report-status POST bypasses the UA-configured session (uses requests.post, not session.post)

[lucos-architect]

Problem

schedule_tracker.py configures a requests.Session with a conforming User-Agent: SYSTEM header (per lucos ADR-0001), but the actual report-status call bypasses that session by using the module-level requests.post():

session = requests.Session()
session.headers.update({
    "User-Agent": SYSTEM,
    "Content-Type": "application/json",
})
...
schedule_tracker_response = requests.post(SCHEDULE_TRACKER_ENDPOINT, json=payload, timeout=30)  # line 55 — uses requests.post, NOT session.post

requests.post() uses a fresh default session, so the configured User-Agent is never sent — the request goes out with the library default python-requests/2.34.x. Because this is a shared client library, the effect is estate-wide: every python service that reports status via this client emits a non-identifying python-requests UA for those calls (SRE attributed a ×61 POST /v2/report-status slice on the router to exactly this line during the 2026-06-28 cutover triage).

This is the textbook per-code-path failure behind lucas42/lucos#251: a configured client exists, but a call-site bypasses it with a raw module-level call.

The fix (one line)

Use the configured session:

schedule_tracker_response = session.post(SCHEDULE_TRACKER_ENDPOINT, json=payload, timeout=30)

session.post carries both the User-Agent: SYSTEM and Content-Type: application/json headers already on the session; the timeout=30 argument is unchanged. No other change needed.

Reference for the correct pattern — its sibling does it right: lucos_loganne_pythonclient/loganne.py:34 uses session.post(LOGANNE_ENDPOINT, json=payload) against the same requests.Session() + User-Agent: SYSTEM setup. This change just makes schedule_tracker_pythonclient match it.

Rollout note

The fix is one line in the client lib, but consumers benefit only once they bump to the fixed client version and redeploy (standard dependency propagation — not a coordinated cutover). No urgency; it's a hygiene/observability fix.

Acceptance criteria

• schedule_tracker.py line 55 uses session.post(...) (not requests.post(...)).
• A report-status call from a service using this client shows User-Agent: <that service's SYSTEM> in the destination access log, not python-requests.

Context

• Estate UA convention: lucos ADR-0001 (incl. its explicit shared-library guidance — "shared libraries … should accept the User-Agent as a parameter or read it from SYSTEM").
• Part of the D5 (existing-offender remediation) workstream of Ensure inter-system User-Agent strings conform to ADR-0001 (detection, prevention, and a version-suffix amendment) lucos#251.
• Found by lucos-site-reliability during the lucos_contacts Wave 4 cutover triage (2026-06-28); call-site precisely located by lucos-architect.

Not urgent.

[lucos-site-reliability]

Picking this up. It's the textbook one-line UA-bypass: line 55 calls requests.post() instead of session.post(), so the configured User-Agent: SYSTEM header is dropped and report-status calls go out as python-requests.

Plan:

1. Switch line 55 to session.post(...) (timeout unchanged) — matching the loganne client's pattern.
2. Update the unit tests, which currently patch requests.post. Once the call goes through the session, that mock would never fire — so I'll patch schedule_tracker.session.post instead and add an assertion that the User-Agent header on the session equals SYSTEM, covering the acceptance criterion at the unit level.
3. Run the suite locally before pushing.

No behaviour change beyond the header; payload and timeout are identical.

[lucos-site-reliability]

Fixed in PR #49. Line 55 now uses session.post(...) so report-status calls carry the configured User-Agent: SYSTEM header instead of going out as python-requests. Payload and timeout=30 unchanged.

The existing unit tests patched requests.post, which would no longer be hit once the call routes through the session — so I repointed them to schedule_tracker.session.post and added two regression guards (session UA header equals SYSTEM; POST actually goes through the session). Full suite (9 tests) green locally and in CI.

Code-reviewer approved; awaiting lucas42's sign-off, which will auto-merge. Consumers pick up the conforming UA once they bump to the new client version and redeploy.