chore(deps): upgrade PyYAML to address known security vulnerability #11017

BLOCKING — Wrong PR number:

This entry says PR #11012 but the actual pull request number is #11017. Please correct this to PR #11017.

Also note: the referenced issue #13605 does not exist in this repository. The correct issue number is #11012. Update to: PR #11017 / issue #11012.

**BLOCKING — Wrong PR number:** This entry says `PR #11012` but the actual pull request number is `#11017`. Please correct this to `PR #11017`. Also note: the referenced `issue #13605` does not exist in this repository. The correct issue number is `#11012`. Update to: `PR #11017 / issue #11012`.

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +3,4 @@

				from __future__ import annotations

				import sys

				from typing import Any, Dict

HAL9001 commented

BLOCKING — Unused imports cause lint failure:

import sys and from typing import Any, Dict are imported here but never used anywhere in this file. Ruff will flag these as F401 violations, which is the direct cause of the CI / lint failure.

Remove both lines:

# Remove these:
import sys
from typing import Any, Dict

If Any is needed later, use from collections.abc import ... or typing.Any — but only if it's actually used.

**BLOCKING — Unused imports cause lint failure:** `import sys` and `from typing import Any, Dict` are imported here but never used anywhere in this file. Ruff will flag these as `F401` violations, which is the direct cause of the `CI / lint` failure. Remove both lines: ```python # Remove these: import sys from typing import Any, Dict ``` If `Any` is needed later, use `from collections.abc import ...` or `typing.Any` — but only if it's actually used.

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +13,4 @@

				    """Attempt to import PyYAML module."""

				    context.pyyaml_import_result = "not_attempted"

				    try:

				        import yaml  # noqa: F401

HAL9001 commented

BLOCKING — # noqa: F401 suppressor is prohibited:

The comment # noqa: F401 is a lint suppression directive, which is not permitted in this project (same policy as # type: ignore). Instead of suppressing the lint warning, fix the code.

The entire try/except approach to testing importability is also not how the project's other import steps work. Consider moving import yaml to the top of the file and testing it directly in the step assertion, or use importlib.util.find_spec() if you need to test availability without importing.

Also: all imports must be at the top of the file, not inside function bodies. See project contributing rules: "Python: all at top, from X import Y, if TYPE_CHECKING: only exception".

**BLOCKING — `# noqa: F401` suppressor is prohibited:** The comment `# noqa: F401` is a lint suppression directive, which is not permitted in this project (same policy as `# type: ignore`). Instead of suppressing the lint warning, fix the code. The entire try/except approach to testing importability is also not how the project's other import steps work. Consider moving `import yaml` to the top of the file and testing it directly in the step assertion, or use `importlib.util.find_spec()` if you need to test availability without importing. Also: all imports must be at the **top of the file**, not inside function bodies. See project contributing rules: "Python: all at top, `from X import Y`, `if TYPE_CHECKING:` only exception".

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +34,4 @@

				    version_str = getattr(yaml, "__version__", "unknown")

				    parts = version_str.split(".")[:3]

				    major, minor = int(parts[0]), int(parts[1])

HAL9001 commented

BLOCKING — Version check is incomplete and will pass vulnerable versions:

The current check (major, minor) >= (6, 0) would incorrectly PASS for PyYAML 6.0.0 and 6.0.1, both of which are vulnerable to CVE-2025-8045. The security floor is 6.0.2 (patch version matters here).

Fix the check to include the patch version:

parts = version_str.split(".")[:3]
major, minor, patch = int(parts[0]), int(parts[1]), int(parts[2]) if len(parts) > 2 else 0

assert (major, minor, patch) >= (6, 0, 2), (
    f"PyYAML version {version_str} is below security floor 6.0.2 (CVE-2025-8045)"
)

Alternatively, use the packaging library for robust version comparison:

from packaging.version import Version
assert Version(version_str) >= Version("6.0.2"), ...

**BLOCKING — Version check is incomplete and will pass vulnerable versions:** The current check `(major, minor) >= (6, 0)` would incorrectly PASS for PyYAML `6.0.0` and `6.0.1`, both of which are vulnerable to CVE-2025-8045. The security floor is `6.0.2` (patch version matters here). Fix the check to include the patch version: ```python parts = version_str.split(".")[:3] major, minor, patch = int(parts[0]), int(parts[1]), int(parts[2]) if len(parts) > 2 else 0 assert (major, minor, patch) >= (6, 0, 2), ( f"PyYAML version {version_str} is below security floor 6.0.2 (CVE-2025-8045)" ) ``` Alternatively, use the `packaging` library for robust version comparison: ```python from packaging.version import Version assert Version(version_str) >= Version("6.0.2"), ... ```

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +44,4 @@

				@given(

				    'a valid YAML actor config file "test.yaml" with content:',

				)

				def step_give_yaml_config_file(context, content: str) -> None:

HAL9001 commented

BLOCKING — Docstring step must use context.text, not a function parameter:

In Behave, when a step uses a docstring (the """..""" block in the .feature file), the content is passed via context.text, NOT as a function parameter. The function signature step_give_yaml_config_file(context, content: str) is incorrect for a docstring step — content will not be populated by Behave and the step will either error or silently write nothing.

This pattern is already established correctly in this codebase. See features/steps/actor_config_steps.py:

@given('an actor config file "{filename}" with content:')
def step_actor_config_file_with_content(context, filename: str) -> None:
    workspace = _ensure_workspace(context)
    path = workspace / filename
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(context.text or "")  # <-- context.text, not a parameter

Fix the step definition to match this pattern:

@given('a valid YAML actor config file "test.yaml" with content:')
def step_give_yaml_config_file(context) -> None:  # no content parameter
    """Create a temporary YAML config file for testing."""
    import tempfile
    import os

    context.temp_dir = tempfile.mkdtemp()
    config_path = os.path.join(context.temp_dir, "test.yaml")
    with open(config_path, "w", encoding="utf-8") as f:
        f.write(context.text or "")  # use context.text
    context.config_file = config_path

(Also: move import tempfile and import os to the top of the file.)

**BLOCKING — Docstring step must use `context.text`, not a function parameter:** In Behave, when a step uses a docstring (the `""".."""` block in the `.feature` file), the content is passed via `context.text`, NOT as a function parameter. The function signature `step_give_yaml_config_file(context, content: str)` is incorrect for a docstring step — `content` will not be populated by Behave and the step will either error or silently write nothing. This pattern is already established correctly in this codebase. See `features/steps/actor_config_steps.py`: ```python @given('an actor config file "{filename}" with content:') def step_actor_config_file_with_content(context, filename: str) -> None: workspace = _ensure_workspace(context) path = workspace / filename path.parent.mkdir(parents=True, exist_ok=True) path.write_text(context.text or "") # <-- context.text, not a parameter ``` Fix the step definition to match this pattern: ```python @given('a valid YAML actor config file "test.yaml" with content:') def step_give_yaml_config_file(context) -> None: # no content parameter """Create a temporary YAML config file for testing.""" import tempfile import os context.temp_dir = tempfile.mkdtemp() config_path = os.path.join(context.temp_dir, "test.yaml") with open(config_path, "w", encoding="utf-8") as f: f.write(context.text or "") # use context.text context.config_file = config_path ``` (Also: move `import tempfile` and `import os` to the top of the file.)

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +46,4 @@

				)

				def step_give_yaml_config_file(context, content: str) -> None:

				    """Create a temporary YAML config file for testing."""

				    import tempfile

HAL9001 commented

BLOCKING — Imports inside function body violate project import rules:

The project's contributing rules state: "Python: all at top, from X import Y, if TYPE_CHECKING: only exception". The imports import tempfile and import os (here), import yaml (lines 33, 62), and import json (line 71) must all be moved to the top of the file.

Move all imports to the top:

import json
import os
import tempfile

import yaml
from behave import given, then, when

**BLOCKING — Imports inside function body violate project import rules:** The project's contributing rules state: "Python: all at top, `from X import Y`, `if TYPE_CHECKING:` only exception". The imports `import tempfile` and `import os` (here), `import yaml` (lines 33, 62), and `import json` (line 71) must all be moved to the top of the file. Move all imports to the top: ```python import json import os import tempfile import yaml from behave import given, then, when ```

pyproject.toml Outdated

						
				@@ -48,6 +48,7 @@ dependencies = [

				    "tenacity>=8.2.0",  # Retry framework for service layer resilience

				    "aiohttp>=3.13.4",  # CVE-2026-34515 mitigation: open redirect vulnerability

				    "a2a-sdk>=0.3.0,<1.0.0",  # A2A Python SDK — required transport for local (stdio) and server (HTTP) modes (ADR-047); pinned <1.0.0 (removed legacy A2AClient)

				    "pyyaml>=6.0.2",  # explicit runtime dep for YAML actor config loading; mitigates CVE-2025-8045 vulnerability in PyYAML <6.0.2

HAL9001 commented

2026-05-09 03:17:12 +00:00

BLOCKING — Version constraint does not match issue requirement:

Issue #11012 (the linked work item) specifies pyyaml>=6.0.3 as the required security floor. This PR sets pyyaml>=6.0.2. Please update to >=6.0.3 to match the issue's stated requirement and ensure consistency between the issue, the code, and the tests.

**BLOCKING — Version constraint does not match issue requirement:** Issue #11012 (the linked work item) specifies `pyyaml>=6.0.3` as the required security floor. This PR sets `pyyaml>=6.0.2`. Please update to `>=6.0.3` to match the issue's stated requirement and ensure consistency between the issue, the code, and the tests.

HAL9001 commented

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

--- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker

HAL9001 requested changes 2026-05-09 03:23:51 +00:00

Dismissed

HAL9001 left a comment

Code Review — PR #11017: `chore(deps): upgrade PyYAML to address known security vulnerability`

The core intent of this PR is correct — explicitly pinning PyYAML as a runtime dependency is the right security fix. However, there are several blocking issues that must be resolved before this can be approved.

CI Status ❌

The following required CI jobs are failing:

CI / lint — Failing after 1m9s (caused by unused imports and lint suppressors in step file)
CI / unit_tests — Failing after 5m46s (caused by broken step definition)
CI / e2e_tests — Failing after 3m41s
CI / benchmark-regression — Failing after 53s
CI / quality — Failing after 12m37s (includes coverage gate)

CI / status-check is blocked pending resolution of the above. Per company policy, all CI quality gates (lint, typecheck, security, unit_tests, coverage) must pass before a PR can be approved and merged.

Blocking Issues

1. CORRECTNESS — Wrong version constraint (BLOCKING)

The PR pins pyyaml>=6.0.2 but issue #11012 explicitly requires pyyaml>=6.0.3 as the security floor. The issue description states: "Add explicit pyyaml>=6.0.3 dependency constraint to prevent installation of vulnerable older versions." The version constraint in pyproject.toml and uv.lock must be corrected to >=6.0.3.

2. CORRECTNESS — Wrong issue reference in commit footer and PR body (BLOCKING)

The commit footer contains ISSUES CLOSED: #13605 but issue #13605 does not exist in this repository. The correct issue to close is #11012. The PR body also says ISSUES CLOSED: #13605. Both must be corrected to reference #11012. The PR body uses Closes #N pattern — this should close #11012.

3. CORRECTNESS — CONTRIBUTORS.md references wrong PR number (BLOCKING)

The new CONTRIBUTORS.md entry says PR #11012 but the actual PR number is #11017. This must be corrected to PR #11017.

4. TEST QUALITY — Version check logic is incomplete (BLOCKING)

In features/steps/pyyaml_runtime_dependency_steps.py, the version check step:

parts = version_str.split(".")[:3]
major, minor = int(parts[0]), int(parts[1])
assert (major, minor) >= (6, 0)

This only validates major.minor, meaning PyYAML 6.0.0 and 6.0.1 (both vulnerable versions) would incorrectly pass the assertion. The security floor is 6.0.2 (or 6.0.3 per the corrected constraint), so the patch component must be included in the check.

Issue #11012 specifies using packaging.version for semantic version comparison:

from packaging.version import Version
import yaml
assert Version(yaml.__version__) >= Version("6.0.3"), ...

This is the correct approach and avoids brittle manual tuple parsing.

5. TEST QUALITY — `Given` step docstring parameter error (BLOCKING)

In step_give_yaml_config_file, the step function signature is:

def step_give_yaml_config_file(context, content: str) -> None:

When Behave passes a docstring (triple-quoted text block from the scenario), it is placed in context.text, NOT passed as a function parameter. The content: str parameter will receive the literal string from the Gherkin step text (just "" in this case) rather than the docstring body. The function must be changed to use context.text instead:

def step_give_yaml_config_file(context) -> None:
    content = context.text
    ...

This is a runtime error that directly causes CI / unit_tests to fail. The codebase pattern for docstring steps is well-established — see features/steps/actor_config_steps.py.

6. CODE STYLE — Unused imports causing lint failure (BLOCKING)

pyyaml_runtime_dependency_steps.py imports sys and from typing import Any, Dict at the top level, but neither is used anywhere in the file. These are unused imports and directly cause the CI / lint failure. They must be removed.

Additionally, from typing import Dict is deprecated in favour of the built-in dict since Python 3.9 — ruff will flag UP006 for this.

7. CODE STYLE — `# noqa: F401` lint suppressor is prohibited (BLOCKING)

Inside step_verify_pyyaml_importable, the code uses:

import yaml  # noqa: F401

The project prohibits all lint suppression comments (# noqa, # type: ignore). Fix the code instead — move import yaml to the top level and use it properly rather than importing and suppressing the unused-import warning.

8. CODE STYLE — Imports inside function bodies violate project rules (BLOCKING)

Multiple step functions contain inline imports (import yaml, import tempfile, import os, import json). The project's Python import rules require all imports to be at the top of the file. The only permitted exception is if TYPE_CHECKING:. All inline imports must be moved to the top of the file.

9. COMMIT AND PR QUALITY — Branch naming convention violation (BLOCKING)

The branch name pr-fix-11012-pyyaml-upgrade does not follow the required convention. Issue #11012 is Type/Bug on milestone v3.2.0 (m2), so the branch should follow the pattern bugfix/m2-<descriptive-name>, e.g. bugfix/m2-pyyaml-upgrade. The branch name must match the Branch: field in the issue's ## Metadata section.

10. COMMIT AND PR QUALITY — No labels applied (BLOCKING)

The PR compliance checklist claims labels were applied (State/In Review, Priority/High, MoSCoW/Must, Type/chore), but the PR currently has zero labels. Per merge requirements, exactly one Type/ label must be applied. Since the linked issue is Type/Bug, the PR should carry Type/Bug (not Type/chore). The correct labels are: State/In Review, Priority/Critical, MoSCoW/Must have, Type/Bug.

11. COMMIT AND PR QUALITY — No milestone assigned (BLOCKING)

The PR compliance checklist claims a milestone was assigned, but the PR currently has no milestone. Per merge requirements, the PR must be assigned to the same milestone as the linked issue: v3.2.0.

Non-Blocking Suggestions

Feature file naming: Issue #11012 specifies the feature file should be named security_pyyaml_dependency.feature, not pyyaml_runtime_dependency.feature. While the content works, aligning the filename with the issue description makes traceability cleaner.
yaml_loader.py defensive import: Now that pyyaml is a declared runtime dependency, the try: import yaml except Exception: yaml = None pattern in yaml_loader.py is misleading — it implies the import is optional when it no longer is. Consider removing the try/except and doing a direct import in a follow-up PR. (Not blocking for this PR's scope.)
Gherkin scenario specificity: Consider naming the scenarios to reference CVE-2025-8045 explicitly, making them more useful as living security documentation.

Summary

The pyproject.toml and uv.lock changes are structurally correct (minus the wrong version floor). The CHANGELOG entry is well-written. The step definitions file has multiple blocking issues: incorrect docstring handling, broken version comparison, prohibited lint suppressors, and import placement violations. The PR is also missing required metadata (labels, milestone) and contains incorrect issue references throughout.

Please address all blocking items, run nox locally to verify all sessions pass, and re-request review.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

## Code Review — PR #11017: `chore(deps): upgrade PyYAML to address known security vulnerability` The core intent of this PR is correct — explicitly pinning PyYAML as a runtime dependency is the right security fix. However, there are several **blocking issues** that must be resolved before this can be approved. --- ### CI Status ❌ The following required CI jobs are **failing**: - `CI / lint` — Failing after 1m9s (caused by unused imports and lint suppressors in step file) - `CI / unit_tests` — Failing after 5m46s (caused by broken step definition) - `CI / e2e_tests` — Failing after 3m41s - `CI / benchmark-regression` — Failing after 53s - `CI / quality` — Failing after 12m37s (includes coverage gate) `CI / status-check` is blocked pending resolution of the above. Per company policy, all CI quality gates (`lint`, `typecheck`, `security`, `unit_tests`, `coverage`) must pass before a PR can be approved and merged. --- ### Blocking Issues #### 1. CORRECTNESS — Wrong version constraint (BLOCKING) The PR pins `pyyaml>=6.0.2` but issue #11012 explicitly requires `pyyaml>=6.0.3` as the security floor. The issue description states: _"Add explicit `pyyaml>=6.0.3` dependency constraint to prevent installation of vulnerable older versions."_ The version constraint in `pyproject.toml` and `uv.lock` must be corrected to `>=6.0.3`. #### 2. CORRECTNESS — Wrong issue reference in commit footer and PR body (BLOCKING) The commit footer contains `ISSUES CLOSED: #13605` but issue #13605 does not exist in this repository. The correct issue to close is `#11012`. The PR body also says `ISSUES CLOSED: #13605`. Both must be corrected to reference `#11012`. The PR body uses `Closes #N` pattern — this should close `#11012`. #### 3. CORRECTNESS — CONTRIBUTORS.md references wrong PR number (BLOCKING) The new CONTRIBUTORS.md entry says `PR #11012` but the actual PR number is `#11017`. This must be corrected to `PR #11017`. #### 4. TEST QUALITY — Version check logic is incomplete (BLOCKING) In `features/steps/pyyaml_runtime_dependency_steps.py`, the version check step: ```python parts = version_str.split(".")[:3] major, minor = int(parts[0]), int(parts[1]) assert (major, minor) >= (6, 0) ``` This only validates `major.minor`, meaning PyYAML 6.0.0 and 6.0.1 (both **vulnerable** versions) would incorrectly pass the assertion. The security floor is `6.0.2` (or `6.0.3` per the corrected constraint), so the patch component must be included in the check. Issue #11012 specifies using `packaging.version` for semantic version comparison: ```python from packaging.version import Version import yaml assert Version(yaml.__version__) >= Version("6.0.3"), ... ``` This is the correct approach and avoids brittle manual tuple parsing. #### 5. TEST QUALITY — `Given` step docstring parameter error (BLOCKING) In `step_give_yaml_config_file`, the step function signature is: ```python def step_give_yaml_config_file(context, content: str) -> None: ``` When Behave passes a docstring (triple-quoted text block from the scenario), it is placed in `context.text`, NOT passed as a function parameter. The `content: str` parameter will receive the literal string from the Gherkin step text (just `""` in this case) rather than the docstring body. The function must be changed to use `context.text` instead: ```python def step_give_yaml_config_file(context) -> None: content = context.text ... ``` This is a runtime error that directly causes `CI / unit_tests` to fail. The codebase pattern for docstring steps is well-established — see `features/steps/actor_config_steps.py`. #### 6. CODE STYLE — Unused imports causing lint failure (BLOCKING) `pyyaml_runtime_dependency_steps.py` imports `sys` and `from typing import Any, Dict` at the top level, but neither is used anywhere in the file. These are unused imports and directly cause the `CI / lint` failure. They must be removed. Additionally, `from typing import Dict` is deprecated in favour of the built-in `dict` since Python 3.9 — ruff will flag `UP006` for this. #### 7. CODE STYLE — `# noqa: F401` lint suppressor is prohibited (BLOCKING) Inside `step_verify_pyyaml_importable`, the code uses: ```python import yaml # noqa: F401 ``` The project prohibits all lint suppression comments (`# noqa`, `# type: ignore`). Fix the code instead — move `import yaml` to the top level and use it properly rather than importing and suppressing the unused-import warning. #### 8. CODE STYLE — Imports inside function bodies violate project rules (BLOCKING) Multiple step functions contain inline imports (`import yaml`, `import tempfile`, `import os`, `import json`). The project's Python import rules require all imports to be at the top of the file. The only permitted exception is `if TYPE_CHECKING:`. All inline imports must be moved to the top of the file. #### 9. COMMIT AND PR QUALITY — Branch naming convention violation (BLOCKING) The branch name `pr-fix-11012-pyyaml-upgrade` does not follow the required convention. Issue #11012 is `Type/Bug` on milestone `v3.2.0` (m2), so the branch should follow the pattern `bugfix/m2-<descriptive-name>`, e.g. `bugfix/m2-pyyaml-upgrade`. The branch name must match the `Branch:` field in the issue's `## Metadata` section. #### 10. COMMIT AND PR QUALITY — No labels applied (BLOCKING) The PR compliance checklist claims labels were applied (`State/In Review, Priority/High, MoSCoW/Must, Type/chore`), but the PR currently has **zero labels**. Per merge requirements, exactly one `Type/` label must be applied. Since the linked issue is `Type/Bug`, the PR should carry `Type/Bug` (not `Type/chore`). The correct labels are: `State/In Review`, `Priority/Critical`, `MoSCoW/Must have`, `Type/Bug`. #### 11. COMMIT AND PR QUALITY — No milestone assigned (BLOCKING) The PR compliance checklist claims a milestone was assigned, but the PR currently has **no milestone**. Per merge requirements, the PR must be assigned to the same milestone as the linked issue: **v3.2.0**. --- ### Non-Blocking Suggestions - **Feature file naming:** Issue #11012 specifies the feature file should be named `security_pyyaml_dependency.feature`, not `pyyaml_runtime_dependency.feature`. While the content works, aligning the filename with the issue description makes traceability cleaner. - **`yaml_loader.py` defensive import:** Now that `pyyaml` is a declared runtime dependency, the `try: import yaml except Exception: yaml = None` pattern in `yaml_loader.py` is misleading — it implies the import is optional when it no longer is. Consider removing the try/except and doing a direct import in a follow-up PR. (Not blocking for this PR's scope.) - **Gherkin scenario specificity:** Consider naming the scenarios to reference CVE-2025-8045 explicitly, making them more useful as living security documentation. --- ### Summary The `pyproject.toml` and `uv.lock` changes are structurally correct (minus the wrong version floor). The CHANGELOG entry is well-written. The step definitions file has multiple blocking issues: incorrect docstring handling, broken version comparison, prohibited lint suppressors, and import placement violations. The PR is also missing required metadata (labels, milestone) and contains incorrect issue references throughout. Please address all blocking items, run `nox` locally to verify all sessions pass, and re-request review. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker

CONTRIBUTORS.md

HAL9001 commented

BLOCKING: This entry references PR #11012 but the actual PR number is #11017. Please correct to PR #11017 / issue #11012.

BLOCKING: This entry references `PR #11012` but the actual PR number is `#11017`. Please correct to `PR #11017 / issue #11012`.

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +2,4 @@

				from __future__ import annotations

				import sys

HAL9001 commented

BLOCKING: import sys is unused — this directly causes the CI / lint failure. Remove it.

BLOCKING: `import sys` is unused — this directly causes the `CI / lint` failure. Remove it.

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +3,4 @@

				from __future__ import annotations

				import sys

				from typing import Any, Dict

HAL9001 commented

BLOCKING: from typing import Any, Dict is unused and must be removed. Additionally, Dict is deprecated since Python 3.9 — use the built-in dict instead (ruff rule UP006). Remove this import entirely.

BLOCKING: `from typing import Any, Dict` is unused and must be removed. Additionally, `Dict` is deprecated since Python 3.9 — use the built-in `dict` instead (ruff rule UP006). Remove this import entirely.

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +10,4 @@

				@when("I verify that PyYAML can be imported")

				def step_verify_pyyaml_importable(context) -> None:

				    """Attempt to import PyYAML module."""

HAL9001 commented

BLOCKING: import yaml # noqa: F401 uses a ruff suppression comment which is prohibited by the project rules. Additionally, this import is inside a function body — all imports must be at the top of the file. Move the import to the top level and remove the # noqa comment. Fix the code to use the import properly rather than suppressing the lint warning.

BLOCKING: `import yaml # noqa: F401` uses a ruff suppression comment which is prohibited by the project rules. Additionally, this import is inside a function body — all imports must be at the top of the file. Move the import to the top level and remove the `# noqa` comment. Fix the code to use the import properly rather than suppressing the lint warning.

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +32,4 @@

				    """Verify PyYAML version meets security floor."""

				    import yaml

				    version_str = getattr(yaml, "__version__", "unknown")

HAL9001 commented

BLOCKING: The version comparison only checks (major, minor) >= (6, 0), which incorrectly passes PyYAML 6.0.0 and 6.0.1 — both vulnerable versions. The security floor is 6.0.2 (or 6.0.3 per the issue). Use packaging.version.Version for correct semantic comparison:

from packaging.version import Version
import yaml
assert Version(yaml.__version__) >= Version("6.0.3"), (
    f"PyYAML {yaml.__version__} is below security floor 6.0.3 (CVE-2025-8045)"
)

BLOCKING: The version comparison only checks `(major, minor) >= (6, 0)`, which incorrectly passes PyYAML 6.0.0 and 6.0.1 — both vulnerable versions. The security floor is 6.0.2 (or 6.0.3 per the issue). Use `packaging.version.Version` for correct semantic comparison: ```python from packaging.version import Version import yaml assert Version(yaml.__version__) >= Version("6.0.3"), ( f"PyYAML {yaml.__version__} is below security floor 6.0.3 (CVE-2025-8045)" ) ```

features/steps/pyyaml_runtime_dependency_steps.py Outdated

						
				@@ -0,0 +48,4 @@

				    """Create a temporary YAML config file for testing."""

				    import tempfile

				    import os

HAL9001 commented

BLOCKING: When Behave passes a docstring (triple-quoted text block from the scenario), it is stored in context.text, NOT passed as a function parameter. The content: str parameter will NOT receive the YAML block from the scenario — it will be empty or cause a runtime error. Change the signature to def step_give_yaml_config_file(context) -> None: and read the content with content = context.text. Also, import tempfile and import os are inline imports that must be moved to the top of the file.

BLOCKING: When Behave passes a docstring (triple-quoted text block from the scenario), it is stored in `context.text`, NOT passed as a function parameter. The `content: str` parameter will NOT receive the YAML block from the scenario — it will be empty or cause a runtime error. Change the signature to `def step_give_yaml_config_file(context) -> None:` and read the content with `content = context.text`. Also, `import tempfile` and `import os` are inline imports that must be moved to the top of the file.

pyproject.toml

HAL9001 commented

2026-05-09 03:24:20 +00:00

BLOCKING: The version constraint is pyyaml>=6.0.2 but issue #11012 explicitly requires pyyaml>=6.0.3. Please update to "pyyaml>=6.0.3".

BLOCKING: The version constraint is `pyyaml>=6.0.2` but issue #11012 explicitly requires `pyyaml>=6.0.3`. Please update to `"pyyaml>=6.0.3"`.

HAL9001 commented

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

--- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker

HAL9000 added the controller-managed label 2026-06-10 14:03:25 +00:00

HAL9000 commented

2026-06-10 14:44:13 +00:00

[CONTROLLER-DEFER:Gate 1:full_duplicate]

This PR has been deferred for re-evaluation. The controller has stepped back
from processing it. To resume, a human or scope-evaluator must clear the
deferral flag AND re-add the auto/sentinel label.

Decision:

Gate: Gate 1
Reason category: full_duplicate
Canonical: chore(deps): upgrade PyYAML to address known security vulnerability (#11078)
LLM confidence: high
LLM reasoning: Four open PRs share the identical title "chore(deps): upgrade PyYAML to address known security vulnerability" and all target the same CVE-2025-8045 vulnerability fix: #10885 (bugfix/m3-issue-9055, 155/437), #11017 anchor (pr-fix-11012-pyyaml-upgrade, 102/0), #11059 (fix-pyyaml-11012, 123/1), and #11078 (fix/pyyaml-security-upgrade, 139/0). The anchor and #11059/#11078 are nearly identical implementations (0 deletions, pure additions 102–139 lines), solving the same problem with no unique merit. #10885's large deletion count (437) suggests a different approach; #11078 is marginally more complete with 139 additions vs anchor's 102. This is a full duplicate where the anchor should be closed in favor of the more-comprehensive variant.

To clear the deferral (SQL):
UPDATE workflows SET deferred_reason=NULL,
deferred_at=NULL,
deferred_target_workflow_id=NULL
WHERE workflow_id = 419;

INSERT INTO controller_events
  (workflow_id, ts, event_type, payload, cause, forgejo_write_pending, replay_attempts)
VALUES (419, datetime('now'), 'deferral_cleared',
        json_object('cleared_by', 'operator', 'reason', '<your reason>'),
        'operator', 0, 0);

Audit ID: 155518

Automated by the CleverAgents controller pipeline.
Identity: HAL9000 (pipeline action)

[CONTROLLER-DEFER:Gate 1:full_duplicate] This PR has been deferred for re-evaluation. The controller has stepped back from processing it. To resume, a human or scope-evaluator must clear the deferral flag AND re-add the auto/sentinel label. Decision: - Gate: Gate 1 - Reason category: full_duplicate - Canonical: #11078 - LLM confidence: high - LLM reasoning: Four open PRs share the identical title "chore(deps): upgrade PyYAML to address known security vulnerability" and all target the same CVE-2025-8045 vulnerability fix: #10885 (bugfix/m3-issue-9055, 155/437), #11017 anchor (pr-fix-11012-pyyaml-upgrade, 102/0), #11059 (fix-pyyaml-11012, 123/1), and #11078 (fix/pyyaml-security-upgrade, 139/0). The anchor and #11059/#11078 are nearly identical implementations (0 deletions, pure additions 102–139 lines), solving the same problem with no unique merit. #10885's large deletion count (437) suggests a different approach; #11078 is marginally more complete with 139 additions vs anchor's 102. This is a full duplicate where the anchor should be closed in favor of the more-comprehensive variant. To clear the deferral (SQL): UPDATE workflows SET deferred_reason=NULL, deferred_at=NULL, deferred_target_workflow_id=NULL WHERE workflow_id = 419; INSERT INTO controller_events (workflow_id, ts, event_type, payload, cause, forgejo_write_pending, replay_attempts) VALUES (419, datetime('now'), 'deferral_cleared', json_object('cleared_by', 'operator', 'reason', '<your reason>'), 'operator', 0, 0); Audit ID: 155518 --- Automated by the CleverAgents controller pipeline. Identity: HAL9000 (pipeline action)

HAL9000 added the auto/needs-reevaluation

2026-06-10 15:01:38 +00:00

labels 2026-06-10 14:44:58 +00:00

HAL9000 referenced this pull request

chore(deps): upgrade PyYAML to address known security vulnerability #11059

HAL9000 referenced this pull request

2026-06-10 17:37:20 +00:00

chore(deps): upgrade PyYAML to address known security vulnerability #11078

drew referenced this issue from a commit

2026-06-11 00:20:31 +00:00

ci: stop master workflow on PR updates

drew added 1 commit 2026-06-11 00:20:31 +00:00

ci: stop master workflow on PR updates

CI / lint (pull_request) Has been cancelled

Details

CI / typecheck (pull_request) Has been cancelled

Details

CI / security (pull_request) Has been cancelled

Details

CI / quality (pull_request) Has been cancelled

Details

CI / unit_tests (pull_request) Has been cancelled

Details

CI / integration_tests (pull_request) Has been cancelled

Details

CI / e2e_tests (pull_request) Has been cancelled

Details

CI / coverage (pull_request) Has been cancelled

Details

CI / build (pull_request) Has been cancelled

Details

CI / docker (pull_request) Has been cancelled

Details

CI / helm (pull_request) Has been cancelled

Details

CI / push-validation (pull_request) Has been cancelled

Details

CI / status-check (pull_request) Has been cancelled

Details

1e2521052f

Remove the stale pull_request trigger from master.yml so PR branch commits do not launch the master workflow.

Maintenance patch for PR #11017.

HAL9000 added 1 commit 2026-06-11 07:58:48 +00:00

chore: re-trigger CI [controller]

CI / lint (pull_request) Failing after 36s

Details

CI / quality (pull_request) Successful in 50s

Details

CI / typecheck (pull_request) Successful in 1m2s

Details

CI / helm (pull_request) Successful in 29s

Details

CI / push-validation (pull_request) Successful in 20s

Details

CI / build (pull_request) Successful in 40s

Details

CI / security (pull_request) Successful in 1m35s

Details

CI / integration_tests (pull_request) Failing after 3m13s

Details

CI / e2e_tests (pull_request) Successful in 3m13s

Details

CI / unit_tests (pull_request) Failing after 7m57s

Details

CI / coverage (pull_request) Has been skipped

Details

CI / docker (pull_request) Has been skipped

Details

CI / status-check (pull_request) Failing after 3s

Details

db7993bb78

HAL9000 removed the

2026-06-12 06:41:52 +00:00

label 2026-06-11 08:02:29 +00:00

HAL9000 commented

📋 Estimate: tier 1.

Core dependency pin (pyproject.toml + uv.lock) is mechanical, but CI has 4 failing gates that require real investigation. Lint failures in the new BDD step file are auto-fixable (5 ruff errors: unused imports, deprecated typing.Dict, unnecessary "r" mode). More significant: unit_tests shows "config_blob cannot be serialised to YAML" errors across multiple existing feature files (actor_run_signature, plan_service_coverage, tdd_memory_service_entity_persistence), suggesting the PyYAML 6.0.2 version constraint may have introduced a behavioral regression in YAML serialization used by actor configs. Integration tests also fail on actor unknown-name scenarios. Fixing requires: (1) lint cleanup in step file, (2) diagnosing whether YAML serialization failures are regressions from the version bump or pre-existing flakiness, (3) fixing or adjusting affected tests. Multi-file scope with cross-feature test diagnosis makes this solidly Tier 1.

**📋 Estimate: tier 1.** Core dependency pin (pyproject.toml + uv.lock) is mechanical, but CI has 4 failing gates that require real investigation. Lint failures in the new BDD step file are auto-fixable (5 ruff errors: unused imports, deprecated typing.Dict, unnecessary "r" mode). More significant: unit_tests shows "config_blob cannot be serialised to YAML" errors across multiple existing feature files (actor_run_signature, plan_service_coverage, tdd_memory_service_entity_persistence), suggesting the PyYAML 6.0.2 version constraint may have introduced a behavioral regression in YAML serialization used by actor configs. Integration tests also fail on actor unknown-name scenarios. Fixing requires: (1) lint cleanup in step file, (2) diagnosing whether YAML serialization failures are regressions from the version bump or pre-existing flakiness, (3) fixing or adjusting affected tests. Multi-file scope with cross-feature test diagnosis makes this solidly Tier 1.

HAL9000 removed the controller-managed label 2026-06-12 18:49:29 +00:00

HAL9000 added the

label 2026-06-12 19:11:08 +00:00

HAL9000 added controller-managed and removed