seathatflowsinourveins · Sep 30, 2026 · Sep 30, 2026
@@ -0,0 +1,17 @@
+# Independent OAuthlib reachability review of draft PR 535, candidate lock `8d257833a90ad409...`
+
+Review of draft PR #535 at the immutable head `bb3d00dc1ed493726481d0d3d746f6b0b46ed8bd` (base `f03f41c7f3601532b8635f8f112a3d2731454375`), lane `lane:shared`: the OpenHands SDK 1.50.0 wheel lock
+`blueprints/runtime-workers/openhands/requirements.lock` with sha256 `8d257833a90ad4096858d108a427e908a54850dee24d1036d37bd7b5e5d86676`, Linux x86_64, CPython 3.13.15. Claims, findings, controls and residuals: `receipt.json`.
+This is a **historical scoped proof for that exact head and lock**; it approves no merge, exception, pin or promotion and is not acceptance of any later closure.
+
+| Files | What they are |
+| --- | --- |
+| `checks/pr535-identity.txt` | head, base, lock hashes, pins, the exact-lock test entry, the OSV config diff |
+| `checks/install-log.txt`, `checks/independent-scan.txt` | the reproduced hashed installs (exit 0, pip check clean) and the independent metadata and raw-text OAuthlib sweep |
+| `checks/advisory-files-and-helper.txt` | the four advisory-related oauthlib files against the candidate's recorded hashes; the Python 2 helper |
+| `checks/osv-exit-codes-and-findings.txt`, `checks/osv-*.json`, `checks/osv-scanner-identity.txt` | OSV-Scanner 2.6.0 (the CI pin): CI form exit 0, the empty-config control exit 1 with exactly the two ids, the base lock with the same two ids |
+| `checks/closure-diff-base-vs-head.txt`, `checks/pin-sources.txt` | the closure difference against the base's lock, and what constrains click, pypdf and soupsieve |
+| `checks/commands-as-typed.txt` | the commands as typed, with times |
+| `scripts/` | the scripts as run (`.txt` copies) |
+
+Host paths are masks (`<REVIEW-SCRATCH>`, `<PR535-WORKTREE>`, `<OSV-BIN>`, `<HOME>`, `<REPO>`); colour codes are removed; nothing else in an output is edited.
@@ -0,0 +1,15 @@
+observed_utc=2026-09-30T08:54:07Z
+hashes in the reproduced install versus the hashes printed in the candidate's own callers output (evidence/wheel-relock-20260930-oauthlib-callers.txt at the head):
+  oauthlib/oauth2/rfc6749/endpoints/revocation.py: reproduced ebc5248a9cfb50e75e04298ee4a4d1a34bf06d415df2d4c6db60a4d21165ba6c | candidate's ebc5248a9cfb50e75e04298ee4a4d1a34bf06d415df2d4c6db60a4d21165ba6c | IDENTICAL
+  oauthlib/oauth2/rfc6749/grant_types/authorization_code.py: reproduced 0d6931601c4e88a078fb3ccf5f052c035ad6a4bb2171efb9c218e088a7272dc6 | candidate's 0d6931601c4e88a078fb3ccf5f052c035ad6a4bb2171efb9c218e088a7272dc6 | IDENTICAL
+  oauthlib/oauth2/rfc6749/endpoints/pre_configured.py: reproduced 6fe072e29e94f0bb6fa65bf8a223893b2702e8d77c52494b389f75bb3ebc6316 | candidate's 6fe072e29e94f0bb6fa65bf8a223893b2702e8d77c52494b389f75bb3ebc6316 | IDENTICAL
+  oauthlib/openid/connect/core/endpoints/pre_configured.py: reproduced bc6ff1a5fa23c2dcc3a782125e13d93355e73abf2e4fadc406b86ebce121e7ee | candidate's bc6ff1a5fa23c2dcc3a782125e13d93355e73abf2e4fadc406b86ebce121e7ee | IDENTICAL
+func_timeout/py2_raise.py: reproduced 19d989963807de3847a00bbe90337fd9100a79cee4327683b601e4bc96225b77 | pinned by the candidate 19d989963807de3847a00bbe90337fd9100a79cee4327683b601e4bc96225b77
+func_timeout/dafunc.py lines 20-26 (which raise helper is selected on Python 3):
+
+  try:
+      from .py3_raise import raise_exception
+  except SyntaxError:
+      from .py2_raise import raise_exception
+  except ImportError:
+      from .py2_raise import raise_exception
@@ -0,0 +1,16 @@
+observed_utc=2026-09-30T08:54:07Z
+sha256 of the two inputs: base 14e57b8d947e62ed60e7bbc69c2e6cc55638a86fa8969d528cbdf591cd42ae64 | head 8d257833a90ad4096858d108a427e908a54850dee24d1036d37bd7b5e5d86676
+old: 335 packages, new: 176; added 0, removed 159, changed 5
+ADDED:    -
+REMOVED:  pyobjc==11.1, pyobjc-core==11.1, pyobjc-framework-accessibility==11.1, pyobjc-framework-accounts==11.1, pyobjc-framework-addressbook==11.1, pyobjc-framework-adservices==11.1, pyobjc-framework-adsupport==11.1, pyobjc-framework-applescriptkit==11.1, pyobjc-framework-applescriptobjc==11.1, pyobjc-framework-applicationservices==11.1, pyobjc-framework-apptrackingtransparency==11.1, pyobjc-framework-audiovideobridging==11.1, pyobjc-framework-authenticationservices==11.1, pyobjc-framework-automaticassessmentconfiguration==11.1, pyobjc-framework-automator==11.1, pyobjc-framework-avfoundation==11.1, pyobjc-framework-avkit==11.1, pyobjc-framework-avrouting==11.1, pyobjc-framework-backgroundassets==11.1, pyobjc-framework-browserenginekit==11.1, pyobjc-framework-businesschat==11.1, pyobjc-framework-calendarstore==11.1, pyobjc-framework-callkit==11.1, pyobjc-framework-carbon==11.1, pyobjc-framework-cfnetwork==11.1, pyobjc-framework-cinematic==11.1, pyobjc-framework-classkit==11.1, pyobjc-framework-cloudkit==11.1, pyobjc-framework-cocoa==11.1, pyobjc-framework-collaboration==11.1, pyobjc-framework-colorsync==11.1, pyobjc-framework-contacts==11.1, pyobjc-framework-contactsui==11.1, pyobjc-framework-coreaudio==11.1, pyobjc-framework-coreaudiokit==11.1, pyobjc-framework-corebluetooth==11.1, pyobjc-framework-coredata==11.1, pyobjc-framework-corehaptics==11.1, pyobjc-framework-corelocation==11.1, pyobjc-framework-coremedia==11.1, pyobjc-framework-coremediaio==11.1, pyobjc-framework-coremidi==11.1, pyobjc-framework-coreml==11.1, pyobjc-framework-coremotion==11.1, pyobjc-framework-coreservices==11.1, pyobjc-framework-corespotlight==11.1, pyobjc-framework-coretext==11.1, pyobjc-framework-corewlan==11.1, pyobjc-framework-cryptotokenkit==11.1, pyobjc-framework-datadetection==11.1, pyobjc-framework-devicecheck==11.1, pyobjc-framework-devicediscoveryextension==11.1, pyobjc-framework-dictionaryservices==11.1, pyobjc-framework-discrecording==11.1, pyobjc-framework-discrecordingui==11.1, pyobjc-framework-diskarbitration==11.1, pyobjc-framework-dvdplayback==11.1, pyobjc-framework-eventkit==11.1, pyobjc-framework-exceptionhandling==11.1, pyobjc-framework-executionpolicy==11.1, pyobjc-framework-extensionkit==11.1, pyobjc-framework-externalaccessory==11.1, pyobjc-framework-fileprovider==11.1, pyobjc-framework-fileproviderui==11.1, pyobjc-framework-findersync==11.1, pyobjc-framework-fsevents==11.1, pyobjc-framework-fskit==11.1, pyobjc-framework-gamecenter==11.1, pyobjc-framework-gamecontroller==11.1, pyobjc-framework-gamekit==11.1, pyobjc-framework-gameplaykit==11.1, pyobjc-framework-healthkit==11.1, pyobjc-framework-imagecapturecore==11.1, pyobjc-framework-inputmethodkit==11.1, pyobjc-framework-installerplugins==11.1, pyobjc-framework-instantmessage==11.1, pyobjc-framework-intents==11.1, pyobjc-framework-intentsui==11.1, pyobjc-framework-iobluetooth==11.1, pyobjc-framework-iobluetoothui==11.1, pyobjc-framework-iosurface==11.1, pyobjc-framework-ituneslibrary==11.1, pyobjc-framework-kernelmanagement==11.1, pyobjc-framework-latentsemanticmapping==11.1, pyobjc-framework-launchservices==11.1, pyobjc-framework-libdispatch==11.1, pyobjc-framework-libxpc==11.1, pyobjc-framework-linkpresentation==11.1, pyobjc-framework-localauthentication==11.1, pyobjc-framework-localauthenticationembeddedui==11.1, pyobjc-framework-mailkit==11.1, pyobjc-framework-mapkit==11.1, pyobjc-framework-mediaaccessibility==11.1, pyobjc-framework-mediaextension==11.1, pyobjc-framework-medialibrary==11.1, pyobjc-framework-mediaplayer==11.1, pyobjc-framework-mediatoolbox==11.1, pyobjc-framework-metal==11.1, pyobjc-framework-metalfx==11.1, pyobjc-framework-metalkit==11.1, pyobjc-framework-metalperformanceshaders==11.1, pyobjc-framework-metalperformanceshadersgraph==11.1, pyobjc-framework-metrickit==11.1, pyobjc-framework-mlcompute==11.1, pyobjc-framework-modelio==11.1, pyobjc-framework-multipeerconnectivity==11.1, pyobjc-framework-naturallanguage==11.1, pyobjc-framework-netfs==11.1, pyobjc-framework-network==11.1, pyobjc-framework-networkextension==11.1, pyobjc-framework-notificationcenter==11.1, pyobjc-framework-opendirectory==11.1, pyobjc-framework-osakit==11.1, pyobjc-framework-oslog==11.1, pyobjc-framework-passkit==11.1, pyobjc-framework-pencilkit==11.1, pyobjc-framework-phase==11.1, pyobjc-framework-photos==11.1, pyobjc-framework-photosui==11.1, pyobjc-framework-preferencepanes==11.1, pyobjc-framework-pushkit==11.1, pyobjc-framework-quartz==11.1, pyobjc-framework-quicklookthumbnailing==11.1, pyobjc-framework-replaykit==11.1, pyobjc-framework-safariservices==11.1, pyobjc-framework-safetykit==11.1, pyobjc-framework-scenekit==11.1, pyobjc-framework-screencapturekit==11.1, pyobjc-framework-screensaver==11.1, pyobjc-framework-screentime==11.1, pyobjc-framework-scriptingbridge==11.1, pyobjc-framework-searchkit==11.1, pyobjc-framework-security==11.1, pyobjc-framework-securityfoundation==11.1, pyobjc-framework-securityinterface==11.1, pyobjc-framework-securityui==11.1, pyobjc-framework-sensitivecontentanalysis==11.1, pyobjc-framework-servicemanagement==11.1, pyobjc-framework-sharedwithyou==11.1, pyobjc-framework-sharedwithyoucore==11.1, pyobjc-framework-shazamkit==11.1, pyobjc-framework-social==11.1, pyobjc-framework-soundanalysis==11.1, pyobjc-framework-speech==11.1, pyobjc-framework-spritekit==11.1, pyobjc-framework-storekit==11.1, pyobjc-framework-symbols==11.1, pyobjc-framework-syncservices==11.1, pyobjc-framework-systemconfiguration==11.1, pyobjc-framework-systemextensions==11.1, pyobjc-framework-threadnetwork==11.1, pyobjc-framework-uniformtypeidentifiers==11.1, pyobjc-framework-usernotifications==11.1, pyobjc-framework-usernotificationsui==11.1, pyobjc-framework-videosubscriberaccount==11.1, pyobjc-framework-videotoolbox==11.1, pyobjc-framework-virtualization==11.1, pyobjc-framework-vision==11.1, pyobjc-framework-webkit==11.1
+CHANGED:  click 8.5.0 -> 8.3.3, openhands-sdk @openhands_sdk-1.49.6-py3-none-any.whl -> @openhands_sdk-1.50.0-py3-none-any.whl, openhands-tools @openhands_tools-1.49.6-py3-none-any.whl -> @openhands_tools-1.50.0-py3-none-any.whl, pypdf 6.19.0 -> 6.16.1, soupsieve 2.9.2 -> 2.9
+  oauthlib: old 3.3.1, new 3.3.1
+  pyjwt: old 2.14.0, new 2.14.0
+  requests-oauthlib: old 2.0.0, new 2.0.0
+  google-auth-oauthlib: old 1.2.2, new 1.2.2
+  authlib: old 1.6.12, new 1.6.12
+  mcp: old 1.28.1, new 1.28.1
+  litellm: old 1.93.0, new 1.93.0
+  google-auth: old 2.53.0, new 2.53.0
+  openhands-sdk: old @openhands_sdk-1.49.6-py3-none-any.whl, new @openhands_sdk-1.50.0-py3-none-any.whl
+  openhands-tools: old @openhands_tools-1.49.6-py3-none-any.whl, new @openhands_tools-1.50.0-py3-none-any.whl
@@ -0,0 +1,16 @@
+Commands of the review as typed (transcribed from the session; the scripts named are in scripts/). Times: the reproduced install ran 2026-09-30T08:37:49Z to 08:37:50Z
+(checks/install-log.txt); the first OSV scans, the closure difference and the independent sweep ran in the following minutes; run_review_outputs.sh regenerated the
+identity, closure, advisory-file, pin-source and OSV outputs from the same git objects and the same scratch install at 2026-09-30T08:52:10Z to 08:52:14Z, and the
+independent sweep was rerun once more with its observed time. Every output file carries its own observed time where its script prints one.
+
+ 1. git fetch -q origin refs/pull/535/head:refs/remotes/pr/535 main                 (git protocol; no REST call)
+ 2. git rev-parse refs/remotes/pr/535; git show refs/remotes/pr/535:blueprints/runtime-workers/openhands/requirements.lock | sha256sum      (identity)
+ 3. python3 lock_closure_diff.py <lock at the PR base> <lock at the head>
+ 4. install_candidate.sh: with UV_NO_CONFIG=1: uv venv --python 3.13.15 <venv>; uv pip install --python <venv>/bin/python --require-hashes --no-deps --only-binary :all:
+    --index-url https://pypi.org/simple -r <build-requirements lock at the head>; uv pip install --python <venv>/bin/python --require-hashes --no-deps --no-build-isolation
+    --index-url https://pypi.org/simple -r <candidate lock>; uv pip check --python <venv>/bin/python      (the candidate's own recorded install commands)
+ 5. <venv>/bin/python oauthlib_independent_scan.py <venv>/lib/python3.13/site-packages
+ 6. <osv-scanner 2.6.0> scan source --config <config> --no-resolve --lockfile=requirements.txt:<lock path> --format json     three times: the head's .github/osv-scanner.toml
+    on the candidate lock; an empty config on the candidate lock (the control); an empty config on the PR base's lock
+ 7. <venv>/bin/python constraint_sources.py <venv>/lib/python3.13/site-packages
+ 8. run_review_outputs.sh      (steps 2, 3, 6, 7 and the advisory-file hash comparison, regenerated with observed times)
@@ -0,0 +1,33 @@
+observed_utc=2026-09-30T08:53:35Z
+== versions: {'oauthlib': '3.3.1', 'PyJWT': '2.14.0', 'requests-oauthlib': '2.0.0', 'google-auth-oauthlib': '1.2.2', 'authlib': '1.6.12', 'openhands-sdk': '1.50.0', 'openhands-tools': '1.50.0'}
+== reverse dependencies (Requires-Dist names oauthlib):
+   requests-oauthlib 2.0.0 <- oauthlib >=3.0.0
+   requests-oauthlib 2.0.0 <- oauthlib[signedtoken] >=3.0.0 ; extra == 'rsa'
+== raw-text sweep: 14616 files outside oauthlib; files mentioning 'oauthlib': 22 in 6 top-level entries
+  browser_use: 1 files {'.py': 1}
+  browser_use-0.11.9.dist-info: 1 files {'(none)': 1}
+  google_auth_oauthlib: 5 files {'.py': 5}
+  google_auth_oauthlib-1.2.2.dist-info: 4 files {'.txt': 2, '(none)': 2}
+  requests_oauthlib: 8 files {'.py': 8}
+  requests_oauthlib-2.0.0.dist-info: 3 files {'.txt': 1, '(none)': 2}
+== import-shaped and dynamic lines (text files), outside requests_oauthlib's plain client imports:
+  browser_use/integrations/gmail/service.py:16: from google_auth_oauthlib.flow import InstalledAppFlow
+  [binary or other] browser_use-0.11.9.dist-info/METADATA
+  google_auth_oauthlib/helpers.py:29: import requests_oauthlib
+  google_auth_oauthlib/flow.py:24: from google_auth_oauthlib.flow import InstalledAppFlow
+  google_auth_oauthlib/flow.py:68: import google_auth_oauthlib.helpers
+  google_auth_oauthlib/flow.py:331: from google_auth_oauthlib.flow import InstalledAppFlow
+  google_auth_oauthlib/interactive.py:27: import google_auth_oauthlib.flow
+  google_auth_oauthlib/interactive.py:129: import google_auth_oauthlib
+  google_auth_oauthlib/tool/__main__.py:39: import google_auth_oauthlib.flow
+  [binary or other] google_auth_oauthlib-1.2.2.dist-info/RECORD
+  [binary or other] google_auth_oauthlib-1.2.2.dist-info/METADATA
+  [binary or other] requests_oauthlib-2.0.0.dist-info/RECORD
+  [binary or other] requests_oauthlib-2.0.0.dist-info/METADATA
+== server-side or advisory names in files that mention oauthlib (outside oauthlib):
+   (0 lines)
+== advisory source files:
+   oauthlib/oauth2/rfc6749/endpoints/revocation.py ebc5248a9cfb50e75e04298ee4a4d1a34bf06d415df2d4c6db60a4d21165ba6c
+   oauthlib/oauth2/rfc6749/grant_types/authorization_code.py 0d6931601c4e88a078fb3ccf5f052c035ad6a4bb2171efb9c218e088a7272dc6
+   oauthlib/oauth2/rfc6749/endpoints/pre_configured.py 6fe072e29e94f0bb6fa65bf8a223893b2702e8d77c52494b389f75bb3ebc6316
+   oauthlib/openid/connect/core/endpoints/pre_configured.py bc6ff1a5fa23c2dcc3a782125e13d93355e73abf2e4fadc406b86ebce121e7ee
@@ -0,0 +1,19 @@
+[2026-09-30T08:37:49Z] venv
+Creating virtual environment at: <REVIEW-SCRATCH>/venv
+Activate with: source <REVIEW-SCRATCH>/venv/bin/activate
+[2026-09-30T08:37:49Z] build lock
+ + packaging==26.3
+ + setuptools==84.0.0
+ + wheel==0.46.3
+rc=0
+[2026-09-30T08:37:49Z] candidate lock
+ + websockets==15.0.1
+ + wrapt==1.17.3
+ + yarl==1.22.0
+ + zipp==3.23.0
+rc=0
+[2026-09-30T08:37:49Z] pip check
+Using Python 3.13.15 environment at: <REVIEW-SCRATCH>/venv
+Checked 178 packages in 4ms
+All installed packages are compatible
+[2026-09-30T08:37:50Z] done