fix(packaging): require fast-mlsirm on every supported runtime

[seonghobae]

Root cause

contextual-orchestrator declared Python >=3.10, while its required fast-mlsirm dependency was guarded by python_full_version >= '3.12'. Upstream fast-mlsirm itself requires Python >=3.12. As a result, supported Python 3.10/3.11 installs could execute without the mandated psychometric response-quality/routing runtime, and the repository's full test suite exposed this as ModuleNotFoundError: No module named 'fast_mlsirm' in tests/test_psychometric_routing.py.

Repair

• raise the supported Python floor to >=3.12, matching the upstream statistical runtime;
• remove the environment marker so fast-mlsirm is installed for every supported contextual-orchestrator interpreter;
• add an executable packaging contract that prevents the mandatory evaluation dependency from becoming conditional again.

TDD evidence

• RED contract commit: d2094b53694775f187b8860b9ed17c75513da83f
• implementation commit: 3718b7b21b2c38fe99225a517d5952a17fb376f9

This fixes the causal packaging boundary rather than suppressing the psychometric test or treating the missing dependency as optional. Hosted exact-head checks remain authoritative.

---

Summary by CodeRabbit

• 변경 사항

  • 프로젝트의 최소 지원 Python 버전이 3.12로 상향되었습니다.
  • fast-mlsirm 의존성이 지원되는 모든 Python 환경에 일관되게 설치되도록 조정되었습니다.

• 테스트

  • Python 버전 요구 사항과 fast-mlsirm 의존성 설정을 검증하는 테스트를 추가했습니다.

• 문서

  • 기술 스택 문서의 최소 Python 버전을 3.12 이상으로 업데이트했습니다.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e0440a26-fa4c-4ca9-a5e9-25c1414fc7bb

📥 Commits

Reviewing files that changed from the base of the PR and between 4d14360 and e83d6d0.

⛔ Files ignored due to path filters (2)

• requirements.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• conductor/tech-stack.md
• pyproject.toml
• tests/test_fast_mlsirm_runtime_contract.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

프로젝트의 최소 Python 버전을 3.12로 상향했습니다. fast-mlsirm 의존성을 지원되는 모든 Python 버전에 설치하도록 변경했습니다. 기술 스택 문서와 런타임 계약 테스트를 갱신했습니다.

Changes

Python 실행 환경 계약

Layer / File(s)	Summary
Python 버전 및 fast-mlsirm 계약 갱신 pyproject.toml, conductor/tech-stack.md, tests/test_fast_mlsirm_runtime_contract.py	requires-python을 >=3.12로 변경했습니다. fast-mlsirm의 Python 환경 마커를 제거하고 v0.9.1 아카이브를 고정했습니다. 문서와 테스트가 새 계약을 반영합니다.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🔵 Low · up to e83d6

Mergeable with explicit owner awareness: deployments still using Python 3.10 or 3.11 must upgrade to Python 3.12+ before adopting this release, otherwise installation will be rejected rather than running without the required evaluation dependency.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 지원되는 모든 런타임에서 fast-mlsirm을 필수 의존성으로 설치하도록 패키징을 수정한 주요 변경 사항을 정확히 요약합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/require_fast_mlsirm_runtime

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

Current integration finding, 2026-09-10. The explicitly authorized emergency merge of exact head e2df7803b5cb77b65ffd3f2a2ce57b2a2cda5a0a was rejected by GitHub with real merge conflicts. Exact-head Quality 33864802780, Scan 33864802633, SAST 33864802606 are successful and both inline findings are resolved; those results do not validate a new combined lock.

The conflict is not permission or review waiting: current main includes e0d9511424c105d51ae390feefe279947153e578, which replaces the mutable fast-mlsirm tag URL in pyproject.toml and uv.lock with immutable Git commit 09f762ded35786dd1078222a4577ff09d649816f. Preserve that pin when integrating this PR's >=3.12/unconditional dependency contract. Do not choose the old tag side wholesale or transfer the old lock's test result. Update the runtime-contract fixture to the retained immutable dependency, regenerate/verify both supported lock paths, and ordinary-restack without force; acceptance is the locked full suite plus the floor/dependency regression on one exact merged head.

Also reverified that #1030 b0e3d62390894af105a3577eb7daf97221330e28 is already an ordinary descendant of this exact head (ahead 32, behind 0) and declares >=3.12. Thus #1030 already carries this delta, but it is not yet protected-main delivery or permission to close #995. This PR remains open with all valid source/lock/test changes preserved. No conflict repair or fresh integrated GREEN is claimed by this comment.

[seonghobae]

Protected-main reconciliation completed without history rewrite. fix/require_fast_mlsirm_runtime now points to 29b7f5457ee6a9c2a1f25f1e564f798d419bacc9, a two-parent ordinary merge descendant of prior #995 head e2df7803b5cb77b65ffd3f2a2ce57b2a2cda5a0a and protected main@012beaacd0631f8cd3391c77744eeb626269b5de.

Fresh compare is 10 ahead / 0 behind and the resulting semantic diff is still exactly the five #995 owner files: conductor/tech-stack.md, pyproject.toml, requirements.lock, tests/test_fast_mlsirm_runtime_contract.py, uv.lock.

Conflict resolution is intentional rather than mechanical: current main's pyproject.toml/uv.lock divergence was only the #1111 chicken-and-egg recovery pin to fast-mlsirm commit 09f762ded35786dd1078222a4577ff09d649816f; #995 restores the released dependency contract and raises the supported Python floor to 3.12. Upstream fast-mlsirm release v0.9.1 is live and GitHub reports immutable: true, so the release tarball is now the correct released-contract identity rather than a mutable dependency or an unverified rollback.

Keep this PR Draft until fresh exact-head CI/review for 29b7f545... is terminal. No predecessor checks/reviews are carried forward.

[seonghobae]

@opencode-agent review

Please review only current head 29b7f5457ee6a9c2a1f25f1e564f798d419bacc9 against protected main@012beaacd0631f8cd3391c77744eeb626269b5de. Predecessor reviews/checks are historical. Pay particular attention to the Python 3.12 floor, lock consistency, and the transition from the temporary immutable commit pin to the immutable fast-mlsirm v0.9.1 Release tag, which currently resolves to the same source commit 09f762ded35786dd1078222a4577ff09d649816f.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• conductor/tech-stack.md — repository behavior
• pyproject.toml — repository behavior
• requirements.lock — repository behavior
• tests/test_fast_mlsirm_runtime_contract.py — regression suite
• uv.lock — repository behavior

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: tech-stack.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: tech-stack.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Repository file: pyproject.toml"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: pyproject.toml"]
  R2 --> V2["required checks"]
  Evidence --> S3["Repository file: requirements.lock"]
  S3 --> I3["repository behavior"]
  I3 --> R3["Review risk: Repository file: requirements.lock"]
  R3 --> V3["required checks"]
  Evidence --> S4["Test: test_fast_mlsirm_runtime_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_fast_mlsirm_runtime_contract.py"]
  R4 --> V4["targeted test run"]
  Evidence --> S5["Repository file: uv.lock"]
  S5 --> I5["repository behavior"]
  I5 --> R5["Review risk: Repository file: uv.lock"]
  R5 --> V5["required checks"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: 29b7f5457ee6a9c2a1f25f1e564f798d419bacc9
• Workflow run: 34730081810
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: tech-stack.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: tech-stack.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Repository file: pyproject.toml"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: pyproject.toml"]
  R2 --> V2["required checks"]
  Evidence --> S3["Repository file: requirements.lock"]
  S3 --> I3["repository behavior"]
  I3 --> R3["Review risk: Repository file: requirements.lock"]
  R3 --> V3["required checks"]
  Evidence --> S4["Test: test_fast_mlsirm_runtime_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_fast_mlsirm_runtime_contract.py"]
  R4 --> V4["targeted test run"]
  Evidence --> S5["Repository file: uv.lock"]
  S5 --> I5["repository behavior"]
  I5 --> R5["Review risk: Repository file: uv.lock"]
  R5 --> V5["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 29b7f5457ee6a9c2a1f25f1e564f798d419bacc9
• Workflow run: 34730081810
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: fix(packaging): require fast-mlsirm on every supported runtime #995 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.

[seonghobae]

Fresh owner-path correction for exact head 29b7f5457ee6a9c2a1f25f1e564f798d419bacc9:

The current OpenCode review block is now reproduced as a central trusted-dependency-materialization defect, not a #995 source/test finding. .github dispatch 34730081810, coverage job 103651431338, formed the authenticated merge tree and then stopped before pytest/coverage with merged_base_fingerprint_drift because uv.lock legitimately differs between base and head (head_blob_sha=517c966e..., base_blob_sha=eec0e795...).

Canonical owner is .github#1398 (fix(coverage): trust validated Python head locks). Its existing contract already owns authenticated exact-HEAD lock selection/re-export with frozen/offline and hashed fail-closed boundaries. Live #1398 head 8ff7cc0969860a1473a57bbfe500ce3a023a41be is 20 ahead / 87 behind protected .github/main@fb17ef556f94f673234aa557254ae52779e9a7b0, mechanically non-mergeable, so it has been returned to Draft and given this #995 canary as current acceptance evidence.

Do not add a #995 no-op/source-neutral freshness commit or rerun OpenCode against the unchanged protected materializer policy. Order is now: .github#1398 ordinary non-force reconciliation + exact-head validation + protected integration → replay unchanged #995 head through real coverage/review → qualifying current-head approval → normal #995 merge. Only then should #1030 reconcile against the new protected CO tip for release publication.

[seonghobae]

@opencode-agent review

Fresh current-head review requested for exact 29b7f5457ee6a9c2a1f25f1e564f798d419bacc9. The same-head coverage-evidence check 103651074831 is now terminal SUCCESS, so the earlier COVERAGE_BLOCKED / COMMENTED receipt from workflow run 34730081810 is stale gate evidence rather than a current product finding. Please evaluate this unchanged exact head against protected main@012beaacd0631f8cd3391c77744eeb626269b5de; do not carry predecessor coverage failure forward. No source-neutral commit or gate weakening is requested.

[seonghobae]

Correction to my immediately preceding @opencode-agent review request: do not treat the independent repository coverage-evidence success as discharging the OpenCode dispatch's internal materialization RED. The same exact #995 head still reproduces the canonical .github#1398 canary in dispatch 34730081810 / internal coverage job 103651431338: authenticated merge-tree construction reaches materialization and fails on legitimate changed-head uv.lock with merged_base_fingerprint_drift before pytest/coverage.

Accordingly, no additional review/rerun is requested until that owner path changes. Normal order is .github#2094 (overlapping narrower materializer/toolchain writer) settles and integrates normally → .github#1398 ordinary/non-force reconciles onto that protected tip preserving exact-HEAD lock trust → unchanged exact #995 is replayed through the OpenCode-internal coverage/review lane. This supersedes only the rerun request above; #995 source remains unchanged and no gate weakening or freshness commit is authorized.

[seonghobae]

Fresh protected-base sweep: contextual-orchestrator/main advanced normally to 767e67fbc6b881a452761f32abb69b9971b9b03b via #1053 (fix(gateway): remove implicit model request timeout). This PR remains exact 29b7f5457ee6a9c2a1f25f1e564f798d419bacc9, with base metadata still at predecessor protected 012beaacd0631f8cd3391c77744eeb626269b5de; GitHub now reports it non-mergeable.

Preserve the Python>=3.12 / unconditional fast-mlsirm runtime contract and repair ancestry ordinary/non-force onto the new protected tip. Then reacquire exact-head/current-base packaging, tests, coverage, security, review, and required workflow evidence. Do not close the valid delta, revert fast-mlsirm to conditional/mutable source authority, copy #1053 timeout logic, or use a no-op wake/force rebase as a substitute for the restack. Prior receipts are ancestry evidence only after this protected-main movement.