chore(toolchain): refresh lockfile, declare db deps, and align hooks with uv.lock

The lockfile had not moved since March: google-adk sat at 1.26.0 while PyPI shipped 2.8.0, and `uv-secure` was failing the CI lint job on stale starlette, urllib3, and sqlparse advisories (this was the red `lint` check on #156). Upgrading surfaced a packaging defect: google-adk 2.x moved SQLAlchemy and aiosqlite behind its optional `db` extra, so this package imported `sqlalchemy` without declaring it and would fail at import for anyone installing against ADK 2.x. `aiosqlite` stayed a core ADK dependency but is declared too, since it is the driver behind our default URL. The pre-commit line also pinned ruff, uv, and uv-secure through mirrors whose versions drifted from the lockfile CI installs, the same pattern quantfit and saucier already moved away from.

- Declare `sqlalchemy[asyncio]>=2.0` and `aiosqlite>=0.21` as direct dependencies; `uv lock --upgrade` to google-adk 2.8.0, cryptography 50.0.1, ruff 0.16.5, ty 0.0.78, pytest 9.1.1, docvet 1.15.1
- Run every Python hook through `uv run` so pre-commit and CI share one pinned version; add `pre-commit-hooks` whitespace/EOF/merge-marker/large-file checks; pin the docvet and actionlint actions by SHA in CI and add yamllint + actionlint steps to the lint job
- Adopt ruff 0.16 defaults: keep `E402` on, ignore `RUF022` (our `__all__` ordering is plain-alphabetical, enforced by `test_public_api.py`), allow `DTZ` in tests and spike scripts, let ruff format Markdown code fences; exclude the framework-generated `_bmad`, `_bmad-output`, `.specify`, and `.claude/commands` trees from ruff and from the whitespace hooks
- Move to PEP 639 license metadata (silences the uv_build classifier warning), widen `uv_build` to `<0.13`, drop the now-unused pygments `uv-secure` ignore, refresh the hook tables in CONTRIBUTING and the development guide

Author: Alberto-Codes

.claude/rules/pytest.md

@@ -67,10 +67,12 @@ tests/
 ```python
 import pytest
 
+
 @pytest.fixture
 def fernet_backend():
     return FernetBackend(key=Fernet.generate_key())
 
+
 @pytest.fixture
 def database_session():
     conn = create_connection()
@@ -97,6 +99,7 @@ def make_backend():
         if key is None:
             key = Fernet.generate_key()
         return FernetBackend(key=key)
+
     return _make_backend
 ```
 
@@ -109,11 +112,15 @@ def make_backend():
 ## Parametrization
 
 ```python
-@pytest.mark.parametrize("input_data, expected", [
-    (b"hello", b"hello"),
-    (b"", b""),
-    (b"\x00\xff", b"\x00\xff"),
-], ids=["ascii", "empty", "binary"])
+@pytest.mark.parametrize(
+    "input_data, expected",
+    [
+        (b"hello", b"hello"),
+        (b"", b""),
+        (b"\x00\xff", b"\x00\xff"),
+    ],
+    ids=["ascii", "empty", "binary"],
+)
 async def test_encrypt_decrypt_roundtrip(backend, input_data, expected):
     encrypted = await backend.encrypt(input_data)
     decrypted = await backend.decrypt(encrypted)
@@ -148,6 +155,7 @@ Use `pytest-asyncio` for async test functions:
 ```python
 import pytest
 
+
 @pytest.mark.asyncio
 async def test_encrypt_returns_bytes(backend):
     result = await backend.encrypt(b"plaintext")

.claude/rules/python.md

@@ -129,7 +129,7 @@ Do not annotate `self` or `cls` parameters.
 
 Use f-strings for string interpolation. For logging, use %-formatting with lazy evaluation:
 ```python
-logger.info('Processing session: %s', session_id)
+logger.info("Processing session: %s", session_id)
 ```
 
 ## Boolean and None Checks

.github/workflows/ci.yml

@@ -27,8 +27,26 @@ jobs:
       - run: uv sync --locked --dev
       - run: uv run ruff check .
       - run: uv run ruff format --check .
-      - run: uv run uv-secure
+      # Retry once on exit 3 only — uv-secure's advisory-fetch crash class
+      # ("<package> raised exception"), which quantfit also hits. Real
+      # findings exit 1 and still fail immediately.
+      - name: uv-secure
+        run: |
+          code=0
+          uv run uv-secure || code=$?
+          if [ "$code" -eq 3 ]; then
+            echo "uv-secure crashed (exit 3) — one retry"
+            uv run uv-secure
+          else
+            exit "$code"
+          fi
       - run: uv run lint-imports
+      - run: uv run yamllint -c .yamllint.yaml .
+      # Pin the same version .pre-commit-config.yaml names. The action
+      # defaults to `latest`, which drifts from the hook line.
+      - uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7  # v2
+        with:
+          version: 1.7.11
       - run: uv cache prune --ci
         if: always()
         continue-on-error: true
@@ -90,4 +108,4 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: Alberto-Codes/docvet@v1
+      - uses: Alberto-Codes/docvet@257310e5edc8249629d388d879a5afde602f02ca  # v1

.gitignore

@@ -211,9 +211,9 @@ cython_debug/
 .abstra/
 
 # Visual Studio Code
-#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
 #  that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
-#  and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#  and can be added to the global gitignore or merged into this file. However, if you prefer,
 #  you could uncomment the following to ignore the entire vscode folder
 # .vscode/
 

.pre-commit-config.yaml

@@ -1,57 +1,92 @@
+# Every Python tool here runs from the project environment through
+# `uv run`, so the lockfile pins one version for both this hook line and
+# CI. A pre-commit mirror carries its own pin that drifts from the
+# lockfile CI installs, and the two gates then disagree.
+#
+# actionlint is a Go binary with no lockfile entry; the CI step pins the
+# same 1.7.11 this mirror does.
+default_stages: [pre-commit]
+
 repos:
-  - repo: https://github.com/adrienverge/yamllint
-    rev: v1.38.0
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
     hooks:
-      - id: yamllint
-        args: [-c, .yamllint.yaml]
+      - id: end-of-file-fixer
+        exclude: ^(_bmad|_bmad-output|\.specify|\.claude/commands)/
+      - id: trailing-whitespace
+        exclude: ^(_bmad|_bmad-output|\.specify|\.claude/commands)/
+      - id: check-merge-conflict
+      - id: check-added-large-files
+        args: [--maxkb=1024]
 
   - repo: https://github.com/rhysd/actionlint
     rev: v1.7.11
     hooks:
       - id: actionlint
 
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.4
+  - repo: local
     hooks:
+      - id: yamllint
+        name: yamllint
+        entry: uv run yamllint -c .yamllint.yaml .
+        language: system
+        pass_filenames: false
+        always_run: true
+
       - id: ruff-check
+        name: ruff check
+        entry: uv run ruff check .
+        language: system
+        pass_filenames: false
+        always_run: true
+
       - id: ruff-format
+        name: ruff format
+        entry: uv run ruff format --check .
+        language: system
+        pass_filenames: false
+        always_run: true
 
-  - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.10.7
-    hooks:
+      # `uv lock --check` reports a stale lockfile where the mirror's bare
+      # `uv lock` rewrote it, matching CI.
       - id: uv-lock
+        name: uv lock is current
+        entry: uv lock --check
+        language: system
+        pass_filenames: false
+        files: ^(uv\.lock|pyproject\.toml|uv\.toml)$
 
-  - repo: https://github.com/owenlamont/uv-secure
-    rev: 0.17.0
-    hooks:
       - id: uv-secure
+        name: uv-secure
+        entry: uv run uv-secure
+        language: system
+        pass_filenames: false
+        files: ^uv\.lock$
 
-  - repo: local
-    hooks:
       - id: lint-imports
         name: import-linter
         entry: uv run lint-imports
         language: system
-        types: [python]
         pass_filenames: false
+        always_run: true
 
       - id: ty-check
         name: ty type check
         entry: uv run ty check src/
         language: system
-        types: [python]
         pass_filenames: false
+        always_run: true
 
       - id: pytest
         name: pytest
         entry: uv run pytest --tb=short -q
         language: system
-        types: [python]
         pass_filenames: false
+        always_run: true
 
       - id: docvet
         name: docvet check
         entry: uv run docvet check --staged
         language: system
-        types: [python]
         pass_filenames: false
+        always_run: true

CONTRIBUTING.md

@@ -81,14 +81,18 @@ This project uses pre-commit hooks to catch issues before they reach CI. Pre-com
 pre-commit install
 ```
 
-Seven hooks run automatically on each commit:
+Every Python tool runs through `uv run`, so the hook line and CI share the version pinned in `uv.lock`. These hooks run automatically on each commit (`uv-lock` and `uv-secure` only when `pyproject.toml` or `uv.lock` is staged):
 
 | Hook | What it checks |
 |------|---------------|
-| yamllint | YAML syntax and formatting |
+| pre-commit-hooks | Trailing whitespace, final newline, merge markers, files over 1 MB |
 | actionlint | GitHub Actions workflow validity |
+| yamllint | YAML syntax and formatting |
 | ruff-check | Python linting |
-| ruff-format | Python code formatting |
+| ruff-format | Python and Markdown code-fence formatting |
+| uv-lock | `uv.lock` is current with `pyproject.toml` |
+| uv-secure | Known vulnerabilities in locked dependencies |
+| import-linter | Layered-architecture contracts hold |
 | ty | Type checking (`src/` only) |
 | pytest | Full test suite |
 | docvet | Docstring quality on staged files |
@@ -233,11 +237,13 @@ Use appropriate markers for your tests:
 ```python
 import pytest
 
+
 @pytest.mark.unit
 async def test_fernet_encrypt_decrypt():
     """Unit test for Fernet round-trip encryption."""
     ...
 
+
 @pytest.mark.integration
 async def test_encrypted_session_persistence():
     """Integration test with real SQLite database."""

README.md

@@ -31,10 +31,12 @@ uv add adk-secure-sessions
 ```python
 # Before (ADK default — unencrypted):
 from google.adk.sessions import DatabaseSessionService
+
 session_service = DatabaseSessionService(db_url="sqlite+aiosqlite:///sessions.db")
 
 # After (encrypted — swap the import and constructor):
 from adk_secure_sessions import EncryptedSessionService, FernetBackend
+
 session_service = EncryptedSessionService(
     db_url="sqlite+aiosqlite:///sessions.db", backend=FernetBackend("your-secret-key")
 )

docs/adr/ADR-001-protocol-based-interfaces.md

@@ -27,6 +27,7 @@ Use **`typing.Protocol`** (PEP 544) for all public interfaces.
 ```python
 from typing import Protocol, runtime_checkable
 
+
 @runtime_checkable
 class EncryptionBackend(Protocol):
     """Contract for all encryption backends."""

docs/development-guide.md

@@ -49,14 +49,18 @@ uv run ruff check .     # Lint check
 
 ## Pre-Commit Hooks
 
-Seven hooks run on each commit:
+Every Python tool runs through `uv run`, so the hook line and CI share the version pinned in `uv.lock`. Only `actionlint` (a Go binary) and the generic `pre-commit-hooks` checks come from pre-commit mirrors.
 
 | Hook | What it checks |
 |------|---------------|
-| yamllint | YAML syntax and formatting |
+| pre-commit-hooks | Trailing whitespace, final newline, merge markers, files over 1 MB |
 | actionlint | GitHub Actions workflow validity |
+| yamllint | YAML syntax and formatting |
 | ruff-check | Python linting |
-| ruff-format | Python code formatting |
+| ruff-format | Python and Markdown code-fence formatting |
+| uv-lock | `uv.lock` is current with `pyproject.toml` |
+| uv-secure | Known vulnerabilities in locked dependencies |
+| import-linter | Layered-architecture contracts hold |
 | ty | Type checking (`src/` only) |
 | pytest | Full test suite |
 | docvet | Docstring quality on staged files |
@@ -113,4 +117,3 @@ Install with: `pre-commit install`
 - **Markers**: `@pytest.mark.unit`, `@pytest.mark.integration`
 - **Fixtures**: Async generators with proper teardown (`yield svc; await svc.close()`)
 - **Warnings**: Treated as errors; third-party warnings filtered in `pyproject.toml`
-

docs/getting-started.md

@@ -41,10 +41,12 @@ just two changes:
 ```python
 # Before (ADK default — unencrypted):
 from google.adk.sessions import DatabaseSessionService
+
 session_service = DatabaseSessionService(db_url="sqlite+aiosqlite:///sessions.db")
 
 # After (encrypted — swap the import and constructor):
 from adk_secure_sessions import EncryptedSessionService, FernetBackend
+
 session_service = EncryptedSessionService(
     db_url="sqlite+aiosqlite:///sessions.db",
     backend=FernetBackend("your-secret-passphrase"),
@@ -150,7 +152,7 @@ import sqlite3
 conn = sqlite3.connect("sessions.db")
 row = conn.execute("SELECT state FROM sessions LIMIT 1").fetchone()
 print(type(row[0]))  # <class 'str'>
-print(row[0][:40])   # First 40 chars of base64-encoded envelope
+print(row[0][:40])  # First 40 chars of base64-encoded envelope
 conn.close()
 ```