reliability: align private HTTPX/HTTPCore runtime support with executable compatibility evidence

[seonghobae]

Buyer-visible dependency-compatibility gap

EgressWeave intentionally uses private HTTPX/HTTPCore transport APIs, so public package metadata must not advertise private API shapes that executable compatibility/security evidence has not proven.

Protected-main implementation status

The narrow compatibility repair is now IMPLEMENTED ON PROTECTED MAIN.

Fresh lineage:

• PR reliability: bind private HTTP dependency compatibility to proven versions #183 (reliability: bind private HTTP dependency compatibility to proven versions) merged on 2026-08-12;
• exact accepted source head: 49324c93a09b971ed6c93f83b07976b2e1ae8c0e;
• merge commit: 443184ca1bc47faf5f2e1f06623b6d51bedba82b;
• current protected main has since advanced to 5e299de0117bd6bfd89f984acec3098565c34005 through security(release): fail closed on protected-main evidence #192 while retaining the reliability: bind private HTTP dependency compatibility to proven versions #183 package metadata/compatibility contract.

The protected package advertises exactly httpx==0.28.1 and httpcore==1.0.9, matching the hash-locked compatibility identity proven by #183. Widening later still requires an explicit executed compatibility matrix, private-surface/behavior review, lock regeneration, and only then metadata expansion. Exact pins can constrain host dependency resolution; that is preferable to silently claiming an unexecuted private API surface in the current pre-1.0 package.

Integrated source evidence

The accepted #183 head recorded:

• CI 31554554735: success;
• SAST Semgrep 31554554746: success;
• exact Python 3.14 proof: 934 tests and 100% owned-production statement/branch coverage (1704/1704, 576/576), plus Ruff/product-guard/compileall success;
• exact-current-head CodeRabbit pass with no actionable comments;
• exact-current-head Strix success with zero annotations.

Its Security Scan 31554554756 was aggregate green while dependency-review job 93984168997 skipped the actual immutable-pinned Dependency review step. That result remains non-passing supply-chain evidence under the EgressWeave contract and is not retroactively repaired by the merge.

Read-only central prerequisite

The organization-owned fail-closed Dependency Review repair remains open/unmerged as ContextualWisdomLab/.github#897, exact current head 59505c1d89eb7ea816e921b6da38079c736608c2 at the latest read-only refetch. .github is read-only to this EgressWeave writer.

Current protected-main #192 adds a release-admission verifier that rejects skipped Dependency Review and unavailable Strix evidence before publication; this prevents the historical evidence gap from silently authorizing a release, but it does not substitute for corrected merge-time Dependency Review evidence.

Acceptance criteria

• Machine-check that public metadata advertises only the compatibility identity covered by executable evidence.
• Advertise exactly httpx==0.28.1 / httpcore==1.0.9 rather than an unexecuted interval.
• Require the package pair to match active hash-locked CI records with artifact hashes.
• Keep Python 3.10 test collection supported through the explicit tomli test-extra fallback.
• Document host dependency-resolution trade-offs and a test-first widening procedure.
• Pass exact-current-head CI/SAST and exact-current-head automated/source review on the accepted source head.
• Merge reliability: bind private HTTP dependency compatibility to proven versions #183 through normal protected integration; the exact-pin compatibility contract is protected-main product behavior.
• Integrate the separately governed fail-closed Dependency Review repair (ContextualWisdomLab/.github#897 or a freshly verified successor) into protected central main.
• Run a fresh protected EgressWeave consumer candidate through the corrected Security Scan and require the actual pinned Dependency review action to execute and succeed; wrapper-green/skipped/predecessor evidence is non-passing.
• Verify the installed protected-main package metadata/private-transport behavior in that corrected end-to-end evidence path.
• Close this issue only after the protected-central repair plus protected EgressWeave consumer proof closes the supply-chain evidence gap; do not create or churn a release merely to close the issue.

Non-goals

• No gratuitous HTTP client rewrite.
• No claim that private APIs are inherently unacceptable when an exact compatibility boundary is tested and controlled.
• No dependency bump merely to create activity.
• No broad support range without an executed compatibility matrix.
• No EgressWeave-local workaround for the organization-owned Dependency Review gate.

[seonghobae]

Fresh current-tree progress is PR #183 (reliability: bind private HTTP dependency compatibility to proven versions) on protected main 52a5c6a0862e0d035b0698b79a0e8556269e0b00, exact head 78af27ba869911c873c7d3e2d98fe46d0ac66e6f. The narrow accepted candidate pins the private HTTP seam to the pair actually proven by the hash-locked toolchain (httpx==0.28.1, httpcore==1.0.9) and adds the compatibility/lock contract without touching active transport source. Current exact-head CI 31516906972 and SAST 31516906946 are terminal-success; CodeRabbit's incremental review through 78af27b... reports no actionable current-head comments and all earlier inline findings are resolved/outdated. Security Scan 31516906933 is only wrapper-green: dependency-review job 93864210182 skipped the actual Dependency review step, so this remains non-passing supply-chain evidence and #183 is not mergeable under the EgressWeave acceptance contract until the read-only central .github#897 repair is integrated and fresh exact-head evidence executes that action successfully. No predecessor review/check evidence transfers.