Repository navigation
SDK Synthetic red 60/60 consecutive runs - demo contract test pins free_commodities == 9, live API serves 37 #80
Description
Confirmed-live, verified 2026-08-10 15:37 UTC against run 31404558326.
tests/integration/test_demo_contract.py:107 (and 2 sibling assertions) pin len(meta["free_commodities"]) == 9. The demo API has intentionally served 37 free codes since api#5207 merged 2026-07-28 (app/controllers/v1/demo_controller.rb:39 FREE_COMMODITIES expansion - gas hubs/JKM/futures/DI still gated, so this is a stale pin, not a paywall leak).
Every Scheduled SDK Synthetic run since has failed: 60 of the last 60 hourly runs red, nobody acting - the monitor now cries wolf hourly and would mask a real SDK regression.
Fix (3 lines): assert the free list is a superset of the original 9 core codes and >= 9, mirroring the un-pinned catalog-count pattern already in the same file.
Same bug class the file itself warns about two lines above the pin. Labeled from measured impact: the synthetic is our only continuous SDK-against-production check and it has been dark 2.5+ days.
🤖 Generated with Claude Code
Activity
karlwaldman commentedon Aug 11, 2026
Fix prepared — exact red/green receipt
Draft PR #81 fixes this at
4d191da: #81The live red phase reproduced 3 failures / 4 tests: 34 current rows and 37 configured demo codes were compared with stale exact-nine assertions. The corrected contract preserves the original nine-code compatibility floor, requires usable current rows for that core, permits deliberate catalogue growth, and checks the advertised free list for core coverage and duplicates.
Green proof: live production synthetic 4/4, mocked DemoResource 5/5, Ruff clean, Black clean, diff check clean. No package release, deploy, API mutation, or customer action occurred; keep this issue open until the PR merges and the scheduled synthetic is observed green.
karlwaldman commentedon Aug 11, 2026
Final exact-head receipt
Exact head:
4d191da09c6dcd4e2e2074f5be28bafdfb6104c5.MERGEABLE/CLEANmainNo release or deploy occurred. Observe at least one scheduled synthetic run after merge before closing #79/#80 or treating SDK health as promotable.
karlwaldman commentedon Aug 11, 2026
Resolved and production-verified.
fdcd39e6ac0711e0aa1f874a7e127c9dc791acc0. The contract now preserves the original core-code compatibility floor, accepts deliberate catalogue growth, validates every returned core row, and propagates request/transport/OS failures instead of skipping.7f2338c9ba3e73810d868b898da283f983f06f60is green. Its always-on keyless demo smoke, required monitor credential, bounded authenticated customer path, and 30-day receipt upload all passed: https://github.com/OilpriceAPI/python-sdk/actions/runs/31487552692oilpriceapi==1.12.1, tag/release at the same exact head. Trusted publisher run 31487832170 passed tests, Ruff, dependency audit, exact-wheel install/import, manifest attachment, and PyPI upload: https://github.com/OilpriceAPI/python-sdk/actions/runs/31487832170oilpriceapi==1.12.1,pip checkpassed, and live keyless plus authenticated Brent/WTI checks returned finite values with source timestamps. Wheel SHA-256:159308247cc36b8a1233c6b190b736bf2b8336ac180759913c5fdd2c70e60afa.This and #79 describe the same stale exact-count incident; no separate work remains.
fix(security): reject raw paths that change the authenticated API ori…