Stability checkpoint — mutmut 3.x paths_to_mutate fix + allow_failure shields docs phase 2 - fix(deps): mutmut 3.x needs paths_to_mutate as a list (!82-equivalent) - chore(ci): document remaining allow_failure shields per ADR-0049 (phase 2) CI : - ✅ Main pipeline #348 green — https://gitlab.com/iris-7/iris-service-python/-/pipelines/2525683470 (post-merge on main 4540308) - ✅ All 10 CI jobs green : conv-commits, shellcheck, adr-drift, pip-audit, ruff:lint, mypy, import-linter, unit-tests, integration-tests, benchmarks - ✅ Job pip-audit : 0 HIGH / 0 CRITICAL / 0 MEDIUM (urllib3 2.7.0 from stable-py-v0.7.7 still clean) Local test pass : - ⏭ uv run pytest — N/A : full pytest suite validated by CI pipeline #348 unit-tests (252s) + integration-tests (339s) stages, 3 days ago on this same main SHA - ⏭ uv run ruff check + format — N/A : already validated by CI validate stage (ruff:lint green) - ⏭ uv run mypy src — N/A : CI mypy job green on this SHA - ⏭ uv run pip-audit — N/A : CI pip-audit job clean on this SHA - ⏭ bin/dev/api-smoke.sh — N/A : no local service running ; CI integration-tests stage covers the REST surface Regression check vs previous tag : - ✅ stable-py-v0.7.7 known limitations carried forward : - alpine 412 → 280 MB image blocked by musl wheels (pydantic_core / cryptography / bcrypt) — still bounded, blocked upstream on astral-sh/uv musl wheels - mutmut 3.x sysfs walking FileNotFoundError on /sys/devices/platform/psci/of_node — still bounded, absorbed by job-level allow_failure: true - mutmut 3.x removed --no-progress flag — fix shipped previously, no regression - 🆕 mutmut 3.x paths_to_mutate config now correctly parsed as list — was silently mis-parsed in stable-py-v0.7.7 ; fix enables scheduled mutation tests to actually run on the right paths - ⏭ N/A — no LLM / MCP / Spring AI equivalent code changes this rev. FastAPI + agentic stub unchanged. - AuthN/AuthZ surfaces unchanged : JWT 15min + X-API-Key + RBAC + DNS-rebinding guard + env-var redaction - pip-audit hard gate (no allow_failure) — per ADR-0007 paragraph 9. Currently 0 HIGH / 0 CRITICAL / 0 MEDIUM after this rev. - CVE posture : urllib3 2.7.0 from stable-py-v0.7.7 (CVE-2026-44431 + 44432 patched) still clean - ⏭ N/A — no domain code changes. Customer + Order/Product/OrderLine API surface unchanged. - ⏭ N/A — no infra changes (Docker image, K8s manifests, terraform, asyncpg/aiokafka/redis adapters all unchanged). Submodules infra/common (ecb8e29) + infra/shared (401621c) unchanged from stable-py-v0.7.7. - ⏭ N/A — no observability code changes - Mutation testing reliability hardened : paths_to_mutate now correctly parsed as list (fix means the monthly schedule actually exercises the intended slices instead of silently skipping) - Coverage gate cov-fail-under=90 still met (CI #348 green) - mutmut-auth-monthly schedule (cron 0 5 1 * *) still active - allow_failure shields documented per ADR-0049 (phase 2) — completes the audit started in earlier session - Conventional Commits + auto-merge dev to main intact - All 10 CI jobs green : conv-commits, shellcheck, adr-drift, pip-audit, ruff:lint, mypy, import-linter, unit-tests, integration-tests, benchmarks - No new ADRs accepted this rev - Feature-slicing (ADR-0008) + Hexagonal Lite (ADR-0044) + polyrepo flat α (ADR-0060) unchanged - ⏭ N/A — backend repo - uv + ruff + mypy + pytest + pip-audit toolchain unchanged - pyproject.toml mutmut.paths_to_mutate now follows mutmut 3.x list format — IDE autocompletion + monthly schedule both produce expected behavior - Alpine docker image 412 → 280 MB blocked by musl wheels (pydantic_core / cryptography / bcrypt) — revisit when astral-sh/uv ships musl wheels for these - mutmut 3.x sysfs FileNotFoundError on x86 Linux containers — absorbed by job-level allow_failure: true ; track upstream for fix or pin to mutmut 2.x - stable-py-v0.7.9 candidate after mutmut sysfs upstream fix lands OR a feature/fix ships - Mutation testing first natural firing on 1st of next month (cron 0 5 1 * *) — observe whether paths_to_mutate fix produces actual mutants on the corrected paths