Enforce Python OpenSSF Gold quality gates and license evidence

[kriptoburak]

Summary

• activate the generated SDK suite through a loopback-only schema-valid mock API
• fix unauthenticated guest-wallet and checkout requests, tuple uploads, invalid containers, and generic type errors
• enforce Python 3.10/3.14 and Pydantic 1/2 coverage thresholds
• add REUSE 3.3 licensing, governance, security boundaries, and public OpenSSF evidence
• audit locked dependencies and verify reproducible licensed wheel and source archives
• make every pull request run pinned, least-privilege CI and harden PyPI releases

Verified evidence

• Ruff, Pyright, and Mypy pass
• Pydantic 2: 2,989 passed, 9 documented skips
• Pydantic 1: 2,976 passed, 22 documented skips
• statement coverage: 10,305/10,941 (94.19%), minimum 90%
• branch coverage: 1,139/1,408 (80.89%), minimum 80%
• pip-audit: zero known vulnerabilities across 52 installed locked packages
• REUSE 3.3: 388/388 files licensed
• wheel and source archives: byte-identical across 2 builds
• Twine metadata, actionlint, shellcheck, and diff checks pass

Gold status

This PR closes the repository's technical gaps. OPENSSF.md truthfully records the remaining human requirements: access continuity, bus factor, 2 unassociated contributors, 50% independent review coverage, and a human security review within 5 years.

A different human must review this nontrivial maintainer-authored change. Do not merge it without that approval.

Note

Add SPDX license headers, mock API test server, and OpenSSF Gold quality gate scripts

• Adds SPDX Apache-2.0 license headers to all source and test files, backed by a REUSE.toml config and checked in CI via fsfe/reuse-action.
• Introduces a local mock HTTP server (tests/mock_api_server.py) that introspects route definitions at import time and serves deterministic responses; tests now start this server automatically unless TEST_API_BASE_URL points to a loopback address.
• Adds scripts/coverage, scripts/verify_coverage.py, and scripts/audit to enforce coverage thresholds (90% statements, 80% branches) and dependency vulnerability scanning in CI.
• Adds scripts/check-reproducible and wires SOURCE_DATE_EPOCH into the build and publish workflows to verify byte-for-byte reproducible distributions.
• Fixes to_httpx_files and async_to_httpx_files to not treat str/bytes/bytearray as sequences, and broadens extract_type_var_from_base to work on any class with __orig_bases__.
• Adds CONTRIBUTING.md, GOVERNANCE.md, OPENSSF.md, and SECURITY.md as required governance and policy documents.
• Risk: the test suite now raises RuntimeError at collection time if TEST_API_BASE_URL is set to a non-loopback host.

^{Macroscope summarized 71d21f0.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	coverage@​7.15.2
	ruff@​0.15.21 ⏵ 0.15.22

View full report

[kriptoburak]

Per-file licensing verification added in e1cb25a.

Local verification on 2026-07-24:

• lint, Ruff, Pyright, Mypy, and import checks passed
• Python 3.10 and 3.14 with Pydantic v1/v2: all executed tests passed; compatibility exclusions were 9 or 22 cases by matrix
• statement coverage: 94.19% (10,305/10,941)
• branch coverage: 80.89% (1,139/1,408)
• locked dependency audit: no known vulnerabilities
• wheel and source archives: bit-for-bit reproducible
• REUSE 3.3: 388/388 files compliant
• actionlint and git diff checks passed

The new diff contains only Apache-2.0 copyright/license notices. It deletes no lines and changes no behavior. Simplification, maintainability, confidentiality, and security review found no applicable code findings. A different human reviewer remains required by the organization review policy before merge.

[kriptoburak]

Reviewed the generated TEST_API_BASE_URL risk note against immutable head e1cb25aea368029e3e7ee52a19e4e8155aba4dc6. The loopback-only validation is intentional test isolation, not a production SDK contract change: it prevents the test suite from mutating remote services. CONTRIBUTING.md documents the accepted literal loopback addresses and rationale. Both hosted Tests & Coverage jobs pass, along with lint, build, reproducibility, dependency security, and CodeQL.

[kriptoburak]

Discovery & Answer-Engine Update

Commit 71d21f0 adds repository-specific README guidance for choosing this surface and finding supported customer tasks. It avoids query permutations, unsupported comparisons, and keyword stuffing.

Research and review rules are recorded in the organization discovery policy. The full repository-native local suite passed, including lint, tests, coverage, dependency/security checks, and reproducibility checks as applicable.

Hosted checks are rerunning. A different human approval remains required before merge.