[dinakarjs]

Problem and change

A valid hash followed by a malformed hash or unsupported option could pass structural validation when an environment marker was present. The parser now retains quoted marker literals and requires the complete trailing suffix to consist of valid SHA-256 hash tokens. Valid marker-bearing, multiple-hash locks remain accepted.

This draft ports the same source correction from WCM #249, source head b4f9af88236de44bab6da86c5f9b0c3619cb7522. It remains gated on independent source and repository-specific acceptance.

Validation — 31 October 2026

Published head: 120b725163c6af6c454639899b0cf53d3dddc299. Published tree 177d2b9e5a300f11a6634acee9c4777a7fb04031 equals the locally tested tree.

The exact workflow command, python -m unittest discover -s tools/tests -p 'test_lock_*.py', passes all 11 methods normally and under python -O. The real temporary-Git driver accepts a valid newly added marker-bearing lock and rejects malformed extra hashes and unsupported options, in both modes.

New regressions fail with the original parser restored; the failure is behavioral, not an import failure. All in-scope checked-in requirement locks parse; scope exclusions are unchanged. Whitespace checks pass. No fresh cross-platform resolver runs, package authentication or upgrade-safety result is claimed. Hosted checks on this new head and independent review remain pending.

Boundaries and adoption

Only repository validation tooling, tests and its scope documentation change. The driver retains no-rename enumeration, so rename/deletion cannot bypass its old baseline; new locks receive structural checks only. The guard compares marker identities; it does not fully validate/evaluate PEP 508 markers. The reported malformed-lock acceptance was not proof of an installation bypass; WCM's separate resolver may also refuse such input.

Implementation and follow-through: @dinakarjs. Draft retained; source approval does not grant this repository's acceptance. No organization-wide policy, merge or release is claimed. Prepared with OpenAI Codex; commit DCO-signed.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

The new Generated lock delta job and hosted workflow lint pass. Ordinary CI stops at inherited certifi/filelock/setuptools audit findings (job 121471802182), covered by existing #795/#822. This draft does not alter those dependencies or bypass the audit; their normal review/merge remains separate.

[carloshvp]

Reviewed exact head 2e8fbb612cf5861f9a1d5869de772662743c86ec in an isolated checkout. Requesting one correction to the generated-lock driver before adoption.

The five committed unittest methods pass. An independent temporary-Git regression renames requirements/dev.txt to requirements/renamed.txt while dropping one of ten exact, hash-pinned dependencies. Git reports R090; the actual driver exits 0 and prints NEW requirements/renamed.txt: structure only; no prior dependency baseline. This reproduces both normally and under python -O.

git diff --name-only applies rename detection and emits only the destination. The old lock never reaches the deleted-lock guard, and the new pathname bypasses comparison with its predecessor, so both deletion and dependency loss escape the advertised review requirement. Please enumerate additions/deletions with rename detection disabled, or explicitly handle rename source/destination pairs and compare their dependency identities. Add a real-Git rename-plus-removal regression alongside the existing deletion and upgrade controls.

This is a defect in the proposed CI guard, not evidence of an installed dependency or production security bypass. The source WCM checker review and this draft's repository-specific acceptance remain separate.

Reviewed with OpenAI Codex.

[dinakarjs]

@carloshvp addressed the rename finding at 50edc08. The driver now passes --no-renames to git diff so the deleted source lock reaches the existing explicit-review guard, even when Git would classify the change as R090/R100. A real temporary-Git regression verifies rename classification and checks both unchanged renames and rename-plus-dependency-removal, normally and under python -O. All four controls fail on the old driver; all six unittest methods pass with the repair, including existing upgrade/deletion controls. Syntax/pyflakes lint and whitespace pass. The documentation makes the conservative rename policy explicit. No dependency pins or runtime behavior changed. Please re-review; draft and independent acceptance gates remain. Prepared with OpenAI Codex.

[carloshvp]

Reviewed current head 50edc08e4917bab141531d06164eaab7b68d0c58.

The --no-renames repair closes the previously reproduced rename/dependency-removal bypass. In an isolated checkout, all six unittest methods pass normally and under python -O; removing only --no-renames makes all four rename controls fail. DCO trailers are present where required.

One remaining CI gap needs fixing: the workflow selects only test_lock_delta.py, so the new test_lock_renames.py regression never runs in the advertised guard job. Its path is also absent from the trigger filter. Use a discovery pattern and path filter that include both test modules, and run that workflow command normally and under -O. Keep the PR draft until its separate acceptance requirements are satisfied. Existing repository checks and independent acceptance remain separate.

Prepared with OpenAI Codex.

[dinakarjs]

@carloshvp addressed the CI discovery gap at 96f164a. The workflow and path filter both use test_lock_*.py, which includes the delta and rename modules; its regression step runs in normal and optimized (-O) modes. Both exact commands pass six unittest methods locally on Linux/Python 3.12.14, and whitespace checks pass. The published tree is the tested parent tree plus only this workflow edit. Draft retained pending independent source-checker/port acceptance and normal repository checks. Please re-review the updated head. Prepared with OpenAI Codex; DCO-signed.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

Hosted validation follow-up at 96f164a: Generated lock delta and all returned applicable technical workflows now succeed. Primary run: https://github.com/agentrust-io/cmcp/actions/runs/40918823720. The CI discovery repair is now verified by the hosted guard job as well as the local normal/-O controls. Draft status and independent source-checker/port acceptance remain unchanged. No merge or publishing workflow was performed. Prepared with OpenAI Codex.

[dinakarjs]

Closure follow-up to @carloshvp: the four current draft port heads still contain the published CI-discovery repair (cmcp #824 96f164a, agent-manifest #557 0ae45b05, ca2a #294 45edfb0c, integrations #394 40d52e23), and their hosted follow-ups already verified both regression modules. Please disposition the remaining current-head review requests/threads when you can. No new duplicate implementation or automatic adoption is proposed; WCM #249 remains the separate source-checker acceptance decision. I cannot dismiss another reviewer's changes request on their behalf. Prepared with OpenAI Codex.

[carloshvp]

Reviewed current head 96f164a3b48f155d840a0589839b54caa6d92bbe.

The CI discovery and trigger filters now include both test_lock_delta.py and test_lock_renames.py, and the workflow runs the same discovery command normally and under -O. I independently ran both commands: all six unittest methods pass in each mode, including the real-Git rename/dependency-loss controls. The four ports contain identical checker/driver code; sign-offs and diff whitespace checks pass.

This resolves my previous CI-discovery change request. Approving this bounded port implementation; keep the draft status until the separate source-checker/adoption decision and repository acceptance requirements are satisfied. This review does not adopt a cross-project policy or approve WCM #249 on its behalf.

Reviewed with OpenAI Codex.