[seonghobae]

Purpose

Replace the stale, conflicted #799 integration path with a bounded current-main repair for #810. Preserve #799 as historical evidence only; do not import its divergent removal of later Strix work.

Root cause

The central required Security Scan could conclude success when the exact dependency-review comparison returned HTTP 403 or 404. The support probe emitted supported=false, exited zero, and skipped the pinned Dependency Review action. A hard supply-chain evidence boundary had therefore been modeled as an optional capability optimization.

Remedy and TDD identity

• exact protected base: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• RED commit b06bb25c1af99b784730209dceb299cd493734f7 reverses the stale fail-open queue contract;
• GREEN commit 71947d24828cfb42806f5ef0a8abf83f9279d0af accepts only HTTP 200, preserves curl transport status separately, bounds connect/total time, discards the response body, checks out the explicit PR-head repository/SHA, and emits exact-identity failure evidence;
• transport-failure regression b527192d7b758fc2f8a95545f25545cec7747c99 proves a partial transfer that prints 200 but exits non-zero cannot pass;
• predecessor repair head: 59d702f30fa419a016e24c18e87e05c76fbee4a3; exact current head is recorded below;
• read-only permissions and immutable action pins remain unchanged.

Scope correction

Unrelated scheduler-secret and Python-lock-materializer source/test changes that had accumulated on this branch were removed. Flattening an include-bearing requirements lock under a generated filename does not preserve relative include targets and requires a separately designed, test-first path-preservation contract.

The final scope changes only the Dependency Review control plane and its durable architecture, operator, release-note, and workflow-contract evidence. The existing executable mode of scripts/ci/materialize_base_python_requirements.py is preserved; the final mode-only correction introduces no source-content change.

Fresh exact-head evidence (2026-08-29 KST)

• exact head: 74eb5d1753cba1a48e47e9bc05940373181d7b23;
• protected base: main@e1b03eebc6dc5c85aed393e5928927c96376cf46;
• the branch was synchronized by a normal non-force merge and is mechanically mergeable;
• Security Scan run 33184295133 checked out and attested the exact head in both Trivy job 98893169360 and Dependency Review job 98893169268; Dependency Review recorded visibility=public, exact base/head, HTTP 200, and curl exit 0 before executing the pinned action;
• SAST, OSV, CodeQL, SBOM, provenance, coverage, and the remaining hosted source-quality workflows completed successfully on this head;
• required Strix run 33184294749 produced no vulnerability report: the protected-main orchestrator/free sidecar passed the local request-envelope boundary but returned gateway HTTP 500 on all three bounded attempts, and the workflow emitted typed non-passing STRIX_PROVIDER_UNAVAILABLE rather than source findings or false success;
• unresolved review threads: 0;
• exact-current-head OpenCode formal verdict: CHANGES_REQUESTED in review 5052719430, bound to 74eb5d1753cba1a48e47e9bc05940373181d7b23; qualifying independent approval: absent.

This head is not merge-ready. Provider failure, neutral/skipped checks, and missing exact-head approval remain non-passing and do not invalidate the source-level exact-head Security repair.

Acceptance contract

Merge only after:

1. all exact-current-head deterministic, security, dependency, and required workflows are terminal and clean;
2. Dependency Review reaches the immutably pinned action through a complete exact HTTP-200 comparison whose transport exits zero;
3. current automated review has no valid unresolved finding;
4. a qualifying counted non-author formal approval exists; and
5. repository protection permits normal integration.

After merge, require a protected-main public-repository consumer run proving a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate before closing #810.

Summary by CodeRabbit

• 보안 강화

  • 보안 스캔이 PR의 정확한 기준·변경 커밋을 검증하도록 개선되었습니다.
  • 의존성 검토에서 네트워크 오류, 불완전한 응답, 빈 응답 및 비정상 상태 코드를 허용하지 않습니다.
  • Trivy와 Scorecard 결과가 정확한 변경 커밋에 연결됩니다.

• 문서

  • 의존성 검토의 실패 종료 정책, 권한 범위 및 예외 처리 기준을 문서화했습니다.

• 테스트

  • 보안 스캔의 커밋 검증과 실패 처리 동작에 대한 자동화 테스트를 강화했습니다.

---