Codex/dependency gate break test

[warheart1984-ctrl]

Summary

Claim posture

• Significant claims labeled: asserted / proven / rejected
• Proof artifact linked (trust bundle, gate output, or proof doc path)
• No unproven release-readiness claims

Change-of-reality (when behavior changes)

• Contract / blueprint docs updated
• Tests or gate command updated
• Fail-safe or operational docs updated if operator-facing

Verification

# List commands run locally:

Debt

Greptile Summary

The PR introduces a GitHub Actions dependency gate, adds a root Python lockfile, reduces npm overrides, and documents the resulting dependency policy. The frontend manifest change was not propagated to its lockfile, so the gate cannot currently complete.

• Runs clean npm installs, audits, frontend tests/build, mobile typechecking, frozen Python synchronization, and backend tests.
• Adds the root uv.lock and documents governed lock and override surfaces.
• Removes frontend overrides and the mobile follow-redirects override.
• Leaves frontend axios metadata inconsistent between package.json and package-lock.json.

Confidence Score: 4/5

The pull request should not merge until the frontend lockfile is synchronized, because the new dependency gate currently fails at its first clean-install step.

The workflow invokes npm ci against a frontend manifest pinned to axios 1.14.0 while the committed lock still records 1.15.2; mutable GitHub Action tags are an additional non-blocking integrity concern.

Files Needing Attention: frontend/package.json, frontend/package-lock.json, .github/workflows/dependency-gate.yml

Security Review

The new workflow uses mutable major-version tags for its three GitHub Actions dependencies. Pinning each action to a reviewed full commit SHA would prevent upstream tag movement from silently changing executed CI code.

Important Files Changed

Filename	Overview
.github/workflows/dependency-gate.yml	Adds comprehensive dependency verification, but uses mutable action references and currently reaches a guaranteed frontend clean-install failure.
frontend/package.json	Downgrades axios to 1.14.0 and removes overrides without synchronizing the committed package lock.
mobile/package.json	Removes the follow-redirects override while retaining the three documented overrides; the committed lock remains compatible.
uv.lock	Adds deterministic root Python resolution for the AAIS project and its development test dependency.
docs/contracts/DEPENDENCY_OVERRIDES.md	Documents the rationale and removal conditions for remaining npm overrides.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Pull request or push] --> B[Checkout]
  B --> C[Setup Node 20]
  C --> D[Frontend npm ci]
  D -->|Manifest and lock disagree| X[Gate fails]
  D -->|After lock repair| E[Frontend audit, tests, build]
  E --> F[Mobile npm ci, audit, typecheck]
  F --> G[Root and API frozen uv sync]
  G --> H[Backend pytest]

Loading

Prompt To Fix All With AI

### Issue 1
frontend/package.json:9
**Frontend lockfile is out of sync**

When the new dependency gate runs, `package.json` requests axios 1.14.0 while `package-lock.json` still records 1.15.2, so `npm ci` rejects the inconsistent files before the frontend audit, tests, and build can run.

### Issue 2
.github/workflows/dependency-gate.yml:13-16
**Action versions use mutable tags**

The workflow resolves checkout, setup-node, and setup-python through mutable major-version tags, allowing upstream tag movement to change the CI code executed without a reviewed repository change; pinning full commit SHAs would make the dependency gate reproducible.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "test: break dependency gate with lock mi..." | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

[greptile-apps]

Frontend lockfile is out of sync

When the new dependency gate runs, package.json requests axios 1.14.0 while package-lock.json still records 1.15.2, so npm ci rejects the inconsistent files before the frontend audit, tests, and build can run.

Prompt To Fix With AI

This is a comment left during a code review.
Path: frontend/package.json
Line: 9

Comment:
**Frontend lockfile is out of sync**

When the new dependency gate runs, `package.json` requests axios 1.14.0 while `package-lock.json` still records 1.15.2, so `npm ci` rejects the inconsistent files before the frontend audit, tests, and build can run.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Action versions use mutable tags

The workflow resolves checkout, setup-node, and setup-python through mutable major-version tags, allowing upstream tag movement to change the CI code executed without a reviewed repository change; pinning full commit SHAs would make the dependency gate reproducible.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/dependency-gate.yml
Line: 13-16

Comment:
**Action versions use mutable tags**

The workflow resolves checkout, setup-node, and setup-python through mutable major-version tags, allowing upstream tag movement to change the CI code executed without a reviewed repository change; pinning full commit SHAs would make the dependency gate reproducible.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!