style: apply black formatting to fix CI lint failure

services/orchestrator/goal_conversation_service.py

@@ -634,8 +634,8 @@ async def get_goal_conversations(
                     ORDER BY last_activity_at DESC, created_at DESC
                     LIMIT ${param_idx}
                 """.format(  # nosec B608 -- where clause is fixed fragments with $N placeholders; all values bound as query params
-                    where_clause=where_clause, param_idx=param_idx
-                ),
+                        where_clause=where_clause, param_idx=param_idx
+                    ),
                     *params,
                     limit,
                 )

services/orchestrator/main_with_hierarchy.py

@@ -1411,6 +1411,8 @@ async def demo_endpoint():
 
     uvicorn.run(
         app,
-        host=os.getenv("HOST", "0.0.0.0"),  # nosec B104 -- container service binds all interfaces by default; override via HOST env
+        host=os.getenv(
+            "HOST", "0.0.0.0"
+        ),  # nosec B104 -- container service binds all interfaces by default; override via HOST env
         port=int(os.getenv("PORT", "8000")),
     )

services/orchestrator/sandbox_manager.py

@@ -397,7 +397,9 @@ async def _create_container(self, sandbox: Sandbox, config: SandboxConfig):
             "cap_drop": config.capabilities["drop"],
             "cap_add": config.capabilities["add"],
             "read_only": False,  # Need write access for development
-            "tmpfs": {"/tmp": "rw,noexec,nosuid,size=1g"},  # nosec B108 -- Docker tmpfs mount point inside the sandbox container, hardened with noexec,nosuid
+            "tmpfs": {
+                "/tmp": "rw,noexec,nosuid,size=1g"
+            },  # nosec B108 -- Docker tmpfs mount point inside the sandbox container, hardened with noexec,nosuid
             "labels": {
                 "fuzeagent.sandbox": "true",
                 "fuzeagent.agent_id": sandbox.agent_id,

services/orchestrator/simple_main.py

@@ -461,6 +461,8 @@ async def get_agent_documents(agent_id: str):
 
     uvicorn.run(
         app,
-        host=os.getenv("HOST", "0.0.0.0"),  # nosec B104 -- container service binds all interfaces by default; override via HOST env
+        host=os.getenv(
+            "HOST", "0.0.0.0"
+        ),  # nosec B104 -- container service binds all interfaces by default; override via HOST env
         port=int(os.getenv("PORT", "8000")),
     )

services/orchestrator/tests/test_auth_authz.py

@@ -27,7 +27,9 @@
 
 # Configure verification material before importing the auth module so that
 # get_current_user runs in its prod-like (fail-closed) mode.
-os.environ["JWT_SECRET"] = "test-secret-for-issue-6-authz"  # nosec B105 -- test-only JWT secret fixture, not a real credential
+os.environ["JWT_SECRET"] = (
+    "test-secret-for-issue-6-authz"  # nosec B105 -- test-only JWT secret fixture, not a real credential
+)
 os.environ["JWT_ALGORITHM"] = "HS256"
 os.environ.pop("AUTH_DISABLED", None)
 os.environ.pop("JWT_AUDIENCE", None)

services/orchestrator/tests/test_claude_code_wrapper.py

@@ -95,7 +95,9 @@ def test_constructor_accepts_agent_context(self, mock_anthropic_client):
             task_id="task-456",
         )
 
-        assert wrapper.workspace_path == "/tmp/does-not-need-to-exist"  # nosec B108 -- test-only literal path assertion
+        assert (
+            wrapper.workspace_path == "/tmp/does-not-need-to-exist"
+        )  # nosec B108 -- test-only literal path assertion
         assert wrapper.agent_id == "agent-123"
         assert wrapper.task_id == "task-456"
         # repository_context is initialised as a fresh dict per instance.

services/orchestrator/tests/test_hierarchy_ws_authz.py

@@ -34,7 +34,9 @@
 # Environment — set BEFORE importing auth/hierarchy_endpoints so the module
 # evaluates with the correct JWT config (fail-closed, no bypass).
 # ---------------------------------------------------------------------------
-os.environ["JWT_SECRET"] = "test-secret-hierarchy-ws-authz"  # nosec B105 -- test-only JWT secret fixture, not a real credential
+os.environ["JWT_SECRET"] = (
+    "test-secret-hierarchy-ws-authz"  # nosec B105 -- test-only JWT secret fixture, not a real credential
+)
 os.environ["JWT_ALGORITHM"] = "HS256"
 os.environ.pop("AUTH_DISABLED", None)
 os.environ.pop("JWT_AUDIENCE", None)

services/orchestrator/tests/test_residual_authz.py

@@ -31,7 +31,9 @@
 import pytest
 
 # Configure verification material BEFORE importing auth so it runs fail-closed.
-os.environ["JWT_SECRET"] = "test-secret-for-issue-6-authz"  # nosec B105 -- test-only JWT secret fixture, not a real credential
+os.environ["JWT_SECRET"] = (
+    "test-secret-for-issue-6-authz"  # nosec B105 -- test-only JWT secret fixture, not a real credential
+)
 os.environ["JWT_ALGORITHM"] = "HS256"
 os.environ.pop("AUTH_DISABLED", None)
 os.environ.pop("JWT_AUDIENCE", None)