Release 4.2.1 - Oauth scopes review

[david-ruiz-cko]

This release updates the OAuthScopes enum and its usage to synchronize with the current Checkout.com API specification, remove deprecated scopes, and improve test coverage. The main focus is on aligning the SDK's OAuth scope definitions with the official API spec, removing outdated values, adding missing ones, and ensuring correctness through comprehensive tests.

OAuth scope enum updates:

• Added missing scopes to OAuthScopes, including COMPLIANCE_REQUESTS, COMPLIANCE_REQUESTS_READ, COMPLIANCE_REQUESTS_RESPOND, and VAULT_TOKENS_METADATA, which are required by some API operations but were not previously declared. [1] [2]
• Removed deprecated or retired scopes such as ISSUING_CARD_MGMT, ISSUING_CLIENT, MARKETPLACE, MIDDLEWARE_GATEWAY, MIDDLEWARE_PAYMENT_CONTEXT, and ensured remaining scopes are alphabetically ordered for maintainability.
• Added a detailed docstring to the OAuthScopes enum explaining its correspondence to the API spec and clarifying subtle differences between similar scopes.

Test improvements and validation:

• Added new tests to tests/oauth_scopes_test.py to verify that all documented and newly added scopes are present, distinguish between similar but distinct scopes, and ensure every enum member has a unique, non-blank wire value.
• Introduced checks to guarantee that enum members remain alphabetically ordered and no duplicate wire values exist, preventing subtle bugs and improving maintainability.

Integration test updates:

• Updated integration tests to use the correct, non-retired scopes (ACCOUNTS instead of MARKETPLACE for payout schedules, and ISSUING_CARD_MANAGEMENT_READ/WRITE instead of retired issuing scopes), with comments explaining the changes and referencing the API spec. [1] [2]

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The diff only updates the version string in properties.py, which is a non-destructive, function-preserving change with no auth/authz, data, config, or integration implications.

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — The diff only updates the version string in properties.py, which is a non-destructive, function-preserving change with no auth/authz, data, config, or integration implications.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The diff only updates the version string, which is a non-destructive, function-preserving change with no new endpoints, auth changes, persisted data, or external integrations.

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}