fix(coverage): materialize trusted uv lock dependencies - #743

Merged

seonghobae merged 101 commits into

mainfrom

fix/trusted-uv-lock-coverage-clean

Aug 5, 2026

Commits on Aug 4, 2026

fix(coverage): materialize trusted uv lock dependencies
seonghobae
committed
9c02e28
fix(security): make trusted uv download URL statically provable
seonghobae
committed
59beb4b
test(security): pin the trusted uv URL sink contract
seonghobae
committed
e57ef51
test(security): parse the trusted uv URL contract without code execution
seonghobae
committed
635bd7d
test(coverage): require per-dependency hashes from uv export
seonghobae
committed
2f6300c
fix(coverage): require hashes on every uv export requirement
seonghobae
committed
59ad185
docs(doctoring): record trusted uv materialization evidence
seonghobae
committed
4a7a01d
test(coverage): require isolated strict uv export
seonghobae
committed
7a2528e
fix(coverage): isolate and strictly validate uv export
seonghobae
committed
ddd9d8e
docs(doctoring): record isolated uv export boundary
seonghobae
committed
229711d
test(coverage): fail closed on tracked uv metadata read errors
seonghobae
committed
15c97c8
fix(coverage): distinguish orphan uv locks from Git read failures
seonghobae
committed
7e66e5a
docs(doctoring): distinguish orphan metadata from read failure
seonghobae
committed
2ef7a36
test(security): reject uv redirects before follow
seonghobae
committed
3ff45c4
test(coverage): enforce uv origin port and branch evidence
seonghobae
committed
41afe7b
test(coverage): measure branch coverage at the 100 percent gate
seonghobae
committed
8ffc9cc
fix(security): reject trusted uv redirects before follow
seonghobae
committed
da6157a
docs(doctoring): record no-proxy no-redirect uv transport
seonghobae
committed
1739459
fix(security): enforce fixed Astral HTTPS origin port
seonghobae
committed
00642c2
docs(doctoring): record fixed origin port and branch coverage evidence
seonghobae
committed
3a15594

Commits on Aug 5, 2026

test(security): require scoped urllib false-positive suppression
seonghobae
committed
c9560d3
fix(security): scope urllib false-positive suppression
seonghobae
committed
3259787
fix(security): refresh vulnerable Strix lock snapshot
seonghobae
committed
7616fd8
fix(ci): align periodic CodeQL action revisions
seonghobae
committed
07c81c0
test(coverage): capture trusted uv portability gaps
seonghobae
committed
8696d74
test(coverage): share deterministic HTTP response support
seonghobae
committed
83ea1d9
test(coverage): support Python 3.10 TOML parsing
seonghobae
committed
7865efd
build(test): support Python 3.10 TOML parsing
seonghobae
committed
54d5927
test(coverage): isolate trusted uv opener cache state
seonghobae
committed
a6a3a96
fix(coverage): harden trusted uv portability and streaming
seonghobae
committed
df31da1
test(coverage): isolate trusted uv process caches
seonghobae
committed
41ba0f4
test(coverage): resolve trusted uv review findings
seonghobae
committed
b4ceeed
test(coverage): require explicit uv workspace rejection
seonghobae
committed
40e19c5
fix(coverage): fail closed on uv workspaces
seonghobae
committed
5b52fea
test(ci): require exact-head trusted uv quality evidence
seonghobae
committed
f93a5c1
ci(coverage): prove trusted uv materializer quality
seonghobae
committed
44f15bb
test(coverage): close JavaScript and Noema branch gaps
seonghobae
committed
ba59139
test(coverage): close review scheduler branch gaps
seonghobae
committed
20de52f
test(coverage): close execution and sandbox branch gaps
seonghobae
committed
e29be20
test(coverage): close reporting branch gaps
seonghobae
committed
5925c8a
test(coverage): remove unused scheduler test import
seonghobae
committed
15c7cb3
ci(coverage): prove complete central branch coverage
seonghobae
committed
2424f7f
test(ci): lock the repository-wide coverage gate
seonghobae
committed
27f08e2
docs(doctoring): record complete coverage repair evidence
seonghobae
committed
c2b987f
fix(strix): integrate hosted NVIDIA fallback into trusted uv prerequisite
seonghobae
committed
edd9a37
test(ci): require exact-head trusted uv checkout
seonghobae
committed
77fe2f2
fix(ci): bind trusted uv quality evidence to PR head
seonghobae
committed
3813a96
docs(changelog): record exact-head uv quality evidence
seonghobae
committed
9c27d43
docs(doctoring): record exact-head checkout boundary
seonghobae
committed
d3b6c79
ci: repair exact-head trusted uv quality regressions
seonghobae
committed
244efdd
test(ci): stabilize trusted uv quality contracts
github-actions[bot]
committed
df74e97
docs(evidence): record trusted uv quality regression repair
seonghobae
committed
90dd9ae
ci: repair exact-head trusted uv quality regressions
seonghobae
committed
f57e5a9
chore(ci): remove completed PR-specific repair workflow
seonghobae
committed
d5ff1d4
ci: externalize PR 743 repair patch
seonghobae
committed
5e57877
ci: simplify PR 743 verified repair runner
seonghobae
committed
add05d3
ci: make PR 743 repair idempotent with concurrent head fix
seonghobae
committed
7384340
ci: rebind PR 743 repair to concurrent hermetic head
seonghobae
committed
90e8cd8
chore(ci): remove completed PR 743 repair workflow
seonghobae
committed
c14b87a
chore(ci): remove completed PR 743 repair helper
seonghobae
committed
7f270b3
test(opencode-review): stage Git config isolation regression
seonghobae
committed
2d223df
chore(ci): remove completed PR 743 repair workflow
seonghobae
committed
ba157b5
test(opencode-review): require PR 743 cleanup boundary
seonghobae
committed
c31feb1
ci: run bounded PR 743 Git configuration repair
seonghobae
committed
0edd9d4
ci: retry bounded PR 743 Git configuration repair
seonghobae
committed
56781fa
fix(ci): bind PR 743 one-shot to reviewed parent
seonghobae
committed
adbaaf7
ci: make PR 743 repair invariant to metadata-only races
seonghobae
committed
951c242
chore(ci): remove completed PR 743 Git isolation workflow
seonghobae
committed
35e40ac
ci: apply PR 743 Git isolation repair
seonghobae
committed
3865f99
ci: make PR 743 Git isolation repair self-cleaning
seonghobae
committed
0ff7e6b
test(ci): require conftest changes to trigger uv quality evidence
seonghobae
committed
8b192fb
test(ci): anchor PR 743 cleanup contracts to repository root
seonghobae
committed
e21c97e
test(opencode-review): finalize Git isolation repair
seonghobae
committed
3ca42fa
fix(ci): trigger trusted uv evidence for shared fixtures
seonghobae
committed
6533e5f
ci: execute PR 743 Git isolation repair as exact-head check
seonghobae
committed
c8a53dc
test(opencode-review): verify final Git isolation tree
seonghobae
committed
2f890f6
test(noema): distinguish review threads without line numbers
seonghobae
committed
5fe76ee
test(uv): verify Python 3.10 fallback in production source
seonghobae
committed
9b8d02a
test(ci): require final PR 743 branch-writer cleanup
seonghobae
committed
ad3ec12
fix(ci): make PR 743 repair self-contained
seonghobae
committed
3a4e43e
ci: remove completed PR 743 Git isolation helper
seonghobae
committed
02ccdd1
fix(ci): complete bounded PR 743 review repair
seonghobae
committed
b0caf9d
ci: remove completed PR 743 finalizer v2
seonghobae
committed
defba71
ci: remove completed PR 743 finalizer
seonghobae
committed
cfa2819
fix(ci): make bounded PR 743 repair race-safe
seonghobae
committed
b2bebb1
ci: apply current PR 743 review fixes
seonghobae
committed
3e477a9
ci: finalize PR 743 with workflow-scoped token
seonghobae
committed
26ddb7b
fix(ci): use established workflow-capable repair credentials
seonghobae
committed
db4dc6c
fix(ci): complete bounded PR 743 review repairs
seonghobae
committed
e70b088
chore(ci): remove completed PR 743 repair workflow
seonghobae
committed
e24dc06
fix(ci): materialize bounded repair without restricted ref writes
seonghobae
committed
4614b44
chore(ci): remove completed PR 743 repair workflow
seonghobae
committed
b7f21a8
test(opencode-review): trigger PAT-scoped PR 743 finalization
seonghobae
committed
95b6c3e
fix(ci): distinguish already-isolated Git invocation blocks
seonghobae
committed
1f75e13
chore(ci): remove completed PR 743 write workflow
seonghobae
committed
133067e
test(ci): scope Git isolation assertions to complete blocks
seonghobae
committed
112d5e0
chore(ci): remove superseded PR 743 finalizer
seonghobae
committed
59c5e0b
test(ci): make readiness clock deterministic
seonghobae
committed
1e2deb7
test(ci): require trusted Git helper boundary marker
seonghobae
committed
3c47966
test(noema): assert complete line-free thread rendering
seonghobae
committed
541f718
test(ci): verify complete safe-directory isolation values
seonghobae
committed
91f0e36