github-agent 2.4.15__tar.gz → 2.5.0__tar.gz

{github_agent-2.4.15 → github_agent-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-agent
-Version: 2.4.15
+Version: 2.5.0
 Summary: GitHub Agent for MCP
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT
@@ -13,7 +13,7 @@ Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.34.2
-Requires-Dist: scion-sdk[graphql,mcp]>=0.9.0
+Requires-Dist: scion-sdk[graphql,mcp]<0.11,>=0.10.2
 Provides-Extra: mcp
 Provides-Extra: all
 Provides-Extra: test
@@ -247,7 +247,6 @@ When query strings or parameters are supplied, an LLM-free **Knowledge Graph res
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
         "DEPENDABOTTOOL": "True",
-        "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
         "GITHUB_TOKEN": "your_github_token_here",
@@ -298,7 +297,6 @@ own runtime secret boundary.
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
         "DEPENDABOTTOOL": "True",
-        "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
         "GITHUB_TOKEN": "your_github_token_here",
@@ -348,7 +346,6 @@ docker run -i --rm \
   -e COMMITTOOL=True \
   -e CONTENTTOOL=True \
   -e DEPENDABOTTOOL=True \
-  -e GITHUB_ALLOW_DESTRUCTIVE=False \
   -e GITHUB_HTTP_CONNECT_TIMEOUT=10 \
   -e GITHUB_HTTP_READ_TIMEOUT=30 \
   -e GITHUB_TOKEN=your_github_token_here \
@@ -412,7 +409,6 @@ the detailed transport contract.
 | `TLS_PROFILE` | `private-ca` | AgentConfig named transport profile |
 | `TLS_PROFILE_REF` | `secret://transport/provider` | Direct runtime profile reference |
 | `TLS_PROFILES_REF` | `secret://transport/catalog` | Named runtime profile catalog |
-| `GITHUB_ALLOW_DESTRUCTIVE` | `False` | Allow destructive (delete/force) operations |
 | `GITHUB_HTTP_CONNECT_TIMEOUT` | `10` | HTTP client timeouts (seconds) |
 | `GITHUB_HTTP_READ_TIMEOUT` | `30` |  |
 | `DEBUG` | `False` |  |

{github_agent-2.4.15 → github_agent-2.5.0}/README.md

@@ -223,7 +223,6 @@ When query strings or parameters are supplied, an LLM-free **Knowledge Graph res
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
         "DEPENDABOTTOOL": "True",
-        "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
         "GITHUB_TOKEN": "your_github_token_here",
@@ -274,7 +273,6 @@ own runtime secret boundary.
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
         "DEPENDABOTTOOL": "True",
-        "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
         "GITHUB_TOKEN": "your_github_token_here",
@@ -324,7 +322,6 @@ docker run -i --rm \
   -e COMMITTOOL=True \
   -e CONTENTTOOL=True \
   -e DEPENDABOTTOOL=True \
-  -e GITHUB_ALLOW_DESTRUCTIVE=False \
   -e GITHUB_HTTP_CONNECT_TIMEOUT=10 \
   -e GITHUB_HTTP_READ_TIMEOUT=30 \
   -e GITHUB_TOKEN=your_github_token_here \
@@ -388,7 +385,6 @@ the detailed transport contract.
 | `TLS_PROFILE` | `private-ca` | AgentConfig named transport profile |
 | `TLS_PROFILE_REF` | `secret://transport/provider` | Direct runtime profile reference |
 | `TLS_PROFILES_REF` | `secret://transport/catalog` | Named runtime profile catalog |
-| `GITHUB_ALLOW_DESTRUCTIVE` | `False` | Allow destructive (delete/force) operations |
 | `GITHUB_HTTP_CONNECT_TIMEOUT` | `10` | HTTP client timeouts (seconds) |
 | `GITHUB_HTTP_READ_TIMEOUT` | `30` |  |
 | `DEBUG` | `False` |  |

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/api/api_client_dependabot.py

@@ -2,6 +2,7 @@
 from typing import Any
 
 from scion_sdk.exceptions import require_auth
+from scion_sdk.mcp.destructive import destructive_operation
 
 from github_agent.api.api_client_base import BaseApiClient
 from github_agent.github_response_models import Response
@@ -59,6 +60,7 @@ class Api(BaseApiClient):
         response.raise_for_status()
         return Response(response=response, data=response.json())
 
+    @destructive_operation
     @require_auth
     def update_dependabot_alert(
         self,

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/api/api_client_orgs.py

@@ -111,8 +111,8 @@ class Api(BaseApiClient):
         """Schedule an organization for deletion. IRREVERSIBLE.
 
         GitHub responds 202 Accepted and deletes the organization, all of its
-        repositories, and all of its data asynchronously. The MCP layer gates
-        this action behind allow_destructive / GITHUB_ALLOW_DESTRUCTIVE.
+        repositories, and all of its data asynchronously. The SDK asks
+        the caller to confirm this action.
 
         DELETE /orgs/{org}
         https://docs.github.com/en/rest/orgs/orgs#delete-an-organization
@@ -240,8 +240,8 @@ class Api(BaseApiClient):
     def remove_organization_member(self, org: str, username: str) -> Response:
         """Remove a user from an organization (repositories access included).
 
-        Destructive: the MCP layer gates this action behind
-        allow_destructive / GITHUB_ALLOW_DESTRUCTIVE. GitHub responds 204.
+        Destructive: the SDK asks the caller to confirm this
+        action. GitHub responds 204.
 
         DELETE /orgs/{org}/members/{username}
         https://docs.github.com/en/rest/orgs/members#remove-an-organization-member

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/api/api_client_pages.py

@@ -150,8 +150,8 @@ class Api(BaseApiClient):
     def delete_pages(self, owner: str, repo: str) -> Response:
         """Disable GitHub Pages for a repository and delete the site.
 
-        Destructive: the MCP layer gates this action behind
-        allow_destructive / GITHUB_ALLOW_DESTRUCTIVE. GitHub responds 204.
+        Destructive: the SDK asks the caller to confirm this
+        action. GitHub responds 204.
 
         DELETE /repos/{owner}/{repo}/pages
         https://docs.github.com/en/rest/pages/pages#delete-a-apiname-pages-site

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/api/api_client_pulls.py

@@ -5,6 +5,7 @@ from scion_sdk.exceptions import (
     ParameterError,
     require_auth,
 )
+from scion_sdk.mcp.destructive import destructive_operation
 
 from github_agent.api.api_client_base import BaseApiClient
 from github_agent.github_input_models import (
@@ -107,6 +108,7 @@ class Api(BaseApiClient):
         response.raise_for_status()
         return Response(response=response, data=response.json())
 
+    @destructive_operation
     @require_auth
     def merge_pull_request(
         self,

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/auth.py

@@ -21,16 +21,6 @@ from github_agent.api_client import Api
 logger = get_logger(__name__)
 
 
-def allow_destructive_default() -> bool:
-    """Fleet-wide default for the destructive-action gate.
-
-    Destructive MCP actions (e.g. organization delete, member removal) are
-    blocked unless the caller passes allow_destructive=true or the
-    GITHUB_ALLOW_DESTRUCTIVE environment variable is set truthy.
-    """
-    return setting("GITHUB_ALLOW_DESTRUCTIVE", False)
-
-
 def _exchange_delegated_token(settings: DelegationSettings) -> str:
     """Exchange the caller's verified MCP token for a downstream GitHub token."""
     logger.info(

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/mcp_server.py

@@ -29,6 +29,7 @@ from scion_sdk.config import load_config
 from scion_sdk.connector_identity import connector_version
 from scion_sdk.mcp.concurrency import run_blocking
 from scion_sdk.mcp.content import ConnectorContent
+from scion_sdk.mcp.destructive import guard_destructive
 from scion_sdk.mcp.server import create_mcp_server
 from scion_sdk.mcp.tool_surface import register_tool_surface
 
@@ -218,7 +219,7 @@ def register_auto_merge_tools(mcp: FastMCP):
     """Register the GraphQL-only pull request auto-merge tools."""
 
     @mcp.tool(
-        tags={"pulls"}, annotations={"readOnlyHint": False, "destructiveHint": False}
+        tags={"pulls"}, annotations={"readOnlyHint": False, "destructiveHint": True}
     )
     async def github_pulls_enable_auto_merge(
         owner: str = Field(description="Repository owner."),
@@ -228,9 +229,21 @@ def register_auto_merge_tools(mcp: FastMCP):
             default="MERGE", description="MERGE, SQUASH or REBASE."
         ),
         client=Depends(get_client),
+        confirm: bool = Field(
+            default=False,
+            description="Confirm this destructive call when the client cannot be asked.",
+        ),
         ctx: Context | None = Field(default=None, description="MCP context"),
     ) -> Any:
         """Turn on auto-merge for a pull request: it merges once required checks pass."""
+        refused = await guard_destructive(
+            ctx,
+            "enable_auto_merge",
+            {"owner": owner, "repo": repo, "number": number},
+            confirm=confirm,
+        )
+        if refused is not None:
+            return refused
         try:
             gql_client = await run_blocking(get_graphql_client)
         except Exception as e:

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/ontology/certification.json

@@ -2,10 +2,10 @@
   "api_version": "graphos.io/v1",
   "artifacts": {
     "github_agent/ontology/fixtures/records.json": "12f5b54b0ae98770f279f99e136788d063340042a9d6ff4bac0c22a886d2dc7b",
-    "github_agent/ontology/github.ttl": "3558c43835211ddcf7d2af622a37c0c370a7e8fe6b40a111b9bc98dd7e91f2ac",
+    "github_agent/ontology/github.ttl": "70c68c0ae5cc8b056bd6f21af44eb3cbdf6d3bf213e0764e5c3341ea536fbd20",
     "github_agent/ontology/mappings/source.yaml": "5142f75b88634aeac6850fe6de5b176958d63073daab2c573cf9c03daa46021c",
     "github_agent/ontology/migrations/manifest.json": "adf16022502dd031dd303a52abae7a0677ece1135e1e05c21dba24c9ae51935c",
-    "github_agent/ontology/shapes/connector.shacl.ttl": "709f555b7b8cc6b1e0adddfeb8e077834f5db548bed4a904afd2a195e49aab1c"
+    "github_agent/ontology/shapes/connector.shacl.ttl": "0972b7e3b5f56fb0452f070800cd1f7ee790f6cf183f308f1cf69e5a0db716e0"
   },
   "checks": {
     "declared_tool_schema": "passed",
@@ -29,5 +29,5 @@
   "signer": "UNSIGNED-PREVIEW",
   "signing_public_key": "",
   "status": "source-validated",
-  "validated_at": "2026-11-06T18:41:25Z"
+  "validated_at": "2026-11-12T19:19:41Z"
 }

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/ontology/github.ttl

@@ -2,6 +2,7 @@
 @prefix foaf: <http://xmlns.com/foaf/0.1/> .
 @prefix dc: <http://purl.org/dc/terms/> .
 @prefix : <http://knuckles.team/kg#> .
+@prefix core: <https://knuckles-team.github.io/ontology/core#> .
 @prefix owl: <http://www.w3.org/2002/07/owl#> .
 @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
 @prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@@ -15,24 +16,26 @@
 # Shared concepts owned by the epistemic-graph ontology and referenced here, never redeclared:
 # Repository, PullRequest, Release, Branch, Commit, PipelineRun. Only the GitHub-specific subclasses and properties are declared in this pack.
 
-:Organization a owl:Class .
+:Organization a owl:Class ;
+    rdfs:subClassOf core:Organization .
 
 
 :Issue a owl:Class ;
-    rdfs:subClassOf :WorkItem ;
+    rdfs:subClassOf core:WorkItem ;
     rdfs:label "Issue" ;
     rdfs:comment "A tracked work item, bug, or discussion in a repository (github_get_issues)." .
 
-:Workflow a owl:Class .
+:Workflow a owl:Class ;
+    rdfs:subClassOf core:Workflow .
 
 
 :WorkflowRun a owl:Class ;
-    rdfs:subClassOf :PipelineRun ;
+    rdfs:subClassOf core:PipelineRun ;
     rdfs:label "Workflow Run" ;
     rdfs:comment "A single execution of a GitHub Actions workflow for a ref/commit (github_get_workflow_runs)." .
 
 :CheckRun a owl:Class ;
-    rdfs:subClassOf :PipelineRun ;
+    rdfs:subClassOf core:PipelineRun ;
     rdfs:label "Check Run" ;
     rdfs:comment """A single job/check within a PipelineRun (github_get_workflow_run_jobs workflow-run job or
     GitHub Checks-API check run). Shares its class name with the twin gitlab-api producer.""" .

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/ontology/shapes/connector.shacl.ttl

@@ -1,5 +1,5 @@
-@prefix : <http://knuckles.team/kg#> .
-@prefix shape: <http://knuckles.team/kg/github/shape#> .
+@prefix : <https://knuckles-team.github.io/ontology/core#> .
+@prefix shape: <https://knuckles-team.github.io/ontology/connector/github-shapes#> .
 @prefix sh: <http://www.w3.org/ns/shacl#> .
 @prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
 

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent/skills/github-agent-development/SKILL.md

@@ -65,8 +65,7 @@ with local copies or bypass a failing check.
 - Credentials come from `GITHUB_TOKEN`; the endpoint is derived from `GITHUB_URL`
   (`api.github.com`, or a GitHub Enterprise `/api/v3` host whose GraphQL endpoint
   is `/api/graphql`). Mock all GitHub calls; never use a real token in a gate.
-- Destructive operations stay behind `GITHUB_ALLOW_DESTRUCTIVE`; keep it false
-  by default and test both states.
+- Destructive operations are declared once with the SDK `destructive_operation` decorator; the SDK asks the caller to confirm (`confirm=true`), and `SCION_ALLOW_DESTRUCTIVE` is the one operator setting. Never add a connector-local knob.
 - Prefer one aliased `github_graphql` query over many REST calls for cross-repo
   reads; keep REST and GraphQL parity when adding a tool domain.
 - Packaged skills under `github_agent/skills/` have their own helper tests

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-agent
-Version: 2.4.15
+Version: 2.5.0
 Summary: GitHub Agent for MCP
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT
@@ -13,7 +13,7 @@ Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.34.2
-Requires-Dist: scion-sdk[graphql,mcp]>=0.9.0
+Requires-Dist: scion-sdk[graphql,mcp]<0.11,>=0.10.2
 Provides-Extra: mcp
 Provides-Extra: all
 Provides-Extra: test
@@ -247,7 +247,6 @@ When query strings or parameters are supplied, an LLM-free **Knowledge Graph res
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
         "DEPENDABOTTOOL": "True",
-        "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
         "GITHUB_TOKEN": "your_github_token_here",
@@ -298,7 +297,6 @@ own runtime secret boundary.
         "COMMITTOOL": "True",
         "CONTENTTOOL": "True",
         "DEPENDABOTTOOL": "True",
-        "GITHUB_ALLOW_DESTRUCTIVE": "False",
         "GITHUB_HTTP_CONNECT_TIMEOUT": "10",
         "GITHUB_HTTP_READ_TIMEOUT": "30",
         "GITHUB_TOKEN": "your_github_token_here",
@@ -348,7 +346,6 @@ docker run -i --rm \
   -e COMMITTOOL=True \
   -e CONTENTTOOL=True \
   -e DEPENDABOTTOOL=True \
-  -e GITHUB_ALLOW_DESTRUCTIVE=False \
   -e GITHUB_HTTP_CONNECT_TIMEOUT=10 \
   -e GITHUB_HTTP_READ_TIMEOUT=30 \
   -e GITHUB_TOKEN=your_github_token_here \
@@ -412,7 +409,6 @@ the detailed transport contract.
 | `TLS_PROFILE` | `private-ca` | AgentConfig named transport profile |
 | `TLS_PROFILE_REF` | `secret://transport/provider` | Direct runtime profile reference |
 | `TLS_PROFILES_REF` | `secret://transport/catalog` | Named runtime profile catalog |
-| `GITHUB_ALLOW_DESTRUCTIVE` | `False` | Allow destructive (delete/force) operations |
 | `GITHUB_HTTP_CONNECT_TIMEOUT` | `10` | HTTP client timeouts (seconds) |
 | `GITHUB_HTTP_READ_TIMEOUT` | `30` |  |
 | `DEBUG` | `False` |  |

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent.egg-info/SOURCES.txt

@@ -83,6 +83,7 @@ tests/test_api_validation.py
 tests/test_auth_client_edge_cases.py
 tests/test_cq_paths.py
 tests/test_default_content_surfaces.py
+tests/test_destructive_declaration.py
 tests/test_fleet_name.py
 tests/test_github_agent_api_brute_force_coverage.py
 tests/test_github_agent_brute_force_coverage.py

{github_agent-2.4.15 → github_agent-2.5.0}/github_agent.egg-info/requires.txt

@@ -1,5 +1,5 @@
 requests>=2.34.2
-scion-sdk[graphql,mcp]>=0.9.0
+scion-sdk[graphql,mcp]<0.11,>=0.10.2
 
 [all]
 

{github_agent-2.4.15 → github_agent-2.5.0}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "github-agent"
-version = "2.4.15"
+version = "2.5.0"
 readme = "README.md"
 description = "GitHub Agent for MCP"
 requires-python = ">=3.12"
 classifiers = [ "Development Status :: 5 - Production/Stable", "License :: Public Domain", "Environment :: Console", "Operating System :: POSIX :: Linux", "Programming Language :: Python :: 3",]
-dependencies = [ "requests>=2.34.2", "scion-sdk[mcp,graphql]>=0.9.0",]
+dependencies = [ "requests>=2.34.2", "scion-sdk[mcp,graphql]>=0.10.2,<0.11",]
 [[project.authors]]
 name = "Repository Maintainers"
 email = "maintainers@knuckles.team"

{github_agent-2.4.15 → github_agent-2.5.0}/tests/test_cq_paths.py

@@ -35,7 +35,7 @@ def test_state_is_declared_on_the_issue_type() -> None:
 
 
 def test_check_run_extends_pipeline_run() -> None:
-    assert "rdfs:subClassOf :PipelineRun" in _block("CheckRun")
+    assert "rdfs:subClassOf core:PipelineRun" in _block("CheckRun")
 
 
 def test_no_mapping_has_a_null_ontology_class() -> None:

github_agent-2.5.0/tests/test_destructive_declaration.py

@@ -0,0 +1,86 @@
+"""CONN-GITHUB-AGENT-CONNECTOR-CONTENT-R008: destructive operations use the SDK's one declaration and guard."""
+
+from __future__ import annotations
+
+import asyncio
+import importlib
+from unittest.mock import patch
+
+import pytest
+import requests
+from fastmcp import Client, FastMCP
+
+pytestmark = pytest.mark.spec("CONN-GITHUB-AGENT-CONNECTOR-CONTENT-R008")
+
+DECLARED = {
+    "github_merge_pull_request",
+    "github_update_dependabot_alert",
+    "github_pulls_enable_auto_merge",
+}
+CLASSIFIED = {"github_delete_repository", "github_delete_branch"}
+
+
+def _server() -> FastMCP:
+    module = importlib.import_module("github_agent.mcp_server")
+    with patch(
+        "sys.argv", ["github-mcp", "--transport", "stdio", "--auth-type", "none"]
+    ):
+        result = module.get_mcp_instance()
+    if isinstance(result, FastMCP):
+        return result
+    return next(value for value in result if isinstance(value, FastMCP))
+
+
+def test_declared_and_classified_operations_are_destructive_tools_that_ask_first(
+    monkeypatch,
+):
+    monkeypatch.delenv("SCION_ALLOW_DESTRUCTIVE", raising=False)
+
+    async def _run():
+        async with Client(_server()) as client:
+            tools = {t.name: t for t in await client.list_tools()}
+            for name in DECLARED | CLASSIFIED:
+                assert tools[name].annotations.destructive_hint is True, name
+                assert "confirm" in tools[name].input_schema["properties"], name
+            for name, tool in tools.items():
+                assert "allow_destructive" not in tool.input_schema["properties"], name
+
+    asyncio.run(_run())
+
+
+@pytest.mark.parametrize(
+    "name,arguments",
+    [
+        (
+            "github_merge_pull_request",
+            {"owner": "o", "repo": "r", "number": 1},
+        ),
+        (
+            "github_delete_branch",
+            {"owner": "o", "repo": "r", "branch": "b"},
+        ),
+    ],
+)
+def test_unconfirmed_call_sends_no_request(name, arguments, monkeypatch):
+    monkeypatch.delenv("SCION_ALLOW_DESTRUCTIVE", raising=False)
+    monkeypatch.setenv("GITHUB_TOKEN", "test-token")
+    sent: list[str] = []
+
+    def record(self, method, url, **kwargs):
+        sent.append(f"{method} {url}")
+        raise AssertionError("no request may be made without confirmation")
+
+    monkeypatch.setattr(requests.Session, "request", record)
+
+    async def _run():
+        async with Client(_server()) as client:
+            refused = await client.call_tool(name, arguments, raise_on_error=False)
+            assert refused.structured_content["cancelled"] is True
+
+    asyncio.run(_run())
+    assert sent == []
+
+
+def test_no_connector_local_knob_remains():
+    auth = importlib.import_module("github_agent.auth")
+    assert not hasattr(auth, "allow_destructive_default")

{github_agent-2.4.15 → github_agent-2.5.0}/tests/test_ontology_parent_link.py

@@ -30,6 +30,11 @@ PARENT_CLASSES = frozenset(
         "http://knuckles.team/kg#Workflow",
     )
 )
+# The core ontology is addressed under its one HTTPS base; a pack class rolls up to a core class by that IRI.
+CORE_BASE = "https://knuckles-team.github.io/ontology/core#"
+PARENT_CLASSES = PARENT_CLASSES | frozenset(
+    CORE_BASE + iri.rsplit("#", 1)[1] for iri in PARENT_CLASSES
+)
 # Classes for which the parent ontology has no fitting class yet. Each is a candidate for a new
 # parent class (see the orphan mapping report); a class leaves this set when it gains a parent.
 PENDING_NEW_PARENT: frozenset[str] = frozenset()