ci: enforce declared Python package compatibility

[seonghobae]

Finding

Protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f consolidated repository-owned quality into Foundation CI, while merged Python packages already declare support below the primary CPython 3.14 runtime. Structured Interview Plan #40 is the concrete adopter: it declares requires-python = ">=3.12" and historically exercised 3.12/3.13/3.14. Deleting its retired package-local workflow without replacement evidence would weaken the declared runtime contract.

Earlier heads repaired four distinct defects: metadata/parser failure being reclassified as an unsupported-package skip; patch-sensitive PEP 440 evaluation against fabricated major.minor.0; owned packages escaping acceptance when src/ or tests/ disappeared; and a second compatibility matrix job that violated the protected one-job Foundation admission contract. Exact head f529086c... produced the real queue-shape RED in Foundation run 34050838082.

Exact head 79e8757515673144b68687517360cf493e93ccb8 then produced Foundation GREEN in run 34053906336: the single Repository quality job passed exact checkout, runner-image proof, Foundation validation, dependency hygiene, primary package/service/PostgreSQL contracts, Python 3.12 compatibility, Python 3.13 compatibility, and clean-checkout proof.

That GREEN exposed one remaining provenance finding on review: .github/requirements/foundation-compatibility-test.txt was hash-locked per dependency but its complete file bytes were not bound by the canonical manifest inventory. A reviewed compatibility dependency set could therefore change without changing the manifest unless a tracked artifact bound it.

Current repair

Current successor f1f152b0838e11cba1cf583706eb0983d56af373 keeps the same one-job compatibility behavior and adds a fail-closed provenance check before compatibility installation:

• .github/workflows/foundation-ci.yml remains exactly one quality job on ubuntu-24.04;
• primary CPython 3.14 package/service/PostgreSQL contracts run first;
• before switching runtimes, Foundation verifies the complete compatibility requirements file against reviewed SHA-256 cebb36181e8ac995a36d73a02a45094a204ff5adb3cbcdc0c9eccff309ac6aab;
• CPython 3.12 and 3.13 then execute sequentially in the same job;
• package discovery remains package-neutral; exact executed interpreter patches drive PEP 440 selection; malformed metadata and incomplete owned package layouts fail closed; compatibility evidence is non-vacuous and keeps each package's 100% statement/branch contract;
• the compatibility file remains installed with --require-hashes --no-deps --only-binary=:all:;
• the manifest-sealed workflow now transitively integrity-binds the compatibility input instead of relying on an untracked mutable dependency file;
• retired package-local workflows remain retired.

The final Foundation workflow is resealed in manifest.json as SHA-256 27fd3f2a69181e6a31b49ab2a3d394bfc8dca2b8ef5e9ce39324273f7962773d, 11,708 bytes, 251 lines. A manual manifest transcription error on an unrelated migration digest in intermediate commit 581e1a3f... was immediately detected by exact diff review and corrected in normal fast-forward successor dd89898a...; comparison against 79e875... after correction shows only the intended Foundation workflow and its manifest entry changed. No migration source was modified.

Traceability is synchronized at the current head and records the successful 34053906336 predecessor evidence plus the provenance repair rationale.

Exact-current-head authority

• exact head: f1f152b0838e11cba1cf583706eb0983d56af373;
• protected base: develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f;
• state: open · Draft · mergeable;
• Foundation 34057542130: terminal SUCCESS;
• SAST 34057542122: terminal SUCCESS;
• Security 34057542151: terminal FAILURE only in dependency-review. Exact-head checkout/verification succeeded; Scorecard, OSV, and Trivy succeeded; Check dependency review support failed before the pinned Dependency Review action, which was skipped. Central owner .github#810 records the current fail-closed GitHub dependency-comparison 403 incident. This is incomplete authoritative security evidence, not an Orgmetra source vulnerability and not permission for a local substitute or gate weakening;
• CodeQL 34057542155: terminal FAILURE. Language detection succeeded and both Python and Actions compatibility jobs successfully requested the current-head dispatch, then failed only at Release runner or enforce current-head CodeQL verdict. Central owner .github#1925 records the dispatched native-scan handler template defect; .github#1927 records the subsequent dispatch-identity authorization mismatch that must be decided at the central security boundary. Do not synthesize a verdict or churn this source head;
• predecessor evidence remains historical RCA only and is not transferred;
• fresh review enumeration: 0 submitted reviews and 0 inline review threads. Live organization ruleset 18156473 still requires one approving review while naming no reviewer/code-owner/last-push authority. .github#772 owns that solo-maintainer governance deadlock; self/model approval and routine administrator bypass remain forbidden.

Scope boundary

The HTTP services declare Python 3.11 support. This PR does not claim that service-runtime compatibility; #260 remains the separate successor after #258/#259 is normally integrated.

Acceptance

Keep Draft until the unchanged exact head has terminal authoritative central Security/CodeQL evidence and the then-live protected review governance is structurally satisfiable. Do not self-approve, use routine administrator bypass, manufacture a status, weaken a gate, create a no-op retrigger, or copy central workflow source into Orgmetra.

After protected integration, #40 and #42 can non-force adopt the canonical Foundation capability without restoring package-local workflow ownership.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh central owner correction for the current CodeQL RCA: .github#1925 should no longer be summarized as a workflow compile/template-validation failure before execution. Direct run evidence shows validate-dispatch receives a runner, setup succeeds, and the OpenCode app-token exchange succeeds. The failure occurs when client_payload.matrix (an array) is evaluated into a scalar step-level env: value in Bind workflow inputs to live org PR metadata; the native CodeQL scan job is then skipped. The likely toJSON(...) repair and real redispatch verification remain central-owner work. #258 has been updated with this narrower mechanism. No #259 source change/no-op retrigger is justified by this correction.