fix(supply-chain): correct unused model inventory claims

[seonghobae]

Superseded by current-base repair #1184

This PR identified a valid supply-chain evidence defect: bandsplit-v1-profile was described as consumed by runtime stem separation and checksum-verified by a loader that the current Demucs runtime does not use. Its corrected inventory blob is 10b1961798d969f400d7e73f086bdfadd7f56e75.

The source head 2c8931491c9eaf72c37688cb35b12727a72c09f5 was based on old develop@749511c3ad4000090048718f685c6bee6b3d2c25. Fresh comparison against protected develop@314ddeae7b775a4957594b599358c8255617eb2e shows this PR is ahead 1 / behind 2, so it is no longer the canonical integration lane.

Draft #1184 is the verified ordinary successor:

• base: current protected develop@314ddeae7b775a4957594b599358c8255617eb2e;
• head: df7bfdd02f9eef5bf9bb9036e6220e33343564f2;
• compare: ahead 1 / behind 0, merge base exactly current develop;
• changed files: exactly supply-chain/supplemental-component-inventory.json, 2 additions / 2 deletions;
• resulting blob: exactly 10b1961798d969f400d7e73f086bdfadd7f56e75, byte-identical to this PR's valid corrected inventory.

Therefore the complete semantic delta and verification contract are retained by #1184 and this stale-base PR is closed as verified succession, not discarded. Historical CodeRabbit review on this PR found no actionable issue in that exact corrected blob, but its checks/review are historical only and do not count as current-head evidence for #1184.

Preserved verification contract

• python3 -m json.tool supply-chain/supplemental-component-inventory.json
• python3 scripts/checks/verify_supply_chain.py
• python3 scripts/checks/verify_docs.py
• python3 scripts/checks/verify_security_notes.py
• git diff --check

Security Notes

The correction is metadata-only. It introduces no dependency, lockfile, runtime, network, filesystem, IPC, model-byte, signing, or credential behavior. The unresolved release risk remains explicit: runtime model-artifact checksum/signature/provenance and commercial-rights enforcement must be implemented and evidenced before release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ae4cb2f-82e4-4846-8414-164f87f75e0b

📥 Commits

Reviewing files that changed from the base of the PR and between 749511c and 2c89314.

📒 Files selected for processing (1)

• supply-chain/supplemental-component-inventory.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

bandsplit-v1-profile의 공급망 인벤토리 설명을 갱신했습니다. 현재 런타임 사용 여부와 SHA256 검증 상태를 정확히 기록합니다.

Changes

공급망 인벤토리 메타데이터

Layer / File(s)	Summary
런타임 사용 및 검증 설명 갱신 supply-chain/supplemental-component-inventory.json	releaseUsage는 프로필이 현재 런타임 분리 경로에서 소비되지 않음을 기록합니다. verification은 SHA256이 기록되지만 런타임 체크섬 검증은 구현되지 않았음을 기록합니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 2c893

This localized metadata correction does not change runtime behavior, dependencies, or deployment configuration. No actionable merge-blocking risk remains.

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 사용되지 않는 모델 인벤토리의 잘못된 주장을 수정하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/supply-chain-bandsplit-inventory

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

@opencode-agent review

[seonghobae]

Current-head gate evidence for 2c89314:\n\n- Strix run 33243121584 completed failure after three bounded openai/orchestrator/free attempts.\n- Each provider attempt returned HTTP 500 internal_error; no authoritative vulnerability report was produced.\n- The run uploaded only log evidence and therefore failed closed. The changed-file scope was one inventory file.\n- This is a provider/backend availability failure, not a source finding. No gate was bypassed.\n\nThe PR remains blocked pending a successful current-head Strix result, current-head OpenCode verdict, and qualifying independent approval.

[seonghobae]

@opencode-agent Review current exact head 2c8931491c9eaf72c37688cb35b12727a72c09f5 of PR #1054 only. Refetch protected develop@749511c3ad4000090048718f685c6bee6b3d2c25, this exact head, diff, reviews/threads, and current checks before producing a verdict; do not transfer predecessor evidence or mutate source unless the review proves a current-head BandScope-owned defect.

The change is intentionally limited to supply-chain/supplemental-component-inventory.json: it removes false claims that the unused bandsplit-v1 profile is consumed by runtime stem separation or checksum-verified by a nonexistent loader, and instead records that the checksum is metadata while runtime verification is not implemented. Revalidate those statements against current runtime/model-loading code and the repository supply-chain verifier. Treat the stated future Demucs/artifact integrity pipeline as a documented gap, not as implemented release evidence.

Current exact-head deterministic CI/build/security/package evidence is otherwise terminal-success where exposed; Devin reported no issues and CodeRabbit produced no actionable finding. Required opencode-review job 99075864506 failed specifically because there is no authenticated APPROVED or CHANGES_REQUESTED OpenCode verdict on this exact head. Required Strix run 33243121584 / job 99076031481 is separately non-passing because the central sidecar vendored protected contextual-orchestrator b21645116b352967e50fc497b87eb745b9cc8c61 and all three eligible orchestrator/free attempts ended in HTTP 500 internal_error without a structured vulnerability report; that dependency outage is not a BandScope finding and is not approval evidence.

Publish the formal verdict against this exact SHA through the authorized review path. If you find a defect, identify the first causal boundary and smallest realistic regression/fix on this existing owner branch. Otherwise publish a current-head no-change/approval verdict. Do not self-approve on behalf of the author, weaken gates, create another PR, or mark provider-unavailable Strix evidence as passing.