fix: keep People API FastAPI dependencies server-owned

[cursor]

Repair the purpose-bound People API so protected routes stay server-owned and the quality gate can pass.

Why this exists

PR #6 (feat/people-api) currently fails People API Quality on Python 3.12 and 3.14. FastAPI 0.116 treats postponed annotations in app.py as query fields, so /v1/people/{id} returns 422 (query.context / query.request) and /openapi.json returns 500. Bearer parsing also hid C0 separators because str.split() treats \\x1f as whitespace.

What to review first

• services/people-api/src/orgmetra_people_api/app.py — runtime annotations, Depends defaults, module-level repository injection
• services/people-api/src/orgmetra_people_api/auth.py — first-space bearer split
• OpenAPI and source-contract tests that forbid context / request query parameters

Verification already run locally

• 90 passed in services/people-api/tests
• 100% statement and branch coverage on orgmetra_people_api
• public docstring gate passed

Customer next action

Review this exact-head repair, then retarget or replace PR #6 so People API Quality can run on a head that no longer exposes repository context as caller input.

Still pre-GA

Atomic idempotency-key ledger and governed high-impact confirmation/evidence remain persistence-stack work. This PR does not claim those are done.

Merge

Do not merge until required checks and independent review pass. This change does not bypass branch protection.

  

[seonghobae]

Closing as a technically superseded parallel repair in favor of PR #18. This is not ancestry-only reasoning: both lanes fork from People API head e5d464d57e769c34becb93faea8570bd10b2e8ba, and fresh file-level comparison shows #18 ships the same repaired auth.py byte-for-byte (Git blob SHA 6ee88ba3689f89c6d66f597127f3b6a73104b87a on both heads), including first-ASCII-space bearer parsing and C0 rejection. #18's current source contract explicitly asserts from __future__ import annotations is absent from app.py, PurposeContext/PeopleRepository are runtime Depends server-owned parameters, and Annotated[...] is absent; its endpoint regressions also assert attacker context/request/repository_port query names cannot become authority and Bearer bad\x1ftoken is rejected without echo. #18 then extends that repaired lane with candidate reads and employment create/read behavior. Keeping #15 would duplicate the same FastAPI root-cause repair on a divergent branch. Reviews/checks do not transfer; #18 still requires fresh reconciliation and exact-head gates.