[abruption]

Summary

Fresh integrated-main CI failed on newly published Better Auth dependency advisories and a macOS SIGINT fixture race. Restore both release gates with two separately reviewable commits; no audit exceptions, protection changes or product-signal changes are introduced.

Closes #343 and #344. These corrections must merge before the separately prepared v1.3.2 version/documentation PR.

Control dependency patch

Pin better-auth and @better-auth/core together at the minimal patched 1.7.7 and align their adapters/telemetry. The lockfile contains no old duplicate or unrelated dependency-version update. The existing session behavior test's explicit baseline pin is updated; all actual lifetime/refresh assertions remain.

This addresses the graph flagged by GHSA-965c-763c-88jm, GHSA-r4xp-prcw-77qf and GHSA-44jh-23m7-hpcf. The inspected app uses bearer/device-authorization plugins and SQLite, not the advisories' Magic Link/OAuth Proxy/PostgreSQL prerequisites. Deployed exploitability was not assessed. Node Control is outside Python archives; Python publication does not deploy this fix.

Operators updating Control should review verification-record namespace changes, coordinate servers sharing that storage and restart pending OAuth sign-ins if required. No user/account schema migration or blanket session revocation is asserted. Existing tests exercise the real GitHub/Google authorization-state and callback flow with mocked provider transport, including tampered state; no real provider account was used.

SIGINT fixture synchronization

The old child printed READY before entering the protected input reader. Parent SIGINT could therefore terminate the interpreter with -2 outside the intended assertion scope. Announce readiness from the real selector inside the protected read, with a separate bounded P/G control pipe for delayed entry. Keep stdin open until child exit so EOF cannot replace SIGINT as the cause.

The fixture retains a real OS signal, exact exit 130, empty stderr and exact metadata-only JSON with no fabricated context. It does not increase a fixed sleep, accept -2, suppress the test or alter product code. A deterministic old-marker control reproduces -2/no JSON on both tested Python versions, but is not a reconstruction of the historical CI schedule.

Validation

• Node 24.22.1/npm 11.19.1, macOS arm64: clean installation, typecheck/build, 18 files / 123 Control tests pass; runtime and full npm audits report zero vulnerabilities.
• Python 3.13.7 development mode with ResourceWarning as error: 11 Node/Python contract-integration tests pass. GitHub/Google OAuth state/callback fixtures remain covered by the Control tests.
• SIGINT file: 17 tests pass on Python 3.9.6 and 3.13.7. Correct signal cases pass 200 repetitions per version (400 total); the early-readiness mutation is rejected by the delayed-entry control.
• The combined tree is checked with the same targeted Node/Python and fixture suites before PR creation. Current PR CI must still validate supported Node 22/24 and Python/platform matrices; local results are not a whole-platform claim.
• No live OAuth, native session/model, operational state or running service was touched. Diff checks pass.

Independent review

Before PR creation, Claude Code 2.1.310 (requested and response-confirmed claude-opus-5-5) and Codex CLI 0.164.0 (isolated default; backend model identity unexposed) reviewed the same frozen self-contained A/B evidence independently in parallel, without tool/test/network/write authority. Both completed successfully and found no mandatory source correction. Input SHA-256 remained eab8d91b0b4e65c800692d32408aefcaa4c0abb1a8d6f862d5c26242222b85c9.

The coordinator checked the dependency graph, unchanged auth configuration, real OAuth-state fixture coverage, protected-read try boundary and process/FD cleanup against source. The OAuth operator-compatibility notes and current supported-platform CI requirement are retained. These reviews do not authorize operations or bypass normal merge/publication gates.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T01:07:23.928688Z	a9b4a2d	PR opened
🔒 Security Review	✅ Completed 2026-10-28T01:08:48.702602Z	a9b4a2d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Integrated verification

PR #345 merged normally as a68c6cf16c234cd3fe72926e519e4178c093081a after all 28 checks and automatic code/security reviews completed without findings. Fresh main CI 40613421898 and CodeQL 40613422124 succeeded on that exact commit, including the previously failing Node audit and macOS Python 3.13 fixture.

The fixture keeps real SIGINT, exact exit 130/metadata, empty stderr and an open stdin producer; only synchronization changed. Deterministic old-marker and mutation controls support the structural race correction, not a reconstruction of the original CI schedule. The Control dependency cohort is pinned at 1.7.7; no audit bypass was introduced. Source-config prerequisites and deployment limitations remain as documented.

This completes the scoped source/test gate corrections. v1.3.2 version preparation and publication are still separate steps; no running service was deployed, restarted, revoked or migrated.