fix: hash-lock psycopg binary for Python 3.14

[seonghobae]

Current exact-head state — 2026-09-03

• live protected integration branch: develop@239008c4edc7d305c97704c5102b593c6622b36f;
• recorded PR base remains predecessor develop@81a2920b0ae9b054fcdcc95902341e3a5bc809c5;
• exact PR head: a093530868213ea712ffadac62965bdce997b757;
• open / Draft / mergeable / not merge-ready. PR fix: allow conserved multi-match reconciliation approvals #29 remains the protected-develop dependency root and this branch must later be reconciled non-force against the integrated protected head.

Current source state

Repository validation canonicalizes dependency project names before constructing duplicate/hash ownership maps with the dependency-free equivalent of packaging name normalization (re.sub(r"[-_.]+", "-", name).lower()). psycopg-binary, psycopg_binary, and psycopg.binary therefore share one project identity for quality-lock validation. Mutation regressions repeat the same pinned psycopg-binary version using underscore and dotted spellings and require duplicate-stanza rejection.

All currently fetched inline review threads are resolved. Thread resolution is not approval.

Evidence boundary

Historical exact-head repository/security evidence on a093530868213ea712ffadac62965bdce997b757 remains useful predecessor evidence only. The recorded base is behind live protected develop and the dependency root has not integrated; therefore those results cannot authorize future integration after the required restack. Skipped integrated-head attestations and non-terminal/failed central reviewer lanes remain non-passing.

Merge boundary

Keep Draft. First integrate #47 -> #43 -> #29, then non-destructively reconcile this branch against the exact protected integrated base and reacquire every applicable repository/organization/security/dependency/review/package/SBOM/provenance gate on one unchanged head. Do not merge, enable auto-merge, bypass protection, force-push, destructively rebase, reuse predecessor evidence, version, tag or release.

[coderabbitai]

📝 Walkthrough

Walkthrough

CPython 3.14용 psycopg-binary manylinux x86_64 휠의 SHA-256 해시를 품질 의존성에 추가했습니다. 저장소 검증 로직과 계약 테스트가 해당 해시의 포함 여부를 확인합니다. 변경 로그도 갱신했습니다.

Changes

품질 의존성 잠금

Layer / File(s)	Summary
psycopg-binary 의존성 해시 잠금 requirements-quality.txt, CHANGELOG.md	psycopg-binary==3.3.4에 CPython 3.14 manylinux x86_64 휠의 SHA-256 해시를 추가했습니다. 관련 주석과 [Unreleased] 변경 로그를 갱신했습니다.

저장소 계약 검증

Layer / File(s)	Summary
저장소 계약 검증 scripts/validate_repository.py, tests/test_repository_contracts.py	CPython 3.14 휠 해시 상수를 정의했습니다. 해시가 없으면 검증 오류를 반환하도록 변경했습니다. 계약 테스트는 유효한 해시와 누락된 해시를 모두 확인합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 3afa5

The change adds a platform-specific dependency hash and repository guards for the quality environment, but the current checks can still pass without proving that the hash belongs to psycopg-binary==3.3.4, and the regression guard has verified structural defects. Merge should wait until these repository checks and the coverage wording are corrected and rerun.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 Python 3.14용 psycopg-binary 해시 잠금이라는 주요 변경 사항을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/quality-lock-psycopg-binary-314

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@codex address the current exact-head review feedback on 1f6d29d3a678a18b0978c3910fcaf8bec1d8aca2 test-first and only on this existing branch. Verify each finding against source before changing it. Preserve the original test_quality_requirements_require_ci_coverage_wheels_and_packaging_backend assertions in that test; make the CPython 3.14 psycopg regression bind the hash specifically to the psycopg-binary==3.3.4 stanza; make validate_quality_requirements() itself fail closed when the exact CPython 3.14 manylinux x86_64 psycopg-binary hash is absent from that stanza; and correct the lockfile comment so it claims only the actually pinned CPython 3.14 platform wheel. Start with a RED mutation that removes or moves only that hash while leaving other psycopg-binary hashes present, then implement the narrow validator/test repair. Keep runtime/accounting authority unchanged. Rerun the focused repository-contract tests and the full exact-head PostgreSQL/100%-coverage/package/security gates. Do not force-push, rebase, merge, or reuse predecessor-head evidence.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

@opencode-agent Please re-review current PR HEAD 7046d99. The CPython 3.14 psycopg-binary hash is now validated specifically within its dependency stanza, and validate_quality_requirements() fails closed when that exact hash is removed or moved.

[seonghobae]

@opencode-agent Please re-review exact current PR HEAD 1e9f4678bf5d92629eaf423c91652a9101dde0ab. The prior version-bound hash-ownership defect has been repaired: repository validation now binds hashes by package name + version, rejects conflicting duplicate version stanzas, and the mutation regression moves the CPython 3.14 hash to psycopg-binary==9.9.9 and requires fail-closed behavior. Exact-head Accounting Foundation CI is green on PostgreSQL 18.4 with 461 tests, 4,987/4,987 owned statements and 1,798/1,798 branches covered, repository contracts valid, and reproducible wheel/SBOM/provenance evidence. Please return an authenticated current-head verdict; do not infer from predecessor reviews.

[seonghobae]

Current-head evidence update: the Strix failure on AIP #38 is reproducible at the hosted sidecar boundary as invalid_stream_options: stream_options.include_usage=true is not supported on /v1/chat/completions. I prepared the root-cause fix upstream in contextual-orchestrator #914, current head 3db6b77c, with provider usage forwarding, usage-only SSE capture/order, stale-state clearing, and structured passthrough fail-closed behavior. Local verification is 2529 passed; static checks pass. The upstream Strix run still provisions main b216451…, so it reproduces the old sidecar behavior until #914 is protected-merged. No bypass or AIP merge was performed.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• CHANGELOG.md — repository behavior
• requirements-quality.txt — repository behavior
• scripts/validate_repository.py — Python module behavior
• tests/test_repository_contracts.py — regression suite

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: CHANGELOG.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: CHANGELOG.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Repository file: requirements-quality.txt"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: requirements-quality.txt"]
  R2 --> V2["required checks"]
  Evidence --> S3["Python: validate_repository.py"]
  S3 --> I3["Python module behavior"]
  I3 --> R3["Review risk: Python: validate_repository.py"]
  R3 --> V3["pytest plus coverage"]
  Evidence --> S4["Test: test_repository_contracts.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_repository_contracts.py"]
  R4 --> V4["targeted test run"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: 1e9f4678bf5d92629eaf423c91652a9101dde0ab
• Workflow run: 33240816962
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: CHANGELOG.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: CHANGELOG.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Repository file: requirements-quality.txt"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: requirements-quality.txt"]
  R2 --> V2["required checks"]
  Evidence --> S3["Python: validate_repository.py"]
  S3 --> I3["Python module behavior"]
  I3 --> R3["Review risk: Python: validate_repository.py"]
  R3 --> V3["pytest plus coverage"]
  Evidence --> S4["Test: test_repository_contracts.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_repository_contracts.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 1e9f4678bf5d92629eaf423c91652a9101dde0ab
• Workflow run: 33240816962
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: fix: hash-lock psycopg binary for Python 3.14 #38 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.

[seonghobae]

Current-head repair pushed as 50fca8c763a57fa2fa4977021c88c18977f55c3f.

• RED: test_quality_requirements_include_central_python_314_psycopg_wheel failed because duplicate psycopg-binary==3.3.4 stanzas were merged by the validator.
• GREEN: validate_quality_requirements() now rejects duplicate package-version stanzas; CHANGELOG updated.
• Fresh local validation on this exact head: 461 tests passed; coverage 4,991/4,991 statements and 1,800/1,800 branches (100%); repository contracts, compileall, changed-file Ruff, and diff-check passed.
• Protected PR remains open and unmergeable by policy: required checks are re-running and no qualifying approval is present. No bypass or merge performed.

[seonghobae]

Fixed on current exact head a093530868213ea712ffadac62965bdce997b757 after verifying the source-real defect. validate_quality_requirements() now applies PEP 503 project-name normalization ([-_.]+ to -, lowercase) before tracking package/version/hash ownership. RED regressions cover both psycopg_binary==3.3.4 and psycopg.binary==3.3.4 as duplicate psycopg-binary stanzas. Local evidence on PostgreSQL 18.6 (127.0.0.1:5434): 461 tests passed; 4,637/4,637 statements and 1,626/1,626 branches at 100%; repository validator, compileall, changed Ruff, and diff checks pass. Predecessor-head evidence is stale; please evaluate this exact SHA.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Current-head governance update for a093530868213ea712ffadac62965bdce997b757:

• After all review threads were resolved, the protected central scheduler run 33258648299 dispatched a new exact-head OpenCode run 33258693094.
• The retry still could not produce a verdict: central coverage-evidence failed before PR execution because the trusted base lock image rejected the compatible psycopg-binary==3.3.4 wheel hash (Got 8c0056529e68dbe9184cd4019a1f3d8f3a4ead2f6fc7a5afcf27d3314edd1277), and OpenCode sidecar provisioning failed.
• The existing central repair ContextualWisdomLab/.github#1398 addresses this boundary by using validated exact-head Python locks, but it remains CONFLICTING/CHANGES_REQUESTED and is not a mergeable authority.

Local PR #38 validation remains green: 461 tests, 4637/4637 statements, 1626/1626 branches, repository validator, compileall, changed-file Ruff, and diff checks. PR #38 remains blocked by the central provider/toolchain failures and lacks a qualifying independent approval; no protected merge was attempted.