- --cov pointed at libs/svcforge_core/domain, a path that does not exist (the
package nests one level deeper). Coverage measured 0.00% of the code. Use the
module form, which is layout-independent.
- pip-audit --strict cannot audit our own editable, not-on-PyPI packages. Audit
the locked dependency set instead and keep --strict.
- bandit re-reports B608/B104, which ruff's S ruleset already enforces with
justified per-line noqa it cannot see. Skipped in config, with reasons.
- registry host was git.oci-oci; it is gitea.oci-oci.
- integration job set SVCFORGE_PG_DSN; conftest reads SVCFORGE_TEST_DSN.
Nguyen Minh Phuc