fix(review): validate base Python lock closures

[seonghobae]

Root cause

OpenCode coverage run 30502031874, job 90743664244 selected Naruon backend/requirements-agent.txt as a standalone hash lock. Pip correctly rejected it under --require-hashes because its transitive httpx>=0.27 requirement is supplied by the sibling backend/requirements-hashes.txt closure.

Fix

• Preflight every trusted base Python candidate with pip --dry-run --ignore-installed --require-hashes --only-binary=:all:.
• Recover supplements only by preflighting all trusted candidates from the same source directory.
• Defer only recognized incomplete hash-closure or explicit foreign-interpreter failures.
• Fail closed on hash mismatch, registry/network failure, empty diagnostics, unknown resolver failure, or an unclassified group failure, with bounded source-aware logs.
• Preserve fix(review): add Nemotron Zen free fallback #659 exclusion of workflow-only CI hash locks.
• Copy and execute the installer only from the trusted central workflow source inside the networked image-build context.
• Deduplicate current-head central repository-dispatch runs under the actual OpenCode Review Dispatch workflow/title alias.

Current-head evidence

Head: bc00945e8b664c8000f8c94554790c89e5c9c6c7; base: 68e573e92561919bddcf529e5593e64888d595a0.

• CodeGraph resynchronized and re-explored for both fatal/deferable lock decisions and scheduler run deduplication.
• Full pytest: 700 passed.
• Focused lock/materializer/workflow/scheduler regression: 197 passed.
• New installer: 100% line and branch coverage (140 statements, 50 branches).
• Interrogate: 100% docstring coverage.
• Ruff lint, Python compile, YAML parse, and git diff --check: passed.
• Exact Naruon failure log (httpx>=0.27) is classified as an incomplete supplement; hash mismatch/network/unknown failures are fatal.
• Repository-wide Ruff format would rewrite thousands of pre-existing lines in the scheduler and is intentionally excluded as unrelated style debt; changed lines pass Ruff lint and the full test suite.

The hosted OpenCode/coverage rerun on this exact head is required before merge. Because repository-dispatch workflows execute the current default-branch workflow, the final production-path proof is a post-merge Naruon #1184 rerun that must log the recovered same-directory closure and pass coverage.

[coderabbitai]

📝 Walkthrough

Walkthrough

신뢰된 base Python 잠금 후보를 검증·preflight·그룹 복구 후 설치하는 CI 설치기가 추가되었습니다. Coverage Docker 빌드는 기존 inline pip 루프 대신 이 설치기를 사용하며, 관련 materializer 메시지와 계약 테스트가 갱신되었습니다.

Changes

Base Python 잠금 설치

Layer / File(s)	Summary
잠금 후보 검증 및 pip 명령 구성 scripts/ci/install_base_python_locks.py, tests/test_install_base_python_locks.py	manifest.json 항목과 materialized 잠금 파일의 형식·경로·파일 유형을 검증하고 hash-enforced preflight 명령과 제한된 실패 출력을 구성합니다.
Preflight 및 그룹 복구 설치 흐름 scripts/ci/install_base_python_locks.py, tests/test_install_base_python_locks.py	후보별 및 source 디렉터리별 preflight 결과로 설치 계획을 결정하고, 완결 closure만 설치하며 실패 후보는 건너뜁니다.
Coverage Docker 설치 경로 통합 .github/workflows/opencode-review-dispatch.yml, scripts/ci/materialize_base_python_requirements.py, tests/test_materialize_base_python_requirements.py, tests/test_opencode_agent_contract.py	Coverage Docker 빌드가 새 설치기를 복사·실행하도록 변경되고, 후보 없음 메시지와 워크플로우 계약 검증이 갱신되었습니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Coverage workflow
  participant Docker build
  participant install-base-python-locks.py
  participant pip
  Coverage workflow->>Docker build: 설치기와 base requirements 준비
  Docker build->>install-base-python-locks.py: --requirements-root 전달
  install-base-python-locks.py->>pip: 잠금 후보 preflight
  install-base-python-locks.py->>pip: 검증된 후보 설치

Loading

Possibly related PRs

• ContextualWisdomLab/.github#650: 신뢰된 coverage 도구체인에서 호환되지 않는 base requirement lock을 처리하는 변경과 새 설치기가 직접 연결됩니다.
• ContextualWisdomLab/.github#660: 동일한 Coverage Docker 빌드 단계의 base Python requirements 설치 경로를 수정합니다.
• ContextualWisdomLab/.github#644: 동일한 base Python lock materialization 경로와 관련된 파일명·테스트 기대값을 변경합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목이 신뢰된 base Python 락 클로저 검증이라는 핵심 변경을 간결하고 정확하게 요약합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-base-python-lock-groups

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Added a fail-closed preflight classification on current head d749ca1a123e928a2bd063d9cb55a30e27d3c552. The installer now defers only an incomplete hash closure that can be recovered from a same-directory lock group, or an explicit requires a different Python incompatibility. Hash mismatch, registry/network, empty diagnostic, unknown resolver, and fatal group-preflight failures stop the trusted image build with bounded source-aware logs.

Local evidence: focused lock/materializer/agent suite 71 passed; new installer line+branch coverage 100%; full suite 699 passed; Ruff lint/format, interrogate 100%, actionlint schema/expression validation (external analyzers disabled due host-wide shellcheck contention), YAML parse, and git diff --check passed.

[seonghobae]

Current-head follow-up for bc00945e8b664c8000f8c94554790c89e5c9c6c7:

• Reproduced a central scheduler deduplication defect: the live privileged workflow is named and titled OpenCode Review Dispatch, while the scheduler only classified the legacy Required OpenCode Review title. A targeted scheduler pass therefore created a second same-head run.
• Cancelled the newly created duplicate run 30506251117 and the superseded d749ca1a... same-head run after publishing this new head.
• Added the live workflow name to the accepted aliases and made repository-dispatch title matching accept both current and legacy aliases.
• Added a parametrized regression test for the deployed current title and the legacy title.

Local evidence:

• 700 passed in 76.85s (full suite)
• scheduler tests: 110 passed
• scheduler statement coverage: 1647/1647 (100%); the five reported partial branches are pre-existing and outside this change
• docstring coverage: 149/149 (100%)
• Ruff lint and git diff --check: clean

Hosted checks are running on this exact head. No user-owned strix_runs/ content was staged.

[seonghobae]

Merge audit for exact head bc00945e8b664c8000f8c94554790c89e5c9c6c7:

• All 46 current-head PR checks completed without a failing or pending check. CodeQL actions/python compatibility and merge-preview jobs, pip-audit, Bandit, Semgrep, OSV, Trivy, dependency review, secret scans, coverage, and Strix were green.
• Open code-scanning had no Medium/High/Critical alert; the only repository alert is a pre-existing Low Scorecard CIIBestPracticesID on refs/heads/main.
• Current non-outdated unresolved review threads: 0.
• Strix run 30506716802 produced only provider-error logs (OpenAI 429 and GitHub Models 403) and no vulnerability report artifact.
• The exact-head OpenCode run 30506990415 passed coverage, then remained inside the free Zen model pool without a verdict. This matches the unbounded free-provider pipeline defect documented in fix(review): bound free-provider failover #662; it was force-cancelled after the merge so no closed-PR review write could occur.
• Per the explicitly authorized pipeline-defect exception, the PR was SHA-guarded squash-merged as 68d3e75bb0ae482f66e4432052b20c95843ae3f3.
• The merge commit tree c77dedcc70af489c01c602d6331750993a4d3734 exactly matches the reviewed PR-head tree.
• Temporary policy bypass was removed immediately. Ruleset 17921150 is active with no bypass actors, 2 approvals, last-push approval, and thread resolution; branch protection is strict, admins are enforced, and force pushes/deletions remain disabled.