fix(coverage): restore validated npm workspace lock owners

[seonghobae]

Purpose

Restore the fail-closed npm workspace lock-owner resolver and its central OpenCode coverage integration as a focused current-main change.

A selected nested package such as BandScope apps/desktop must install from its nearest validated npm workspace owner instead of requiring an invalid duplicate lockfile beside every workspace package.

Rebuild state

The branch was reset to protected main at f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae because the previous stacked base had diverged and accidentally removed the verified LLVM 19 coverage toolchain while applying the workspace resolver. A bounded exact-parent repair now reapplies only the reviewed seven-file npm workspace ownership contract and its tests while preserving the current central control-plane baseline.

The temporary branch-repair helper and workflow must delete themselves before the verified product-policy commit is published. The final diff must contain exactly:

• .github/workflows/opencode-review-dispatch.yml
• docs/doctoring/npm-workspace-lock-ownership.md
• scripts/ci/npm_workspace_install_root.py
• tests/npm_workspace_test_support.py
• tests/test_npm_workspace_install_root.py
• tests/test_npm_workspace_install_root_hardening.py
• tests/test_opencode_agent_contract.py

Merge gate

This PR remains Draft until the rebuilt seven-file diff is published and exact-head focused/full tests, resolver statement/branch coverage 100%, production docstrings 100%, Python compilation, Ruff, workflow contracts, security workflows, OpenCode, Noema, CodeRabbit, qualifying independent approval, unresolved-thread policy, and branch protection all succeed.

No predecessor-head check or review result is reused.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5d9f10da-fc32-49dc-b952-28a98cef3dc1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stack correction: #731 was closed without merge on August 4, 2026, so it is not a valid remaining dependency and none of its checks or reviews are transferable. Keep this PR draft at exact head e280cd677ecb4e34a907574f3fcbee289aeab593. The current protected-baseline dependency is #743. After #743 merges, rebuild or reconcile this branch onto the resulting protected main, remove inherited CodeQL/Strix and historical control-plane overlap, reduce the final diff to the bounded workspace-lock-owner slice named in the description, and rerun all exact-head quality, security, supply-chain, OpenCode, Noema, independent-approval, unresolved-thread, and branch-protection gates. Do not mark ready before that reconciliation.

[seonghobae]

Exact-head downstream evidence from ContextualWisdomLab/bandscope#751 exposes an additional fail-closed npm-lock compatibility defect that should be covered before this workspace-owner slice is declared complete.

At BandScope head fa1dc9436a7cc0fc2aa0982159309e4c2b5502f4, central run 30992866042 rejects the valid npm v3 entry apps/desktop/node_modules/@types/react-dom because it has version/peer metadata but omits resolved and integrity. The exact protected base acdbea6344fe1231c39535b575f4de35e4c607c9 contains the same npm-generated entry, so this is not a Dependabot regression. validate_head_npm_lock() currently requires every non-link node_modules entry to carry its own registry tarball and SHA-512 value, which is stricter than real npm workspace lock serialization and blocks an otherwise fully green security update.

Please preserve the supply-chain boundary rather than broadly skipping incomplete entries. A reviewable acceptance rule is: permit a metadata-only nested entry only when the lock contains a canonical package entry for the same package identity/version whose resolved URL is exactly https://registry.npmjs.org/...tgz and whose integrity is one valid SHA-512 SRI; reject missing canonical metadata, version mismatch, ambiguous conflicting canonical entries, non-registry URLs, and invalid/missing integrity. Add positive BandScope-shaped workspace coverage plus negative mismatch/ambiguity/URL/integrity cases at 100% statement and branch coverage. The workspace-owner resolution and dependency-cache receipt checks should then consume the validated lock unchanged.

[seonghobae]

Closing this stale stacked draft. Its current head is the protected main commit f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae, while its base is the unmerged #759 feature branch, so the reported 33-file/102-commit diff does not represent the stated focused npm workspace resolver and cannot be safely reviewed or merged. Recreate the resolver as a clean current-main PR only after the surviving coverage/review baseline is integrated, preserving the validated lock-owner and BandScope regression contracts without inherited history.

[seonghobae]

Correction after re-reading the live branch: the stale stack was already reset and retargeted to protected main, and the current two-file diff is a bounded self-removing rebuild helper for the declared seven-file resolver slice. Reopening so that repair can finish. The PR must remain Draft and unmergeable until both helper files delete themselves, exactly the seven permanent files remain, 100% resolver coverage/docstrings and full current-head checks/reviews pass.