fix(review): offline coverage deps for naruon backend and keyverse service

[seonghobae]

What

Extends the trusted OpenCode coverage image's hash-pinned Python runtime set so the networkless coverage sandbox can execute the test suites of ContextualWisdomLab/naruon (backend) and ContextualWisdomLab/keyverse (services/account_unification).

Why

Since the 2026-07-17 offline isolation (#584), the sandbox has only coverage/interrogate/pytest/pytest-cov/uv. Repositories whose tests import third-party packages fail deterministically:

• naruon: ModuleNotFoundError for fastapi (for example review run 29791397066)
• keyverse: ModuleNotFoundError for pydantic (for example review run 29877526040)

OpenCode then publishes REQUEST_CHANGES on every backend-touching PR, so those repository queues cannot drain through the governance pipeline.

Naruon's backend/tests/conftest.py imports the application root. Collection therefore loads the mail, database, LLM, Google, telemetry, upload, and authentication service graph. The broader runtime set is required for real collection and execution rather than import-only stubbing. Naruon also imports starlette.websockets directly, so starlette remains an explicit reviewed pin.

How

• Add the reviewed Naruon/Keyverse runtime set to requirements-opencode-review-ci.txt.
• Keep build/lint-only setuptools, wheel, and ruff out of the trusted runtime set.
• Normalize the direct PyJWT project name to pyjwt and enforce both trust-minimization rules with a central contract test.
• Regenerate requirements-opencode-review-ci-hashes.txt for Python 3.12 on x86_64 manylinux_2_28.
• Preserve the trusted-image controls: PR manifests remain inert and installation still requires hashes and binary wheels.

Verification

• Isolated Python 3.12 installation resolved 112 packages and imported coverage, interrogate, pytest, pytest_cov, fastapi, starlette, and jwt.
• Naruon full backend suite with network denied: 1536 passed, 33 skipped.
• Keyverse account-unification suite with network denied: 52 passed.
• Central focused contract suite: 37 passed.
• Central full suite: 634 passed.
• Ruff 0.15.21: passed.
• pip-audit on the regenerated hash lock: no known vulnerabilities.
• The current-head Actions image build is the authoritative x86_64 hash/install confirmation.

Strix lock security update

This PR also moves pyasn1 0.6.3 to 0.6.4 in requirements-strix-ci-hashes.txt. That separate reviewed lock is scanned by the repo-wide hard gates, and pyasn1 0.6.3 is affected by the newly published High advisories GHSA-8ppf-4f7h-5ppj / CVE-2026-59885 and CVE-2026-59886. Leaving the old pin makes pip-audit and dependency-review fail every PR in this repository. The 0.6.4 hashes are official PyPI wheel/source digests, and the full Strix lock resolves with require-hashes and binary-only enforcement.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Extends the offline, hash-pinned Python dependency set used by the OpenCode coverage sandbox so test suites for ContextualWisdomLab/naruon (backend) and ContextualWisdomLab/keyverse (services/account_unification) can run without network access.

Changes:

• Adds additional trusted runtime pins (e.g., FastAPI/Pydantic/SQLAlchemy stack and related deps) to the reviewed requirements list.
• Regenerates the fully hash-pinned lockfile to support --require-hashes --only-binary=:all: installs in the sandbox.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
requirements-opencode-review-ci.txt	Adds the additional direct pins needed for naruon/keyverse (and retains existing saju-caldav pins) in the reviewed runtime manifest.
requirements-opencode-review-ci-hashes.txt	Regenerated hash-locked dependency graph for offline installation and reproducible builds.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 6 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1ff2f60e-bd1d-40fa-b0dd-a0a647e74839

📥 Commits

Reviewing files that changed from the base of the PR and between ddaf14e and 0a94029.

📒 Files selected for processing (3)

• requirements-opencode-review-ci-hashes.txt
• requirements-opencode-review-ci.txt
• tests/test_opencode_agent_contract.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Rebased onto current main and refreshed for the sandbox as it stands today. Summary of what changed in this update (the "How"/"Verification" sections above predate it):

• Merged origin/main (ddaf14e) — resolves the prior dirty/conflict state.
• Regenerated requirements-opencode-review-ci-hashes.txt for Python 3.14, not 3.12 — the coverage sandbox base image is now python:3.14-slim. Regenerated via scripts/ci/compile_opencode_review_lock.sh (uv, --upgrade, --only-binary :all:, x86_64 manylinux_2_28). Still 112 packages; every compiled extension (asyncpg, greenlet, tiktoken, protobuf, pydantic-core, cryptography, bcrypt, grpcio, jiter, regex) resolves to a cp314 wheel. The pytest-cov==7.1.0 and coverage==7.14.3 sentinel hashes the contract test pins are preserved.
• Dropped the strix-hashes change — main already carries pyasn1==0.6.4, so that part is now redundant (diff is down to 3 files).
• Contract test: kept both the main-side compile-command assertions and this PR's trusted-manifest (pyjwt/setuptools/wheel/ruff) assertions.

Local verification: test_opencode_agent_contract, test_opencode_docker_evidence_contract, test_materialize_base_python_requirements, test_install_base_python_locks — 72 passed. The current-head Actions image build remains the authoritative x86_64/py3.14 hash+install confirmation.

This unblocks keyverse #33's coverage-evidence (and naruon backend PRs) centrally with no per-repo change.

---

Generated by Claude Code