fix(coverage): restore validated npm workspace lock owners - #748

_{Comment @coderabbitai help to get the list of available commands.}

Stack correction: #731 was closed without merge on August 4, 2026, so it is not a valid remaining dependency and none of its checks or reviews are transferable. Keep this PR draft at exact head e280cd677ecb4e34a907574f3fcbee289aeab593. The current protected-baseline dependency is #743. After #743 merges, rebuild or reconcile this branch onto the resulting protected main, remove inherited CodeQL/Strix and historical control-plane overlap, reduce the final diff to the bounded workspace-lock-owner slice named in the description, and rerun all exact-head quality, security, supply-chain, OpenCode, Noema, independent-approval, unresolved-thread, and branch-protection gates. Do not mark ready before that reconciliation.

Exact-head downstream evidence from ContextualWisdomLab/bandscope#751 exposes an additional fail-closed npm-lock compatibility defect that should be covered before this workspace-owner slice is declared complete.

At BandScope head fa1dc9436a7cc0fc2aa0982159309e4c2b5502f4, central run 30992866042 rejects the valid npm v3 entry apps/desktop/node_modules/@types/react-dom because it has version/peer metadata but omits resolved and integrity. The exact protected base acdbea6344fe1231c39535b575f4de35e4c607c9 contains the same npm-generated entry, so this is not a Dependabot regression. validate_head_npm_lock() currently requires every non-link node_modules entry to carry its own registry tarball and SHA-512 value, which is stricter than real npm workspace lock serialization and blocks an otherwise fully green security update.

Please preserve the supply-chain boundary rather than broadly skipping incomplete entries. A reviewable acceptance rule is: permit a metadata-only nested entry only when the lock contains a canonical package entry for the same package identity/version whose resolved URL is exactly https://registry.npmjs.org/...tgz and whose integrity is one valid SHA-512 SRI; reject missing canonical metadata, version mismatch, ambiguous conflicting canonical entries, non-registry URLs, and invalid/missing integrity. Add positive BandScope-shaped workspace coverage plus negative mismatch/ambiguity/URL/integrity cases at 100% statement and branch coverage. The workspace-owner resolution and dependency-cache receipt checks should then consume the validated lock unchanged.

Closing this stale stacked draft. Its current head is the protected main commit f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae, while its base is the unmerged #759 feature branch, so the reported 33-file/102-commit diff does not represent the stated focused npm workspace resolver and cannot be safely reviewed or merged. Recreate the resolver as a clean current-main PR only after the surviving coverage/review baseline is integrated, preserving the validated lock-owner and BandScope regression contracts without inherited history.

Correction after re-reading the live branch: the stale stack was already reset and retargeted to protected main, and the current two-file diff is a bounded self-removing rebuild helper for the declared seven-file resolver slice. Reopening so that repair can finish. The PR must remain Draft and unmergeable until both helper files delete themselves, exactly the seven permanent files remain, 100% resolver coverage/docstrings and full current-head checks/reviews pass.

Release blocker: current scope is still a branch-rebuilding workflow plus apply_pr748_current_main.py, not the permanent seven-file npm workspace ownership repair. Do not execute or merge this source-writing path.

@opencode-agent address

Delete .github/workflows/rebuild-pr748-current-main.yml and the patch/apply helper. Reimplement the validated npm workspace lock-owner resolver directly through ordinary commits in the authoritative workflow, resolver, tests, support code, and APA 7 doctoring. Preserve current protected-main LLVM and coverage infrastructure. The resolver must select the nearest validated npm workspace owner, bind exact package identity and workspace declaration, reject traversal/symlinks/malformed patterns/ambiguous owners/missing or untrusted lockfiles, and never require an invalid duplicate lock beside each nested package. The final diff must contain only the intended permanent files and no repair workflow, trigger, snapshot, or writer. Keep Draft until exact-head focused/full tests, resolver 100% statement/branch coverage, public docstrings, Python compilation/Ruff, coverage workflow contracts, security/supply-chain gates, current-head OpenCode/Noema/CodeRabbit, independent approval, and branch protection all pass without reuse of predecessor evidence.

@jules Complete the existing current-main rebuild on exact live head 567e2310a6531b336ed198b400795e38b12aa1c8 without adding another workflow or helper. Keep Draft.

The branch still exposes only .github/workflows/rebuild-pr748-current-main.yml and scripts/ci/apply_pr748_current_main.py; the intended seven-file permanent diff was not published. Use the committed helper/workflow logic as reviewed input, but apply the focused resolver slice directly in an ordinary descendant commit, run its focused and complete quality gates, then delete both temporary files in the same final product commit.

Final base-to-head changed paths must be exactly:

• .github/workflows/opencode-review-dispatch.yml
• docs/doctoring/npm-workspace-lock-ownership.md
• scripts/ci/npm_workspace_install_root.py
• tests/npm_workspace_test_support.py
• tests/test_npm_workspace_install_root.py
• tests/test_npm_workspace_install_root_hardening.py
• tests/test_opencode_agent_contract.py

Preserve the protected-main LLVM 19 toolchain and all existing central security/reviewer boundaries. Do not absorb the separate nested metadata-pin problem from #807 into this PR. Run focused resolver statement/branch coverage 100%, interrogate 100%, compileall, Ruff, complete central tests, workflow contracts, and git diff --check. Commit normally; no amend, force-push, source-generating workflow, Ready transition, merge, release, or protection/credential change. Stop without mutation if the live head differs before writing.

OpenCode Review Overview

• Head SHA: 66d155513d08bce07c3d9c789797d43e2fe7b919
• Workflow run: 31135677183
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 66d155513d08bce07c3d9c789797d43e2fe7b919.

• Head SHA: 66d155513d08bce07c3d9c789797d43e2fe7b919

• Workflow run: 31135677183

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: rebuild-pr748-current-main.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: rebuild-pr748-current-main.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["CI script: apply_pr748_current_main.py"]
  S2 --> I2["review and security gate shell path"]
  I2 --> R2["Review risk: CI script: apply_pr748_current_main.py"]
  R2 --> V2["bash -n plus Strix self-test"]

자동 정리: base 대비 실제 변경(diff)이 0건이라 이 PR을 닫습니다. 변경을 추가한 뒤 reopen하세요.

@opencode-agent

Finish the bounded current-main reconstruction through its existing self-removing materializer. Import only the reviewed seven-file npm workspace lock-owner contract while preserving the current LLVM 19 coverage baseline. Verify nearest validated npm workspace owner selection for nested packages, exact regular lockfile/package ownership, traversal/symlink/workspace-glob fail-closed behavior, immutable base provenance, resolver 100% statement/branch coverage and public docstrings, Python compilation, Ruff, full workflow contracts and security gates. The final diff must contain only the seven documented product files and no temporary repair workflow/helper. Do not approve, merge, release, use COPILOT_GITHUB_TOKEN, or alter protections.

The PR now has an empty permanent diff after removing the PR-controlled rebuild and patch-application path. Closing the no-op branch; the npm workspace lock-owner repair must be rebuilt through ordinary reviewed source/test/doc commits if still needed.

@cwl-noema-review @opencode-agent Please review the exact current head after restoring the bounded npm workspace-owner implementation and removing temporary repair scope. Do not reuse predecessor-head evidence.