PyJWT relock record: redis decode search (D1), timing range from the outputs (D2), honest output labels

[seathatflowsinourveins]

Scope

• What this PR changes: the record of OpenHands recipe lock: PyJWT 2.14.0 relock closes ten advisories (unblocks the required osv-scanner check) #525's PyJWT 2.14.0 relock, after the second review's residuals (D1, D2 and nits): the reason for staying on 2.14.0 until the joint relock now covers every PyJWT decode found in the relocked venv (a static search of its 10,746 installed .py files, script published), the two failing requests-oauthlib tests' timing miss is computed from the retained outputs and explained, and the returned outputs' header rule names its exceptions. No lock, pin, test or config change (requirements.lock, pins.json, tests/, .github/osv-scanner.toml are byte-unchanged from main).
• Base commit: f77612b6 (main, after OpenHands recipe lock: PyJWT 2.14.0 relock closes ten advisories (unblocks the required osv-scanner check) #525).
• Lane: lane:foundation (registering the files in manifests/evidence.json through the hot-file protocol does not make it shared).
• Owned paths touched: blueprints/runtime-workers/openhands/ (research.md and evidence/), docs/decisions/2026-09-22-github-automation-closure.md, evidence/receipts/, manifests/evidence.json (last commit).

SOTA sources

• The same sources as OpenHands recipe lock: PyJWT 2.14.0 relock closes ten advisories (unblocks the required osv-scanner check) #525: PyJWT 2.14.0 (repository https://github.com/jpadilla/pyjwt, tag 2.14.0; CHANGELOG.rst v2.14.0 read from the sdist), the GitHub global advisory API and OSV records for the ten advisories, OpenHands/software-agent-sdk@fcc102a697874d54a357e36004e02c95040dbdc0 (the recipe's pinned source and uv.lock), google/osv-scanner v2.6.0.
• New for D1: the installed sources of redis 7.2.1 (redis/auth/token.py:83-91), google-auth 2.53.0 (google/oauth2/id_token.py:153), oauthlib 3.3.1 (oauthlib/common.py:221), litellm 1.93.0 and mcp 1.28.1, as pinned in the recipe lock and installed by its own install-container.sh sequence into a scratch venv; and PyJWT 2.15.0's changelog (the Security item about deeply nested payloads).
• Precedent: OpenHands recipe lock: PyJWT 2.14.0 relock closes ten advisories (unblocks the required osv-scanner check) #525 and its receipt evidence/receipts/osv-openhands-pyjwt-relock-20260930.json.

Evidence-class table

Claim	Evidence class	Command / receipt
No decode of an attacker-controlled token through PyJWT is reachable in the recipe venv: the PyJWT importers are google-auth (id_token.py:146, through import jwt as jwt_lib; no importer of that module outside google/auth and google/oauth2), LiteLLM (seven proxy modules, one through import jwt as _jwt at mcp_management_endpoints.py:1516; nothing outside litellm references litellm.proxy; the proxy is not run), oauthlib (common.py:221, no caller outside oauthlib), redis (auth/token.py:89, verify_signature false on a token its credential provider supplies; nothing outside redis references redis.auth.token or JWToken) and mcp (encode only); none of the recipe's 12 .py files (searched recursively) imports redis or jwt	local_integration (static text search of installed .py files, import aliases and from-imports followed; a name assembled at run time would not match; not a runtime trace)	receipt release_choice.decision_point_2_15_0; returned outputs section K; evidence/relock-2026-09-30.jwt-callers.py.txt
The two failing requests-oauthlib tests fail on an integer-versus-float timestamp comparison off by 0.09 to 0.39 s in the four retained failures, which follows the run's fractional second; they fail under oauthlib 3.3.1 and 4.0.0 alike	unchanged upstream test code run by us on a scratch tree	receipt oauthlib_4_0_0_precheck; returned outputs section J (full pytest output)
The returned outputs' commands are shown as run, with abridged and derived lines labelled, and the builder that wrote them is published	source_review (reading the file against its builder)	evidence/relock-2026-09-30.txt, evidence/relock-2026-09-30.builder.sh.txt

Local commands run

$ python3 scripts/validate.py
{"components": 69, "hashed_files": 8244, "profiles": 4, "receipts": 173, "status": "passed"}         exit 0
$ python3 scripts/evidence_manifest.py --check
{"files": 8244, "status": "passed"}                                                                   exit 0
$ python3 -B -m unittest tests.test_osv_lockfile_coverage tests.test_runtime_worker_openhands
Ran 151 tests ... OK                                                                                  exit 0
$ python3 relock-2026-09-30.jwt-callers.py <scratch venv site-packages> blueprints/runtime-workers/openhands   (section K)
10746 files searched; PyJWT importers and callers as in the table; output equals section K byte for byte  exit 0

The full unittest discovery runs in CI's validate check.

Decision record

docs/decisions/2026-09-22-github-automation-closure.md, the dated 2026-09-30 addendum (rewritten in place for D1, with the as-of times refreshed); the overturn list is unchanged, and trigger (c) still fires at 2026-09-30T16:56:01Z if the recorded reason stops holding.

Host evidence

This PR touches a receipt under evidence/receipts/, not evidence/hosts/.

• scripts/validate.py (exit 0 above) validates the receipt and its registration.
• Independent review: session 21 read head 1ac08865 (needs changes: aliased PyJWT imports missed by section K, the google-auth decode cited at the wrong line, an unretained figure cited as retained, unnamed exceptions in the outputs header); all are fixed in the repair round (head 3f18398c), and section K reproduces byte for byte from the published script. Session 21 was asked to check the new head.
• No platform_status change.

Residuals

• The image's server binary (PyJWT 2.13.0) and the grader venv (PyJWT 2.10.1) are still outside the OSV inventory and unmeasured.
• The section K search is static and covers installed packages only; code the OpenHands agent writes and runs is out of scope.
• The joint oauthlib 4.0.0 and PyJWT 2.15.1 relock stays in Relock OpenHands onto oauthlib 4.0.0 / PyJWT 2.15.1 by 2026-10-08 (osv ignores from #517 expire 2026-10-13) #518 (earliest 2026-10-05T18:40:43Z, due 2026-10-08).

Checklist

• No workflows or Actions are changed.
• No secrets are printed, logged or committed.
• No new paid hosting, subscription or billing surface.
• Peer-owned untracked files and worktrees were preserved.

🤖 Generated with Claude Code