chore(deps): 2/3 stack — observability group

[cryptoxdog]

Summary

Middle of the stack. structlog 26.1.0 and prometheus-client 0.26.0 from #211, based on the pin-refresh branch so the SPDX AND allow-list is already present.

Merge after 1/3 (#217). File-disjoint from the parent (pyproject.toml + poetry.lock only).

Stack

1. chore(ci): 1/3 stack — pin refresh + license allow-list #217 pin refresh + license allow-list
2. This PR
3. attest-build-provenance v4.2.2

Test plan

• Dependency Review passes (allow-list is on the parent)
• Unit / lint jobs green

Made with Cursor

[github-actions]

✅ PR reviewable size is within recommended limits

[github-actions]

L9 Audit Harness Report

• Generated: 2026-08-21T13:27:28.489958+00:00
• Repo root: /home/runner/work/Cognitive.Engine.Graphs/Cognitive.Engine.Graphs
• Overall result: ✅ PASSED
• Exit code: 0

Step Results

Step	Status	Exit Code	Notes
Architecture Audit	✅ Passed	0
Spec Coverage	✅ Passed	0
Contract Wiring	✅ Passed	0

Architecture Audit Findings

Severity	Count
🔴 CRITICAL	0
🟠 HIGH	0
🟡 MEDIUM	25
🔵 LOW	0

See artifacts/audit_report.md for full details.

Spec Coverage

• ✅ Implemented: 37
• ⚠️ Partial: 9
• ❌ Missing: 0
• Total features: 46

Category	Implemented	Partial	Missing	Total
gates	10	0	0	10
scoring	7	0	0	7
v1.1_node	2	0	0	2
v1.1_edge	2	0	0	2
v1.1_action	0	2	0	2
v1.1_scoring	1	1	0	2
action_handler	0	6	0	6
gds_algorithm	5	0	0	5
research_pattern	10	0	0	10

See artifacts/coverage_report.md for full details.

Next Steps

All checks passed. Safe to merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 978facdb45

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the pip dependency source alongside Poetry

When the application is built through the default Docker path, this upgrade is ignored: Dockerfile:24-25 installs requirements.txt, which still constrains structlog to >=25.5.0,<26.0.0 at requirements.txt:16. The pip-based CI jobs use that file as well, so they continue testing 25.x while Poetry locks 26.1.0, leaving the production image on the old version and potentially hiding 26.x compatibility regressions. Keep requirements.txt synchronized with this constraint change.

Useful? React with 👍 / 👎.

[cryptoxdog]

Superseded by #220 — compatible sdk-revision (b1a49141), SPDX AND licenses appended despite repo ALLOWED_LICENSES, Poetry+requirements.txt observability, attest v4.2.2. Closing this stack PR.

[cryptoxdog]

Closed in favor of #220.