[swkeever]

Synchronize the vendored public OpenAPI bundle and generated internal client with Hosting #3213, preserve the existing OAuth provider facade, and update this repository's locked Rack dependency from 3.2.7 to 3.2.8. The whole-spec refresh includes accumulated Sandbox, Connector and LavaFlow changes since SDK base e3082ccaf707baa64a6db7c700123fe6a2129c86: 283 files (+76,695 / -15,460), including the original 275-file synchronization, lock update and native compatibility corrections.

The LavaFlow additions expose optional confirmed severity, a filtered recorded PR branch and the saved proposed patch title; they do not assert a verified or shipped fix. No public facade operation is added. The OAuth facade continues to return provider name and linkage timestamps for both older three-field and current five-field responses. A narrow existing raw-response pattern keeps the new generated ID requirement from changing that public contract; native provider/date validation remains in place. New regressions exercise the default public client through the real generated transport/API and intercept only the HTTP execution boundary. They cover legacy/current payloads, malformed or missing public fields, impossible dates/offsets, fractional timestamps and empty collections. Existing public assertions remain intact. The transport type target now loads the standard date signatures used by its timestamp parser, preserving strict diagnostics. README provenance now identifies this exact Hosting bundle.

Source: Hosting 134dfb1196d944b20d6fb9f0ddf4e9984af6287d (#3213), public bundled OpenAPI SHA-256 8bc109d5034348f37d1ab4d5a968db51b376c85ebf8e6386ea49c4ddcc6b0f23. The generated tree and bundle are unchanged by the native and lock repairs. The generation-test digest literal tracks this bundle; generator policy and the separate digest-mechanism PR #353 are unchanged. This supersedes the older snapshot proposed by the untouched bot sync #5; its CI does not validate this branch.

Rack 3.2.8 addresses the repository bundle's current audit findings (upstream release). The gemspec and dependency ranges are unchanged: this does not establish a downstream consumer minimum or claim downstream remediation. Only Rack's locked version changes.

The canonical generator completed before the native repair, and independent source/security review passed for this repaired head. Fresh native CI, AI review and security checks are pending; prior-head green checks do not validate this revision. Generation freshness, audit, lint, type, unit/coverage, defect checks, package validation and Quality Gate remain required. Public documentation and shared behavioral acceptance are coordinated in Hosting #3213. Land the required SDK updates before Hosting. No package publication is included.

[github-actions]

AI review: no P0-P2 findings

Reviewed 138019b. Run log

This PR syncs the vendored public OpenAPI bundle and the private generated client with Hosting #3213 (283 files, +76k/−15k). It also bumps the locked Rack to 3.2.8 and adds a shim in lib/volcano/generated_transport_oauth.rb that reads the linked-providers response as raw JSON. The previous P2, where older three-field responses failed on the newly required provider_user_id, is fixed and covered by tests that run through the real generated transport. The stale README provenance is also fixed. I found two minor P3 issues in the new shim. The generated API methods and models that native SDK code calls kept their parameters, return types and field requirements. The generated namespace is a private constant, so removing the Autofix classes doesn't change the public SDK surface. The regenerated tree is too large to read line by line.

⚪ P3

• lib/volcano/generated_transport_oauth.rb:110 UTC linked-provider timestamps now come back as +00:00 offset Times, not UTC Times
• lib/volcano/generated_transport_oauth.rb:41 Method-wide rescue relabels client-configuration errors as malformed provider responses

Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.

• Whether openapi/openapi.yaml is byte-identical to Hosting 134dfb1's public bundle (SHA-256 8bc109d5…), and whether the committed generated tree matches a fresh OpenAPI Generator 7.17.0 run.
• Whether the strict Steep transport target accepts DateTime.rfc3339(value, Date::GREGORIAN) with the newly added library 'date'.
• Whether Hosting #3213's deployed linked-provider responses emit RFC 3339 timestamps that the new strict regex accepts.
• Whether Rack 3.2.8 clears the bundle-audit findings that motivated the lock bump.
• Verify the pinned generator reproduces the committed generated tree.

Human review: needed

• Do openapi/openapi.yaml and the regenerated lib/volcano/generated tree (+76k/−15k) match Hosting 134dfb1? This review checked closely only the parts native SDK code calls.
• Should list_linked_oauth_providers now raise TypeError on server timestamps the old Time.parse path accepted, e.g. no offset or a space separator (generated_transport_oauth.rb)?
• Are removing Autofix operations and rejecting project access tokens for repository binding acceptable for existing consumers (openapi/openapi.yaml)?
• Can a maintainer complete close review of the remaining schemas and APIs in this 283-file refresh (openapi/openapi.yaml and lib/volcano/generated/)?

Decide the points above: approve to accept them, or request changes.

Suggested reviewer: subnetmarco (recently synced openapi/openapi.yaml, the generated client and the README generated-boundary section). Any collaborator with write access other than the author can approve.

[github-actions]

🟡 P2: Preserve linked-provider decoding for older responses

A linked-provider response containing only provider, linked_at, and updated_at—the previously supported shape still used in spec/support/generated_api/fake_o_auth_api.rb—now assigns nil to provider_user_id, whose writer raises ArgumentError. GeneratedTransport#auth_list_oauth_providersstill deserializes through this model, soAuth#list_linked_oauth_providers` fails against deployments returning that shape, although its public result does not use the new ID. Preserve compatibility at the transport boundary and cover deserialization of the older response.

_{Found by gpt-6.1-sol}

[github-actions]

⚪ P3: UTC linked-provider timestamps now come back as +00:00 offset Times, not UTC Times

The old path parsed linked_at/updated_at with the generated model's Time.parse. Every other native SDK timestamp uses Time.iso8601. Both return a UTC Time for a ...Z value. DateTime.rfc3339(value, Date::GREGORIAN).to_time instead returns Time.new(..., 0), which has a fixed +00:00 offset. Equality and ordering are unchanged, so the specs still pass. But LinkedOAuthProvider#linked_at.utc? changes from true to false, zone changes from "UTC" to nil, and iso8601 changes from ...Z to ...+00:00. to_s now prints +0000 where it used to print UTC, which is what the docs/authentication.md example ([provider.provider, provider.linked_at].join(' ')) shows. Fix: keep the regex and DateTime check as validation, then return Time.iso8601(value). It keeps explicit offsets and fractional seconds, and returns UTC for Z.

_{Found by claude-opus-5-5}

[github-actions]

⚪ P3: Method-wide rescue relabels client-configuration errors as malformed provider responses

The rescue JSON::ParserError, KeyError, ArgumentError, TypeError wraps the whole invoke block, not just linked_oauth_providers_body. It therefore also catches errors from @​api_factory.call(authorization). One example is the ArgumentError, 'API URL requires a host' that generated_configuration raises when the client is built with a scheme-less api_url such as 'api.volcano.dev' and session tokens passed directly. Every other operation reports that error as is. list_linked_oauth_providers instead raises TypeError: Expected complete linked OAuth providers, which points the user at the server response. Fix: move the rescue so it wraps only the body decoding, e.g. a begin/rescue around linked_oauth_providers_body(body).

_{Found by claude-opus-5-5}