fix: repair frozen security graph and versioning fixture

[djm81]

Core PR #755 fails on unchanged dev dependencies and a versioning fixture that stages Git metadata. This owner-authorized slice of #747 upgrades the five necessary frozen packages, restricts fixture staging to generated projects, and isolates the smoke fallback from inherited unverified seed caches. The Semgrep sentinel follows the lock while retaining its security floor, MCP and no-waiver checks.

Frozen updates: PyJWT 2.15.1, urllib3 2.8.0, virtualenv 21.11.0, Semgrep 1.179.0 and python-discovery 1.6.0. Module/release identity, verifier dependencies, workflows, gate policy and trust exceptions are unchanged.

Signed final head: 9ed629582d5bdfe4a93610178b95772f58a1c2a3, tree 982b8ffe2f2e56c56f46340dff9328c8d090fdfd. The isolated JWT probe tests the hash-pinned delivery wheel in a separate temporary target, retaining the trusted verifier's base environment. Frozen parent assertions verify its bound version, unchanged caller options and expiry on reuse. The cache probe preserves its process-boundary assertions.

Authenticated RED: authored head 0f9d114be7e4fd70083d0c1a101590c2ab9ca06d, Requirements run 37896570864, artifact 11600054315, ZIP byte digest sha256:b30ddc50df79e0ceb1465baaec8f3ab8872f60e5b4f9c4d458c470651d4befa0. The actual report passes RED with no findings. The selected tests, mapping and acceptance record remain unchanged through final publication. Earlier rejected snapshots are retained in TDD_EVIDENCE.md and are not substituted for this proof.

Validation: published-head provenance and local native final reconciliation pass (verified maturity, zero findings). Twenty-five scoped tests pass. Ruff check/format, project BasedPyright (zero errors), scoped Markdown/YAML, selected strict OpenSpec, coherent export and lock checks pass. Self-review has zero blocking findings, with explicit dispositions for two baseline warnings, four unchanged AST suggestions and one probe-readability advisory. The unchanged reviewed graph previously passed both advisory gates, trust/licenses and fifteen security/control probes; current hosted gates and full-suite/matrix results remain independently required.

All-change OpenSpec retains the known unrelated governance delta failure (39/40). Prior broad local runs had environment failures and nested Hatch graph drift; those results are not frozen delivery proof. Artifact screening retains provenance-verification and optional Semgrep Pro limitations. Upgrading cannot sanitize external previously compromised Hatch/user caches; this change does not purge shared caches.

Current-head hosted final execution, exact-head human authority and completed required reviews remain necessary before integration. Refs #747 and #755. Original #748's broader consolidation stays open and unchanged. This slice does not close #747, archive the broad change or implement planned workflow runtime. After integration, refresh the internal wiki's merged/dependency status and rebuild its graph; its mirror was updated and rebuilt on the authoring host on 9 October 2026.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: nold-ai/specfact-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: d9d20490-756c-4045-8712-a4b41175a67c

📥 Commits

Reviewing files that changed from the base of the PR and between 2ad2b5a and 9ed6295.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• openspec/changes/dependency-update-consolidation/TDD_EVIDENCE.md
• openspec/changes/dependency-update-consolidation/design.md
• openspec/changes/dependency-update-consolidation/requirements-evidence.yaml
• openspec/changes/dependency-update-consolidation/requirements-proof/review-evidence.json
• openspec/changes/dependency-update-consolidation/tasks.md
• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• nold-ai/specfact-cli-modules (manual)

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: Reproducible Delivery Evidence
• GitHub Check: Tests (Python 3.12)
• GitHub Check: Compatibility (Python 3.11)

⚠️ CI failures not shown inline (2)

GitHub Actions: Trusted Requirements Authority / 0_Trusted Requirements Authority.txt: fix: repair frozen security graph and versioning fixture

Conclusion: failure

View job details

##[group]Run python3 .trusted-policy/.github/scripts/trusted_requirements_authority.py --event "$GITHUB_EVENT_PATH"
 �[36;1mpython3 .trusted-policy/.github/scripts/trusted_requirements_authority.py --event "$GITHUB_EVENT_PATH"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GITHUB_API_URL: https://api.github.com
   GITHUB_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 Trusted Requirements authority failed: trusted authority rejected
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Trusted Requirements Authority / Trusted Requirements Authority: fix: repair frozen security graph and versioning fixture

Conclusion: failure

View job details

##[group]Run python3 .trusted-policy/.github/scripts/trusted_requirements_authority.py --event "$GITHUB_EVENT_PATH"
 �[36;1mpython3 .trusted-policy/.github/scripts/trusted_requirements_authority.py --event "$GITHUB_EVENT_PATH"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GITHUB_API_URL: https://api.github.com
   GITHUB_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 Trusted Requirements authority failed: trusted authority rejected
 ##[error]Process completed with exit code 1.

🧰 Additional context used

📚 Code guidelines (9)

.cursor/rules/automatic-openspec-workflow.mdc — auto-discovered
.cursorrules — auto-discovered
.cursor/rules/spec-fact-cli-rules.mdc — auto-discovered
.cursor/rules/clean-code-principles.mdc — auto-discovered
.cursor/rules/testing-and-build-guide.mdc — auto-discovered
.cursor/rules/yaml-and-workflows.md — auto-discovered
.cursor/rules/python-github-rules.mdc — auto-discovered
.cursor/rules/markdown-rules.mdc — auto-discovered
.github/copilot-instructions.md — auto-discovered

📓 Path-based instructions (18)

Treat as specification source of truth: proposal/tasks/spec deltas vs.

⚙️ CodeRabbit configuration file

Files:

• openspec/changes/dependency-update-consolidation/tasks.md
• openspec/changes/dependency-update-consolidation/design.md
• openspec/changes/dependency-update-consolidation/TDD_EVIDENCE.md

Contract-first testing: meaningful scenarios, not redundant assertions already covered by contracts.

⚙️ CodeRabbit configuration file

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

Apply `openspec/config.yaml` project context and per-artifact rules (for proposal, specs, design, tasks) when creating or updating any OpenSpec change artifact in the specfact-cli codebase After implementation, validate the change with `ope...

📄 CodeRabbit inference engine (.cursor/rules/automatic-openspec-workflow.mdc)

Files:

• openspec/changes/dependency-update-consolidation/tasks.md
• openspec/changes/dependency-update-consolidation/design.md

For `/opsx:archive` (Archive change): Include module signing and cleanup in final tasks.

📄 CodeRabbit inference engine (.cursorrules)

Files:

• openspec/changes/dependency-update-consolidation/tasks.md
• openspec/changes/dependency-update-consolidation/design.md
• openspec/changes/dependency-update-consolidation/TDD_EVIDENCE.md

Linting must pass with no errors using: pylint src tests

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

Secret redaction via `LoggerSetup.redact_secrets` must be covered by unit tests

📄 CodeRabbit inference engine (.cursor/rules/clean-code-principles.mdc)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

Tests must be meaningful and test actual functionality, cover both success and failure cases, be independent and repeatable, and have clear, descriptive names.

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

Trim low-value unit tests when a contract covers the same assertion (type/shape/raises on negative checks) Delete tests that only assert input validation, datatype/shape enforcement, or raises on negative conditions now guarded by contracts...

📄 CodeRabbit inference engine (.cursor/rules/testing-and-build-guide.mdc)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

Format all YAML and workflow files using `hatch run yaml-fix-all` before committing Use Prettier to fix whitespace, indentation, and final newline across YAML files Use yamllint with the repo .yamllint configuration (line-length 140, traili...

📄 CodeRabbit inference engine (.cursor/rules/yaml-and-workflows.md)

Files:

• openspec/changes/dependency-update-consolidation/requirements-evidence.yaml

Validate YAML configuration files locally using `hatch run yaml-lint` before committing

📄 CodeRabbit inference engine (.cursor/rules/testing-and-build-guide.mdc)

Files:

• openspec/changes/dependency-update-consolidation/requirements-evidence.yaml

Write tests first in test-driven development (TDD) using the Red-Green-Refactor cycle Ensure each test is independent and repeatable with no shared state between tests Organize Python imports in tests using unittest.mock for Mock and patch...

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

Do not use more than one consecutive blank line anywhere in the document (MD012: No Multiple Consecutive Blank Lines) Fenced code blocks should be surrounded by blank lines (MD031: Fenced Code Blocks) Lists should be surrounded by blank lin...

📄 CodeRabbit inference engine (.cursor/rules/markdown-rules.mdc)

Files:

• openspec/changes/dependency-update-consolidation/tasks.md
• openspec/changes/dependency-update-consolidation/design.md
• openspec/changes/dependency-update-consolidation/TDD_EVIDENCE.md

After any code changes, follow these steps in order: (1) Apply linting and formatting to ensure code quality: `hatch run format`, (2) Type checking: `hatch run type-check` (basedpyright), (3) Contract-first approach: Run `hatch run contract...

📄 CodeRabbit inference engine (.cursorrules)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

YAML files must pass linting using: hatch run yaml-lint with relaxed policy.

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Files:

• openspec/changes/dependency-update-consolidation/requirements-evidence.yaml

Avoid markdown linting errors (refer to markdown-rules)

📄 CodeRabbit inference engine (.cursorrules)

Files:

• openspec/changes/dependency-update-consolidation/tasks.md
• openspec/changes/dependency-update-consolidation/design.md
• openspec/changes/dependency-update-consolidation/TDD_EVIDENCE.md

Code must be formatted with black and isort: black .

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

Maintain minimum 80% test coverage, with 100% coverage for critical paths in Python code Use clear naming and self-documenting code, preferring clear names over comments Ensure each function/class has a single clear purpose (Single Responsi...

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

Public APIs require `@icontract` and `@beartype` decorators

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

• tests/integration/scripts/test_runtime_discovery_fallback.py
• tests/unit/security/test_frozen_jwt_compatibility.py

🪛 ast-grep (0.45.3)

tests/integration/scripts/test_runtime_discovery_fallback.py

[error] 32-39: Command coming from incoming request
Context: subprocess.run(
[sys.executable, "-P", "-c", FALLBACK_PROBE, str(REPO_ROOT), str(tmp_path)],
cwd=REPO_ROOT,
capture_output=True,
text=True,
check=True,
timeout=10,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(subprocess-from-request)

tests/unit/security/test_frozen_jwt_compatibility.py

[error] 49-69: Command coming from incoming request
Context: subprocess.run(
[
uv,
"--no-config",
"pip",
"install",
"--target",
str(target),
"--only-binary=:all:",
"--no-deps",
"--require-hashes",
"--index-url",
"https://pypi.org/simple",
"-r",
str(requirement),
],
check=True,
capture_output=True,
text=True,
timeout=120,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(subprocess-from-request)

---

[error] 70-76: Command coming from incoming request
Context: subprocess.run(
[sys.executable, "-I", "-S", "-c", JWT_PROBE, str(target)],
check=True,
capture_output=True,
text=True,
timeout=10,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(subprocess-from-request)

---

[warning] 86-86: Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables).
Context: token = jwt.encode({"sub": "fixture"}, TEST_KEY, algorithm="HS256")
Note: [CWE-522] Insufficiently Protected Credentials.

(jwt-python-hardcoded-secret-python)

🪛 LanguageTool

openspec/changes/dependency-update-consolidation/TDD_EVIDENCE.md

[grammar] ~19-~19: Use a hyphen to join words.
Context: ...and Semgrep 1.180.0; this run is fixture failing evidence and JWT control evidenc...

(QB_NEW_EN_HYPHEN)

---

[grammar] ~90-~90: Use a hyphen to join words.
Context: ...lin) The unchanged caller/locks/fixture authored commit `24a67a043f133c5b03ca8f9...

(QB_NEW_EN_HYPHEN)

---

[style] ~196-~196: ‘exactly the same’ might be wordy. Consider a shorter alternative.
Context: ...rt closure. A temporary local probe of exactly the same child command observed missing isolated...

(EN_WORDINESS_PREMIUM_EXACTLY_THE_SAME)

---

[grammar] ~210-~210: Use a hyphen to join words.
Context: ...oundary tests have zero explicit-project type errors/warnings. Public #747 now re...

(QB_NEW_EN_HYPHEN)

---

[grammar] ~268-~268: Use a hyphen to join words.
Context: ...ng isolation arguments. Explicit-project type checking of the revised JWT file ha...

(QB_NEW_EN_HYPHEN)

---

[grammar] ~303-~303: Use a hyphen to join words.
Context: ...d correction batch. The rejected earlier authored chain and all five prior batche...

(QB_NEW_EN_HYPHEN)

🔀 Multi-repo context nold-ai/specfact-cli-modules

Linked repositories findings

nold-ai/specfact-cli-modules

• Native analyzer inputs for CPython 3.11–3.13 still pin PyJWT 2.13.0 and Semgrep 1.175.0, while this PR updates core CI to PyJWT 2.15.1 and Semgrep 1.179.0. urllib3 is already aligned at 2.8.0. [::nold-ai/specfact-cli-modules::] (scripts/native_analyzer_inputs/darwin-arm64-cp311.txt:805,1113,1194, corresponding cp312/cp313 files)
• The native Semgrep contract hard-codes version 1.175.0, its SHA-256 payload identity, plan ID, and adapter schema. Updating the core Semgrep lock does not update this companion boundary automatically. [::nold-ai/specfact-cli-modules::] (scripts/native_semgrep_parity.py:49-67, scripts/macos_managed_boundary/python_analyzers.py:32-37,774-780)
• Companion documentation explicitly requires parent-owned updates to production producers, consumers, locks, signed profiles, and Linux/portable evidence when reconciling the released Semgrep identity with the native candidate. [::nold-ai/specfact-cli-modules::] (scripts/native_analyzer_inputs/README.md:121-127,149-153, openspec/changes/code-review-native-platform-execution/NATIVE_DEPENDENCY_CONTRACT.md:9-13,116-121)
• The code-review module has an authenticated toolchain-lock resource and signed manifest, so any native analyzer refresh would require regenerated resource digests and signature handling. No module payload/version change is evidenced by this PR itself. [::nold-ai/specfact-cli-modules::] (packages/specfact-code-review/module-package.yaml:16-18,45-47)

---

📝 Summary

User-visible behavior and CLI surface

• The pip-editable runtime-discovery fallback now stores virtualenv app data under the workspace and disables periodic updates.
• If virtualenv is unavailable, the fallback still re-raises the original exception.
• The versioning fixture now stages only files under .specfact/projects, so Git metadata outside generated project files is not staged.

Contract and API impact

• No public function, Pydantic model, CLI command, option, default, or module boundary changes.
• JWT regression tests verify that inspection preserves caller-owned options, expired tokens remain rejected when verification is enabled, and padded signatures remain compatible.

Dependency and security impact

• The frozen CI dependency graph and its export update PyJWT to 2.15.1, urllib3 to 2.8.0, virtualenv to 21.11.0, Semgrep to 1.179.0, and python-discovery to 1.6.0.
• The Semgrep lock sentinel now expects 1.179.0. No security gate, trust policy, waiver, or shared-cache cleanup is added.

OpenSpec and release impact

• The change is tracked under dependency-update-consolidation as a focused implementation slice of #747. The broader consolidation remains open and out of scope.
• OpenSpec records the requirements, design, tasks, and evidence for the dependency, fixture, and cache repairs.
• No module identity or release version bump is included. No docs/ or CHANGELOG touchpoint is reported.

Testing and quality gates

• Added tests cover the hash-pinned PyJWT behavior and isolated virtualenv fallback cache.
• The PR objectives report passing scoped tests, Ruff, BasedPyright, scoped Markdown/YAML, selected OpenSpec checks, coherent export, and lock checks. The supplied evidence does not establish hatch run contract-test, coverage results, or independent full-suite and matrix results.
• Hosted current-head final execution, exact-head authority, required reviews, and independent checks remain required before integration.

Walkthrough

The change records a focused dependency and versioning-fixture repair. It updates five locked packages, changes versioning-fixture staging, isolates the virtualenv fallback cache, and adds regression tests for JWT compatibility and launcher behavior. OpenSpec documents scope, requirements, test evidence, and remaining verification.

Changes

Focused dependency repair

Layer / File(s)	Summary
Repair scope and evidence openspec/CHANGE_ORDER.md, openspec/changes/dependency-update-consolidation/*	OpenSpec records the focused repair scope, requirements, candidate checks, chronological evidence, and remaining verification and publication tasks.
Locked graph and compatibility regressions requirements/ci/locked.txt, tests/unit/security/*, tests/unit/versioning/test_analyzer.py, openspec/changes/dependency-update-consolidation/specs/*, openspec/changes/dependency-update-consolidation/requirements-evidence.yaml	The CI export updates PyJWT, python-discovery, Semgrep, urllib3, and virtualenv. Tests cover JWT option preservation, expiry, padded signatures, the Semgrep version sentinel, and versioning-fixture staging.
Isolated virtualenv fallback cache scripts/runtime_discovery_smoke.py, tests/integration/scripts/test_runtime_discovery_fallback.py, openspec/changes/dependency-update-consolidation/specs/*, openspec/changes/dependency-update-consolidation/requirements-evidence.yaml	The virtualenv fallback uses workspace-local app data and disables periodic updates. The integration test checks the cache argument, editable installation, and launcher path.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 9ed62

This change updates locked development dependencies, repairs a test fixture, and adds regression tests. No specific merge-blocking risk was found. Confirm the hosted CI checks pass on the final head before merging.

🚥 Pre-merge checks | ✅ 3 | ❌ 1 | ❓ 1

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 45.45% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 6 files. (5 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check		The 9 October amendment to #747 authorizes the five package updates, generated-project-only fixture staging, isolated virtualenv fallback data, and JWT/cache regression evidence. The summary shows the…	Provide reviewable evidence for the excluded uv.lock state and for the required current-head hosted tests, compatibility and built-wheel matrix, reproducible delivery, independent analysis, code review, signatures, and final authority che…

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check		The title uses the preferred fix: Conventional Commits prefix and accurately summarizes the frozen security graph and versioning fixture repairs.
Description check		The description is detailed and directly covers the change summary, issue references, motivation, scope, testing evidence, remaining gates, and exclusions. It does not follow the template headings or …
Out of Scope Changes check		The reviewed changes map to the focused amendment in #747. The package export, fixture staging fix, isolated smoke fallback, sentinel update, and regression tests directly support the authorized repai…

Full details: Linked Issues check

Explanation

The 9 October amendment to #747 authorizes the five package updates, generated-project-only fixture staging, isolated virtualenv fallback data, and JWT/cache regression evidence. The summary shows these changes and reports passing scoped checks, with no gate, trust, release, or module-identity changes. However, uv.lock is excluded from review, so coherent lock updates cannot be independently verified. The description also states that current-head hosted execution, exact-head authority, required reviews, and full-suite or matrix results remain pending. These items are required before integration by #747.

Resolution

Provide reviewable evidence for the excluded uv.lock state and for the required current-head hosted tests, compatibility and built-wheel matrix, reproducible delivery, independent analysis, code review, signatures, and final authority checks.

Full details: Docstring Coverage

Explanation

Docstring coverage is 45.45% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 6 files. (5 skipped: 5 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 22.83s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 15.25s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 26.11s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 27.79s
Checks: 4 total (3 passed) (1 skipped)

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 48 pull requests across this workspace.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T07:11:45.225834Z	9ed6295	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-09T07:13:10.865684Z	9ed6295	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2ad2b5adf9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 25.69s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 25.66s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 27.58s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 26.31s
Checks: 4 total (3 passed) (1 skipped)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​semgrep@​1.175.0 ⏵ 1.179.0	+1

View full report

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.13s
Checks: 4 total (3 passed) (1 skipped)

[djm81]

Final review and gate ledger for signed head 9ed629582d5bdfe4a93610178b95772f58a1c2a3 (tree 982b8ffe2f2e56c56f46340dff9328c8d090fdfd), checked 9 October 2026.

CodeRabbit completed the incremental review from 2ad2b5adf9c90c27086cfcbed9b2730d697c3079 through this head, processed seven selected files, and reported no actionable comments. No unresolved current review threads remain. No CodeRabbit code corrections were applied in this review pass.

The advisory Docstring Coverage precheck reports 45.45% with five unsupported functions. Independent AST inspection of the six functions whose bodies intersect the actual dev-to-head Python diff finds all four public test functions documented. The two undocumented helpers are private (_create_pip_editable_launcher and _init_repo), and their absence of docstrings is unchanged from dev. No public documentation or contract defect is established by this aggregate score. The repository review configuration requests material correctness/security/regression findings and excludes trivial style nits; the native self-review and clean-code gate retain their own results. The provider warning is retained without editing unrelated baseline documentation.

The Linked Issues precheck correctly leaves final authority unresolved. uv.lock is excluded by the provider's path filter, so its review cannot establish lock correctness. Independent frozen export/lock checks, current Security Audit, Dependency Trust, License Compliance and Reproducible Delivery checks pass; the candidate contains exactly the five documented package updates. Current Python 3.12 full-suite, Python 3.11 compatibility, built-wheel/runtime matrix, independent analysis, signatures, type/lint and both native Requirements producers pass. Hosted final Requirements run 37897110799 attests the current source; producer artifact 11601240278 has ZIP byte digest sha256:e2724274b2e4346f1eb9a72ceee107a030c67f5176c5c24034a5897618107c52, and fresh execution artifact 11600219867 has digest sha256:4d1187c20e626363da4d43143e11c20f3ca0c73864e0e96113c8bb155a7d1102. These byte digests are distinct from the semantic mapping digest.

The effective snapshot has 36 passing checks, no pending checks, and Trusted Requirements Authority failing because its exact member grant is not yet approved/posted. This is not overall green. Exact-head authority and conditional integration approval are pending with the human; no grant or merge is fabricated. Original #755, broader #747/#748 tasks, and planned workflow runtime remain unchanged/open. All-change OpenSpec retains the separately recorded unrelated 39/40 governance-delta failure.

[djm81]

SPECFACT_TRUSTED_REQUIREMENTS_AUTHORITY_V1
{"authority_version":1,"base_ref":"dev","capability":"trusted-requirements-authority","expires_at":"2026-10-10T07:08:21Z","head_branch":"codex/fix-core-ci-baseline","head_commit":"9ed629582d5bdfe4a93610178b95772f58a1c2a3","head_tree":"982b8ffe2f2e56c56f46340dff9328c8d090fdfd","pull_request":756,"repository":"nold-ai/specfact-cli","signer_login":"djm81"}