build(deps): bump cyclonedx-bom from 7.3.0 to 7.3.1

[dependabot]

Summary

Upgrade cyclonedx-bom from 7.3.0 to 7.3.1, regenerate the hash-locked security closure, and keep the repository security-metadata contract synchronized. This head also incorporates the current PR #96 security boundary without weakening its transport, response-trust, fuzz, or coverage controls.

Exact identity and scope

• Contributor head: 1c058275259daad1cbcce96683b0e44137d99a38
• Stacked base: PR fix(security): pin provider egress and repair the Atheris lock #96 at 3703d0da9823b8258a0be94f1801aa5d61bfad9f
• Protected main: 6841b71935e0b7cb98fb52bcb4709cc5100c8d87
• Unique diff relative to fix(security): pin provider egress and repair the Atheris lock #96: the two security dependency manifests, their generated lock, and the matching repository metadata test
• No unresolved inline review threads

Exact-head acceptance evidence

Local verification on the exact tree:

• Focused security-metadata tests: 8 passed
• Full suite: 566 passed
• Owned production coverage: 3,667 statements and 934 branches, 100%
• Public docstrings: 100%
• Hash-locked security environment: installed successfully
• pip-audit: no known vulnerabilities
• CycloneDX 1.6 SBOM: 70 components

Hosted verification checked out the exact contributor head:

• Tests run 31552972197, job 93979419376: success; 566 passed; 100% statement/branch coverage and 100% public docstrings
• Security run 31552972213: CodeQL job 93979419398 succeeded; supply-chain job 93979419448 succeeded with no known vulnerabilities
• SBOM artifact 9124944004: sha256:17e8f6f5117a258d4c6cbe3353588ba4291e8848bc9eb40c5b6f9b2f26dec95b
• Fuzz run 31552972208: Hypothesis job 93979419552 passed; Atheris job 93979419668 completed all four targets without crash artifacts

Merge governance

Keep this PR Draft until PR #96 is accepted and protected. Historical reviews, predecessor-head checks, synthetic-merge results, author approval, and prior OpenCode findings do not transfer to this head. After the prerequisite integrates, refresh only if ancestry requires it, regenerate exact-head evidence, obtain an eligible independent non-author approval, and merge only through protected branch policy.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 9709900954b84de2b341e7324c47a3ec199e4e6d.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Full unit and contract suite check run: failure (https://github.com/ContextualWisdomLab/contextual-orchestrator/actions/runs/30217099824/job/89833104160)
• SAST Semgrep/Semgrep (multi-language SAST): FAILURE (https://github.com/ContextualWisdomLab/contextual-orchestrator/actions/runs/30217099833/job/89833104149)
• Semgrep (multi-language SAST) check run: failure (https://github.com/ContextualWisdomLab/contextual-orchestrator/actions/runs/30217099833/job/89833104149)
• Tests/Full unit and contract suite: FAILURE (https://github.com/ContextualWisdomLab/contextual-orchestrator/actions/runs/30217099824/job/89833104160)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 2f4ec9fed753927d1ebc83638db68683736e6fad
• Workflow run: 30888054372
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2f4ec9fed753927d1ebc83638db68683736e6fad.

• Head SHA: 2f4ec9fed753927d1ebc83638db68683736e6fad

• Workflow run: 30888054372

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test_repository_security_metadata.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_repository_security_metadata.py"]
  R2 --> V2["targeted test run"]

Loading

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 8 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a6a10ceb-c33b-479d-93f7-2b3176d6523c

📥 Commits

Reviewing files that changed from the base of the PR and between 6841b71 and 2f4ec9f.

📒 Files selected for processing (4)

• requirements-security-ci.in
• requirements-security-ci.txt
• requirements-security-tools.txt
• tests/test_repository_security_metadata.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Reviewed the exact Dependabot head. The CycloneDX input pin, generated hash closure, dependency extras, and repository metadata assertion are synchronized; the broader lock diff is generated dependency metadata rather than unrelated source behavior. Tests, Fuzz, Security, and Security Scan pass. The remaining Semgrep failure is the pre-existing base finding set addressed by PR #76, so auto-merge must still wait for a rebased green head.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2f4ec9fed753927d1ebc83638db68683736e6fad.

• Head SHA: 2f4ec9fed753927d1ebc83638db68683736e6fad

• Workflow run: 30888054372

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test_repository_security_metadata.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_repository_security_metadata.py"]
  R2 --> V2["targeted test run"]

Loading

[seonghobae]

@dependabot rebase

Rebase onto the integrated security/Atheris prerequisite base fix/atheris-interpreter-lock (cfd42f309ea39a189635ff8ba573c5d3b0e332ba). Treat all earlier checks and approvals as stale; rerun exact-head validation and require a fresh independent approval before merge.

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[seonghobae]

@opencode-agent @cwl-noema-review

Review exact current contributor head 1c058275259daad1cbcce96683b0e44137d99a38 against exact live base 3703d0da9823b8258a0be94f1801aa5d61bfad9f. All repository-local Tests, Security, and Fuzz workflows are terminal-success on this exact head. Treat predecessor-head reviews, approvals, requested changes, and checks as historical. Report only current-head actionable findings; model evidence is not qualifying independent approval.

[seonghobae]

Closed by autonomous commercial loop: draft dependency/tooling PR with CHANGES_REQUESTED or stack base risk. Prefer Dependabot re-open against current main after #111–#114 land, rather than carrying long-lived draft dep branches. (build(deps): bump cyclonedx-bom from 7.3.0 to 7.3.1)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.