fix(build): hash-verified requirements.lock for presign + langextract

[POWERFULMOVES]

Summary

• Generate requirements.lock with uv pip compile --generate-hashes for presign and langextract services
• Both had -r requirements.lock in requirements.txt (Docker hardening pattern) but lock files were never generated
• Adds requirements.lock generation as a Known Road in CLAUDE.md

Context

Discovered during post-merge validation — Docker builds failed on missing lock files. Pattern follows grayjay-plugin-host, graph-linker, consciousness-service, comfy-watcher.

Test plan

• docker compose build presign langextract succeeds
• make -C pmoves up completes without build errors

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Updated operational guidelines for lock file management, clarifying requirements for generating and verifying package dependencies across services.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

📝 Walkthrough

Walkthrough

Documentation update replacing a GitHub Actions secret synchronization workflow entry with a requirements for generating hash-verified lock files for services that reference requirements.lock in their requirements.txt files.

Changes

Cohort / File(s)	Summary
Documentation .claude/CLAUDE.md	Removed "Known Roads" mapping for gh workflow run sync-secrets-local and replaced with instructions for generating hash-verified requirements.lock files via uv pip compile, listing example services requiring this enforcement.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• fix(ci): stabilize integrations GHCR (disk, digest signing, platforms) #313: Enforces hash-verified requirements.lock files and modifies how services install dependencies with --require-hashes
• fix(ci): unblock integrations GHCR + lockfile builds #312: Modifies CI and Dockerfiles to handle and use hash-verified requirements.lock files in the build process
• fix(docker): correct build contexts and requirements.lock references #348: Updates Dockerfiles/docker-compose for specific services to include and copy requirements.lock, aligning with the documented enforcement

Poem

🐰 Old secrets swept away like dust,
Lock files now earn our trust,
Hash-verified and crystalline clear,
Dependencies safe, no need to fear!
From GitHub whispers to lockfile might,
The garden grows more secure and bright! 🌱

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description includes a summary of changes, context, and test plan, but is missing key sections from the template like 'Testing' with explicit commands, 'Required Checks' checklist items, and 'Reviewer Notes'.	Expand the description to include the 'Testing' section with actual commands run (docker compose build, make output), and complete/check the required checklist items for CHIT Contract Check and documentation updates.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: adding hash-verified requirements.lock files for presign and langextract services to fix Docker build failures.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/docker-hardening-lock-files

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.claude/CLAUDE.md (1)

382-382: Clarify command path to avoid cwd-dependent failures.

Line 382 uses <svc>/..., while Line 386 scopes services under pmoves/services/. Consider making the command explicitly root-relative.

Suggested doc tweak

-| Missing `requirements.lock` | `uv pip compile <svc>/requirements.txt --generate-hashes -o <svc>/requirements.lock` | — |
+| Missing `requirements.lock` | `uv pip compile pmoves/services/<svc>/requirements.txt --generate-hashes -o pmoves/services/<svc>/requirements.lock` | — |

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.claude/CLAUDE.md at line 382, The table entry using `uv pip compile
<svc>/requirements.txt --generate-hashes -o <svc>/requirements.lock` is
ambiguous and cwd-dependent—update that command to use the repo-root service
path used elsewhere (e.g. `pmoves/services/<svc>/requirements.txt`) so it always
resolves; change both input and output paths in the table row to
`pmoves/services/<svc>/requirements.txt` and
`pmoves/services/<svc>/requirements.lock` (or explicitly prefix with
`./pmoves/services/<svc>/...`) so the command is root-relative and consistent
with the other entries.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.claude/CLAUDE.md:
- Line 382: The table entry using `uv pip compile <svc>/requirements.txt
--generate-hashes -o <svc>/requirements.lock` is ambiguous and
cwd-dependent—update that command to use the repo-root service path used
elsewhere (e.g. `pmoves/services/<svc>/requirements.txt`) so it always resolves;
change both input and output paths in the table row to
`pmoves/services/<svc>/requirements.txt` and
`pmoves/services/<svc>/requirements.lock` (or explicitly prefix with
`./pmoves/services/<svc>/...`) so the command is root-relative and consistent
with the other entries.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: cf5a4c02-02d1-4692-af90-f560ae3f8066

📥 Commits

Reviewing files that changed from the base of the PR and between a07949e and 28f02ca.

⛔ Files ignored due to path filters (2)

• pmoves/services/langextract/requirements.lock is excluded by !**/*.lock
• pmoves/services/presign/requirements.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• .claude/CLAUDE.md