[shaealh]

Addresses item 2 of #69616.

Summary

• Raise the Cadwyn minimum to 7.1.0 and FastAPI minimum to 0.137.2.
• Replace mutation of a shared Execution API router with fresh, build-time router assembly.
• Use FastAPI's iter_route_contexts() for authentication and token-scope route inspection.
• Preserve custom token-scope metadata from the original routes.
• Add a negative regression test proving that an accidentally unprotected route is detected.
• Refresh uv.lock to Cadwyn 7.1.0 and FastAPI 0.139.0.

Testing

• Full Task Execution API suite: 524 passed.
• Focused FastAPI migration suite: 36 passed.
• Airflow core mypy: passed, 1,202 files checked.
• Ruff formatting and lint: passed.
• API server startup: verified.
• Dag processor startup: verified.
• git diff --check: passed.

Gen-AI disclosure

• Yes, generative AI tooling was used. -- OpenAI Codex

[github-actions]

uv.lock on main just moved via #74198 ("Add a Databricks toolset for Unity Gateway MCP Services"), commit 5aadb55 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[ashb]

@amoghrajesh Could you take a look at this one please?

[potiuk]

Thanks for this, @shaealh. Most of it has since landed on main via #75689 ("Allow FastAPI 0.137+ by requiring cadwyn 8.1"), which raised the floors to cadwyn>=8.1.0 / fastapi>=0.142.0 and switched the auth and token-scope route inspection to iter_route_contexts().

What this PR still adds on top looks like the build-time assembly of a fresh Execution API router (instead of mutating the shared one), keeping custom token-scope metadata from the original routes, and the regression test showing that an unprotected route is detected. If you'd like to carry those, could you rebase onto main and narrow the PR to just them? If you think they're no longer needed after #75689, feel free to close it.

---

Drafted-by: Claude Code (Claude Opus 5); reviewed by @potiuk before posting