fix(coverage): materialize requirements-directory locks

[seonghobae]

Buyer and review problem

Central OpenCode coverage discovers conventional requirements*.txt names but ignores complete hash-pinned locks stored as direct children such as requirements/ci.txt. In fast-mlsirm#546, the authenticated base contains a generated NumPy-bearing requirements/ci.txt, yet central coverage materialized zero lock candidates and produced 166 collection errors, including ModuleNotFoundError: No module named 'numpy'. This blocks meaningful review of the changed production code.

Test-first and repair state

The immutable RED contract at 8344a2b2e24d6952fe2442e68b9ee514cb1d7ee8 proves direct requirements/*.txt lock discovery is absent and covers realistic base-owned hash locks plus deeper/unrelated rejection cases.

Current exact head: 9d24c19d860cbd8fef5e4fc60501fc156f057abb.

The branch currently contains only the RED contract and a bounded self-removing repair workflow. The repair now:

• uses top-level read permission with job-scoped contents: write;
• requires the exact trusted actor, branch, current head, and RED ancestor;
• validates that the pre-product delta contains only the contract and repair workflow;
• requires a genuine pytest assertion failure (exit 1) rather than accepting collection/import errors as RED evidence;
• applies the narrow direct-child path rule;
• updates permanent quality coverage, APA 7 doctoring, and CHANGELOG evidence;
• executes focused and complete 100% statement/branch/docstring gates;
• revalidates the live remote head and publishes with --force-with-lease;
• removes itself before publishing the product commit.

The current exact head is intentionally Draft and not merge-ready. Temporary write-capable automation or the expected RED test is not product evidence.

Intended trust boundary

Candidate status is granted only to a .txt file that is a direct child of a directory named requirements, in addition to existing conventional names. Existing controls remain authoritative:

• source file must be a regular blob in the authenticated base commit;
• path must be relative and traversal-free;
• content must be nonempty and hash-pinned;
• exact source is recorded in the materialization manifest;
• image installation must preflight an independently complete pip --require-hashes closure;
• unpinned input files, notes, symlinks, PR-only files, and malformed Git trees remain excluded.

Downstream impact

After this central fix merges, fast-mlsirm#546 must rerun exact-head coverage/review so its Rust-backed psychometric report orchestration is judged with NumPy and the repository's real hash-locked test environment rather than a dependency-free image.

Merge gate

Keep Draft until the repair publishes a workflow-free exact head. Then require Trusted uv Materializer Quality CI, complete central tests, 100% production statement/branch/docstring evidence, Python 3.10/3.14 compatibility, Python Security, Security Scan, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, SBOM, current-head CodeRabbit/OpenCode/Noema review, independent approval, zero unresolved threads, and branch protection without bypass.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1e576640-372c-45de-be5f-4b56ca215ea0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}