Merge pull request #422 from berntpopp/fix/ontology-defects-and-curation-specs

fix(ontology,curation): stop the importer rewriting curator labels, correct 14 wrong ontology identifiers, restore 408 dropped annotations

Author: berntpopp

.github/actions/setup-uv-python/action.yml

@@ -40,4 +40,4 @@ runs:
         for g in ${{ inputs.groups }}; do
           groups="$groups --group $g"
         done
-        uv sync $groups
+        uv sync --locked $groups

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
       docker_config: ${{ steps.filter.outputs.docker_config }}
       ci: ${{ steps.filter.outputs.ci }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706  # v4
         id: filter
         with:
@@ -90,14 +90,18 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Setup uv + Python
         uses: ./.github/actions/setup-uv-python
         with:
           working-directory: backend
           groups: dev test
 
+      - name: Verify requirements exports match uv.lock
+        working-directory: backend
+        run: make check-requirements-drift
+
       - name: Run database migrations
         env:
           # ENVIRONMENT=development lets the backend job bypass the Wave 5c
@@ -161,10 +165,10 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '22'
           cache: 'npm'
@@ -174,6 +178,10 @@ jobs:
         working-directory: frontend
         run: npm ci
 
+      - name: Verify dependency consistency
+        working-directory: frontend
+        run: npm run check:dependencies
+
       - name: Run tests (vitest)
         working-directory: frontend
         run: npm test
@@ -213,7 +221,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Setup uv + Python
         uses: ./.github/actions/setup-uv-python
@@ -280,10 +288,10 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '22'
           cache: 'npm'
@@ -374,7 +382,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Verify ENABLE_DEV_AUTH not truthy in prod compose
         # Catch every YAML-truthy spelling (mapping or list form, bare or
@@ -401,7 +409,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0

.github/workflows/docker.yml

@@ -25,7 +25,7 @@ jobs:
       docker_mcp: ${{ steps.filter.outputs.docker_mcp }}
       docker_config: ${{ steps.filter.outputs.docker_config }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706  # v4
         id: filter
         with:
@@ -64,7 +64,7 @@ jobs:
             context: mcp
             dockerfile: mcp/Dockerfile.prod
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Decide whether to build this image
         id: gate
@@ -127,7 +127,7 @@ jobs:
             context: mcp
             dockerfile: mcp/Dockerfile.prod
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Decide whether to publish this image
         id: gate
@@ -136,7 +136,7 @@ jobs:
 
       - name: Log in to GHCR
         if: ${{ steps.gate.outputs.build == 'true' }}
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.gitignore

@@ -237,3 +237,6 @@ test-results/
 
 # Codex CLI tool state (regenerates per-session)
 .codex
+
+# Claude Code local hook config (per-machine tool state, not project code)
+.github/hooks/

.planning/README.md

@@ -31,6 +31,11 @@ durable reference documentation only.
 
 ## Current Active Set
 
+- `reviews/2026-08-09-pr-422-cross-layer-review.md` — merge-blocking clinical data, backend, frontend, privacy, and dependency review
+- `specs/2026-08-09-source-faithful-individual-curation-design.md` — one-individual/one-Phenopacket, multiple-report-observation target contract
+- `roadmaps/2026-08-09-pr-422-remediation-roadmap.md` — parallel remediation sequencing and gates
+- `plans/2026-08-09-source-observation-implementation-plan.md` — detailed TDD plan across importer, database, API, MCP, and frontend
+- `plans/2026-08-09-dependency-security-consolidation-plan.md` — coherent Dependabot/action/alert integration plan
 - `plans/2026-04-15-release-hardening-and-8plus-plan.md` — current source of truth for release-readiness sequencing and go/no-go criteria
 - `reviews/2026-04-17-ui-ux-design-review.md` — current UI/UX assessment after PR #263; still contains actionable medium/low follow-ups