chore: sync uv.lock to the 2.7.0 self-version - #118
Merged
Merged
Conversation
The 2.7.0 release bumped pyproject.toml without regenerating the lock; uv rewrites the editable self-entry on the next sync, which left every checkout dirty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
8 tasks
vvillait88
added a commit
that referenced
this pull request
Aug 28, 2026
## Summary Both wallet-OFAC paths branched on `if decision == "deny"`, so everything that was not literally the string `"deny"` was permitted **by structure**: `None` from an unreadable response, and any decision value the API adds later. Both paths already deny on an API outage and describe themselves as strict-liability, so letting an unreadable answer through contradicted their own posture. On the compute-first path it would have settled the payment. Sites: `agentscore_commerce/checkout.py` (`_run_wallet_sanctions_only`) and `agentscore_commerce/checkout_compute_first.py`. Both now deny unless the decision is exactly `"allow"`. A missing or null decision is an unreadable response rather than a verdict about the buyer, so it maps to `api_error`, matching how an outage is already reported on these paths; a decision that is present but not an approval keeps `wallet_not_trusted`. Found by the Q3 2026 penetration test, worked with Varun. The node-commerce half is PR #118 there, and the API half has already landed in core. ## Type of change - [x] Bug fix (no breaking change) - [ ] New feature (no breaking change) - [ ] Breaking change (existing callers must update) - [ ] Docs, tests, or internal maintenance only No exported surface changes. The only behavior difference is that a response which could not be read as an approval is now refused; a merchant relying on that was relying on the defect. ## Public API None. No signature, model or response shape changes. Behavior changes for two response shapes that should not occur against a current API: an assess response with no `decision`, and one carrying an unrecognised decision value. Both now deny where they previously allowed, returning `api_error` and `wallet_not_trusted` respectively. ## Test plan `uv run ruff check`, `uv run ruff format --check` and `uv run ty check` all clean. `uv run pytest`: **1868 passed**, 4 skipped, coverage 95.37% (above the 95% gate). Five new tests across the two paths: missing `decision`, explicit null `decision`, and an unrecognised decision value, asserting on both the denial code and, for compute-first, that `verify_payment` was never called so no settle occurred. Both guards were drilled rather than assumed: restoring the original `decision == "deny"` check in both files fails 5 of the new tests, and every one passes again once reverted. Deliberately **not** added: a `policy_result` check. Neither path sends a merchant policy, so requiring one would deny every call, since `policy_result` is correctly null when no policy was submitted. That half of the finding lives in the node gate, which does send policies. ## Checklist - [x] Tests cover the new behavior, and the suite passes locally - [x] Lint, format, and type checks pass - [x] Docs and README examples updated if the public surface changed - [x] No secrets, credentials, or personal data in the diff or the tests
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The 2.7.0 release bumped
pyproject.tomlwithout regeneratinguv.lock, so uv rewrites the editable self-entry (2.6.0 to 2.7.0) on the next sync and leaves every checkout dirty. One-line lock sync; no dependency changes. Worked with Varun (workspace sync surfaced it).Type of change
Public API
None.
Test plan
Lockfile-only; the diff is the self-version line. CI is the gate.
Checklist