Scheduled SDK Synthetic red since 2026-08-10 ~08:51 UTC: /v1/demo returns 37 commodities, contract tests assert 9

[karlwaldman]

Confirmed-live 2026-08-10 (6+ consecutive hourly failures). tests/integration/test_demo_contract.py:58 asserts len(prices) == 9 (got 37) and :79 asserts meta.available_commodities == 9 (got 37). The API's keyless demo surface widened 9→37 today. Decide: (a) intentional demo expansion (api#5790 agent-visibility orbit) → SDK tests should assert shape and a MINIMUM count, not an exact count; or (b) the API accidentally widened the keyless surface → fix API-side. Either way, exact-count assertions on a remote catalogue are brittle by design — prefer >= 9 + schema checks. Found during inbox-zero GitHub triage.

[karlwaldman]

Fix prepared — exact red/green receipt

Draft PR #81 fixes this at 4d191da: #81

The live red phase reproduced 3 failures / 4 tests: 34 current rows and 37 configured demo codes were compared with stale exact-nine assertions. The corrected contract preserves the original nine-code compatibility floor, requires usable current rows for that core, permits deliberate catalogue growth, and checks the advertised free list for core coverage and duplicates.

Green proof: live production synthetic 4/4, mocked DemoResource 5/5, Ruff clean, Black clean, diff check clean. No package release, deploy, API mutation, or customer action occurred; keep this issue open until the PR merges and the scheduled synthetic is observed green.

[karlwaldman]

Resolved and production-verified.

• Fix: PR Fix live demo catalogue synthetic drift #81 merged as fdcd39e6ac0711e0aa1f874a7e127c9dc791acc0. The contract now preserves the original core-code compatibility floor, accepts deliberate catalogue growth, validates every returned core row, and propagates request/transport/OS failures instead of skipping.
• Post-merge synthetic: run 31487552692 at release head 7f2338c9ba3e73810d868b898da283f983f06f60 is green. Its always-on keyless demo smoke, required monitor credential, bounded authenticated customer path, and 30-day receipt upload all passed: https://github.com/OilpriceAPI/python-sdk/actions/runs/31487552692
• Released artifact: oilpriceapi==1.12.1, tag/release at the same exact head. Trusted publisher run 31487832170 passed tests, Ruff, dependency audit, exact-wheel install/import, manifest attachment, and PyPI upload: https://github.com/OilpriceAPI/python-sdk/actions/runs/31487832170
• Public registry verification: a fresh virtual environment installed exactly oilpriceapi==1.12.1, pip check passed, and live keyless plus authenticated Brent/WTI checks returned finite values with source timestamps. Wheel SHA-256: 159308247cc36b8a1233c6b190b736bf2b8336ac180759913c5fdd2c70e60afa.

This and #80 describe the same stale exact-count incident; no separate work remains.