression;
• prove at runtime under warnings-as-errors that Starlette TestClient selected httpx2, rather than treating manifest presence as execution evidence;
• structurally validate the direct pin's SHA-256 records;
• keep existing production HTTP-client/provider routing semantics unchanged;
• treat broad backend dependency PR build(deps): bump the backend-python group across 1 directory with 72 updates #1685 as a dependent migration lane: it is now stacked on this exact head and must preserve the direct httpx2 TestClient contract while regenerating its combined lock/hash graph.

The doctoring record preserves PyPI/trusted-publishing provenance, exact wheel digest evidence, rollback boundary, and APA 7 references. Earlier local focused passes remain development evidence only and do not transfer as protected merge evidence.

Fresh hosted evidence

For unchanged head 52dfc863d1a5d6e4e80b6366f719dd09f2aa6172, Application CI 33942903892, Security Scan 33942904025, SAST Semgrep 33942903923, and Bandit 33942903937 are terminal-success. CodeQL PR 33942903900 is terminal-failure because all three compatibility-analysis jobs (actions, javascript-typescript, python) fail at the Release runner or enforce current-head CodeQL verdict step after the dispatch request succeeds; the language-detection job itself succeeds. Docker run 33942904099 remains queued. The current formal review inventory and review-thread inventory are both empty, so no qualifying post-last-push independent approval exists.

The CodeQL compatibility result is a fail-closed gate. Do not reinterpret it as source GREEN or bypass it. Do not churn this source merely to manufacture queue activity; queued Docker evidence is a wait state, while any current-head CodeQL dispatch/verdict control-plane defect belongs to its canonical workflow owner.

Merge boundary

Keep Draft until this unchanged exact head has every then-live repository/organization required check terminal-success, every valid current-head finding/thread resolved, and a qualifying independent post-last-push approval under the effective protected-branch rules. Pending, queued, cancelled, skipped-required, absent, stale, predecessor, status-only, author-side, and model-only evidence is non-passing. No predecessor-evidence transfer, self-approval, admin bypass, force-push, destructive rebase, dummy/no-op requeue commit, warning-suppression restoration, or gate weakening.

[coderabbitai]

Warning

Review limit reached

Next included review available in 19 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: f65d9847-cf86-40b8-a16f-ed741a78a942

📥 Commits

Reviewing files that changed from the base of the PR and between 042b0c7 and 52dfc86.

⛔ Files ignored due to path filters (1)

• backend/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• CHANGELOG.md
• backend/pyproject.toml
• backend/pytest.ini
• backend/requirements-hashes.txt
• backend/requirements.txt
• backend/tests/test_container_dependency_pin_contract.py
• docs/doctoring/starlette-httpx2-testclient-dependency.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review found that the dependency test proved only manifest/hash presence, not Starlette runtime selection. Exact head 52dfc863d1a5d6e4e80b6366f719dd09f2aa6172 now imports starlette.testclient under -W error and asserts its selected transport module is httpx2. The focused two-test suite and Ruff pass. Doctoring records Starlette release history plus PyPI trusted-publishing provenance and the exact 2.5.0 wheel digest. Hosted state is 21 queued / 5 skipped / 0 failures; the PR remains Draft.

[seonghobae]

Exact head 52dfc863d1a5d6e4e80b6366f719dd09f2aa6172를 원격과 다시 대조했습니다. dependency pin 계약과 실제 FastAPI TestClient 경로 7개가 -W error로 통과했고 Ruff·diff check도 통과했습니다. 미해결 thread, source failure, base 충돌이 없어 Ready로 전환했습니다. queued hosted Checks와 독립 리뷰는 보호 병합 증거가 아니며 완료 전 병합하지 않습니다.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T05:54:20.777122Z	52dfc86	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seonghobae]

Fresh exact-head gate RCA for 52dfc863d1a5d6e4e80b6366f719dd09f2aa6172:

• Application CI, Security Scan, SAST Semgrep, and Bandit are terminal SUCCESS.
• Docker's prior failure is not a source/lock finding: backend and combined Naruon images passed; only the frontend image failed while fetching the pinned node:26-slim@sha256:4ebb5ace… base because auth.docker.io timed out (failed to fetch oauth token ... i/o timeout). I reran that specific failed job rather than changing source or weakening the gate.
• CodeQL PR's three compatibility shards failed only because the central current-head dispatch verdict was still pending; the job explicitly says the dispatch workflow should publish a terminal verdict and rerun the exact failed shard. There is still no authenticated codeql-dispatch/* terminal status on this head, so this remains a central evidence/control-plane blocker, not a Naruon source GREEN.
• Formal review inventory remains empty; Devin/CodeRabbit success statuses are not being treated as a qualifying post-last-push approval.

Keep Draft. Do not create a no-op commit, suppress the CodeQL gate, or transfer predecessor evidence.