ci: enforce declared Python package compatibility

[seonghobae]

Finding

Protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f consolidated repository-owned quality into Foundation CI, while merged Python packages already declare support below the primary CPython 3.14 runtime. Structured Interview Plan #40 is the concrete adopter: it declares requires-python = ">=3.12" and historically exercised 3.12/3.13/3.14. Deleting its retired package-local workflow without replacement evidence would weaken the declared runtime contract.

Earlier heads repaired four distinct defects: metadata/parser failure being reclassified as an unsupported-package skip; patch-sensitive PEP 440 evaluation against fabricated major.minor.0; owned packages escaping acceptance when src/ or tests/ disappeared; and a second compatibility matrix job that violated the protected one-job Foundation admission contract. Exact head f529086c... produced the real queue-shape RED in Foundation run 34050838082.

Exact head 79e8757515673144b68687517360cf493e93ccb8 then produced Foundation GREEN in run 34053906336: the single Repository quality job passed exact checkout, runner-image proof, Foundation validation, dependency hygiene, primary package/service/PostgreSQL contracts, Python 3.12 compatibility, Python 3.13 compatibility, and clean-checkout proof.

That GREEN exposed one remaining provenance finding on review: .github/requirements/foundation-compatibility-test.txt was hash-locked per dependency but its complete file bytes were not bound by the canonical manifest inventory. A reviewed compatibility dependency set could therefore change without changing the manifest unless a tracked artifact bound it.

Current repair

Current successor f1f152b0838e11cba1cf583706eb0983d56af373 keeps the same one-job compatibility behavior and adds a fail-closed provenance check before compatibility installation:

• .github/workflows/foundation-ci.yml remains exactly one quality job on ubuntu-24.04;
• primary CPython 3.14 package/service/PostgreSQL contracts run first;
• before switching runtimes, Foundation verifies the complete compatibility requirements file against reviewed SHA-256 cebb36181e8ac995a36d73a02a45094a204ff5adb3cbcdc0c9eccff309ac6aab;
• CPython 3.12 and 3.13 then execute sequentially in the same job;
• package discovery remains package-neutral; exact executed interpreter patches drive PEP 440 selection; malformed metadata and incomplete owned package layouts fail closed; compatibility evidence is non-vacuous and keeps each package's 100% statement/branch contract;
• the compatibility file remains installed with --require-hashes --no-deps --only-binary=:all:;
• the manifest-sealed workflow now transitively integrity-binds the compatibility input instead of relying on an untracked mutable dependency file;
• retired package-local workflows remain retired.

The final Foundation workflow is resealed in manifest.json as SHA-256 27fd3f2a69181e6a31b49ab2a3d394bfc8dca2b8ef5e9ce39324273f7962773d, 11,708 bytes, 251 lines. A manual manifest transcription error on an unrelated migration digest in intermediate commit 581e1a3f... was immediately detected by exact diff review and corrected in normal fast-forward successor dd89898a...; comparison against 79e875... after correction shows only the intended Foundation workflow and its manifest entry changed. No migration source was modified.

Traceability is synchronized at the current head and records the successful 34053906336 predecessor evidence plus the provenance repair rationale.

Exact-current-head authority — 2026-09-12

• exact head: f1f152b0838e11cba1cf583706eb0983d56af373;
• protected base: develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f;
• state: open · Ready / Proposed · mechanically mergeable; Ready admits independent review and is not merge authorization;
• Foundation 34057542130: terminal SUCCESS;
• SAST 34057542122: terminal SUCCESS;
• Security 34057542151: terminal FAILURE only in dependency-review. Exact-head checkout/verification succeeded; sibling scanners completed, but central owner .github#810 still records the fail-closed public non-fork dependency-comparison availability/configuration incident. This is incomplete authoritative security evidence, not an Orgmetra source vulnerability and not permission for a local substitute or gate weakening;
• CodeQL 34057542155: terminal FAILURE on this exact immutable head. Historical compatibility consumers failed at current-head verdict enforcement before their downstream dispatch path could complete. The central authority has advanced: protected .github/main is now fb17ef556f94f673234aa557254ae52779e9a7b0; canonical producer/consumer successor .github#2040 is exact 85522306949bada2b5939608dc911f6374125f1b, 150 ahead / 0 behind, open · Draft · mergeable after ordinary reconciliation; and its protected-handler bootstrap prerequisite .github#2106 is exact 24bb6591ab7df23558cb793b4af60c567ff9da97, 24 ahead / 0 behind the same protected main, open · Draft · mergeable. #2106 current-head Runtime Quality/SAST/Python Security/Security are GREEN while CodeQL remains terminal non-passing with both language dispatches successful and verdict pending; independent approval is absent. This is still a central bootstrap/settlement cycle, not an Orgmetra leaf finding. Therefore no ci: enforce declared Python package compatibility #259 rerun, synthetic verdict, no-op churn, or product-repository workflow copy is justified until the central protected-handler prerequisite and canonical successor integrate normally and current-head evidence converges;
• predecessor evidence remains historical RCA only and is not transferred;
• fresh review state remains without a qualifying independent APPROVED review. Live organization ruleset 18156473 still requires one approving review while naming no reviewer/code-owner/last-push authority. .github#772 owns that solo-maintainer governance deadlock; self/model approval and routine administrator bypass remain forbidden.

Scope boundary

The HTTP services declare Python 3.11 support. This PR does not claim that service-runtime compatibility; #260 remains the separate successor after #258/#259 is normally integrated.

Owner dependencies and acceptance

Ready / Proposed admits the unchanged exact head to independent review. Terminal authoritative central Security/CodeQL evidence and a qualifying independent approval remain mandatory merge gates. Do not self-approve, use routine administrator bypass, manufacture a status, weaken a gate, create a no-op retrigger, or copy central workflow source into Orgmetra.

After protected integration, #40 and #42 can non-force adopt the canonical Foundation capability without restoring package-local workflow ownership.

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 368df92b-2a30-43f4-8446-95da3dc70584

📥 Commits

Reviewing files that changed from the base of the PR and between eb9757f and f1f152b.

📒 Files selected for processing (5)

• .github/requirements/foundation-compatibility-test.txt
• .github/workflows/foundation-ci.yml
• docs/traceability/foundation-python-compatibility.md
• manifest.json
• tests/test_foundation_ci_dependency_hygiene.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh central owner correction for the current CodeQL RCA: .github#1925 should no longer be summarized as a workflow compile/template-validation failure before execution. Direct run evidence shows validate-dispatch receives a runner, setup succeeds, and the OpenCode app-token exchange succeeds. The failure occurs when client_payload.matrix (an array) is evaluated into a scalar step-level env: value in Bind workflow inputs to live org PR metadata; the native CodeQL scan job is then skipped. The likely toJSON(...) repair and real redispatch verification remain central-owner work. #258 has been updated with this narrower mechanism. No #259 source change/no-op retrigger is justified by this correction.

[seonghobae]

Fresh adopter canary from #98 after ordinary protected-parent reconciliation: #98 exact ec39bfa9bcb73b2b7730a0a6115b2e484d78acb2 adds packages/document-record-evidence, targets develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, and its Foundation run 34625702215 reached Run owned unit and service contracts once SUCCESS. The protected workflow’s explicit pytest list does not include packages/document-record-evidence, so that step is a concrete false-green for a newly owned package: exact checkout/compile/foundation validation can pass while the package’s own 100% statement/branch contract is never executed. This is direct current-head acceptance evidence for #259’s package-neutral discovery requirement. Do not repair #98 by restoring its retired feature-local workflow; keep #98 Draft until the canonical Foundation successor is protected truth and the package is actually discovered/executed on a fresh exact head.

[seonghobae]

Fresh central CodeQL owner-path correction for current dependency metadata: the #259 body still references .github#2040@d7bb95f6..., but live #2040 has ordinary-forward reconciled to protected .github/main@cb0872c9a20d5584703dffacca65c096fc034c6c and now has exact head 3b2de64c2c4c95c56d2f5099a480a0825304d038, open · Draft · mergeable while the reconciled head reacquires hosted/security/review evidence.

This changes no Orgmetra source and does not transfer central predecessor GREEN. #259 remains exact f1f152b0838e11cba1cf583706eb0983d56af373, Draft, with its historical exact-head Foundation/SAST evidence and unresolved central Security/CodeQL plus independent-approval prerequisites. Do not rerun/no-op-churn #259 merely because #2040 moved; wait for normal protected central integration and then reacquire whatever exact-head evidence the live policy requires.

[seonghobae]

Fresh central-owner authority update: protected ContextualWisdomLab/.github/main has advanced from cb0872c9... to 691fb78932eff5fbe52db69077848134b0b4e053. Canonical CodeQL successor #2040 is currently exact be25a767aa2e0d5cb79d6988853011bae16d4be3, open · Draft · GitHub reports non-mergeable. Fresh compare against protected main@691fb789... is 147 ahead / 8 behind with merge base still cb0872c9...; therefore the earlier #259 body statement that #2040 was reconciled 145 ahead / 0 behind onto protected main is now stale. This is a central-owner reconciliation finding, not justification for an Orgmetra no-op rerun, copied workflow, synthetic verdict, force update, or gate weakening. Keep #259 Draft until the central successor ordinary-forward adopts the new protected main and reacquires current-head evidence.

[seonghobae]

Ready / Proposed admission receipt

• Exact unchanged head: f1f152b0838e11cba1cf583706eb0983d56af373
• Protected base snapshot: develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f
• Review threads: 0 unresolved; mechanical mergeability is not merge authorization.
• Exact-head Foundation 34057542130 and SAST 34057542122 are terminal GREEN.
• Security 34057542151 failed only because dependency-review received HTTP 403 from GitHub's dependency comparison API after exact checkout; sibling scanners passed. This is central control-plane/settings evidence, not an Orgmetra source vulnerability.
• CodeQL 34057542155 recorded successful dispatch with verdict still pending in the protected central path; no leaf source failure was established.

Ready removes the circular review-admission block only. Fresh exact-head terminal Security/CodeQL evidence and qualifying independent approval remain merge gates. No manual rerun, no-op churn, self-approval, review dismissal, status synthesis, gate weakening, or administrator bypass was used.

[seonghobae]

Exact-head Ready-admission repair

Audited head f1f152b0838e11cba1cf583706eb0983d56af373 against base eb9757f8649aaad026a9865508d9aad50c1a7a4f (17 ahead / 0 behind).

Current substantive blocker evidence:

• terminal workflow failure: Security Scan=failure#34057542151, CodeQL PR=failure#34057542155

Queued/pending/in-progress Checks are not blockers and were not treated as failures. This PR is being returned to Draft/Proposed so review admission does not imply readiness while the recorded blocker remains. Preserve the branch and complete the causal source/review/topology repair on a new non-force commit; then re-fetch this exact head's Checks and reviews before restoring Ready.

No merge, close, bypass, review dismissal, synthetic status/approval, manual rerun, force push, or destructive rebase is authorized by this receipt.

[seonghobae]

Exact-log RCA for current head f1f152b0838e11cba1cf583706eb0983d56af373

• CodeQL Actions/Python jobs failed closed with VERDICT_STATE=pending after central dispatch.
• Dependency Review validated the exact checkout, then dependency-graph compare returned HTTP 403 for base eb9757f8649aaad026a9865508d9aad50c1a7a4f and this head.

Keep Draft until the canonical .github dispatch path and dependency-graph evidence boundary are repaired and a new exact-head run proves terminal results. No manual rerun was issued.