fix: let ty see the test imports and drop stale replica comments

docker-compose.yaml

@@ -30,10 +30,11 @@
 services:
   openvpn:
     # Pulls the published multi-arch image from GHCR - the five-minute path.
-    # Set CULVERT_IMAGE to pin a tag (e.g. ...culvert:v2.1.3) or point at a
+    # Risk accepted: the :latest default serves that path only. A deployment
+    # sets CULVERT_IMAGE to a digest pin (...culvert:vX.Y.Z@sha256:...) or a
     # private mirror. To build locally instead, uncomment the build: block
     # below and run `docker compose up --build`.
     image: ${CULVERT_IMAGE:-ghcr.io/hyperi-io/culvert:latest}
     # build:
     #   context: .
     #   dockerfile: Dockerfile

profiles/edge-fleet.yaml

@@ -36,11 +36,9 @@ routing_control_enabled: true
 # reaches them). Isolation stays ON.
 client_isolation: true
 
-# Sharing is left at the shipped default deliberately. This preset runs 2-8
-# replicas, and duplicate-cn is enforced per OpenVPN process, so opting out
-# would give per-pod exclusivity while reading as a fleet-wide guarantee. Each
-# appliance already holds its own certificate; a cloned one is caught by the
-# connection log and revoked with revoke-client, not by duplicate-cn.
+# Sharing is left at the shipped default deliberately. Each appliance holds
+# its own certificate, and a cloned one is caught by the connection log and
+# revoked with revoke-client, not by duplicate-cn.
 
 # Outbound allow-list: appliances may only INITIATE to the receiver
 # network. Set this to your receiver's service CIDR.
@@ -59,9 +57,8 @@ downstream_admin_cidrs: "10.10.0.0/16"
 # allowed_destinations + downstream_admin_cidrs.
 push_routes: "10.20.0.0/16,10.10.0.0/16"
 
-# K8s behind a connection-based LB: log to stdout for the cluster log
-# pipeline. The LB must be connection-sticky (a single UDP/TCP flow
-# stays pinned to one culvert pod); see docs/use-case-edge-fleet.md.
+# Log to stdout for the cluster log pipeline; see
+# docs/use-case-kubernetes.md for the single-replica chart install.
 log_mode: stdout
 
 # External PKI is typical here (fleet CA in OpenBao / a mounted secret).

pyproject.toml

@@ -30,9 +30,11 @@ secrets-aws = ["scalo[secrets-aws]"]
 secrets-gcp = ["scalo[secrets-gcp]"]
 secrets-azure = ["scalo[secrets-azure]"]
 otel = ["scalo[opentelemetry]"]
-# Bounded, like the runtime deps. An unpinned dev dependency is not a loose
-# constraint but an invisible one: nothing proposes an update, and the version
-# moves silently on the next lock refresh.
+
+# A group, not an extra: uv syncs it by default, so ty and pytest under
+# `uv run` resolve the test imports. Bounded, like the runtime deps -- an
+# unpinned dev dependency moves silently on the next lock refresh.
+[dependency-groups]
 dev = [
     "ruff>=0.16.1,<0.17",
     "pytest>=9.1,<10",

tests/run-unit.sh

@@ -40,9 +40,9 @@ main() {
     cd "${SCRIPT_DIR}/.."
 
     if [[ "${1:-}" == "--verbose" ]] || [[ "${1:-}" == "-v" ]]; then
-        uv run --frozen --extra dev pytest tests/unit -v
+        uv run --frozen --group dev pytest tests/unit -v
     else
-        uv run --frozen --extra dev pytest tests/unit
+        uv run --frozen --group dev pytest tests/unit
     fi
 }