Stability checkpoint — urllib3 CVE patch + mutmut schedule wiring - fix(deps): bump urllib3 2.6.3 → 2.7.0 (CVE-2026-44431, CVE-2026-44432) - ci(mutmut): support scheduled runs via RUN_MUTMUT=true - ci(mutmut): drop unsupported --no-progress flag (mutmut 3.x removed it) - chore(submodule): bump iris-common SHA → ecb8e29 - (transitively via the common SHA bump : ADRs 0066-0071 available + new bin/ship/github-mirror-sync.sh + auto-merge force-fetch fix in template) CI : - Main pipeline #341 green — https://gitlab.com/iris-7/iris-service-python/-/pipelines/2525307641 - Pre-merge MR pipeline !81 (bump + urllib3) — pip-audit cleared urllib3 2.7.0 - Pre-merge MR pipeline !82 (mutmut rule) - Pre-merge MR pipeline !83 (mutmut flag drop) - Scheduled trigger via mutmut-auth-monthly verified : pipeline #338 + #342 created with mutation-test job in the queue (rule schedule + RUN_MUTMUT=true matches as designed) Local test pass : - pytest — N/A : full pytest suite validated by CI pipeline #341 unit-tests (252s) + integration-tests (339s) stages - ruff check + mypy — N/A : already validated by CI validate stage (all green : ruff:lint 312s, mypy 354s, import-linter 313s) - pip-audit — VERIFIED in CI : urllib3 2.7.0 (no CVEs) replaces 2.6.3. Job duration 150s, exit code 0. Regression check vs previous tag : - stable-py-v0.7.6 known limitations (musl wheels blocked upstream for alpine 412 to 280 MB image) — still bounded, unchanged - urllib3 CVE-2026-44431 + 44432 — fixed in this rev - N/A — no LLM / MCP code changes this rev - urllib3 CVE-2026-44431 + CVE-2026-44432 fixed (bump 2.6.3 to 2.7.0) - AuthN/AuthZ surfaces unchanged : JWT 15min + X-API-Key + RBAC + DNS-rebinding guard + env-var redaction - pip-audit hard gate (no allow_failure) — per ADR-0007 paragraph 9. Currently 0 HIGH / 0 CRITICAL / 0 MEDIUM after this rev. - N/A — no domain code changes - N/A — no infra changes (Docker image, K8s manifests, terraform, asyncpg/aiokafka/redis adapters all unchanged) - N/A — no observability code changes - Coverage gate cov-fail-under=90 still met (CI green) - Mutation testing wired to monthly schedule (RUN_MUTMUT=true on 1st of each month at 05:00 Paris) - mutmut 3.x has 2 upstream bugs discovered in this rev : - --no-progress flag removed in 3.x then dropped from CI script (fix shipped) - sysfs walking (FileNotFoundError on /sys/devices/platform/psci/of_node) on x86 Linux containers — currently exits 1, absorbed by job-level allow_failure: true. Track upstream for a fix or pin to mutmut 2.x. - mutmut-auth-monthly pipeline schedule created (cron 0 5 1 * *, RUN_MUTMUT=true) - mutmut-test rule supports schedule source (carry-forward closed from 2026-05-09 to 12 audit) - All 10 CI jobs green : conv-commits, shellcheck, adr-drift, pip-audit, ruff:lint, mypy, import-linter, unit-tests, integration-tests, benchmarks - Conventional Commits + auto-merge dev to main intact - Feature-slicing (ADR-0008) + Hexagonal Lite (ADR-0044) + polyrepo flat alpha (ADR-0060) unchanged - ADR-0071 (cross-cutting in iris-common) — pipeline variable override role policy now active on this project (owner role required) - N/A — backend repo - uv + ruff + mypy + pytest + pip-audit toolchain unchanged - infra/common/bin/ship/github-mirror-sync.sh now available via the common SHA bump (one-command github mirror sync across 5 repos) - Auto-merge template force-fetch fix (plus prefix on git fetch line) — fixes stale runner-workspace ref non-fast-forward rejection observed 2026-05-14 - alpine image 412 to 280 MB blocked — pydantic_core / cryptography / bcrypt have no musl wheels (track astral-sh/uv upstream) - Mac arm64 + GitLab Runner services architectural impasse — integration-tests still on SaaS Linux runner (ADR-0068) - NEW : mutmut 3.x sysfs walking bug — surfaces in CI but absorbed by allow_failure. Investigate workaround. - New product feature lands (e.g. extending the MCP tool set) - mutmut sysfs bug fixed/worked around (delivers actual surviving-mutant report from the monthly schedule) - alpine musl wheels available for pydantic/cryptography/bcrypt (412 to 280 MB image saving)