fix: complete graph isolation and resolution contracts

[n24q02m]

Scope\n- preserve the new .better-code-review-graph state path without adopting legacy state\n- resolve PHP CALLS targets and protect impact traversal\n- enforce per-sub setup status and HTTP subject isolation\n- validate Cohere dimensions/input types and cursor-based exports\n- update dependency floors/lock and product handover\n\n## Verification\n- focused dimension, PHP, export, setup, and isolation scenarios pass\n- ruff, format check, ty, package build, and full pytest pass\n- full pytest: 1507 passed, 1 skipped, 48 deselected\n\nPaid Cohere live proof remains explicitly pending capped spend authorization; no STABLE promotion included.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/alembic	1.19.2	Unknown	Unknown
pip/fastretrieval	1.2.0	Unknown	Unknown
pip/litellm	1.100.0	Unknown	Unknown
pip/mcp	1.30.0	Unknown	Unknown
pip/tree-sitter-language-pack	1.16.2	Unknown	Unknown

Scanned Files

• uv.lock

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	litellm@​1.98.0 ⏵ 1.100.0	+1
	alembic@​1.19.1 ⏵ 1.19.2
	fastretrieval@​1.1.0 ⏵ 1.2.0
	mcp@​1.29.1 ⏵ 1.30.0	+1
	tree-sitter-language-pack@​1.15.8 ⏵ 1.16.2	+1

View full report