[dependabot]

FastAPI native uvicorn workloads now consume published Core v0.19.10's
authenticated process-group writer and recovery contract. This is a fix at the
owning dependency boundary: FastAPI already delegates process lifetime to
Core's native runner. No alternate lifecycle, registry, recovery code, or generic
Python Runtime change is introduced; service-python stays at v0.0.66.

This carrier preserves PR107's checkout/setup-go/Syft action updates and all
current main history through 5bf66270. Core was adopted through the supported
agent deps --pin v0.19.10 command; its shared CI workflow pin moves with it.
AGENTS.md and docs/native-qualification.md document the ownership boundary,
build operation, opt-in gate and qualification limits. Agent version remains
0.0.123; the local build is not a published release.

The new opt-in test consumes the actual supported agent build --native-only
installation through Core's authenticated manager and gRPC Load/Init/Start.
Real uvicorn workloads prove ordinary Stop, re-Init/restart, original owner birth
capture, stale-owner refusal before any delivery, identity-bound owner death,
CLI preview/expect orphan recovery, and preservation of the independent sibling's
exact workload and original owner births. The native registry uses a disposable
OS home; agent installation uses a disposable Codefly home.

Validation with final artifact at clean 246a3e0f7bed72bdd4b158cb65cd745677504633:

• Supported package build, go build ./..., go vet ./..., and
  go mod tidy -diff passed.
• The pre-correction non-Docker suite passed in 68.748s; its corrected test was
  an excluded opt-in. The later race selection passed in 71.425s. Each log contains
  623 passing tests plus the package pass. Eleven Docker/mixed-backend tests were explicitly excluded. The
  installed-agent opt-in gate is skipped in that default selection.
• Corrected actual installed-agent gate passed separately in 2.33s, with
  authenticated-v2 recovery reporting group_dead=true, record_removed=true.
• Binary SHA256 c01e120fc07e42e2b7fe33e2edd34b4386604e02609483a835c6b3e2307cd87e;
  adjacent SBOM binds that hash and Core v0.19.10.

Docker/image scans/native cross-build, Linux native runtime, Nix, sandbox and
principal policy, full CLI composition, Wiki adoption and publication are not
qualified. The existing TestCreateToRunNative Poetry guard returns without a
lifecycle when Poetry is absent; the separate installed-agent test supplies the
native evidence here. Build audit reports existing unpatched upstream advisories
GO-2026-4883 and GO-2026-4887. Historical pre-correction native PASS output is
retained as weaker, superseded evidence; only the corrected final gate closes the
owner-provenance requirement. The chosen existing CLI uses the supplied Core
source replacement; a newer published-pin CLI is not claimed.

Fresh independent source/artifact review closes the original-owner-before-signal finding and found no blocker in this dependency/test/documentation integration. Frozen local manifest: fastapi107-qualification/final-manifest.json; review: codex-native-next-fastapi-owner-correction-review.md. The manifest and old evidence remain unchanged.

Hosted CI run 40641703598 passed all four jobs on merge ref 9fbc672 (head246a3e0 into reviewedmain5bf66270): build, full test, race and required Nix. The ordinary run includes explicit passes for all eleven locally excluded Docker/mixed cases; its native ownership opt-in remains skipped, with the exact Darwin installed-agent proof retained separately. The separate requirenix job passed. Root rehashed all seven retained log/metadata files and verified the live exact-head check rollup.

Linux authenticated owner-death/recovery, release artifacts, actual Wiki adoption and full composition remain separate qualification. No release or full composition success is claimed.

[antoinetoussaint-byte]

A lazybox agent is working on this. codex (codex-native-next-fastapi-owner-correction-review.md, closes F1 at246a3e0 and accepts boun…
• Ran python3 - <<'PY' …
└ 5bf6627 refs/heads/main
9fbc672 refs/pull/107/merge

+ 4 lines (⌃t to expand)                                                                                            

• Ran python3 - <<'PY' …
└ {"ok":true,"completed":true,"error":null,"client_request_id":null,"events":[]}
246a3e0
+ Show details
• CI run 40641703598 (https://github.com/codefly-dev/service-python-fastapi/actions/runs/40641703598) passed all four jobs for head 246a3e0, tested as merge ref 9fbc672 against main 5bf6627.

All eleven locally excluded Docker/mixed tests passed. Required Nix passed separately. Hosted CI skipped the native ownership opt-in gate.

Saved exact metadata, conclusions and all logs in the CI receipt (.lazybox/artifacts/native-qualification/hosted-ci/ receipt.json) and reported to terminal10879. No retries or source changes; freezes remain intact. Root can assess the draft CI hold while retaining the composition, adoption and publication limits.

Worked for 12m 11s • 2:18 AM
⚠ Heads up, you have less than 10% of your weekly limit left. Run /status for a breakdown.

› Ask Codex to do anything

GPT-6-Astra · high) started at 2026-10-28 05:37 UTC, last renewed the claim at 2026-10-28 17:14 UTC, and the claim lapses at 2026-10-28 17:59 UTC unless it is renewed again. A claim is an assertion with an expiry, not proof that a process is alive.

claim detail

Lazybox-Claim-Device: effacd542b611010656e
Lazybox-Claim-Session: 65d811ba31
Lazybox-Claim-Workspace: github-codefly-dev-service-python-fastapi-107
Lazybox-Claim-Agent: codex
Lazybox-Claim-Model: codex-native-next-fastapi-owner-correction-review.md, closes F1 at246a3e0 and accepts boun… 
• Ran python3 - <<'PY' …
  └ 5bf66270c818a55d3a17b40aa540e63fe913230b    refs/heads/main
    9fbc672d2bba52e1f98221442b1ae1ecb6f1f0ea    refs/pull/107/merge

    + 4 lines (⌃t to expand)                                                                                            
• Ran python3 - <<'PY' …
  └ {"ok":true,"completed":true,"error":null,"client_request_id":null,"events":[]}
    246a3e0f7bed72bdd4b158cb65cd745677504633
    + Show details                                                                                                      
• CI run 40641703598 (https://github.com/codefly-dev/service-python-fastapi/actions/runs/40641703598) passed all four     jobs for head 246a3e0, tested as merge ref 9fbc672 against main 5bf66270.

  All eleven locally excluded Docker/mixed tests passed. Required Nix passed separately. Hosted CI skipped the native     ownership opt-in gate.

  Saved exact metadata, conclusions and all logs in the CI receipt (.lazybox/artifacts/native-qualification/hosted-ci/    receipt.json) and reported to terminal10879. No retries or source changes; freezes remain intact. Root can assess the   draft CI hold while retaining the composition, adoption and publication limits.

  Worked for 12m 11s • 2:18 AM                                                                                          
⚠ Heads up, you have less than 10% of your weekly limit left. Run /status for a breakdown.


› Ask Codex to do anything

  GPT-6-Astra · high
Lazybox-Claim-Started: 2026-10-28T05:37:54Z
Lazybox-Claim-Heartbeat: 2026-10-28T17:14:00Z
Lazybox-Claim-Expires: 2026-10-28T17:59:00Z