OpenHands: owner delta review of draft PR 535 at head 7c0df369 (lock 83293867: urllib3 2.8.0, PyJWT 2.15.0), artifact-only record

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: adds an artifact-only record, evidence/artifacts/openhands-oauthlib-review-535-head7c0df3-20260930/, of the owner delta review of draft PR Qualify native runtime recipes and repair Sol routing and grader FTP dependency #535 at its head 7c0df369 (lock sha256 83293867..., Linux x86_64 CPython 3.13.15): the OpenHands SDK 1.50.0 lock relocked onto urllib3 2.8.0 and PyJWT 2.15.0, reviewed against the lock of the earlier record (6a7b16, OpenHands: independent OAuthlib reachability review of draft PR 535 at its corrected head 6a7b1646 (candidate lock 383ccc5b), artifacts only #537). No code, workflow, config or lock changes.
• Base commit: 8fc86119eacfd5be9b8a139e1ed167d85748091b
• Lane: lane:foundation
• Owned paths touched: evidence/artifacts/openhands-oauthlib-review-535-head7c0df3-20260930/ (new, 32 files), manifests/evidence.json (registration only).

SOTA sources

• The review's method is the earlier record's (evidence/artifacts/openhands-oauthlib-review-535-head6a7b16-20260930/, merged in OpenHands: independent OAuthlib reachability review of draft PR 535 at its corrected head 6a7b1646 (candidate lock 383ccc5b), artifacts only #537) plus checks of this delta: the pinned OSV-Scanner 2.6.0 (https://github.com/google/osv-scanner/releases/tag/v2.6.0, binary sha256 ca69b3d3...), uv 0.12.17 hashed installs, the PyPI release metadata of urllib3 2.8.0 and PyJWT 2.15.0 (https://pypi.org/project/urllib3/2.8.0/, https://pypi.org/project/PyJWT/2.15.0/), the PyJWT 2.15.0 sdist and tag (https://github.com/jpadilla/pyjwt/releases/tag/2.15.0), and the OpenHands software-agent-sdk archive at commit dcf401af7a9a302ef92cb7d092e1df9bb659daa5 (https://github.com/OpenHands/software-agent-sdk/tree/dcf401af7a9a302ef92cb7d092e1df9bb659daa5), whose sha256 and uv.lock hash are recomputed in the record.

Evidence-class table

Claim	Evidence class	Command / receipt
Head, base, lock, pins and exact-lock row agree; the lock is byte-identical to an independent prediction (reviewed lock with only the urllib3 and pyjwt entries substituted from PyPI hashes)	source_review, our_integration_check	checks/pr535-identity.txt, checks/prediction.txt (claims D1, D2)
Closure against the reviewed lock: 176/176 packages, 2 changed (pyjwt, urllib3); against main: 335 to 176, 159 pyobjc removed, 2 SDK wheels changed	our_integration_check	checks/closure-diff-*.txt (D2)
Hashed installs, uv pip check and the SDK import check pass in a fresh CPython 3.13.15 venv	our_integration_check	checks/install-log.txt (D3)
No path from the closure to the two advisories' server-side code; the four advisory files hash as recorded earlier; PyJWT importers and the JWKS client caller	our_integration_check (static)	checks/independent-scan.txt, checks/pyjwt-surface.txt (D4, D5)
OSV-Scanner: candidate exit 0 under the ordinary config; empty-config control reports exactly the two oauthlib ids; the reviewed lock reports those plus four findings the relock removes; the workflow's own step exits 0 on 56 entries	our_integration_check	checks/osv-*.txt, checks/osv-*.json (D6, D7)
The requested receipt's 62 artifact and 53 command bindings hold; external hashes (PyJWT sdist inputs, SDK archive, uv.lock) recomputed from PyPI and codeload	our_integration_check	checks/receipt-bindings.txt, checks/external-hashes.txt (D8, D9)
The repository's own checks at the head pass (245 tests, validate.py, evidence_manifest.py --check)	our_integration_check	checks/repo-checks-at-head.txt (D10)

Findings recorded (no change to the lock needed): P2-1 the receipt's bound_files entry for security-scan.yml records the pre-#546 workflow; P2-2 four frozen compile-input captures are listed under excluded although the inventory rule names only deliberately vulnerable test fixtures. Not covered: the other workers' locks and their nltk allowances, hosted CI of the head, image, trusted observer and task quality (the record approves none of them).

Local commands run

$ bash scripts/run_delta_outputs.sh      # regenerates every output from the immutable head (refuses any other head)
[2026-09-30T19:29:37Z] outputs regenerated
$ python3 scripts/validate.py
{"components": 69, "hashed_files": 8577, "profiles": 4, "receipts": 176, "status": "passed"}
$ python3 scripts/evidence_manifest.py --check
{"files": 8577, "status": "passed"}

Decision record

None needed: an artifact-only record. The decision paragraph "urllib3 and PyJWT relock and a frozen macOS lock (2026-09-30)" of docs/decisions/2026-09-22-github-automation-closure.md (merged in #546) covers the lock lane.

Checklist

• No workflow, action, permission or config change.
• No secrets are printed, logged or committed; host paths are masked; the advisories' details prose is removed from the scanner JSON.
• No new paid hosting, subscription or billing surface.
• Peer-owned untracked files and worktrees were preserved (built in its own worktree at the base commit).

🤖 Generated with Claude Code