Merge pull request #107 from codefly-dev/dependabot/github_actions/github-actions-8236830756

fix(runtime): adopt Core 0.19.10 native ownership

Author: antoinetoussaint-byte

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ concurrency:
 
 jobs:
   ci:
-    uses: codefly-dev/core/.github/workflows/go-service-ci.yml@v0.19.6
+    uses: codefly-dev/core/.github/workflows/go-service-ci.yml@v0.19.10
     with:
       # The Python runtime tests drive `uv` on the host (dependency sync,
       # pytest); it isn't on the runner by default.
@@ -35,8 +35,8 @@ jobs:
   race:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           # Same reason as the shared workflow: setup-go's cache tar corrupts
@@ -58,8 +58,8 @@ jobs:
   nix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           # Same reason as the race job above.

.github/workflows/releaser.yml

@@ -9,8 +9,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           # go.mod pins a `toolchain` newer than the `go` line, so setup-go
@@ -29,7 +29,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       # ARCHITECTURE: the shared core release workflow runs goreleaser-action
@@ -45,7 +45,7 @@ jobs:
       # first goreleaser-cross tag whose Go equals go.mod's `go` line.
       - name: Install Syft for archive SBOMs
         id: syft
-        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           syft-version: v1.44.0
       - name: Run CGO-capable GoReleaser

AGENTS.md

@@ -67,7 +67,7 @@ within reach.
 ## Build and test
 
 Derived from `.github/workflows/ci.yml`, which delegates to core's shared
-`go-service-ci.yml`, pinned to the linked core's tag (`@v0.19.6`; move it with
+`go-service-ci.yml`, pinned to the linked core's tag (`@v0.19.10`; move it with
 the core bump), and adds a `race` job of its own. Go comes from `go.mod`
 (1.27.3). All of it runs locally:
 
@@ -197,4 +197,4 @@ carried here:
   each skill's frontmatter are asserted in `conformance_test.go`, so `go test
   ./...` enforces them with no workflow change.
 - There is no `CLAUDE.md`; if one is added, it is a one-line `@AGENTS.md` pointer.
-- Treat this file as code: the PR that changes a process updates it.
+- Treat this file as code; native ownership qualification: [procedure](docs/native-qualification.md).

docs/native-qualification.md

@@ -0,0 +1,47 @@
+# Native FastAPI ownership qualification
+
+FastAPI owns its uvicorn lifecycle; generic `service-python` supplies shared
+Python tooling and retains its own no-op Runtime. Native FastAPI launches use
+Core's `NewNativeEnvironment` and `NativeProc`, which owns authenticated process
+group registration, birth checks and termination. Core v0.19.10 is the published
+dependency; explicit orphan recovery remains Core's protocol consumed by CLI.
+No registry, process matcher or recovery implementation belongs in this agent.
+
+Use the maintained `codefly agent deps --pin v0.19.10` operation to adopt the
+published module, and `codefly agent build --native-only` to package/install the
+agent and adjacent SBOM. Keep the manifest version unchanged for local builds.
+Use a disposable OS `HOME` and `CODEFLY_HOME` for those commands; do not use an
+incident or shared agent home. The installed binary is local qualification,
+not evidence that a version bearing the same label was published or adopted.
+
+The opt-in gate consumes that installed binary and an existing CLI with
+`recover process-group --preview/--expect`:
+
+```sh
+FASTAPI_NATIVE_AGENT_HOME=/absolute/disposable/codefly-home \
+FASTAPI_QUALIFICATION_CLI=/absolute/qualified/codefly \
+GOWORK=off go test -count=1 -v -run '^TestNativeAgentOwnershipLifecycle$' .
+```
+
+The test creates a separate temporary OS home for registry authentication and
+two disposable services. Core's authenticated manager starts each actual agent;
+gRPC Load/Init/Start run real uvicorn workloads. Core resolves temporary network
+mappings. Each workload reports its own PID and process group; Core authenticates
+that group and its exact process birth. Ordinary Stop must remove the first
+group and registration while the independent sibling birth and live owner stay
+intact. FastAPI Stop releases its environment, so restart uses Init then Start.
+At manager load the test captures the authenticated agent-group leader identity.
+After restart it requires the current full owner identity to equal that original
+birth before Core's identity-bound signal kills only the disposable agent owner.
+A stale-birth negative must be refused by that guard, with both original owners
+and uvicorn workload births still alive, before the valid owner-death case.
+The existing CLI previews that exact authenticated-v2 orphan, then consumes its
+unchanged receipt to recover it. The sibling must still retain its exact birth
+and live owner, and its ordinary Stop must also remove its registration.
+
+Record source revision/dirty state, module origin and sum, binary and SBOM hashes,
+CLI identity, actual test output, and any skipped checks. The test does not prove
+Linux operation, sandbox/principal policy, Docker, Nix, full CLI composition,
+Wiki `model/model` adoption, or publication. Default tests skip this opt-in gate;
+a default green run alone does not qualify an installed agent. Run container and
+image-scanning checks only with the fleet's allocated Docker slot.

go.mod

@@ -3,7 +3,7 @@ module github.com/codefly-dev/service-python-fastapi
 go 1.27.3
 
 require (
-	github.com/codefly-dev/core v0.19.7-0.20261025070021-a3bf508a5e55
+	github.com/codefly-dev/core v0.19.10
 	github.com/codefly-dev/service-python v0.0.66
 	github.com/pelletier/go-toml/v2 v2.4.3
 	github.com/stretchr/testify v1.12.1
@@ -19,8 +19,8 @@ require (
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/semver/v3 v3.5.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.4.1 // indirect
+	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
+	github.com/ProtonMail/go-crypto v1.5.2 // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
@@ -32,6 +32,7 @@ require (
 	github.com/codefly-dev/gortk v0.2.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/log v0.2.0 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dekobon/tree-sitter-groovy v0.3.0 // indirect
@@ -56,7 +57,7 @@ require (
 	github.com/go-openapi/jsonreference v1.0.2 // indirect
 	github.com/go-openapi/loads v0.25.3 // indirect
 	github.com/go-openapi/spec v1.0.1 // indirect
-	github.com/go-openapi/strfmt v0.27.2 // indirect
+	github.com/go-openapi/strfmt v0.27.3 // indirect
 	github.com/go-openapi/swag v0.29.2 // indirect
 	github.com/go-openapi/swag/cmdutils v0.29.2 // indirect
 	github.com/go-openapi/swag/conv v0.29.2 // indirect
@@ -85,10 +86,11 @@ require (
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-pointer v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.28 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
+	github.com/moby/sys/sequential v0.7.0 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
+	github.com/morikuni/aec v1.1.0 // indirect
 	github.com/oklog/ulid/v2 v2.1.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
@@ -119,22 +121,23 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 // indirect
 	go.opentelemetry.io/otel v1.47.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 // indirect
 	go.opentelemetry.io/otel/log v1.47.0 // indirect
 	go.opentelemetry.io/otel/metric v1.47.0 // indirect
 	go.opentelemetry.io/otel/trace v1.47.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/crypto v0.57.0 // indirect
-	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
-	golang.org/x/mod v0.41.0 // indirect
-	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/exp v0.0.0-20261014143641-f0251eb4aa3e // indirect
+	golang.org/x/mod v0.42.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
-	golang.org/x/term v0.46.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
+	golang.org/x/term v0.47.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect