[krokicki]

Summary

• mypy joins the pixi test feature: pixi run typecheck (check_untyped_defs, warnings on unused ignores). CI runs it between lint and tests. The suite was clean at 0 after fixing 121 findings; nothing is suppressed with type: ignore.
• What the findings were, and how they are fixed:
  • GitHub.request is now overloaded: it returns Response | None only when ok404=True, so the twenty .json() call sites type-check without guards.
  • read_untrusted is overloaded on binary, so text readers get str | None and the crop/gallery readers get bytes | None.
  • autodev's helpers that mia-data reuses (token_fn, bot_login, _client, _setup_logging, the ops commands) take a Deployment protocol instead of autodev's Config. Both packages' configs satisfy it structurally; no runtime change.
  • Activities.temporal (both packages) raises a clear error when an activity that needs the Temporal client runs without one, instead of an AttributeError on None.
  • MiaDataDataset._limits() loads the round limits lazily, replacing the repeated self.limits or await self._act("limits"). On every recorded path the activity calls are unchanged (the replay tests pass). A merged PR that reports no merge commit now ends the round in needs-human rather than failing the workflow task.
  • GitHub App credentials are checked in one place and the key must be RSA; combine_checks and check_state take Sequence[str]; a few Optional narrowings with assert where the invariant is established earlier in the workflow.
• orjson is added as an explicit dependency. The pixi environment contained an empty site-packages/orjson/ directory (an NFS leftover from a deleted file) that shadowed the real package and crashed mypy's cache writer. A fresh environment would not have hit this, but pinning the dependency makes it moot.

Test plan

• pixi run lint, pixi run typecheck clean
• pixi run test: 328 passed, including the Temporal replay tests
• CI green

🤖 Generated with Claude Code