fix(docker): install slowapi in Dockerfile.production so the image starts

[groupthinking]

Summary

main's production image crashes at startup with ModuleNotFoundError: No module named 'slowapi'. This is a one-line fix: add slowapi>=0.1.8 to the Dockerfile.production install list.

Why it's broken on main

• src/youtube_extension/main.py:14-17 imports slowapi unconditionally at module top level (Limiter, SlowAPIMiddleware, _rate_limit_exceeded_handler, get_remote_address) and binds it at import time (limiter = Limiter(...), app.add_middleware(SlowAPIMiddleware)).
• Dockerfile.production's CMD is youtube_extension.main:app, so uvicorn imports that module at startup → slowapi must be importable in the image.
• The RUN pip install list shipped 8 packages and omitted slowapi; requirements.txt is copied but deliberately not -r-installed. So the container exits immediately on boot.
• slowapi>=0.1.8 is a canonical dependency in both requirements.txt:8 and pyproject.toml:36; the added floor matches.

This is the same "the production image was never actually verified to start" defect class the earlier server:app → youtube_extension.main:app CMD fix addressed — one import deeper. It was flagged by Vercel VADE review on #1122 and #1128, independently verified, and shipped to main when #1128 merged (that branch carried the Dockerfile.production change).

Why the existing guard missed it

test_dockerfile_production_pins_dependency_floors only validates packages already present in the install list — it never asserts that every canonical runtime import resolves to an installed pin. So a missing required package is invisible to it. Worth hardening separately (e.g. a build-stage python -c "import youtube_extension.main" smoke check, or extending the entrypoint test to assert the CMD module's third-party imports are all installed) so this class can't recur; not done here to keep the fix minimal.

Verification

tests/unit/test_security_fixes.py -k dockerfile  →  5 passed

Risk

Minimal. Adds one required runtime dependency to the image; touches no application code and no other package floor.

Note for maintainers (separate issue, not in this PR)

CI gitleaks (working tree) is red on main due to a false positive: uv.lock:5129 is the parso-0.8.7.tar.gz sha256: package hash, matched by the square-access-token rule. Not a credential. Recommend an allowlist in .gitleaks.toml (path rule for uv.lock package hashes, or the fingerprint uv.lock:square-access-token:5129). Left out of this PR since editing the secret-scanner config is better done deliberately.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 2, 2026 12:05am

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3c435654-5445-4d17-a16f-f9f56f71957f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[groupthinking]

CI triage for this one-line fix — functional checks pass; the reds are all pre-existing/governance, none caused by this change:

Passing: lint-python, lint-frontend, bandit, python-safety, npm-audit, guards, Vercel. test / build / security scans / coverage were still running at time of writing and can't be affected by adding one runtime dependency to the image. Locally, tests/unit/test_security_fixes.py -k dockerfile → 5 passed with this change.

Red — not fixable in this PR:

• agent-completion/truth-gate, Agent completion enforcement, Canonical issue and evidence, validate — the repo's agent-completion governance gate. Blocks because this is an automated PR with no linked canonical issue / trusted-publication provenance. Human-only gate, exactly as documented for the rest of the agent-PR backlog; no code change clears it.
• gitleaks (working tree) — false positive inherited from main: uv.lock:5129 is the parso-0.8.7.tar.gz sha256: package hash matched by the square-access-token rule. Not a secret. Fix is a .gitleaks.toml allowlist (deliberately not bundled here — see PR body).
• dependency-review — repo-config failure: the job log says "Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled." Fails on any PR regardless of contents.

Fixed this round: added the bug/python labels to clear the label gate.

Net: the code change is minimal, correct, and verified. Terminal state is HALTED(awaiting human — governance gate + merge approval), same human gate as the rest of the backlog. Not pushing further commits, since none would clear the remaining reds.

---

Generated by Claude Code

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: invalid_payload

Machine-readable verdict

{
  "details": {
    "invalid_fields": [
      "issue.number",
      "policy.agent_login",
      "policy.run_id"
    ]
  },
  "reasons": [
    "invalid_payload"
  ],
  "verdict": "blocked"
}

Workflow evidence

[groupthinking]

Closing as a duplicate of canonical focused repair #1121 / PR #1122. The verified slowapi>=0.1.8 Docker dependency and its non-vacuous regression assertion already exist on #1122; that canonical branch has now been refreshed onto current main at exact head 1ce8db37d0e1292f9251edada74a7e53222e4aa0. This PR has no focused issue or valid execution receipt. Its branch and commit 762048d71f18ffb1b64cd55197c75bc0b0e9c4c0 are preserved.

[groupthinking]

Agreed — closing as a duplicate is the right call, and #1122 is the better home: it pairs the slowapi>=0.1.8 install with a non-vacuous regression assertion, which this minimal PR deliberately left out. Thanks for folding it in and refreshing onto current main.

One factual note tied to why this was escalated: the crash is live on main today — #1128 shipped the Dockerfile.production change (with slowapi missing) to d1d66c4, so any image built from main still exits at startup with ModuleNotFoundError: No module named 'slowapi' until #1122 actually merges. Since #1122 sits behind the same agent-completion/truth-gate governance gate as the rest of the backlog, that merge is the remaining human step. No action needed from me — flagging only so the merge of #1122 is treated as the fix landing, not the refresh.

---

Generated by Claude Code