fix(coverage): admit exact base VCS sources

[seonghobae]

Outcome

OpenCode coverage can now test a protected base branch whose frozen uv lock contains an exact ContextualWisdomLab Git source dependency. Registry packages remain SHA-256 hash-required, and pull-request code still executes without network access or credentials.

Root cause

LineageWeave PR #355 repeatedly failed before tests because its protected base uv export includes RankWeave at a full Git commit while the central materializer previously accepted registry hash lines only.

Security boundary

• accepts only HTTPS GitHub ContextualWisdomLab repositories at full 40-character commits
• rejects symbolic refs, alternate origins, fragments, and conflicting revisions
• verifies fetched FETCH_HEAD and HEAD against the manifest
• removes Git metadata and exposes source without running build or installation hooks
• derives the manifest only from the validated base commit

Verification

• central Python quality suite: 1339 passed, 1 skipped, 16 subtests; 100% statement and branch coverage
• focused materializer and workflow contracts: 126 passed
• real LineageWeave uv export partition and exact RankWeave fetch/import probe passed
• actionlint native workflow validation and diff hygiene passed

Decision evidence and APA 7th references are recorded in docs/doctoring/opencode-exact-vcs-dependency-evidence.md.

---

Summary by CodeRabbit

• 개선 사항

  • 조직 소유 저장소의 Python 의존성을 특정 커밋으로 고정해 이미지 빌드에 안정적으로 반영합니다.
  • 의존성 출처와 커밋을 검증하며, 지원되지 않거나 충돌하는 설정은 빌드 전에 차단합니다.
  • 설치 과정의 실행 훅 없이 필요한 import 경로만 제공해 비밀 정보와 네트워크 접근 없이도 빌드·검증할 수 있습니다.

• 문서

  • 의존성 고정, 검증 기준, 안전 경계 및 테스트 범위를 관련 문서에 추가했습니다.

• 테스트

  • 정상적인 의존성 처리와 잘못된 저장소·커밋 설정에 대한 검증을 강화했습니다.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 47 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 55eb5328-5a90-4c14-a7f2-38af0ac1c9e8

📥 Commits

Reviewing files that changed from the base of the PR and between 72ad181 and 42a5229.

📒 Files selected for processing (5)

• .github/workflows/opencode-review-dispatch.yml
• CHANGELOG.md
• docs/doctoring/opencode-exact-vcs-dependency-evidence.md
• tests/test_opencode_agent_contract.py
• tests/test_pr_review_autofix_nvidia_nim_contract.py

📝 Walkthrough

Walkthrough

정확한 커밋으로 고정된 조직 VCS 의존성을 uv export 결과에서 분리합니다. 빌드가 해당 커밋을 검증하고 /opt/base-vcs-dependencies에 체크아웃합니다. 발견한 import root를 .pth에 등록하고 관련 신뢰 경계와 계약 테스트를 추가합니다.

Changes

정확한 VCS 의존성 흐름

Layer / File(s)	Summary
VCS export 분리와 검증 scripts/ci/materialize_base_python_requirements.py, tests/test_uv_export_isolation_contract.py	허용된 조직의 HTTPS Git 소스를 전체 커밋으로 인식합니다. 레지스트리 해시 의존성과 VCS 의존성을 분리합니다. 지원되지 않는 형식과 커밋 충돌을 거부합니다.
VCS manifest materialization scripts/ci/materialize_base_python_requirements.py, tests/test_materialize_base_python_requirements.py	잠금 파일에서 VCS 의존성을 수집합니다. 레지스트리 잠금과 분리된 vcs-manifest.json을 생성합니다. 빈 VCS 목록, VCS 전용 closure, 충돌 커밋을 검증합니다.
Docker VCS checkout과 import wiring .github/workflows/opencode-review-dispatch.yml, tests/test_opencode_agent_contract.py, tests/test_pr_review_autofix_nvidia_nim_contract.py	Docker 빌드가 manifest의 커밋을 shallow fetch하고 검증합니다. import root를 .pth에 등록합니다. 누락된 root와 권한 조건을 계약 테스트로 확인합니다.
신뢰 경계와 운영 문서 AGENTS.md, ARCHITECTURE.md, CHANGELOG.md, docs/doctoring/opencode-exact-vcs-dependency-evidence.md	허용된 VCS 형식, import-only 처리, 네트워크 격리, 검증 범위와 참고문헌을 문서화합니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🟡 Moderate · up to 72ad1

The workflow now admits exact Git-based sources, but its import-only validation still accepts unsupported package layouts or compiled extensions that the documented boundary forbids. That could allow unintended runtime code into the generated environment, so fail-closed validation and contract tests are needed before merge.

Sequence Diagram(s)

sequenceDiagram
  participant Docker_build
  participant vcs_manifest
  participant Git_repository
  participant Python_site_packages
  participant OpenCode_tests
  Docker_build->>vcs_manifest: VCS 의존성 manifest 읽기
  Docker_build->>Git_repository: 지정 커밋 shallow fetch 및 검증
  Git_repository-->>Docker_build: 검증된 소스 반환
  Docker_build->>Python_site_packages: import root를 .pth에 등록
  OpenCode_tests->>Python_site_packages: 설치 경로와 import root 검증

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 exact base VCS source를 허용하는 이번 변경의 핵심을 간결하게 설명합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 95.45% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 5 files. (5 skipped: 5 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/opencode-exact-vcs-base-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head follow-up verification for 163da58 completed after review repairs: 1339 passed, 1 skipped, 16 subtests; 100% statement and branch coverage across 8,317 statements and 3,208 branches. The focused VCS materializer gate remains 105 passed at 100%, focused workflow contracts 126 passed, docstrings 100%, actionlint native validation passed, and diff hygiene passed.

[seonghobae]

Exact-head revalidation after merging current main: 498c93a. Local focused VCS materialization and merged-main scheduler tests: 107 passed. Local full suite: 1,340 passed, 1 skipped, and 16 subtests passed. No force push or protection bypass was used.

[seonghobae]

@opencode-agent Review only exact current head 498c93a. Verify exact VCS dependency materialization, hash/commit identity checks, fork isolation, and all terminal hosted checks. Submit a formal Reviews API verdict without changing the branch, self-approving, or bypassing protection.

[seonghobae]

@opencode-agent Review only exact current head 72ad181 after its normal merge of current main. Verify exact VCS identity, the documented import-only fail-closed limits, unprivileged read permissions, registry hash preservation, and unchanged reviewer credential boundaries. Submit a formal Reviews API verdict without changing the branch, self-approving, or bypassing protection.

[seonghobae]

@opencode-agent Please review the exact current head 6e644df after the fail-closed VCS import-layout repair. Preserve the existing reviewer key and protected-merge policy.

[seonghobae]

Exact-head Strix RCA for 6e644df847bcda5bdeaaddafdcee621467018b05: the required Strix run 32539851878 completed successfully. Separate manual run 32539864490 reported Vulnerabilities 0, then failed before scanning because Strix local Caido loginAsGuest exhausted retries after curl exit 7 against 127.0.0.1:48080; its legacy strix status remains failure. #1213 carries the narrow central repair: only that exact scanner-local bootstrap signal is neutral when no positive vulnerability or severity exists, while every finding and other runtime failure stays fail-closed. Keep this PR on the protected path until #1213 is independently approved/merged and a new exact-head manual run supersedes the stale status; no status deletion or protection bypass is warranted.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🔍 Flat-layout path file exposes the whole dependency repo root

For a non-src layout, python_root resolves to the checkout root and that entire directory is added via the .pth file (opencode-review-dispatch.yml:797-799). Any top-level module in the fetched repo then joins sys.path and can shadow the product's own modules at test collection. The build rejects namespace roots, symlinks, extensions, and dist metadata, but not sibling top-level names.

---

Was this helpful? React with 👍 or 👎 to provide feedback.