feat(reviewer): extract shared noema-core package (ADR-0014)

.github/workflows/central-review.yml

@@ -429,7 +429,7 @@ jobs:
       - name: Run independent PydanticAI review and publish current-head verdict
         env:
           GH_TOKEN: ${{ steps.noema_write_app.outputs.token }}
-          PYTHONPATH: ${{ github.workspace }}/reviewer
+          PYTHONPATH: ${{ github.workspace }}/reviewer:${{ github.workspace }}/packages/noema-core/src
           NOEMA_REVIEW_TOKEN_SOURCE: noema-github-app
           NOEMA_LLM_API_URL: ${{ vars.NOEMA_LLM_API_URL }}
           NOEMA_LLM_MODEL: ${{ vars.NOEMA_LLM_MODEL }}

.github/workflows/reviewer-ci.yml

@@ -20,6 +20,7 @@ jobs:
     timeout-minutes: 30
     env:
       NOEMA_CODEGRAPH_SANDBOX_SOURCE_IMAGE: gcr.io/distroless/java-base-debian13:nonroot
+      PYTHONPATH: ${{ github.workspace }}/reviewer:${{ github.workspace }}/packages/noema-core/src
     defaults:
       run:
         working-directory: reviewer
@@ -50,12 +51,98 @@ jobs:
       - name: install (hash-pinned dependencies)
         run: pip install --require-hashes --no-deps -r requirements-ci-hashes.txt
 
+      - name: test noema-core (100% line+branch coverage gate)
+        working-directory: packages/noema-core
+        run: python -m pytest
+
+      - name: docstring coverage noema-core (100% gate)
+        working-directory: packages/noema-core
+        run: python -m interrogate -c pyproject.toml src/noema_core
+
       - name: test (100% line+branch coverage gate)
         run: python -m pytest
 
       - name: docstring coverage (100% gate)
         run: python -m interrogate -c pyproject.toml noema_reviewer
 
+      - name: smoke-test installed reviewer wheel and sdist-to-wheel path
+        run: |
+          set -euo pipefail
+          wheel_dir="$RUNNER_TEMP/noema-reviewer-wheel"
+          sdist_dir="$RUNNER_TEMP/noema-reviewer-sdist"
+          sdist_wheel_dir="$RUNNER_TEMP/noema-reviewer-sdist-wheel"
+          direct_venv="$RUNNER_TEMP/noema-reviewer-install-smoke"
+          sdist_venv="$RUNNER_TEMP/noema-reviewer-sdist-install-smoke"
+          mkdir -p "$wheel_dir" "$sdist_dir" "$sdist_wheel_dir"
+
+          python -m pip wheel . --no-deps --no-build-isolation --wheel-dir "$wheel_dir"
+          direct_wheel="$(find "$wheel_dir" -maxdepth 1 -type f -name 'noema_reviewer-*.whl' -print -quit)"
+          test -n "$direct_wheel"
+
+          SDIST_DIR="$sdist_dir" SDIST_NAME_FILE="$RUNNER_TEMP/noema-reviewer-sdist-name" python - <<'PY'
+          import os
+          from pathlib import Path
+          from build_backend import build_sdist
+
+          sdist_name = build_sdist(os.environ["SDIST_DIR"])
+          Path(os.environ["SDIST_NAME_FILE"]).write_text(sdist_name, encoding="utf-8")
+          PY
+          sdist="$sdist_dir/$(cat "$RUNNER_TEMP/noema-reviewer-sdist-name")"
+          test -f "$sdist"
+          python -m pip wheel "$sdist" --no-deps --no-build-isolation --wheel-dir "$sdist_wheel_dir"
+          sdist_wheel="$(find "$sdist_wheel_dir" -maxdepth 1 -type f -name 'noema_reviewer-*.whl' -print -quit)"
+          test -n "$sdist_wheel"
+
+          for contract in direct sdist; do
+            if [ "$contract" = direct ]; then
+              wheel="$direct_wheel"
+              venv_dir="$direct_venv"
+            else
+              wheel="$sdist_wheel"
+              venv_dir="$sdist_venv"
+            fi
+            python -m venv --system-site-packages "$venv_dir"
+            "$venv_dir/bin/python" -m pip install --no-deps "$wheel"
+            (
+              cd "$RUNNER_TEMP"
+              PYTHONPATH='' "$venv_dir/bin/python" - <<'PY'
+          import hashlib
+          import os
+          from pathlib import Path
+
+          import noema_core
+          import noema_core.agent
+          import noema_reviewer
+          from noema_reviewer.cli import parse_args
+
+          canonical_agent = Path(os.environ["GITHUB_WORKSPACE"]) / "packages" / "noema-core" / "src" / "noema_core" / "agent.py"
+          installed_agent = Path(noema_core.agent.__file__)
+          assert hashlib.sha256(installed_agent.read_bytes()).digest() == hashlib.sha256(canonical_agent.read_bytes()).digest()
+          assert noema_core.NOEMA_PERSONA
+          assert noema_reviewer.build_agent is not None
+          assert parse_args([]).repo == ""
+          PY
+            )
+          done
+
+      - name: smoke-test isolated editable reviewer with locked runtime dependencies
+        run: |
+          set -euo pipefail
+          editable_venv="$RUNNER_TEMP/noema-reviewer-editable-smoke"
+          python -m venv "$editable_venv"
+          "$editable_venv/bin/python" -m pip install --require-hashes --no-deps -r requirements-ci-hashes.txt
+          "$editable_venv/bin/python" -m pip install --no-deps -e .
+          (
+            cd "$RUNNER_TEMP"
+            PYTHONPATH='' "$editable_venv/bin/python" - <<'PY'
+          import noema_core
+          import noema_reviewer
+
+          assert noema_core.build_agent is not None
+          assert noema_reviewer.build_agent is not None
+          PY
+          )
+
       - name: install lock-pinned CodeGraph tooling for sandbox smoke test
         env:
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
@@ -98,7 +185,7 @@ jobs:
           source_root="$RUNNER_TEMP/noema-codegraph-smoke"
           mkdir -p "$source_root"
           printf 'export const commercialReadiness = true;\n' >"$source_root/example.ts"
-          PYTHONPATH=. python - <<'PY'
+          python - <<'PY'
           import os
           from noema_reviewer.sandbox import DockerCodeGraphRunner
 

.gitignore

@@ -11,3 +11,4 @@ exchange-30d.ndjson
 exchange-30d.ndjson.provenance.json
 noema-kpi-evidence.json
 noema-smoke-evidence.json
+reviewer/_build_include/

CHANGELOG.md

@@ -1,6 +1,7 @@
 # Changelog
 
 ## Unreleased
+- `reviewer/noema_reviewer`의 PydanticAI `Agent` 구성 배선(`AsyncOpenAI` → `OpenAIChatModel` → `OpenAIProvider` → `Agent(...)`)을 신규 `packages/noema-core` 서브패키지로 추출한다(`docs/adr/0012-shared-noema-core-package.md`). 이 배선은 naruon의 `noema_agent.py:build_noema_agent`에도 독립적으로 존재하는 실제 중복이며, `noema-core`는 그 중복만 제거한다 — verdict 스키마, gating, tool/deps 기계, 자격 증명 해석 정책은 각 소비자에 그대로 남는다. `reviewer/`는 이번 PR에서 유일한 소비자이며(self-consumption only), 동작 변화 없이 기존 100% coverage/docstring 테스트 스위트가 그대로 통과한다. `noema-core`는 아직 게시되지 않아 CI/로컬 테스트 모두 `PYTHONPATH`로만 제공되며(기존에 `noema_reviewer` 자체를 제공하던 방식과 동일), PyPI 게시와 naruon 쪽 채택은 별도 후속 PR이다.
 - Noema의 필수 PR 워크플로 `ci`, `reviewer-ci`, `patch-validator-image`를 부동 `ubuntu-latest` 대신 명시적 `ubuntu-24.04` GitHub-hosted runner에 고정하고, 인용 여부와 무관하게 `ubuntu-latest` 회귀를 탐지하는 계약 테스트를 추가해 pre-checkout runner-assignment stall의 repository-owned selector 원인을 제거한다. 중앙 `Security Scan`의 runner/control-plane 권한은 별도 `.github` owner 경계에 유지한다.
 - 비공개 취약점 보고 감사가 16 KiB 응답 상한, bounded stream 취소, canonical repository/source identity의 독립 검증, SHA-1/SHA-256 exact revision, symlink·retained-path 보호를 실패-폐쇄로 강제한다. 이 감사 결과는 live private reporting 활성화, notification staffing, 실제 advisory 대응 또는 release/deployment 완료 증거를 대신하지 않는다.
 - External scheduler evidence audits now retain source authority through final report publication: reports are owner-only, no-follow, exclusive one-shot receipts, so a concurrent rename cannot move the accepted source inode onto the report pathname and have it replaced. Source/report path and inode alias checks, single-link retained-source validation, and Unicode control sanitization remain fail closed.