From 30fe441c888d8800bc67ba8e8c3cde45372ffff4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:17:15 +0900
Subject: [PATCH 01/17] chore(ci): stage current-main workspace resolver
 rebuild

---
 scripts/ci/apply_pr748_current_main.py | 180 +++++++++++++++++++++++++
 1 file changed, 180 insertions(+)
 create mode 100644 scripts/ci/apply_pr748_current_main.py

diff --git a/scripts/ci/apply_pr748_current_main.py b/scripts/ci/apply_pr748_current_main.py
new file mode 100644
index 000000000..84264e51b
--- /dev/null
+++ b/scripts/ci/apply_pr748_current_main.py
@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""Reapply the reviewed npm-workspace resolver without regressing LLVM coverage.
+
+This temporary branch-repair helper derives one previously reviewed commit as a
+unified patch, removes only the unrelated LLVM-toolchain deletion hunks, applies
+the remaining patch with Git's three-way merge support, and fails closed on any
+unexpected file or residual conflict. The publishing workflow deletes this file
+before committing the verified product-policy tree.
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+
+REVIEWED_BASE = "4d076f636b6de5043e8501e93c06ed0a8c896eb3"
+REVIEWED_CHILD = "b715577b9e946ecad4bd00c9f8afc7b2a219e048"
+EXPECTED_MAIN_PARENT = "f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae"
+PATCH_PATH = Path("/tmp/pr748-current-main.patch")
+ALLOWED_PATHS = (
+    ".github/workflows/opencode-review-dispatch.yml",
+    "docs/doctoring/npm-workspace-lock-ownership.md",
+    "scripts/ci/npm_workspace_install_root.py",
+    "tests/npm_workspace_test_support.py",
+    "tests/test_npm_workspace_install_root.py",
+    "tests/test_npm_workspace_install_root_hardening.py",
+    "tests/test_opencode_agent_contract.py",
+)
+LLVM_PRESERVATION_TOKENS = (
+    "llvm-19",
+    "LLVM_COV",
+    "LLVM_PROFDATA",
+    "cargo-llvm-cov/releases/download",
+    "test_opencode_coverage_image_provisions_compatible_llvm_tools",
+)
+
+
+def _run(*args: str, capture: bool = False) -> subprocess.CompletedProcess[str]:
+    """Run one Git command with text-mode output and fail on any error."""
+
+    return subprocess.run(
+        args,
+        check=True,
+        text=True,
+        capture_output=capture,
+    )
+
+
+def _section_path(section: str) -> str:
+    """Return the repository path named by one unified-diff file section."""
+
+    first_line = section.splitlines()[0]
+    match = re.fullmatch(r"diff --git a/(.+) b/(.+)", first_line)
+    if match is None or match.group(1) != match.group(2):
+        raise SystemExit(f"unexpected diff header: {first_line!r}")
+    return match.group(1)
+
+
+def _filter_reviewed_patch(patch: str) -> str:
+    """Keep the seven-file resolver patch while preserving LLVM hunks."""
+
+    sections = [
+        part
+        for part in re.split(r"(?=^diff --git )", patch, flags=re.MULTILINE)
+        if part.strip()
+    ]
+    if not sections:
+        raise SystemExit("reviewed child commit produced no patch")
+
+    seen: set[str] = set()
+    filtered_sections: list[str] = []
+    for section in sections:
+        path = _section_path(section)
+        if path not in ALLOWED_PATHS:
+            raise SystemExit(f"unexpected path in reviewed patch: {path}")
+        if path in seen:
+            raise SystemExit(f"duplicate path in reviewed patch: {path}")
+        seen.add(path)
+
+        if path not in {
+            ".github/workflows/opencode-review-dispatch.yml",
+            "tests/test_opencode_agent_contract.py",
+        }:
+            filtered_sections.append(section)
+            continue
+
+        parts = re.split(r"(?=^@@ )", section, flags=re.MULTILINE)
+        header, hunks = parts[0], parts[1:]
+        kept_hunks = [
+            hunk
+            for hunk in hunks
+            if not any(token in hunk for token in LLVM_PRESERVATION_TOKENS)
+        ]
+        if not kept_hunks:
+            raise SystemExit(f"filter removed every hunk for required path: {path}")
+        filtered_sections.append(header + "".join(kept_hunks))
+
+    if seen != set(ALLOWED_PATHS):
+        missing = sorted(set(ALLOWED_PATHS) - seen)
+        raise SystemExit(f"reviewed patch is missing required paths: {missing}")
+
+    filtered = "".join(filtered_sections)
+    for line in filtered.splitlines():
+        if line.startswith("-") and any(
+            token in line for token in LLVM_PRESERVATION_TOKENS
+        ):
+            raise SystemExit(f"filtered patch still deletes LLVM contract: {line}")
+    return filtered
+
+
+def _verify_applied_tree() -> None:
+    """Verify the staged tree contains the resolver and preserved toolchain."""
+
+    workflow = Path(
+        ".github/workflows/opencode-review-dispatch.yml"
+    ).read_text(encoding="utf-8")
+    required_workflow_fragments = (
+        "llvm-19",
+        "ENV LLVM_COV=/usr/bin/llvm-cov-19",
+        "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19",
+        "resolve_npm_package_root()",
+        "resolve_npm_install_root()",
+        "npm_workspace_install_root.py",
+        '--workspace "$npm_workspace_selector"',
+    )
+    for fragment in required_workflow_fragments:
+        if fragment not in workflow:
+            raise SystemExit(f"required workflow fragment is absent: {fragment}")
+
+    changed = set(
+        _run(
+            "git",
+            "diff",
+            "--cached",
+            "--name-only",
+            capture=True,
+        ).stdout.splitlines()
+    )
+    if changed != set(ALLOWED_PATHS):
+        raise SystemExit(
+            "staged product-policy scope mismatch: "
+            f"expected={sorted(ALLOWED_PATHS)}, actual={sorted(changed)}"
+        )
+
+
+def main() -> int:
+    """Apply the reviewed resolver patch to the exact protected-main parent."""
+
+    current = _run("git", "rev-parse", "HEAD", capture=True).stdout.strip()
+    if current == EXPECTED_MAIN_PARENT:
+        pass
+    else:
+        parent = _run("git", "rev-parse", "HEAD^", capture=True).stdout.strip()
+        if parent != EXPECTED_MAIN_PARENT:
+            raise SystemExit(
+                "repair trigger is not based on the reviewed protected-main parent: "
+                f"current={current}, parent={parent}"
+            )
+
+    patch = _run(
+        "git",
+        "diff",
+        "--binary",
+        REVIEWED_BASE,
+        REVIEWED_CHILD,
+        "--",
+        *ALLOWED_PATHS,
+        capture=True,
+    ).stdout
+    PATCH_PATH.write_text(_filter_reviewed_patch(patch), encoding="utf-8")
+    _run("git", "apply", "--3way", "--index", str(PATCH_PATH))
+    _run("git", "diff", "--cached", "--check")
+    _verify_applied_tree()
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

From 9b75e0a7d72780ebc2b3ca00def4eba4ceaab0bc Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:18:58 +0900
Subject: [PATCH 02/17] chore(ci): bind resolver repair to exact temporary
 scope

---
 scripts/ci/apply_pr748_current_main.py | 42 +++++++++++++++++++-------
 1 file changed, 31 insertions(+), 11 deletions(-)

diff --git a/scripts/ci/apply_pr748_current_main.py b/scripts/ci/apply_pr748_current_main.py
index 84264e51b..fc0bfbf18 100644
--- a/scripts/ci/apply_pr748_current_main.py
+++ b/scripts/ci/apply_pr748_current_main.py
@@ -28,6 +28,10 @@
     "tests/test_npm_workspace_install_root_hardening.py",
     "tests/test_opencode_agent_contract.py",
 )
+TEMPORARY_PATHS = (
+    ".github/workflows/rebuild-pr748-current-main.yml",
+    "scripts/ci/apply_pr748_current_main.py",
+)
 LLVM_PRESERVATION_TOKENS = (
     "llvm-19",
     "LLVM_COV",
@@ -145,20 +149,36 @@ def _verify_applied_tree() -> None:
         )
 
 
+def _verify_trigger_scope() -> None:
+    """Require the trigger branch to contain only the two temporary files."""
+
+    _run(
+        "git",
+        "merge-base",
+        "--is-ancestor",
+        EXPECTED_MAIN_PARENT,
+        "HEAD",
+    )
+    temporary_diff = set(
+        _run(
+            "git",
+            "diff",
+            "--name-only",
+            f"{EXPECTED_MAIN_PARENT}...HEAD",
+            capture=True,
+        ).stdout.splitlines()
+    )
+    if temporary_diff != set(TEMPORARY_PATHS):
+        raise SystemExit(
+            "repair trigger scope mismatch: "
+            f"expected={sorted(TEMPORARY_PATHS)}, actual={sorted(temporary_diff)}"
+        )
+
+
 def main() -> int:
     """Apply the reviewed resolver patch to the exact protected-main parent."""
 
-    current = _run("git", "rev-parse", "HEAD", capture=True).stdout.strip()
-    if current == EXPECTED_MAIN_PARENT:
-        pass
-    else:
-        parent = _run("git", "rev-parse", "HEAD^", capture=True).stdout.strip()
-        if parent != EXPECTED_MAIN_PARENT:
-            raise SystemExit(
-                "repair trigger is not based on the reviewed protected-main parent: "
-                f"current={current}, parent={parent}"
-            )
-
+    _verify_trigger_scope()
     patch = _run(
         "git",
         "diff",

From 01599291cada3ecb3644d292b0bc431ae830ba27 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:20:17 +0900
Subject: [PATCH 03/17] chore(ci): trigger current-main workspace resolver
 rebuild

---
 .../workflows/rebuild-pr748-current-main.yml  | 146 ++++++++++++++++++
 1 file changed, 146 insertions(+)
 create mode 100644 .github/workflows/rebuild-pr748-current-main.yml

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
new file mode 100644
index 000000000..06f3148c3
--- /dev/null
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -0,0 +1,146 @@
+name: Rebuild PR 748 on current main
+
+on:
+  push:
+    branches:
+      - fix/npm-workspace-coverage-root-clean
+    paths:
+      - .github/workflows/rebuild-pr748-current-main.yml
+
+concurrency:
+  group: rebuild-pr748-current-main
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  PYTHONWARNINGS: error
+
+jobs:
+  rebuild:
+    if: >-
+      github.repository == 'ContextualWisdomLab/.github' &&
+      github.actor != 'github-actions[bot]' &&
+      github.ref == 'refs/heads/fix/npm-workspace-coverage-root-clean'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact trigger
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Verify exact trigger and apply reviewed patch
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD^)" = "9b75e0a7d72780ebc2b3ca00def4eba4ceaab0bc"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          python3 -m py_compile scripts/ci/apply_pr748_current_main.py
+          python3 scripts/ci/apply_pr748_current_main.py
+          git diff --cached --check
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install hash-locked central test dependencies
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Verify focused behavior and complete resolver coverage
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python -m coverage erase
+          python -m coverage run --branch -m pytest -q \
+            tests/test_npm_workspace_install_root.py \
+            tests/test_npm_workspace_install_root_hardening.py
+          python -m coverage report \
+            --include=scripts/ci/npm_workspace_install_root.py \
+            --fail-under=100 \
+            --show-missing
+          interrogate -vv --fail-under=100 scripts/ci/npm_workspace_install_root.py
+          python -m pytest -q tests/test_opencode_agent_contract.py
+          python -m compileall -q \
+            scripts/ci/npm_workspace_install_root.py \
+            tests/npm_workspace_test_support.py \
+            tests/test_npm_workspace_install_root.py \
+            tests/test_npm_workspace_install_root_hardening.py \
+            tests/test_opencode_agent_contract.py
+          ruff check \
+            scripts/ci/npm_workspace_install_root.py \
+            tests/npm_workspace_test_support.py \
+            tests/test_npm_workspace_install_root.py \
+            tests/test_npm_workspace_install_root_hardening.py \
+            tests/test_opencode_agent_contract.py
+
+      - name: Verify full central regression suite and workflow contract
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python -m pytest -q
+          python - <<'PY'
+          from pathlib import Path
+          import yaml
+
+          workflow_path = Path('.github/workflows/opencode-review-dispatch.yml')
+          workflow = workflow_path.read_text(encoding='utf-8')
+          yaml.safe_load(workflow)
+          required = (
+              'llvm-19',
+              'ENV LLVM_COV=/usr/bin/llvm-cov-19',
+              'ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19',
+              'resolve_npm_package_root()',
+              'resolve_npm_install_root()',
+              'npm_workspace_install_root.py',
+              '--workspace "$npm_workspace_selector"',
+          )
+          missing = [fragment for fragment in required if fragment not in workflow]
+          if missing:
+              raise SystemExit(f'missing workflow contracts: {missing}')
+          PY
+          git diff --check
+
+      - name: Publish verified seven-file product-policy diff
+        env:
+          PUSH_TOKEN: ${{ github.token }}
+          TARGET_BRANCH: fix/npm-workspace-coverage-root-clean
+          REVIEWED_MAIN: f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          rm -f \
+            .coverage \
+            .github/workflows/rebuild-pr748-current-main.yml \
+            scripts/ci/apply_pr748_current_main.py
+          git add -A
+          git diff --cached --check
+          actual_files="$(git diff --cached --name-only "$REVIEWED_MAIN" | sort)"
+          expected_files="$(printf '%s\n' \
+            .github/workflows/opencode-review-dispatch.yml \
+            docs/doctoring/npm-workspace-lock-ownership.md \
+            scripts/ci/npm_workspace_install_root.py \
+            tests/npm_workspace_test_support.py \
+            tests/test_npm_workspace_install_root.py \
+            tests/test_npm_workspace_install_root_hardening.py \
+            tests/test_opencode_agent_contract.py | sort)"
+          test "$actual_files" = "$expected_files"
+          test ! -e .github/workflows/rebuild-pr748-current-main.yml
+          test ! -e scripts/ci/apply_pr748_current_main.py
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "fix(coverage): restore validated npm workspace lock owners"
+          auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')"
+          echo "::add-mask::$auth_header"
+          git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \
+            push origin "HEAD:${TARGET_BRANCH}"

From d4a0a91e48bb290abb6d8942d04a92dff603a5f2 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:29:31 +0900
Subject: [PATCH 04/17] fix(ci): fetch reviewed resolver commits explicitly

---
 scripts/ci/apply_pr748_current_main.py | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/scripts/ci/apply_pr748_current_main.py b/scripts/ci/apply_pr748_current_main.py
index fc0bfbf18..5c7f94c30 100644
--- a/scripts/ci/apply_pr748_current_main.py
+++ b/scripts/ci/apply_pr748_current_main.py
@@ -52,6 +52,23 @@ def _run(*args: str, capture: bool = False) -> subprocess.CompletedProcess[str]:
     )
 
 
+def _ensure_reviewed_commit(commit_sha: str) -> None:
+    """Fetch one exact reviewed commit when branch rewrites made it unreachable."""
+
+    try:
+        _run("git", "cat-file", "-e", f"{commit_sha}^{{commit}}")
+    except subprocess.CalledProcessError:
+        _run(
+            "git",
+            "fetch",
+            "--no-tags",
+            "--depth=1",
+            "origin",
+            commit_sha,
+        )
+        _run("git", "cat-file", "-e", f"{commit_sha}^{{commit}}")
+
+
 def _section_path(section: str) -> str:
     """Return the repository path named by one unified-diff file section."""
 
@@ -179,6 +196,8 @@ def main() -> int:
     """Apply the reviewed resolver patch to the exact protected-main parent."""
 
     _verify_trigger_scope()
+    _ensure_reviewed_commit(REVIEWED_BASE)
+    _ensure_reviewed_commit(REVIEWED_CHILD)
     patch = _run(
         "git",
         "diff",

From fd2e428b01f6c4cc42dfc913dd041b7cc3f591a6 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:30:35 +0900
Subject: [PATCH 05/17] fix(ci): retrigger resolver rebuild with reviewed
 commit fetch

---
 .github/workflows/rebuild-pr748-current-main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
index 06f3148c3..a5c448a0f 100644
--- a/.github/workflows/rebuild-pr748-current-main.yml
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Verify exact trigger and apply reviewed patch
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
-          test "$(git rev-parse HEAD^)" = "9b75e0a7d72780ebc2b3ca00def4eba4ceaab0bc"
+          test "$(git rev-parse HEAD^)" = "d4a0a91e48bb290abb6d8942d04a92dff603a5f2"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           python3 -m py_compile scripts/ci/apply_pr748_current_main.py
           python3 scripts/ci/apply_pr748_current_main.py

From 07f4e13a0daf17d9c12a5cbf227e9e273b51617b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:45:36 +0900
Subject: [PATCH 06/17] fix(ci): rebuild workspace contract without stale test
 hunk

---
 scripts/ci/apply_pr748_current_main.py | 113 +++++++++++++++----------
 1 file changed, 68 insertions(+), 45 deletions(-)

diff --git a/scripts/ci/apply_pr748_current_main.py b/scripts/ci/apply_pr748_current_main.py
index 5c7f94c30..a50db8176 100644
--- a/scripts/ci/apply_pr748_current_main.py
+++ b/scripts/ci/apply_pr748_current_main.py
@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
 """Reapply the reviewed npm-workspace resolver without regressing LLVM coverage.
 
-This temporary branch-repair helper derives one previously reviewed commit as a
-unified patch, removes only the unrelated LLVM-toolchain deletion hunks, applies
-the remaining patch with Git's three-way merge support, and fails closed on any
-unexpected file or residual conflict. The publishing workflow deletes this file
-before committing the verified product-policy tree.
+This temporary branch-repair helper derives the six nonconflicting product and
+resolver-test files from one previously reviewed commit, removes only the
+unrelated LLVM-toolchain deletion hunk from the central workflow, and adds a
+current-main-compatible workflow contract test directly. The publishing
+workflow deletes this helper before committing the verified product-policy tree.
 """
 
 from __future__ import annotations
@@ -19,15 +19,16 @@
 REVIEWED_CHILD = "b715577b9e946ecad4bd00c9f8afc7b2a219e048"
 EXPECTED_MAIN_PARENT = "f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae"
 PATCH_PATH = Path("/tmp/pr748-current-main.patch")
-ALLOWED_PATHS = (
+CONTRACT_PATH = Path("tests/test_opencode_agent_contract.py")
+PATCH_PATHS = (
     ".github/workflows/opencode-review-dispatch.yml",
     "docs/doctoring/npm-workspace-lock-ownership.md",
     "scripts/ci/npm_workspace_install_root.py",
     "tests/npm_workspace_test_support.py",
     "tests/test_npm_workspace_install_root.py",
     "tests/test_npm_workspace_install_root_hardening.py",
-    "tests/test_opencode_agent_contract.py",
 )
+FINAL_PATHS = PATCH_PATHS + (str(CONTRACT_PATH),)
 TEMPORARY_PATHS = (
     ".github/workflows/rebuild-pr748-current-main.yml",
     "scripts/ci/apply_pr748_current_main.py",
@@ -37,8 +38,35 @@
     "LLVM_COV",
     "LLVM_PROFDATA",
     "cargo-llvm-cov/releases/download",
-    "test_opencode_coverage_image_provisions_compatible_llvm_tools",
 )
+CONTRACT_FUNCTION = "test_opencode_coverage_resolves_validated_npm_workspace_lock_owner"
+CONTRACT_TEST = r'''
+
+
+def test_opencode_coverage_resolves_validated_npm_workspace_lock_owner():
+    """Guard nested npm packages against invalid duplicate-lock requirements."""
+    workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(
+        encoding="utf-8"
+    )
+
+    assert "resolve_npm_package_root()" in workflow
+    assert "resolve_npm_install_root()" in workflow
+    assert (
+        'python3 -I "$GITHUB_WORKSPACE/scripts/ci/npm_workspace_install_root.py"'
+        in workflow
+    )
+    assert 'trusted_npm_lock_is_materialized "$npm_install_root"' in workflow
+    assert 'npm_workspace_args=(--workspace "$npm_workspace_selector")' in workflow
+    assert 'install_package_dependencies "$package_runner" "$package_dir"' in workflow
+    assert "npm workspace-root offline ci, lifecycle hooks disabled" in workflow
+    assert "npm ci --offline --ignore-scripts" in workflow
+    assert "ContextualWisdomLab/.github:scripts/ci/npm_workspace_install_root.py" in workflow
+    assert "ContextualWisdomLab/.github:tests/test_npm_workspace_install_root.py" in workflow
+    assert (
+        "ContextualWisdomLab/.github:tests/"
+        "test_npm_workspace_install_root_hardening.py" in workflow
+    )
+'''
 
 
 def _run(*args: str, capture: bool = False) -> subprocess.CompletedProcess[str]:
@@ -58,14 +86,7 @@ def _ensure_reviewed_commit(commit_sha: str) -> None:
     try:
         _run("git", "cat-file", "-e", f"{commit_sha}^{{commit}}")
     except subprocess.CalledProcessError:
-        _run(
-            "git",
-            "fetch",
-            "--no-tags",
-            "--depth=1",
-            "origin",
-            commit_sha,
-        )
+        _run("git", "fetch", "--no-tags", "--depth=1", "origin", commit_sha)
         _run("git", "cat-file", "-e", f"{commit_sha}^{{commit}}")
 
 
@@ -80,7 +101,7 @@ def _section_path(section: str) -> str:
 
 
 def _filter_reviewed_patch(patch: str) -> str:
-    """Keep the seven-file resolver patch while preserving LLVM hunks."""
+    """Keep the six resolver files while preserving current LLVM setup."""
 
     sections = [
         part
@@ -94,16 +115,13 @@ def _filter_reviewed_patch(patch: str) -> str:
     filtered_sections: list[str] = []
     for section in sections:
         path = _section_path(section)
-        if path not in ALLOWED_PATHS:
+        if path not in PATCH_PATHS:
             raise SystemExit(f"unexpected path in reviewed patch: {path}")
         if path in seen:
             raise SystemExit(f"duplicate path in reviewed patch: {path}")
         seen.add(path)
 
-        if path not in {
-            ".github/workflows/opencode-review-dispatch.yml",
-            "tests/test_opencode_agent_contract.py",
-        }:
+        if path != ".github/workflows/opencode-review-dispatch.yml":
             filtered_sections.append(section)
             continue
 
@@ -115,11 +133,11 @@ def _filter_reviewed_patch(patch: str) -> str:
             if not any(token in hunk for token in LLVM_PRESERVATION_TOKENS)
         ]
         if not kept_hunks:
-            raise SystemExit(f"filter removed every hunk for required path: {path}")
+            raise SystemExit("filter removed every central workflow hunk")
         filtered_sections.append(header + "".join(kept_hunks))
 
-    if seen != set(ALLOWED_PATHS):
-        missing = sorted(set(ALLOWED_PATHS) - seen)
+    if seen != set(PATCH_PATHS):
+        missing = sorted(set(PATCH_PATHS) - seen)
         raise SystemExit(f"reviewed patch is missing required paths: {missing}")
 
     filtered = "".join(filtered_sections)
@@ -131,12 +149,24 @@ def _filter_reviewed_patch(patch: str) -> str:
     return filtered
 
 
+def _add_current_contract_test() -> None:
+    """Add a conflict-free workflow contract to the current-main test file."""
+
+    text = CONTRACT_PATH.read_text(encoding="utf-8")
+    if CONTRACT_FUNCTION in text:
+        raise SystemExit("npm workspace contract test already exists unexpectedly")
+    if not text.endswith("\n"):
+        text += "\n"
+    CONTRACT_PATH.write_text(text.rstrip() + CONTRACT_TEST + "\n", encoding="utf-8")
+    _run("git", "add", str(CONTRACT_PATH))
+
+
 def _verify_applied_tree() -> None:
     """Verify the staged tree contains the resolver and preserved toolchain."""
 
-    workflow = Path(
-        ".github/workflows/opencode-review-dispatch.yml"
-    ).read_text(encoding="utf-8")
+    workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(
+        encoding="utf-8"
+    )
     required_workflow_fragments = (
         "llvm-19",
         "ENV LLVM_COV=/usr/bin/llvm-cov-19",
@@ -150,32 +180,24 @@ def _verify_applied_tree() -> None:
         if fragment not in workflow:
             raise SystemExit(f"required workflow fragment is absent: {fragment}")
 
+    contract = CONTRACT_PATH.read_text(encoding="utf-8")
+    if contract.count(f"def {CONTRACT_FUNCTION}(") != 1:
+        raise SystemExit("current-main npm workspace contract test is not unique")
+
     changed = set(
-        _run(
-            "git",
-            "diff",
-            "--cached",
-            "--name-only",
-            capture=True,
-        ).stdout.splitlines()
+        _run("git", "diff", "--cached", "--name-only", capture=True).stdout.splitlines()
     )
-    if changed != set(ALLOWED_PATHS):
+    if changed != set(FINAL_PATHS):
         raise SystemExit(
             "staged product-policy scope mismatch: "
-            f"expected={sorted(ALLOWED_PATHS)}, actual={sorted(changed)}"
+            f"expected={sorted(FINAL_PATHS)}, actual={sorted(changed)}"
         )
 
 
 def _verify_trigger_scope() -> None:
     """Require the trigger branch to contain only the two temporary files."""
 
-    _run(
-        "git",
-        "merge-base",
-        "--is-ancestor",
-        EXPECTED_MAIN_PARENT,
-        "HEAD",
-    )
+    _run("git", "merge-base", "--is-ancestor", EXPECTED_MAIN_PARENT, "HEAD")
     temporary_diff = set(
         _run(
             "git",
@@ -205,11 +227,12 @@ def main() -> int:
         REVIEWED_BASE,
         REVIEWED_CHILD,
         "--",
-        *ALLOWED_PATHS,
+        *PATCH_PATHS,
         capture=True,
     ).stdout
     PATCH_PATH.write_text(_filter_reviewed_patch(patch), encoding="utf-8")
     _run("git", "apply", "--3way", "--index", str(PATCH_PATH))
+    _add_current_contract_test()
     _run("git", "diff", "--cached", "--check")
     _verify_applied_tree()
     return 0

From cf865bc9a43d638bd092b1f995a46b2e1393e851 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:46:24 +0900
Subject: [PATCH 07/17] fix(ci): retrigger conflict-free workspace resolver
 rebuild

---
 .github/workflows/rebuild-pr748-current-main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
index a5c448a0f..d0deec2f5 100644
--- a/.github/workflows/rebuild-pr748-current-main.yml
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Verify exact trigger and apply reviewed patch
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
-          test "$(git rev-parse HEAD^)" = "d4a0a91e48bb290abb6d8942d04a92dff603a5f2"
+          test "$(git rev-parse HEAD^)" = "07f4e13a0daf17d9c12a5cbf227e9e273b51617b"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           python3 -m py_compile scripts/ci/apply_pr748_current_main.py
           python3 scripts/ci/apply_pr748_current_main.py

From 16f0b9122c9ce8e32aa5ea2ac2ab0f5cbff578de Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:49:26 +0900
Subject: [PATCH 08/17] fix(ci): keep rebuilt contract free of trailing
 whitespace

---
 scripts/ci/apply_pr748_current_main.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/scripts/ci/apply_pr748_current_main.py b/scripts/ci/apply_pr748_current_main.py
index a50db8176..78df85810 100644
--- a/scripts/ci/apply_pr748_current_main.py
+++ b/scripts/ci/apply_pr748_current_main.py
@@ -155,9 +155,10 @@ def _add_current_contract_test() -> None:
     text = CONTRACT_PATH.read_text(encoding="utf-8")
     if CONTRACT_FUNCTION in text:
         raise SystemExit("npm workspace contract test already exists unexpectedly")
-    if not text.endswith("\n"):
-        text += "\n"
-    CONTRACT_PATH.write_text(text.rstrip() + CONTRACT_TEST + "\n", encoding="utf-8")
+    CONTRACT_PATH.write_text(
+        text.rstrip() + CONTRACT_TEST.rstrip() + "\n",
+        encoding="utf-8",
+    )
     _run("git", "add", str(CONTRACT_PATH))
 
 

From c0658307270690983968ef579879b267842b00c0 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:50:13 +0900
Subject: [PATCH 09/17] fix(ci): retrigger whitespace-clean workspace resolver
 rebuild

---
 .github/workflows/rebuild-pr748-current-main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
index d0deec2f5..05b8d7db9 100644
--- a/.github/workflows/rebuild-pr748-current-main.yml
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Verify exact trigger and apply reviewed patch
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
-          test "$(git rev-parse HEAD^)" = "07f4e13a0daf17d9c12a5cbf227e9e273b51617b"
+          test "$(git rev-parse HEAD^)" = "16f0b9122c9ce8e32aa5ea2ac2ab0f5cbff578de"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           python3 -m py_compile scripts/ci/apply_pr748_current_main.py
           python3 scripts/ci/apply_pr748_current_main.py

From 810c7c9d69410701b78d0d636c0f0e8224f49e88 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:56:01 +0900
Subject: [PATCH 10/17] fix(ci): keep workspace rebuild scoped to protected
 main

---
 scripts/ci/apply_pr748_current_main.py | 74 +++++++-------------------
 1 file changed, 20 insertions(+), 54 deletions(-)

diff --git a/scripts/ci/apply_pr748_current_main.py b/scripts/ci/apply_pr748_current_main.py
index 78df85810..a0a9e9c85 100644
--- a/scripts/ci/apply_pr748_current_main.py
+++ b/scripts/ci/apply_pr748_current_main.py
@@ -1,11 +1,12 @@
 #!/usr/bin/env python3
-"""Reapply the reviewed npm-workspace resolver without regressing LLVM coverage.
+"""Reapply the reviewed npm-workspace resolver to protected current main.
 
 This temporary branch-repair helper derives the six nonconflicting product and
-resolver-test files from one previously reviewed commit, removes only the
-unrelated LLVM-toolchain deletion hunk from the central workflow, and adds a
-current-main-compatible workflow contract test directly. The publishing
-workflow deletes this helper before committing the verified product-policy tree.
+resolver-test files from one previously reviewed commit and adds a
+current-main-compatible workflow contract test directly. It deliberately does
+not import unrelated coverage-toolchain work from another pull request. The
+publishing workflow deletes this helper before committing the verified
+product-policy tree.
 """
 
 from __future__ import annotations
@@ -33,12 +34,6 @@
     ".github/workflows/rebuild-pr748-current-main.yml",
     "scripts/ci/apply_pr748_current_main.py",
 )
-LLVM_PRESERVATION_TOKENS = (
-    "llvm-19",
-    "LLVM_COV",
-    "LLVM_PROFDATA",
-    "cargo-llvm-cov/releases/download",
-)
 CONTRACT_FUNCTION = "test_opencode_coverage_resolves_validated_npm_workspace_lock_owner"
 CONTRACT_TEST = r'''
 
@@ -100,8 +95,8 @@ def _section_path(section: str) -> str:
     return match.group(1)
 
 
-def _filter_reviewed_patch(patch: str) -> str:
-    """Keep the six resolver files while preserving current LLVM setup."""
+def _validate_reviewed_patch(patch: str) -> str:
+    """Require the reviewed patch to contain exactly the six expected files."""
 
     sections = [
         part
@@ -111,42 +106,15 @@ def _filter_reviewed_patch(patch: str) -> str:
     if not sections:
         raise SystemExit("reviewed child commit produced no patch")
 
-    seen: set[str] = set()
-    filtered_sections: list[str] = []
-    for section in sections:
-        path = _section_path(section)
-        if path not in PATCH_PATHS:
-            raise SystemExit(f"unexpected path in reviewed patch: {path}")
-        if path in seen:
-            raise SystemExit(f"duplicate path in reviewed patch: {path}")
-        seen.add(path)
-
-        if path != ".github/workflows/opencode-review-dispatch.yml":
-            filtered_sections.append(section)
-            continue
-
-        parts = re.split(r"(?=^@@ )", section, flags=re.MULTILINE)
-        header, hunks = parts[0], parts[1:]
-        kept_hunks = [
-            hunk
-            for hunk in hunks
-            if not any(token in hunk for token in LLVM_PRESERVATION_TOKENS)
-        ]
-        if not kept_hunks:
-            raise SystemExit("filter removed every central workflow hunk")
-        filtered_sections.append(header + "".join(kept_hunks))
-
-    if seen != set(PATCH_PATHS):
-        missing = sorted(set(PATCH_PATHS) - seen)
-        raise SystemExit(f"reviewed patch is missing required paths: {missing}")
-
-    filtered = "".join(filtered_sections)
-    for line in filtered.splitlines():
-        if line.startswith("-") and any(
-            token in line for token in LLVM_PRESERVATION_TOKENS
-        ):
-            raise SystemExit(f"filtered patch still deletes LLVM contract: {line}")
-    return filtered
+    seen = [_section_path(section) for section in sections]
+    if len(seen) != len(set(seen)):
+        raise SystemExit(f"reviewed patch contains duplicate file sections: {seen}")
+    if set(seen) != set(PATCH_PATHS):
+        raise SystemExit(
+            "reviewed patch scope mismatch: "
+            f"expected={sorted(PATCH_PATHS)}, actual={sorted(seen)}"
+        )
+    return patch
 
 
 def _add_current_contract_test() -> None:
@@ -163,19 +131,17 @@ def _add_current_contract_test() -> None:
 
 
 def _verify_applied_tree() -> None:
-    """Verify the staged tree contains the resolver and preserved toolchain."""
+    """Verify the staged tree contains the complete npm workspace contract."""
 
     workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(
         encoding="utf-8"
     )
     required_workflow_fragments = (
-        "llvm-19",
-        "ENV LLVM_COV=/usr/bin/llvm-cov-19",
-        "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19",
         "resolve_npm_package_root()",
         "resolve_npm_install_root()",
         "npm_workspace_install_root.py",
         '--workspace "$npm_workspace_selector"',
+        "npm workspace-root offline ci, lifecycle hooks disabled",
     )
     for fragment in required_workflow_fragments:
         if fragment not in workflow:
@@ -231,7 +197,7 @@ def main() -> int:
         *PATCH_PATHS,
         capture=True,
     ).stdout
-    PATCH_PATH.write_text(_filter_reviewed_patch(patch), encoding="utf-8")
+    PATCH_PATH.write_text(_validate_reviewed_patch(patch), encoding="utf-8")
     _run("git", "apply", "--3way", "--index", str(PATCH_PATH))
     _add_current_contract_test()
     _run("git", "diff", "--cached", "--check")

From 13547eaa99f70fb6a1cb46d102208a28270e749b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 21:57:04 +0900
Subject: [PATCH 11/17] fix(ci): retrigger focused current-main resolver
 rebuild

---
 .github/workflows/rebuild-pr748-current-main.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
index 05b8d7db9..bb62ce958 100644
--- a/.github/workflows/rebuild-pr748-current-main.yml
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Verify exact trigger and apply reviewed patch
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
-          test "$(git rev-parse HEAD^)" = "16f0b9122c9ce8e32aa5ea2ac2ab0f5cbff578de"
+          test "$(git rev-parse HEAD^)" = "810c7c9d69410701b78d0d636c0f0e8224f49e88"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           python3 -m py_compile scripts/ci/apply_pr748_current_main.py
           python3 scripts/ci/apply_pr748_current_main.py
@@ -98,13 +98,11 @@ jobs:
           workflow = workflow_path.read_text(encoding='utf-8')
           yaml.safe_load(workflow)
           required = (
-              'llvm-19',
-              'ENV LLVM_COV=/usr/bin/llvm-cov-19',
-              'ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19',
               'resolve_npm_package_root()',
               'resolve_npm_install_root()',
               'npm_workspace_install_root.py',
               '--workspace "$npm_workspace_selector"',
+              'npm workspace-root offline ci, lifecycle hooks disabled',
           )
           missing = [fragment for fragment in required if fragment not in workflow]
           if missing:

From 4512b35ec4e5dd10a082ef13b741b2e70ef3f76e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 22:00:08 +0900
Subject: [PATCH 12/17] fix(ci): preserve current-main npm diagnostic contract

---
 scripts/ci/apply_pr748_current_main.py | 41 ++++++++++++++++++++------
 1 file changed, 32 insertions(+), 9 deletions(-)

diff --git a/scripts/ci/apply_pr748_current_main.py b/scripts/ci/apply_pr748_current_main.py
index a0a9e9c85..2b9e8be4d 100644
--- a/scripts/ci/apply_pr748_current_main.py
+++ b/scripts/ci/apply_pr748_current_main.py
@@ -2,9 +2,10 @@
 """Reapply the reviewed npm-workspace resolver to protected current main.
 
 This temporary branch-repair helper derives the six nonconflicting product and
-resolver-test files from one previously reviewed commit and adds a
-current-main-compatible workflow contract test directly. It deliberately does
-not import unrelated coverage-toolchain work from another pull request. The
+resolver-test files from one previously reviewed commit, normalizes one
+human-readable diagnostic so the current protected-main contract remains true,
+and adds a current-main-compatible workflow contract test directly. It does not
+import unrelated coverage-toolchain work from another pull request. The
 publishing workflow deletes this helper before committing the verified
 product-policy tree.
 """
@@ -20,9 +21,10 @@
 REVIEWED_CHILD = "b715577b9e946ecad4bd00c9f8afc7b2a219e048"
 EXPECTED_MAIN_PARENT = "f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae"
 PATCH_PATH = Path("/tmp/pr748-current-main.patch")
+WORKFLOW_PATH = Path(".github/workflows/opencode-review-dispatch.yml")
 CONTRACT_PATH = Path("tests/test_opencode_agent_contract.py")
 PATCH_PATHS = (
-    ".github/workflows/opencode-review-dispatch.yml",
+    str(WORKFLOW_PATH),
     "docs/doctoring/npm-workspace-lock-ownership.md",
     "scripts/ci/npm_workspace_install_root.py",
     "tests/npm_workspace_test_support.py",
@@ -35,6 +37,8 @@
     "scripts/ci/apply_pr748_current_main.py",
 )
 CONTRACT_FUNCTION = "test_opencode_coverage_resolves_validated_npm_workspace_lock_owner"
+CURRENT_MAIN_DIAGNOSTIC = "npm offline ci (workspace root), lifecycle hooks disabled"
+REVIEWED_DIAGNOSTIC = "npm workspace-root offline ci, lifecycle hooks disabled"
 CONTRACT_TEST = r'''
 
 
@@ -53,7 +57,7 @@ def test_opencode_coverage_resolves_validated_npm_workspace_lock_owner():
     assert 'trusted_npm_lock_is_materialized "$npm_install_root"' in workflow
     assert 'npm_workspace_args=(--workspace "$npm_workspace_selector")' in workflow
     assert 'install_package_dependencies "$package_runner" "$package_dir"' in workflow
-    assert "npm workspace-root offline ci, lifecycle hooks disabled" in workflow
+    assert "npm offline ci (workspace root), lifecycle hooks disabled" in workflow
     assert "npm ci --offline --ignore-scripts" in workflow
     assert "ContextualWisdomLab/.github:scripts/ci/npm_workspace_install_root.py" in workflow
     assert "ContextualWisdomLab/.github:tests/test_npm_workspace_install_root.py" in workflow
@@ -117,6 +121,24 @@ def _validate_reviewed_patch(patch: str) -> str:
     return patch
 
 
+def _normalize_current_main_diagnostic() -> None:
+    """Retain the existing generic npm diagnostic while naming workspace scope."""
+
+    text = WORKFLOW_PATH.read_text(encoding="utf-8")
+    if text.count(REVIEWED_DIAGNOSTIC) != 1:
+        raise SystemExit(
+            "reviewed npm workspace diagnostic count changed: "
+            f"{text.count(REVIEWED_DIAGNOSTIC)}"
+        )
+    if CURRENT_MAIN_DIAGNOSTIC in text:
+        raise SystemExit("current-main diagnostic unexpectedly already exists")
+    WORKFLOW_PATH.write_text(
+        text.replace(REVIEWED_DIAGNOSTIC, CURRENT_MAIN_DIAGNOSTIC, 1),
+        encoding="utf-8",
+    )
+    _run("git", "add", str(WORKFLOW_PATH))
+
+
 def _add_current_contract_test() -> None:
     """Add a conflict-free workflow contract to the current-main test file."""
 
@@ -133,19 +155,19 @@ def _add_current_contract_test() -> None:
 def _verify_applied_tree() -> None:
     """Verify the staged tree contains the complete npm workspace contract."""
 
-    workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(
-        encoding="utf-8"
-    )
+    workflow = WORKFLOW_PATH.read_text(encoding="utf-8")
     required_workflow_fragments = (
         "resolve_npm_package_root()",
         "resolve_npm_install_root()",
         "npm_workspace_install_root.py",
         '--workspace "$npm_workspace_selector"',
-        "npm workspace-root offline ci, lifecycle hooks disabled",
+        CURRENT_MAIN_DIAGNOSTIC,
     )
     for fragment in required_workflow_fragments:
         if fragment not in workflow:
             raise SystemExit(f"required workflow fragment is absent: {fragment}")
+    if REVIEWED_DIAGNOSTIC in workflow:
+        raise SystemExit("stale workspace-root diagnostic remains")
 
     contract = CONTRACT_PATH.read_text(encoding="utf-8")
     if contract.count(f"def {CONTRACT_FUNCTION}(") != 1:
@@ -199,6 +221,7 @@ def main() -> int:
     ).stdout
     PATCH_PATH.write_text(_validate_reviewed_patch(patch), encoding="utf-8")
     _run("git", "apply", "--3way", "--index", str(PATCH_PATH))
+    _normalize_current_main_diagnostic()
     _add_current_contract_test()
     _run("git", "diff", "--cached", "--check")
     _verify_applied_tree()

From 7fb99a29dbfefb6cb2b437e6823c4290885fd16f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 22:01:16 +0900
Subject: [PATCH 13/17] fix(ci): retrigger compatible npm workspace rebuild

---
 .github/workflows/rebuild-pr748-current-main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
index bb62ce958..fcfb7b8b3 100644
--- a/.github/workflows/rebuild-pr748-current-main.yml
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Verify exact trigger and apply reviewed patch
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
-          test "$(git rev-parse HEAD^)" = "810c7c9d69410701b78d0d636c0f0e8224f49e88"
+          test "$(git rev-parse HEAD^)" = "4512b35ec4e5dd10a082ef13b741b2e70ef3f76e"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           python3 -m py_compile scripts/ci/apply_pr748_current_main.py
           python3 scripts/ci/apply_pr748_current_main.py
@@ -102,7 +102,7 @@ jobs:
               'resolve_npm_install_root()',
               'npm_workspace_install_root.py',
               '--workspace "$npm_workspace_selector"',
-              'npm workspace-root offline ci, lifecycle hooks disabled',
+              'npm offline ci (workspace root), lifecycle hooks disabled',
           )
           missing = [fragment for fragment in required if fragment not in workflow]
           if missing:

From 4da492a385134b1c9e20eaea79a26ef0eae82230 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 22:07:56 +0900
Subject: [PATCH 14/17] fix(ci): update current-main npm trust contract

---
 scripts/ci/apply_pr748_current_main.py | 35 +++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/scripts/ci/apply_pr748_current_main.py b/scripts/ci/apply_pr748_current_main.py
index 2b9e8be4d..48469f3f4 100644
--- a/scripts/ci/apply_pr748_current_main.py
+++ b/scripts/ci/apply_pr748_current_main.py
@@ -4,9 +4,9 @@
 This temporary branch-repair helper derives the six nonconflicting product and
 resolver-test files from one previously reviewed commit, normalizes one
 human-readable diagnostic so the current protected-main contract remains true,
-and adds a current-main-compatible workflow contract test directly. It does not
-import unrelated coverage-toolchain work from another pull request. The
-publishing workflow deletes this helper before committing the verified
+and updates the current-main test contract for the argument-bound lock owner.
+It does not import unrelated coverage-toolchain work from another pull request.
+The publishing workflow deletes this helper before committing the verified
 product-policy tree.
 """
 
@@ -39,6 +39,16 @@
 CONTRACT_FUNCTION = "test_opencode_coverage_resolves_validated_npm_workspace_lock_owner"
 CURRENT_MAIN_DIAGNOSTIC = "npm offline ci (workspace root), lifecycle hooks disabled"
 REVIEWED_DIAGNOSTIC = "npm workspace-root offline ci, lifecycle hooks disabled"
+OLD_NPM_LOCK_ASSERTION = '''    assert (
+        "if ! trusted_npm_lock_is_materialized || "
+        "! prepare_writable_npm_cache; then"
+    ) in npm_install_case
+'''
+NEW_NPM_LOCK_ASSERTION = '''    assert (
+        'if ! trusted_npm_lock_is_materialized "$npm_install_root" || '
+        "! prepare_writable_npm_cache; then"
+    ) in npm_install_case
+'''
 CONTRACT_TEST = r'''
 
 
@@ -139,12 +149,20 @@ def _normalize_current_main_diagnostic() -> None:
     _run("git", "add", str(WORKFLOW_PATH))
 
 
-def _add_current_contract_test() -> None:
-    """Add a conflict-free workflow contract to the current-main test file."""
+def _update_current_contract_test() -> None:
+    """Update the stale lock assertion and add the workspace ownership contract."""
 
     text = CONTRACT_PATH.read_text(encoding="utf-8")
+    if text.count(OLD_NPM_LOCK_ASSERTION) != 1:
+        raise SystemExit(
+            "current-main legacy npm lock assertion count changed: "
+            f"{text.count(OLD_NPM_LOCK_ASSERTION)}"
+        )
+    if NEW_NPM_LOCK_ASSERTION in text:
+        raise SystemExit("argument-bound npm lock assertion already exists unexpectedly")
     if CONTRACT_FUNCTION in text:
         raise SystemExit("npm workspace contract test already exists unexpectedly")
+    text = text.replace(OLD_NPM_LOCK_ASSERTION, NEW_NPM_LOCK_ASSERTION, 1)
     CONTRACT_PATH.write_text(
         text.rstrip() + CONTRACT_TEST.rstrip() + "\n",
         encoding="utf-8",
@@ -160,6 +178,7 @@ def _verify_applied_tree() -> None:
         "resolve_npm_package_root()",
         "resolve_npm_install_root()",
         "npm_workspace_install_root.py",
+        'trusted_npm_lock_is_materialized "$npm_install_root"',
         '--workspace "$npm_workspace_selector"',
         CURRENT_MAIN_DIAGNOSTIC,
     )
@@ -172,6 +191,10 @@ def _verify_applied_tree() -> None:
     contract = CONTRACT_PATH.read_text(encoding="utf-8")
     if contract.count(f"def {CONTRACT_FUNCTION}(") != 1:
         raise SystemExit("current-main npm workspace contract test is not unique")
+    if contract.count(NEW_NPM_LOCK_ASSERTION) != 1:
+        raise SystemExit("argument-bound npm lock assertion is not unique")
+    if OLD_NPM_LOCK_ASSERTION in contract:
+        raise SystemExit("stale argument-free npm lock assertion remains")
 
     changed = set(
         _run("git", "diff", "--cached", "--name-only", capture=True).stdout.splitlines()
@@ -222,7 +245,7 @@ def main() -> int:
     PATCH_PATH.write_text(_validate_reviewed_patch(patch), encoding="utf-8")
     _run("git", "apply", "--3way", "--index", str(PATCH_PATH))
     _normalize_current_main_diagnostic()
-    _add_current_contract_test()
+    _update_current_contract_test()
     _run("git", "diff", "--cached", "--check")
     _verify_applied_tree()
     return 0

From 2d2a1044d7927d27fce1c575800051b7b931bac2 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 22:09:09 +0900
Subject: [PATCH 15/17] fix(ci): retrigger argument-bound npm trust contract

---
 .github/workflows/rebuild-pr748-current-main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
index fcfb7b8b3..5caaaceaa 100644
--- a/.github/workflows/rebuild-pr748-current-main.yml
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Verify exact trigger and apply reviewed patch
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
-          test "$(git rev-parse HEAD^)" = "4512b35ec4e5dd10a082ef13b741b2e70ef3f76e"
+          test "$(git rev-parse HEAD^)" = "4da492a385134b1c9e20eaea79a26ef0eae82230"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           python3 -m py_compile scripts/ci/apply_pr748_current_main.py
           python3 scripts/ci/apply_pr748_current_main.py

From f4f5d2d736683d1c3790423cbc801e9032ff7e23 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 6 Aug 2026 13:24:04 +0900
Subject: [PATCH 16/17] ci: preserve LLVM while rebuilding npm workspace
 coverage

---
 .../workflows/rebuild-pr748-current-main.yml  | 77 ++++++++++++++++---
 1 file changed, 67 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
index 5caaaceaa..ba3c0c811 100644
--- a/.github/workflows/rebuild-pr748-current-main.yml
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -9,10 +9,10 @@ on:
 
 concurrency:
   group: rebuild-pr748-current-main
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 permissions:
-  contents: write
+  contents: read
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -22,9 +22,11 @@ jobs:
   rebuild:
     if: >-
       github.repository == 'ContextualWisdomLab/.github' &&
-      github.actor != 'github-actions[bot]' &&
+      github.actor == 'seonghobae' &&
       github.ref == 'refs/heads/fix/npm-workspace-coverage-root-clean'
-    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - name: Harden runner
@@ -32,20 +34,68 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Checkout exact trigger
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout exact trigger without persisted credentials
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Verify exact trigger and apply reviewed patch
+      - name: Apply reviewed resolver patch without regressing current toolchain
+        env:
+          REVIEWED_MAIN: f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
-          test "$(git rev-parse HEAD^)" = "4da492a385134b1c9e20eaea79a26ef0eae82230"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          git merge-base --is-ancestor "$REVIEWED_MAIN" HEAD
           python3 -m py_compile scripts/ci/apply_pr748_current_main.py
           python3 scripts/ci/apply_pr748_current_main.py
+          python3 - <<'PY'
+          from pathlib import Path
+
+          path = Path('.github/workflows/opencode-review-dispatch.yml')
+          workflow = path.read_text(encoding='utf-8')
+
+          package_anchor = (
+              '              r-cran-testthat \\\n'
+              '              rustc \\\n'
+          )
+          package_replacement = (
+              '              r-cran-testthat \\\n'
+              '              llvm-19 \\\n'
+              '              rustc \\\n'
+          )
+          if package_replacement not in workflow:
+              if workflow.count(package_anchor) != 1:
+                  raise SystemExit('LLVM package restoration anchor is not unique')
+              workflow = workflow.replace(package_anchor, package_replacement, 1)
+
+          tool_anchor = (
+              '            && rm -rf /var/lib/apt/lists/*\n'
+              '          RUN curl --proto \'=https\' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \\\n'
+          )
+          tool_replacement = (
+              '            && rm -rf /var/lib/apt/lists/*\n'
+              '          ENV LLVM_COV=/usr/bin/llvm-cov-19\n'
+              '          ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19\n'
+              '          RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"\n'
+              '          RUN curl --proto \'=https\' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \\\n'
+          )
+          if tool_replacement not in workflow:
+              if workflow.count(tool_anchor) != 1:
+                  raise SystemExit('LLVM executable restoration anchor is not unique')
+              workflow = workflow.replace(tool_anchor, tool_replacement, 1)
+
+          llvm_package = workflow.index('              llvm-19 ' + chr(92))
+          llvm_check = workflow.index('RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"')
+          cargo_llvm_cov = workflow.index(
+              'https://github.com/taiki-e/cargo-llvm-cov/releases/download/'
+          )
+          if not llvm_package < llvm_check < cargo_llvm_cov:
+              raise SystemExit('LLVM package/check ordering regressed')
+          path.write_text(workflow, encoding='utf-8')
+          PY
+          git add .github/workflows/opencode-review-dispatch.yml
           git diff --cached --check
 
       - name: Set up Python 3.14
@@ -55,7 +105,7 @@ jobs:
           cache: pip
           cache-dependency-path: requirements-opencode-review-ci-hashes.txt
 
-      - name: Install hash-locked central test dependencies
+      - name: Install exact hash-locked central test dependencies
         run: >-
           python -m pip install --disable-pip-version-check --require-hashes
           -r requirements-opencode-review-ci-hashes.txt
@@ -103,6 +153,9 @@ jobs:
               'npm_workspace_install_root.py',
               '--workspace "$npm_workspace_selector"',
               'npm offline ci (workspace root), lifecycle hooks disabled',
+              '              llvm-19 ' + chr(92),
+              'ENV LLVM_COV=/usr/bin/llvm-cov-19',
+              'ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19',
           )
           missing = [fragment for fragment in required if fragment not in workflow]
           if missing:
@@ -114,9 +167,12 @@ jobs:
         env:
           PUSH_TOKEN: ${{ github.token }}
           TARGET_BRANCH: fix/npm-workspace-coverage-root-clean
+          EXPECTED_HEAD: ${{ github.sha }}
           REVIEWED_MAIN: f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
+          remote_head="$(git ls-remote origin "refs/heads/${TARGET_BRANCH}" | cut -f1)"
+          test "$remote_head" = "$EXPECTED_HEAD"
           rm -f \
             .coverage \
             .github/workflows/rebuild-pr748-current-main.yml \
@@ -141,4 +197,5 @@ jobs:
           auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')"
           echo "::add-mask::$auth_header"
           git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \
-            push origin "HEAD:${TARGET_BRANCH}"
+            push --force-with-lease="refs/heads/${TARGET_BRANCH}:${EXPECTED_HEAD}" \
+            origin "HEAD:refs/heads/${TARGET_BRANCH}"

From d755240833b1a3813e336ed108864a7dbf8af970 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 6 Aug 2026 14:42:32 +0900
Subject: [PATCH 17/17] fix(ci): materialize PR 748 through immutable Git
 objects

---
 .../workflows/rebuild-pr748-current-main.yml  | 193 ++++++++++++++----
 1 file changed, 154 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/rebuild-pr748-current-main.yml b/.github/workflows/rebuild-pr748-current-main.yml
index ba3c0c811..75264fd62 100644
--- a/.github/workflows/rebuild-pr748-current-main.yml
+++ b/.github/workflows/rebuild-pr748-current-main.yml
@@ -1,4 +1,5 @@
 name: Rebuild PR 748 on current main
+run-name: Rebuild PR 748 at ${{ github.sha }}
 
 on:
   push:
@@ -9,7 +10,7 @@ on:
 
 concurrency:
   group: rebuild-pr748-current-main
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 permissions:
   contents: read
@@ -22,10 +23,11 @@ jobs:
   rebuild:
     if: >-
       github.repository == 'ContextualWisdomLab/.github' &&
-      github.actor == 'seonghobae' &&
       github.ref == 'refs/heads/fix/npm-workspace-coverage-root-clean'
     permissions:
       contents: write
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
@@ -44,9 +46,10 @@ jobs:
       - name: Apply reviewed resolver patch without regressing current toolchain
         env:
           REVIEWED_MAIN: f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
+          EXPECTED_HEAD: ${{ github.sha }}
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
-          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD"
           git merge-base --is-ancestor "$REVIEWED_MAIN" HEAD
           python3 -m py_compile scripts/ci/apply_pr748_current_main.py
           python3 scripts/ci/apply_pr748_current_main.py
@@ -57,13 +60,13 @@ jobs:
           workflow = path.read_text(encoding='utf-8')
 
           package_anchor = (
-              '              r-cran-testthat \\\n'
-              '              rustc \\\n'
+              '              r-cran-testthat ' + chr(92) + '\n'
+              '              rustc ' + chr(92) + '\n'
           )
           package_replacement = (
-              '              r-cran-testthat \\\n'
-              '              llvm-19 \\\n'
-              '              rustc \\\n'
+              '              r-cran-testthat ' + chr(92) + '\n'
+              '              llvm-19 ' + chr(92) + '\n'
+              '              rustc ' + chr(92) + '\n'
           )
           if package_replacement not in workflow:
               if workflow.count(package_anchor) != 1:
@@ -72,14 +75,16 @@ jobs:
 
           tool_anchor = (
               '            && rm -rf /var/lib/apt/lists/*\n'
-              '          RUN curl --proto \'=https\' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \\\n'
+              "          RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz "
+              + chr(92) + '\n'
           )
           tool_replacement = (
               '            && rm -rf /var/lib/apt/lists/*\n'
               '          ENV LLVM_COV=/usr/bin/llvm-cov-19\n'
               '          ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19\n'
               '          RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"\n'
-              '          RUN curl --proto \'=https\' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \\\n'
+              "          RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz "
+              + chr(92) + '\n'
           )
           if tool_replacement not in workflow:
               if workflow.count(tool_anchor) != 1:
@@ -95,8 +100,7 @@ jobs:
               raise SystemExit('LLVM package/check ordering regressed')
           path.write_text(workflow, encoding='utf-8')
           PY
-          git add .github/workflows/opencode-review-dispatch.yml
-          git diff --cached --check
+          git diff --check
 
       - name: Set up Python 3.14
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -121,7 +125,7 @@ jobs:
             --include=scripts/ci/npm_workspace_install_root.py \
             --fail-under=100 \
             --show-missing
-          interrogate -vv --fail-under=100 scripts/ci/npm_workspace_install_root.py
+          python -m interrogate -vv --fail-under=100 scripts/ci/npm_workspace_install_root.py
           python -m pytest -q tests/test_opencode_agent_contract.py
           python -m compileall -q \
             scripts/ci/npm_workspace_install_root.py \
@@ -129,7 +133,7 @@ jobs:
             tests/test_npm_workspace_install_root.py \
             tests/test_npm_workspace_install_root_hardening.py \
             tests/test_opencode_agent_contract.py
-          ruff check \
+          python -m ruff check \
             scripts/ci/npm_workspace_install_root.py \
             tests/npm_workspace_test_support.py \
             tests/test_npm_workspace_install_root.py \
@@ -163,11 +167,11 @@ jobs:
           PY
           git diff --check
 
-      - name: Publish verified seven-file product-policy diff
+      - name: Build immutable verified seven-file product commit object
         env:
-          PUSH_TOKEN: ${{ github.token }}
-          TARGET_BRANCH: fix/npm-workspace-coverage-root-clean
+          API_TOKEN: ${{ github.token }}
           EXPECTED_HEAD: ${{ github.sha }}
+          TARGET_BRANCH: fix/npm-workspace-coverage-root-clean
           REVIEWED_MAIN: f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |
@@ -177,25 +181,136 @@ jobs:
             .coverage \
             .github/workflows/rebuild-pr748-current-main.yml \
             scripts/ci/apply_pr748_current_main.py
-          git add -A
-          git diff --cached --check
-          actual_files="$(git diff --cached --name-only "$REVIEWED_MAIN" | sort)"
-          expected_files="$(printf '%s\n' \
-            .github/workflows/opencode-review-dispatch.yml \
-            docs/doctoring/npm-workspace-lock-ownership.md \
-            scripts/ci/npm_workspace_install_root.py \
-            tests/npm_workspace_test_support.py \
-            tests/test_npm_workspace_install_root.py \
-            tests/test_npm_workspace_install_root_hardening.py \
-            tests/test_opencode_agent_contract.py | sort)"
-          test "$actual_files" = "$expected_files"
-          test ! -e .github/workflows/rebuild-pr748-current-main.yml
-          test ! -e scripts/ci/apply_pr748_current_main.py
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git commit -m "fix(coverage): restore validated npm workspace lock owners"
-          auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')"
-          echo "::add-mask::$auth_header"
-          git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \
-            push --force-with-lease="refs/heads/${TARGET_BRANCH}:${EXPECTED_HEAD}" \
-            origin "HEAD:refs/heads/${TARGET_BRANCH}"
+          git diff --check
+          python3 - <<'PY' | tee "${RUNNER_TEMP}/pr748-materialization-receipt.txt"
+          import base64
+          import json
+          import os
+          import subprocess
+          import urllib.request
+          from pathlib import Path
+
+          repository = 'ContextualWisdomLab/.github'
+          parent_sha = os.environ['EXPECTED_HEAD']
+          reviewed_main = os.environ['REVIEWED_MAIN']
+          token = os.environ['API_TOKEN']
+          api_root = f'https://api.github.com/repos/{repository}'
+          expected_paths = {
+              '.github/workflows/opencode-review-dispatch.yml',
+              '.github/workflows/rebuild-pr748-current-main.yml',
+              'docs/doctoring/npm-workspace-lock-ownership.md',
+              'scripts/ci/apply_pr748_current_main.py',
+              'scripts/ci/npm_workspace_install_root.py',
+              'tests/npm_workspace_test_support.py',
+              'tests/test_npm_workspace_install_root.py',
+              'tests/test_npm_workspace_install_root_hardening.py',
+              'tests/test_opencode_agent_contract.py',
+          }
+          permanent_paths = {
+              '.github/workflows/opencode-review-dispatch.yml',
+              'docs/doctoring/npm-workspace-lock-ownership.md',
+              'scripts/ci/npm_workspace_install_root.py',
+              'tests/npm_workspace_test_support.py',
+              'tests/test_npm_workspace_install_root.py',
+              'tests/test_npm_workspace_install_root_hardening.py',
+              'tests/test_opencode_agent_contract.py',
+          }
+
+          def request(method, endpoint, payload=None):
+              data = None if payload is None else json.dumps(payload).encode('utf-8')
+              req = urllib.request.Request(
+                  api_root + endpoint,
+                  data=data,
+                  method=method,
+                  headers={
+                      'Accept': 'application/vnd.github+json',
+                      'Authorization': f'Bearer {token}',
+                      'X-GitHub-Api-Version': '2022-11-28',
+                      'User-Agent': 'cwl-pr748-materializer',
+                  },
+              )
+              with urllib.request.urlopen(req, timeout=60) as response:
+                  return json.load(response)
+
+          raw = subprocess.check_output(['git', 'diff', '--name-status', '-z', 'HEAD'])
+          parts = raw.decode('utf-8').split('\0')
+          changes = []
+          index = 0
+          while index < len(parts) - 1:
+              status = parts[index]
+              path = parts[index + 1]
+              index += 2
+              if status.startswith(('R', 'C')):
+                  raise SystemExit(f'rename/copy outside reviewed scope: {status} {path}')
+              changes.append((status, path))
+          actual_paths = {path for _, path in changes}
+          if actual_paths != expected_paths:
+              raise SystemExit(
+                  f'materialization path mismatch: missing={sorted(expected_paths - actual_paths)} '
+                  f'extra={sorted(actual_paths - expected_paths)}'
+              )
+
+          final_diff = set(
+              subprocess.check_output(
+                  ['git', 'diff', '--name-only', reviewed_main], text=True
+              ).splitlines()
+          )
+          if final_diff != permanent_paths:
+              raise SystemExit(
+                  f'final seven-file scope mismatch: expected={sorted(permanent_paths)} '
+                  f'actual={sorted(final_diff)}'
+              )
+
+          parent = request('GET', f'/git/commits/{parent_sha}')
+          tree_entries = []
+          for status, path in changes:
+              if status == 'D':
+                  tree_entries.append({'path': path, 'mode': '100644', 'type': 'blob', 'sha': None})
+                  continue
+              encoded = base64.b64encode(Path(path).read_bytes()).decode('ascii')
+              blob = request('POST', '/git/blobs', {'content': encoded, 'encoding': 'base64'})
+              mode = '100755' if os.access(path, os.X_OK) else '100644'
+              tree_entries.append({'path': path, 'mode': mode, 'type': 'blob', 'sha': blob['sha']})
+              print(f"BLOB {blob['sha']} {path}")
+
+          tree = request(
+              'POST',
+              '/git/trees',
+              {'base_tree': parent['tree']['sha'], 'tree': tree_entries},
+          )
+          commit = request(
+              'POST',
+              '/git/commits',
+              {
+                  'message': 'fix(coverage): restore validated npm workspace lock owners',
+                  'tree': tree['sha'],
+                  'parents': [parent_sha],
+              },
+          )
+          print(f"PR748_MATERIALIZATION_PARENT_SHA={parent_sha}")
+          print(f"PR748_MATERIALIZATION_TREE_SHA={tree['sha']}")
+          print(f"PR748_MATERIALIZATION_COMMIT_SHA={commit['sha']}")
+          PY
+
+      - name: Publish exact-head materialization pointer
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EXPECTED_HEAD: ${{ github.sha }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          commit_sha="$(sed -n 's/^PR748_MATERIALIZATION_COMMIT_SHA=//p' "${RUNNER_TEMP}/pr748-materialization-receipt.txt")"
+          test "${#commit_sha}" -eq 40
+          case "$commit_sha" in (*[!0-9a-f]*) exit 1;; esac
+          body="PR748_MATERIALIZATION_PARENT_SHA=${EXPECTED_HEAD}%0APR748_MATERIALIZATION_COMMIT_SHA=${commit_sha}"
+          gh api \
+            --method POST \
+            repos/ContextualWisdomLab/.github/issues/748/comments \
+            -f "body=${body}"
+
+      - name: Upload exact-head materialization receipt
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.0
+        with:
+          name: pr748-exact-head-materialization
+          path: ${{ runner.temp }}/pr748-materialization-receipt.txt
+          if-no-files-found: error
+          retention-days: 5