[DuqueOM]

What and why

This takes the five open Dependabot updates (#153–#157) as one commit. It also stops auto-merge from spending the commits C7 keeps for remediation.

Updates:

• copier 9.19.1, ruff 0.17.3, pre-commit 4.7.0 and coverage 7.17.0 (chore(deps): Bump the dev-tooling group with 3 updates #153, chore(deps): Bump coverage from 7.16.2 to 7.17.0 #156);
• kfp 2.17.3 and great-expectations 1.24.1 (chore(deps): Bump kfp from 2.17.0 to 2.17.3 in the remaining-patches group #154, chore(deps): Bump great-expectations from 1.23.2 to 1.24.1 #157);
• duckdb 2.0.0 (chore(deps): Bump duckdb from 1.5.6 to 2.0.0 #155).

ruff 0.17.3 is one patch newer than #153's 0.17.2. The pre-commit ruff hook moves to v0.17.3 with the lock, which tests/test_tool_versions.py requires and which made #153 red. ruff 0.17 reports nothing new on the tree.

The urllib3 security override is retired. kfp 2.17.3 pins urllib3==2.8.0 itself on Python ≥ 3.10, and tests/test_dependency_overrides.py failed as designed, which is #154's red check. Without the override the lock still resolves urllib3 2.8.0, the release that fixes CVE-2026-97687, -97688 and -97689. The test keeps its checks for the next override. They also run against recorded declarations, including kfp 2.17.3's real one, so they keep failing correctly while no override is in force.

Auto-merge now has a budget. Every squash merge is one of the ten commits C7 allows between QA-4 rounds. After round nineteen, #152 merged on its own as the seventh, and the remediation still waiting had to be cut to fit the three that were left.

dependabot-auto-merge.yml now queues a merge only while scripts/dependabot_merge_budget.py says the merge keeps main within the first half of the grace. The script uses C7's own count, through check_doc_coherence.audit_drift, so it cannot disagree with the gate it protects. When C7 cannot measure (no marker, a marker the trail does not corroborate, or one off the history), it refuses.

• A rebase that re-runs the job withdraws a merge an earlier run queued.
• A new push: main job unqueues every queued Dependabot merge that no longer fits, because --auto waits for checks while main moves.
• The budget is read from main's code, never the pull request's, because the job holds contents: write.

RESERVED is half the grace, derived from AUDIT_GRACE_COMMITS rather than written as a number.

Found, not fixed (DEP27-D1, CONSULT): ml-core declares duckdb and nothing imports it. ADR-004 and the technology inventory count DuckDB as Core, and crossover.py describes a "DuckDB/Polars" side that it measures with Polars alone. The finding is recorded in the work order with both remedies. This round takes 2.0.0 because nothing calls it.

Class

• AUTO: dependency updates within their compatible ranges, except duckdb's major, which no code imports. A retired override whose own test demanded the deletion. A workflow that auto-merges less. No gate or threshold is lowered.

Evidence

$ make -i verify          # on 99a599a (rebased onto b55c3f7 #158); no ignored failures; C7 10/10
  ok   L1/L2 libs/            94.60% combined (floor 90)
  ok   P12   scripts/         88.36% combined (floor 86)
  ok   P17   projects/        97.40% combined (floor 97)
  ok   P17   orchestration/  100.00% combined (floor 100)
EXIT=0

$ uv run python scripts/mutation_harness.py DEP2 DEP3 DEP27-1 DEP27-2 DEP27-3 DEP27-4 DEP27-5 DEP27-6 DEP27-7
KILLED   DEP2   ...   KILLED   DEP27-7
[mutation] 9/9 expected kills

$ uv run --locked --no-dev --package ml-platform python scripts/dependabot_merge_budget.py   # 5-package env, on 7d7eb83
[dependabot-merge-budget] WAIT — main is 7/10 commits past the last independent audit; merging would make it 8, past the 5 Dependabot may spend (5 reserved for remediation). The update waits for the next batched dependency round.

$ uv run python -c "from importlib.metadata import requires; print([r for r in requires('kfp') if 'urllib3' in r])"
['urllib3==2.6.3; python_version < "3.10"', 'urllib3==2.8.0; python_version >= "3.10"']

Layer this evidence reaches:

• L1 — contract: the full suite passes (make verify)
• L2 — component: the budget ran in the environment the workflow builds, and the lock resolved without the override
• L3 — cluster
• L4 — cloud

If this adds or changes a gate

• What you broke to make it fail: DEP27-1 to DEP27-7. They let Dependabot spend the whole grace, compare against the grace instead of the limit, count against an uncorroborated or unreachable marker, read the budget from the PR's head, queue whatever the budget says, and drop the push: main trigger. DEP2 adds an override with no entry.

• The failure it produced (paste it):

  E       AssertionError: overrides in pyproject.toml ['urllib3'] vs explained []
  FAILED tests/test_dependency_overrides.py::test_every_override_is_explained_here
  

• Commit that records the verification: this one (catalogue entries DEP2, DEP3, DEP27-1 to DEP27-7)

Derived documents

No component is added. check_technology_inventory.py, check_implementation_status.py and check_compliance_mapping.py pass.

Supersedes #153, #154, #155, #156 and #157, which will be closed with a link here once this merges.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 94.59459% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
scripts/dependabot_merge_budget.py	90.4%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!