Fix the CI gates: Python 3.13, concurrency groups, hook violations

The gates have never gone green on the new runners. Three separate reasons:

- backend/Dockerfile shipped Python 3.10 while the code imports typing.Self
  and datetime.UTC, so the container exited on import and the suite could not
  even load its conftest. The image moves to 3.13 and the packages declare
  >=3.12, which is the floor the tests actually pass on; ruff's target follows
  and rewrites timezone.utc and asyncio.TimeoutError accordingly. Relocking
  drops the 3.10 branch, which bumps FastAPI and so regenerates the SDK.
- frontend/README.md had no trailing newline and two dashboard widgets used
  arbitrary text-[…] sizes. Both are em-relative on purpose, so they move to
  the inline style the neighbouring ramp already uses.
- Every commit left its own run queued: without a concurrency group a runner
  that was offline for a while works through a backlog nobody reads. A stack
  that fails to come up now prints its logs before the teardown removes it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/fluksio/api/routes/oauth.py

@@ -27,7 +27,7 @@ import secrets
 import time
 import uuid
 from collections import defaultdict, deque
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any
 from urllib.parse import urlencode, urlparse
 
@@ -125,12 +125,12 @@ def _valid_redirect_uri(value: str) -> bool:
 
 
 def _now() -> datetime:
-    return datetime.now(timezone.utc)
+    return datetime.now(UTC)
 
 
 def _aware(value: datetime) -> datetime:
     """Postgres hands back naive datetimes; compare them in UTC."""
-    return value if value.tzinfo else value.replace(tzinfo=timezone.utc)
+    return value if value.tzinfo else value.replace(tzinfo=UTC)
 
 
 def _prune(session: SessionDep) -> None:

backend/fluksio/api/routes/observability.py

@@ -7,7 +7,7 @@ which the generated SDK turns into a thrown error — and a health page that
 cannot render while the engine is degraded is the wrong way round.
 """
 
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any, Literal
 
 from fastapi import APIRouter, Depends, Request
@@ -110,7 +110,7 @@ class DeadLetter(BaseModel):
 
 
 def _since(hours: int) -> datetime:
-    return datetime.now(timezone.utc) - timedelta(hours=hours)
+    return datetime.now(UTC) - timedelta(hours=hours)
 
 
 def _window_hours(hours: int) -> int:
@@ -124,7 +124,7 @@ def _window_hours(hours: int) -> int:
 
 def _aware(when: datetime) -> datetime:
     """A bound as the columns store it. A naive one is read as UTC."""
-    return when if when.tzinfo else when.replace(tzinfo=timezone.utc)
+    return when if when.tzinfo else when.replace(tzinfo=UTC)
 
 
 @router.get("/summary", response_model=HealthSummary)

backend/fluksio/api/routes/workers.py

@@ -124,7 +124,7 @@ async def attach(websocket: WebSocket, token: str = "") -> None:
     await websocket.accept()
     try:
         hello = await asyncio.wait_for(websocket.receive_json(), timeout=30)
-    except (TimeoutError, asyncio.TimeoutError, ValueError):
+    except (TimeoutError, ValueError):
         await websocket.close(code=1002)
         return
 

backend/fluksio/cloud/enroll.py

@@ -9,7 +9,7 @@ before the engine has started, holding nothing but the database.
 
 from __future__ import annotations
 
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from typing import Any
 
 import httpx
@@ -83,7 +83,7 @@ def enroll(
         # talking to. Nothing refreshes this.
         jwks=data["jwks"],
         local_user_id=str(user.id),
-        enrolled_at=datetime.now(timezone.utc).isoformat(),
+        enrolled_at=datetime.now(UTC).isoformat(),
         portal_account=user.email,
     )
     cloud_config.save(config)

backend/fluksio/core/config.py

@@ -2,7 +2,7 @@ import os
 import secrets
 import warnings
 from pathlib import Path
-from typing import Annotated, Any, Literal
+from typing import Annotated, Any, Literal, Self
 
 from pydantic import (
     AnyUrl,
@@ -13,7 +13,6 @@ from pydantic import (
     model_validator,
 )
 from pydantic_settings import BaseSettings, SettingsConfigDict
-from typing_extensions import Self
 
 #: Everything the engine keeps on disk, relative to :attr:`Settings.DATA_DIR`.
 #: One setting to move the lot; each still overridable on its own, which is

backend/fluksio/core/security.py

@@ -1,6 +1,6 @@
 import base64
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from functools import lru_cache
 from typing import Any
 
@@ -40,7 +40,7 @@ PANEL_AUDIENCE = "fluksio-panel"
 
 
 def create_access_token(subject: str | Any, expires_delta: timedelta) -> str:
-    expire = datetime.now(timezone.utc) + expires_delta
+    expire = datetime.now(UTC) + expires_delta
     to_encode = {"exp": expire, "sub": str(subject)}
     encoded_jwt = jwt.encode(to_encode, settings.SECRET_KEY, algorithm=ALGORITHM)
     return encoded_jwt
@@ -109,7 +109,7 @@ def create_oauth_access_token(
     from someone's browser is refused there, so agent traffic never arrives
     looking like a person's.
     """
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     payload = {
         "sub": str(user_id),
         "iss": settings.oauth_issuer,
@@ -140,7 +140,7 @@ def create_worker_token(name: str, expires_delta: timedelta) -> str:
     worker's token grants no API access, and an agent's opens no worker
     connection.
     """
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     payload = {
         "sub": name,
         "iss": settings.oauth_issuer,
@@ -193,7 +193,7 @@ def create_panel_token(
     Long-lived on purpose: a wall tablet is set up once and left running, and
     it has no keyboard to log in again with.
     """
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     payload = {
         "sub": str(user_id),
         "aud": PANEL_AUDIENCE,

backend/fluksio/core/types.py

@@ -6,7 +6,7 @@ models cannot import from there.
 
 from __future__ import annotations
 
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from typing import Any
 
 from sqlalchemy import DateTime, TypeDecorator
@@ -31,8 +31,8 @@ class UTCDateTime(TypeDecorator[datetime]):
         if value is None:
             return None
         if value.tzinfo is None:
-            return value.replace(tzinfo=timezone.utc)
-        return value.astimezone(timezone.utc)
+            return value.replace(tzinfo=UTC)
+        return value.astimezone(UTC)
 
     def process_result_value(
         self, value: datetime | None, dialect: Any
@@ -40,5 +40,5 @@ class UTCDateTime(TypeDecorator[datetime]):
         if value is None:
             return None
         if value.tzinfo is None:
-            return value.replace(tzinfo=timezone.utc)
-        return value.astimezone(timezone.utc)
+            return value.replace(tzinfo=UTC)
+        return value.astimezone(UTC)

backend/fluksio/flow/controller.py

@@ -488,7 +488,7 @@ class FlowController:
             return
         try:
             await asyncio.wait_for(self._lock.acquire(), wait)
-        except asyncio.TimeoutError:
+        except TimeoutError:
             raise RebuildBusy(
                 f"A pipeline rebuild is still running after {wait:.0f}s"
             ) from None
@@ -736,7 +736,7 @@ class FlowController:
                 continue
             try:
                 await asyncio.wait_for(node.stop(self.app), NODE_STOP_TIMEOUT)
-            except asyncio.TimeoutError:
+            except TimeoutError:
                 # Abandoned rather than waited on: the next node still gets to
                 # close, and the rebuild still happens.
                 logger.warning(

backend/fluksio/flow/metrics.py

@@ -15,7 +15,7 @@ from __future__ import annotations
 import asyncio
 import logging
 import time
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any
 
 from sqlalchemy import delete, func, update
@@ -68,7 +68,7 @@ RECORDED = {
 
 
 def _minute(ts: float) -> datetime:
-    return datetime.fromtimestamp(ts, timezone.utc).replace(second=0, microsecond=0)
+    return datetime.fromtimestamp(ts, UTC).replace(second=0, microsecond=0)
 
 
 def _detail(event: dict[str, Any]) -> str:
@@ -106,7 +106,7 @@ class MetricsCollector:
                 timeout = max(0.05, self._flush_s - (time.monotonic() - last))
                 try:
                     event = await asyncio.wait_for(queue.get(), timeout)
-                except asyncio.TimeoutError:
+                except TimeoutError:
                     pass
                 else:
                     try:
@@ -184,7 +184,7 @@ class MetricsCollector:
             error = str(event.get("error") or "")
             self._pending.append(
                 EngineEvent(
-                    ts=datetime.fromtimestamp(ts, timezone.utc),
+                    ts=datetime.fromtimestamp(ts, UTC),
                     type="node_error",
                     flow=str(event.get("flow") or ""),
                     node=str(event.get("node") or ""),
@@ -201,7 +201,7 @@ class MetricsCollector:
 
         if kind == "cascade_finished":
             if run is not None:
-                run["finished_at"] = datetime.fromtimestamp(ts, timezone.utc)
+                run["finished_at"] = datetime.fromtimestamp(ts, UTC)
                 run["duration_ms"] = round((ts - run["started_ts"]) * 1000, 2)
                 run["status"] = "error" if run["errors"] else "ok"
             return
@@ -210,7 +210,7 @@ class MetricsCollector:
             if event.get("health") == "down":
                 self._pending.append(
                     EngineEvent(
-                        ts=datetime.fromtimestamp(ts, timezone.utc),
+                        ts=datetime.fromtimestamp(ts, UTC),
                         type="node_health",
                         flow=str(event.get("flow") or ""),
                         node=str(event.get("node") or ""),
@@ -222,7 +222,7 @@ class MetricsCollector:
         if kind == "audit":
             self._pending.append(
                 EngineEvent(
-                    ts=datetime.fromtimestamp(ts, timezone.utc),
+                    ts=datetime.fromtimestamp(ts, UTC),
                     type="audit",
                     flow=str(event.get("flow") or ""),
                     detail=str(event.get("action") or ""),
@@ -234,7 +234,7 @@ class MetricsCollector:
         if kind in RECORDED:
             self._pending.append(
                 EngineEvent(
-                    ts=datetime.fromtimestamp(ts, timezone.utc),
+                    ts=datetime.fromtimestamp(ts, UTC),
                     type=kind,
                     flow=str(event.get("flow") or ""),
                     node=str(event.get("node") or event.get("task") or ""),
@@ -258,7 +258,7 @@ class MetricsCollector:
             "flow": str(event.get("flow") or "")[:NAME_MAX],
             "source": str(event.get("cause") or ""),
             "started_ts": ts,
-            "started_at": datetime.fromtimestamp(ts, timezone.utc),
+            "started_at": datetime.fromtimestamp(ts, UTC),
             "finished_at": None,
             "status": "running",
             "nodes": 0,
@@ -382,7 +382,7 @@ class MetricsCollector:
             session.commit()
 
     def _prune(self, session: Session) -> None:
-        now = datetime.now(timezone.utc)
+        now = datetime.now(UTC)
         cutoff = now - timedelta(days=settings.OBS_RETENTION_DAYS)
         session.execute(delete(MetricBucket).where(col(MetricBucket.bucket) < cutoff))
         session.execute(delete(EngineEvent).where(col(EngineEvent.ts) < cutoff))

backend/fluksio/flow/nodes/base.py

@@ -10,7 +10,7 @@ import asyncio
 import inspect
 import logging
 from collections.abc import Callable, Coroutine, Iterable, Iterator
-from typing import TYPE_CHECKING, Any, TypeAlias
+from typing import TYPE_CHECKING, Any
 
 from fluksio.flow import logs
 from fluksio.flow.messages import MessageSpec, qualify
@@ -26,7 +26,7 @@ logger = logging.getLogger(__name__)
 
 # What a node hands back: the pipeline's state once it is bound, since a
 # trigger runs the graph, and its own outputs when it is not.
-NodeResult: TypeAlias = "StateBackend | dict[str, Any] | None"
+type NodeResult = StateBackend | dict[str, Any] | None
 
 
 class NodeOutputError(TypeError):

backend/fluksio/flow/nodes/delay.py

@@ -265,7 +265,7 @@ class DelayNode(Node):
                     await asyncio.wait_for(stop.wait(), timeout=wait_seconds)
                     # If we get here, stop was requested
                     break
-                except asyncio.TimeoutError:
+                except TimeoutError:
                     # Timeout means it's time to fire
                     pass
 

backend/fluksio/flow/nodes/inject.py

@@ -159,7 +159,7 @@ class InjectNode(Node):
         """Wait, but wake immediately if the node is being stopped."""
         try:
             await asyncio.wait_for(stop.wait(), timeout=seconds)
-        except asyncio.TimeoutError:
+        except TimeoutError:
             pass
 
     async def _fire(self) -> None:

backend/fluksio/flow/runs.py

@@ -35,7 +35,7 @@ import time
 import uuid
 from collections.abc import Callable
 from concurrent.futures import ThreadPoolExecutor
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any
 
 from sqlalchemy import update
@@ -380,7 +380,7 @@ class RunService:
             cause=cause,
             status="queued",
             labels=required_labels(flow),
-            created_at=datetime.now(timezone.utc),
+            created_at=datetime.now(UTC),
             actor=actor,
         )
         with Session(db_engine) as session:
@@ -428,7 +428,7 @@ class RunService:
                 .where(col(Run.id) == run_id, col(Run.status) == "queued")
                 .values(
                     status="cancelled",
-                    finished_at=datetime.now(timezone.utc),
+                    finished_at=datetime.now(UTC),
                     status_reason="Cancelled before it started",
                 )
             )
@@ -516,7 +516,7 @@ class RunService:
                 break
             with self._lock:
                 mine = list(self._active)
-            now = datetime.now(timezone.utc)
+            now = datetime.now(UTC)
             try:
                 if mine:
                     with Session(db_engine) as session:
@@ -561,7 +561,7 @@ class RunService:
         The compare-and-swap is what makes a redelivered item harmless — the
         second engine to arrive updates nothing and walks away.
         """
-        now = datetime.now(timezone.utc)
+        now = datetime.now(UTC)
         with Session(db_engine) as session:
             result = session.exec(
                 update(Run)
@@ -648,7 +648,7 @@ class RunService:
             run_id=run_id,
             node=outcome.node[:255],
             status="ok" if outcome.ok else "error",
-            started_at=datetime.now(timezone.utc),
+            started_at=datetime.now(UTC),
             duration_ms=outcome.duration_ms,
             error=outcome.error[:ERROR_CAP],
             logs=outcome.logs[:LOG_CAP],
@@ -693,7 +693,7 @@ class RunService:
                         status_reason=reason,
                         result=result,
                         duration_ms=duration_ms,
-                        finished_at=datetime.now(timezone.utc),
+                        finished_at=datetime.now(UTC),
                     )
                 )
                 session.commit()

backend/fluksio/models.py

@@ -1,5 +1,5 @@
 import uuid
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from typing import Any
 
 from pydantic import EmailStr
@@ -10,7 +10,7 @@ from fluksio.core.types import UTCDateTime
 
 
 def get_datetime_utc() -> datetime:
-    return datetime.now(timezone.utc)
+    return datetime.now(UTC)
 
 
 # Shared properties
@@ -120,7 +120,7 @@ class OAuthClient(SQLModel, table=True):
     client_name: str = Field(max_length=128)
     redirect_uris: list[str] = Field(sa_column=Column(JSON), default_factory=list)
     created_at: datetime = Field(
-        default_factory=lambda: datetime.now(timezone.utc),
+        default_factory=lambda: datetime.now(UTC),
         nullable=False,
         sa_type=UTCDateTime,
     )
@@ -147,7 +147,7 @@ class OAuthAuthorizationCode(SQLModel, table=True):
     #: The refresh token this code produced, so replaying the code can revoke it.
     refresh_token_id: uuid.UUID | None = None
     created_at: datetime = Field(
-        default_factory=lambda: datetime.now(timezone.utc),
+        default_factory=lambda: datetime.now(UTC),
         nullable=False,
         sa_type=UTCDateTime,
     )
@@ -172,7 +172,7 @@ class OAuthRefreshToken(SQLModel, table=True):
     expires_at: datetime = Field(sa_type=UTCDateTime)
     revoked: bool = False
     created_at: datetime = Field(
-        default_factory=lambda: datetime.now(timezone.utc),
+        default_factory=lambda: datetime.now(UTC),
         nullable=False,
         sa_type=UTCDateTime,
     )
@@ -429,6 +429,6 @@ class RunArtifact(SQLModel, table=True):
     size: int = 0
     media_type: str = Field(default="application/octet-stream", max_length=128)
     created_at: datetime = Field(
-        default_factory=lambda: datetime.now(timezone.utc),
+        default_factory=lambda: datetime.now(UTC),
         sa_type=UTCDateTime,
     )

backend/fluksio/utils.py

@@ -1,6 +1,6 @@
 import logging
 from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from pathlib import Path
 from typing import Any
 
@@ -102,7 +102,7 @@ def generate_new_account_email(
 
 def generate_password_reset_token(email: str) -> str:
     delta = timedelta(hours=settings.EMAIL_RESET_TOKEN_EXPIRE_HOURS)
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     expires = now + delta
     exp = expires.timestamp()
     encoded_jwt = jwt.encode(