fix(coverage): materialize trusted uv lock dependencies

.github/workflows/opencode-review-dispatch.yml

@@ -873,6 +873,8 @@ jobs:
               GITHUB_STEP_SUMMARY=/dev/null \
               BASH_ENV=/dev/null \
               UV_NO_BUILD=1 \
+              GIT_CONFIG_NOSYSTEM=1 \
+              GIT_CONFIG_GLOBAL=/dev/null \
               GIT_CONFIG_COUNT=1 \
               GIT_CONFIG_KEY_0=safe.directory \
               GIT_CONFIG_VALUE_0=/work \
@@ -932,6 +934,8 @@ jobs:
               GITHUB_STEP_SUMMARY=/dev/null \
               BASH_ENV=/dev/null \
               UV_NO_BUILD=1 \
+              GIT_CONFIG_NOSYSTEM=1 \
+              GIT_CONFIG_GLOBAL=/dev/null \
               GIT_CONFIG_COUNT=1 \
               GIT_CONFIG_KEY_0=safe.directory \
               GIT_CONFIG_VALUE_0=/work \
@@ -991,6 +995,8 @@ jobs:
               GITHUB_STEP_SUMMARY=/dev/null \
               BASH_ENV=/dev/null \
               UV_NO_BUILD=1 \
+              GIT_CONFIG_NOSYSTEM=1 \
+              GIT_CONFIG_GLOBAL=/dev/null \
               GIT_CONFIG_COUNT=1 \
               GIT_CONFIG_KEY_0=safe.directory \
               GIT_CONFIG_VALUE_0=/work \

.github/workflows/scheduled-security-scan.yml

@@ -90,13 +90,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
         continue-on-error: true
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}-scheduled"
 
@@ -131,7 +131,7 @@ jobs:
       - name: Upload Trivy SARIF to code scanning
         if: always() && hashFiles('trivy-results.sarif') != ''
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           sarif_file: trivy-results.sarif
           category: trivy-fs-scheduled

.github/workflows/strix.yml

@@ -443,7 +443,7 @@ jobs:
       - name: Gate Strix secrets
         id: gate
         env:
-          STRIX_MODEL: ${{ github.event.client_payload.strix_llm || (steps.target_visibility.outputs.is_private == 'false' && 'nvidia_nim/nvidia/nemotron-3-ultra-550b-a55b' || 'gpt-5.6-luna') }}
+          STRIX_MODEL: ${{ github.event.client_payload.strix_llm || (steps.target_visibility.outputs.is_private == 'false' && 'nvidia_nim/nvidia/nemotron-3-super-120b-a12b' || 'gpt-5.6-luna') }}
           STRIX_MODEL_REQUESTED: ${{ github.event.client_payload.strix_llm || '' }}
           STRIX_OPENAI_API_KEY: ${{ secrets.STRIX_OPENAI_API_KEY || secrets.OPENAI_API_KEY }}
           STRIX_OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
@@ -453,7 +453,7 @@ jobs:
           TARGET_REPOSITORY_PRIVATE: ${{ steps.target_visibility.outputs.is_private }}
         run: |
           strix_model="$(printf '%s' "$STRIX_MODEL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
-          if [ -z "$STRIX_MODEL_REQUESTED" ] && [ "$strix_model" = "nvidia_nim/nvidia/nemotron-3-ultra-550b-a55b" ] && [ -z "${STRIX_NVIDIA_NIM_API_KEY:-}" ]; then
+          if [ -z "$STRIX_MODEL_REQUESTED" ] && [ "$strix_model" = "nvidia_nim/nvidia/nemotron-3-super-120b-a12b" ] && [ -z "${STRIX_NVIDIA_NIM_API_KEY:-}" ]; then
             strix_model="gpt-5.6-luna"
           fi
           echo "strix_model=$strix_model" >> "$GITHUB_OUTPUT"
@@ -497,7 +497,7 @@ jobs:
                 exit 1
               fi
               ;;
-            nvidia_nim/nvidia/nemotron-3-ultra-550b-a55b)
+            nvidia_nim/nvidia/nemotron-3-super-120b-a12b)
               if [ "$TARGET_REPOSITORY_PRIVATE" != "false" ]; then
                 echo '::error::NVIDIA NIM hosted trial scans are limited to public repositories.'
                 exit 1
@@ -763,7 +763,7 @@ jobs:
             openrouter/free | openrouter/openrouter/free)
               printf '%s' 'openrouter/free' > "$strix_llm_file"
               ;;
-            nvidia_nim/nvidia/nemotron-3-ultra-550b-a55b)
+            nvidia_nim/nvidia/nemotron-3-super-120b-a12b)
               printf '%s' "$strix_model" > "$strix_llm_file"
               ;;
             vertex_ai/gemini-3.1-pro-preview-customtools | vertex_ai/gemini-2.5-flash)
@@ -807,7 +807,7 @@ jobs:
           STRIX_LLM_MAX_RETRIES: 1
           STRIX_TRANSIENT_RETRY_PER_MODEL: 2
           STRIX_TRANSIENT_RETRY_BACKOFF_SECONDS: 60
-          STRIX_FALLBACK_MODELS: ${{ steps.gate.outputs.provider_mode == 'github_models' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'openai_direct' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'openrouter' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'nvidia_nim' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || '' }}
+          STRIX_FALLBACK_MODELS: ${{ steps.gate.outputs.provider_mode == 'github_models' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'openai_direct' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'openrouter' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'nvidia_nim' && 'nvidia_nim/nvidia/llama-3.3-nemotron-super-49b-v1.5 github_models/openai/o3 github_models/openai/gpt-5-chat' || '' }}
           STRIX_GITHUB_MODELS_API_BASE_FILE: ${{ env.STRIX_GITHUB_MODELS_API_BASE_FILE }}
           STRIX_GITHUB_MODELS_KEY_FILE: ${{ env.STRIX_GITHUB_MODELS_KEY_FILE }}
           STRIX_FAIL_ON_PROVIDER_SIGNAL: "1"
@@ -861,7 +861,7 @@ jobs:
           fi
 
           # Recognized signals that the LLM backend was unavailable / starved.
-          backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure'
+          backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure|litellm(\.exceptions)?\.NotFoundError[^[:cntrl:]]*Nvidia_nimException[^[:cntrl:]]*Error code:[[:space:]]*404'
           # Any evidence that a vulnerability was actually reported. Its presence
           # forces a hard failure so real findings are NEVER downgraded. Keep the
           # severity branch anchored away from identifiers so environment lines

.github/workflows/trusted-uv-materializer-quality-ci.yml

@@ -0,0 +1,165 @@
+name: Trusted uv Materializer Quality CI
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/trusted-uv-materializer-quality-ci.yml"
+      - "scripts/ci/materialize_base_python_requirements.py"
+      - "tests/conftest.py"
+      - "tests/test_materialize*.py"
+      - "tests/test_trusted_uv*.py"
+      - "tests/test_uv*.py"
+      - "tests/test_repository_branch_coverage_*.py"
+      - "requirements-opencode-review-ci-hashes.txt"
+      - "pyproject.toml"
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/trusted-uv-materializer-quality-ci.yml"
+      - "scripts/ci/materialize_base_python_requirements.py"
+      - "tests/conftest.py"
+      - "tests/test_materialize*.py"
+      - "tests/test_trusted_uv*.py"
+      - "tests/test_uv*.py"
+      - "tests/test_repository_branch_coverage_*.py"
+      - "requirements-opencode-review-ci-hashes.txt"
+      - "pyproject.toml"
+
+concurrency:
+  group: trusted-uv-materializer-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  minimum-python-contract:
+    name: Python 3.10 compatibility contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up minimum supported Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Compile production on Python 3.10
+        run: python -m compileall -q scripts/ci/materialize_base_python_requirements.py
+
+      - name: Exercise the conditional tomli import
+        run: |
+          python - <<'PY'
+          import sys
+          import tempfile
+          from pathlib import Path
+
+          stub_root = Path(tempfile.mkdtemp(prefix="trusted-uv-tomli-stub-"))
+          (stub_root / "tomli.py").write_text(
+              "STUB_MARKER = True\n"
+              "class TOMLDecodeError(ValueError):\n"
+              "    pass\n"
+              "def loads(_value):\n"
+              "    return {}\n",
+              encoding="utf-8",
+          )
+          sys.path.insert(0, str(stub_root))
+          from scripts.ci import materialize_base_python_requirements as materializer
+
+          assert materializer.tomllib.STUB_MARKER is True
+          PY
+
+  full-quality-gate:
+    name: Python 3.14 full quality gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up current stable Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install hash-locked quality tooling
+        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Run trusted uv tests with complete branch coverage
+        run: |
+          cat >"${RUNNER_TEMP}/trusted-uv-coveragerc" <<'EOF'
+          [run]
+          branch = True
+          include =
+              scripts/ci/materialize_base_python_requirements.py
+
+          [report]
+          fail_under = 100
+          show_missing = True
+          EOF
+          export COVERAGE_RCFILE="${RUNNER_TEMP}/trusted-uv-coveragerc"
+          python -m coverage erase
+          python -m coverage run -m pytest \
+            tests/test_materialize_base_python_requirements.py \
+            tests/test_materialize_uv_export_hash_contract.py \
+            tests/test_trusted_uv_download_contract.py \
+            tests/test_trusted_uv_portability_and_streaming.py \
+            tests/test_uv_export_isolation_contract.py \
+            tests/test_uv_redirect_and_coverage_contract.py \
+            tests/test_uv_redirect_boundary.py \
+            tests/test_uv_workspace_fail_closed.py \
+            tests/test_trusted_uv_materializer_quality_workflow_contract.py \
+            -q
+          python -m coverage report
+
+      - name: Run complete central test and branch coverage gate
+        run: |
+          unset COVERAGE_RCFILE
+          python -m coverage erase
+          python -m coverage run -m pytest tests -q
+          python -m coverage report
+
+      - name: Enforce complete production docstrings
+        run: python -m interrogate --fail-under 100 scripts/ci/materialize_base_python_requirements.py
+
+      - name: Compile production and quality contracts
+        run: |
+          python -m compileall -q \
+            scripts/ci/materialize_base_python_requirements.py \
+            tests/test_materialize_base_python_requirements.py \
+            tests/test_materialize_uv_export_hash_contract.py \
+            tests/test_trusted_uv_download_contract.py \
+            tests/test_trusted_uv_portability_and_streaming.py \
+            tests/test_uv_export_isolation_contract.py \
+            tests/test_uv_redirect_and_coverage_contract.py \
+            tests/test_uv_redirect_boundary.py \
+            tests/test_uv_workspace_fail_closed.py \
+            tests/test_trusted_uv_materializer_quality_workflow_contract.py \
+            tests/test_repository_branch_coverage_javascript_and_noema.py \
+            tests/test_repository_branch_coverage_review_schedulers.py \
+            tests/test_repository_branch_coverage_execution_sandboxes.py \
+            tests/test_repository_branch_coverage_reporting_edges.py

CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to the organization automation repository are documented in
+this file. The format follows Keep a Changelog, and versioned releases follow
+Semantic Versioning where the repository publishes a release.
+
+## [Unreleased]
+
+### Added
+
+- Added exact-base `uv.lock` materialization that reconstructs standalone nested projects with a checksum-pinned official `uv` exporter, isolated frozen/offline execution, strict exact-pin and SHA-256 output validation, and complete Python 3.10/3.14 quality evidence.
+
+### Fixed
+
+- Bound both trusted-uv quality jobs to `github.event.pull_request.head.sha` and added a permanent two-checkout regression contract so exact-head compatibility, coverage, docstring, and compilation claims cannot silently measure GitHub's generated pull-request merge revision.
+- Made Strix treat only a single LiteLLM provider-error line containing NVIDIA NIM context and model-catalog 404 evidence as cross-model fallback evidence, rejecting cross-line signal assembly and provider-like target source literals; moved the public default to Nemotron 3 Super 120B and added a second NVIDIA hosted candidate before GitHub Models without neutralizing reported vulnerabilities.

docs/doctoring/strix-nvidia-nim-not-found-fallback.md

@@ -0,0 +1,76 @@
+# Strix NVIDIA NIM model-catalog fallback: evidence and design record
+
+## Decision
+
+Strix treats an authenticated NVIDIA NIM model-catalog `404 Not Found` as
+provider availability evidence, not as a target-application vulnerability. The
+gate does not retry the same unavailable model. It proceeds to a distinct
+reviewed NVIDIA hosted model and only then to the existing GitHub Models
+candidates.
+
+Public-repository scans now default to
+`nvidia/nemotron-3-super-120b-a12b`. The first fallback is
+`nvidia/llama-3.3-nemotron-super-49b-v1.5`. Private repositories retain the
+contracted provider because NVIDIA hosted trial inputs are restricted to public
+repositories by the central workflow.
+
+## Trust boundary
+
+The NVIDIA classifier accepts only a single bounded log line that contains all
+three signals: a LiteLLM `NotFoundError`, NVIDIA NIM provider context, and
+model-catalog not-found evidence. It does not assemble provider and `404`
+signals from different lines. A bare application `404`, route miss, database
+lookup miss, provider-like source literal, or other target-controlled output is
+not enough to enter model fallback.
+
+This same-line rule matters because scanner stdout can include text derived from
+the repository under review. Requiring the trusted LiteLLM exception marker and
+all provider-availability evidence on one line prevents repository content from
+combining with an unrelated application `404` to spoof infrastructure fallback.
+Provider-side failure also remains a fail-closed incomplete scan until a distinct
+fallback produces complete evidence.
+
+The outer workflow may classify exhausted provider infrastructure as neutral only
+when the run log contains no vulnerability signal. Any reported severity or
+non-zero vulnerability count remains blocking. Scanner reports and attempt logs
+remain available as artifacts.
+
+## Verification contract
+
+Regression evidence proves that:
+
+1. the exact LiteLLM `Nvidia_nimException` 404 observed in required CI is
+   recognized;
+2. an ordinary application 404 is not recognized;
+3. provider context and 404 evidence on different lines are not recognized;
+4. a provider-like source literal on one line without LiteLLM `NotFoundError`
+   context is not recognized;
+5. model-catalog 404s enter cross-model fallback but never same-model retry;
+6. the primary and first fallback are current NVIDIA hosted models;
+7. GitHub Models remain later cross-provider fallbacks;
+8. vulnerability signals prevent neutral infrastructure classification; and
+9. the required-workflow smoke contract pins these properties.
+
+## Limitations
+
+Hosted model catalogs may change independently of this repository. A model-card
+page or supported self-hosted NIM container does not guarantee indefinite hosted
+trial availability. The ordered model plan must therefore be reviewed against
+current NVIDIA documentation whenever a provider returns a catalog 404. This
+change does not treat arbitrary provider errors as success and does not weaken
+Strix severity, changed-file attribution, or independent approval requirements.
+
+## References
+
+Fielding, R., Nottingham, M., & Reschke, J. (2022). *HTTP semantics* (RFC
+9110). Internet Engineering Task Force. https://doi.org/10.17487/RFC9110
+
+NVIDIA Corporation. (2025). *Llama-3.3-Nemotron-Super-49B-v1.5* [Model card].
+NVIDIA NIM. https://build.nvidia.com/nvidia/llama-3_3-nemotron-super-49b-v1_5/modelcard
+
+NVIDIA Corporation. (2026a). *NVIDIA-Nemotron-3-Super-120B-A12B* [Model
+card]. NVIDIA NIM.
+https://build.nvidia.com/nvidia/nemotron-3-super-120b-a12b/modelcard
+
+NVIDIA Corporation. (2026b). *Configuration reference*. NVIDIA AI-Q Blueprint.
+https://docs.nvidia.com/aiq-blueprint/2.2.0-rc1/customization/configuration-reference.html