ci: prepare prospective decision metadata with pinned PyYAML

[seathatflowsinourveins]

Scope

Prepare prospective MADR metadata validation for decision paths introduced after R5's actual main landing tree, a deterministic index, and advisory review-date reporting. Add PyYAML 6.0.3 through the existing Linux CI binary-only, hash-locked requirements installer after #735 landed.

Partial draft: the validate.yml caller remains #706-owned. The decision documents the one-line opt-in and full-history prerequisite after R5 lands. Default integrity and arbitrary-file scanning remain stdlib-only. This draft changes no workflow and claims no hosted metadata enforcement. It stays draft for the command center's Claude read.

• Base commit: 1796303f957c522e78b92667e553c06840fae3a2 (current-main rebase; includes Adaptive paper engine: exchange-calendars XNYS as the primary session calendar (never-rebuild), overnight-cap fail-open fixed #735 merge 095d4fad)
• Lane: lane:foundation
• Owned paths: .github/requirements-ci.txt; scripts/{validate,currency_due,decision_metadata}.py; tests/test_decision_metadata.py; new decision/index; sanitized R5 receipt; manifests/evidence.json in the last commit.

SOTA sources

• adr/madr@2475fe1973f66a12aaf58a91d8fa7b42c0f5ea3d:template/adr-template.md:1-10: MADR 4.0.0 frontmatter.
• yaml/pyyaml@49790e73684bebad1df05ef8d828fa12f685bffb:lib/yaml/init.py:117-125 and constructor.py:322-351: native safe_load and timestamp behavior, version 6.0.3.
• Official PyYAML 6.0.3 wheel metadata, freshly verified: Linux x86_64 CP312 ba1cc08a..., CP313 0f29edc4..., CP314 c458b6d0...; full SHA256 values in the lock and receipt.
• pip 26.2.1 install: installed native help and matching official docs; existing binary/hash installer, dry-run/report and discriminating hash control.
• Git 2.53.0 log, ls-tree, rev-parse: immutable main snapshot, fixed-path first-parent introduction and native landing tree. Current squash-only landing supports the premise; multi-commit rebase/fast-forward overturns it.
• Python JSON, datetime, argparse: stdlib index/date processing and explicit mode selection.
• User A16/A17, 2026-10-05: every record present at R5's own landing is grandfathered, no retrofit; Adaptive paper engine: exchange-calendars XNYS as the primary session calendar (never-rebuild), overnight-cap fail-open fixed #735 lands first before this lock addition. Required fields/index policy is repository-specific campaign A8/R5. Evidence enum follows the repository PR template.

Evidence-class table

Claim	Evidence class	Command / receipt
Required fields, date bounds, concurrent-main arrivals, backdated additions, stale indexes and pending/unknown states obey the policy	synthetic / local_integration	196 touched tests passed after rebase
Default/scan validation, currency report shape/notices and final coverage-row position remain compatible	local_integration	Existing currency, notice and validator tests in those 196
Combined CI lock resolves binary wheels with verified hashes on CP313; a wrong PyYAML hash is rejected	local_integration / synthetic control, reused	Earlier native pip dry-run 0, 11 candidates; zeroed-hash fixture exit 1 as expected; lock/include/installer bytes unchanged
Existing analyzer pin/hash and OSV calendar include remain consistent	local_integration	Three targeted lock-policy tests passed
Selected PyYAML parser passed its unchanged upstream harness on the reviewed CP313 wheel	native_proven, reused	2,608 upstream tests, one unchanged-source warning; not a new R5/CI312 acceptance
Registry references/hashes are consistent	local_integration	python3 scripts/validate.py exit 0; integrity/scope only
SDK constructor completed	unknown / unfinished	Native 25-minute timeout, no report/edits, requests/usage UNKNOWN; source-backed coordinator recovery has separate evidence
Hosted metadata enforcement / native CP312 parser acceptance	unknown	#706 caller held; no workflow rerun or new hosted acceptance claim

Local commands run

Private paths are sanitized; actual commands/results are retained in the lane record and compact receipt. The 199 local tests and integrity check are fresh on main1796303f. Pip and unchanged upstream parser evidence are reused from the prior receipt with matching input hashes; no repeat install or parser execution.

env TMPDIR=<private-cache> PYTHONDONTWRITEBYTECODE=1 <accepted-parser-venv>/bin/python -m unittest tests.test_decision_metadata tests.test_currency_due tests.test_currency_due_notice tests.test_validate
Ran 196 tests in 30.514s on main1796303f; OK; exit 0
python -m unittest tests.test_workflow_policy.ZizmorConfigurationTests.test_the_analyzer_stays_pinned_by_hash tests.test_catalog_freshness_pins.CatalogFreshnessPinTableTests.test_zizmor_pin_matches_requirements_lock tests.test_osv_lockfile_coverage.IgnorePolicyTests.test_repo_wide_ignores_hide_nothing_outside_their_allowed_lock
Ran 3 tests in 0.214s on main1796303f; OK; exit 0
python -m pip install --isolated --dry-run --ignore-installed --only-binary=:all: --require-hashes --index-url https://pypi.org/simple -r .github/requirements-ci.txt --report <private-native-report>
exit 0; 11 binary candidates; PyYAML6.0.3 CP313 SHA2560f29edc4...
same native pip command with deliberately zeroed PyYAML expected hash
exit 1; expected hash mismatch
python3 scripts/validate.py
exit 0; 69 components, 4 profiles, 204 receipts, 10189 hashes
python3 scripts/component_matrix.py --write
exit 0; 32 rows, 0 flip-rule violations
python3 scripts/new_host_grand_list.py --write
exit 0; 32 layers, 66 winners
git diff --check
exit 0

Failed attempts

The native OpenHands SDK builder job ns2604-ci-r5-write-20261005 started at 2026-10-05T14:03:00Z and ended at 2026-10-05T14:28:00Z after its 1,500-second (25-minute) limit. Preparation exited 0; the native start/wait command exited 1, and independent service observation reported Result=timeout. The attempt is UNFINISHED: no run report, no repository edits, and requests and usage UNKNOWN. ExecMainStatus=0 does not establish completion. Native journal and frozen source inputs remain retained privately. No SDK retry.

The lane root's cited-source implementation and later tests are separate integration/synthetic evidence and do not stand in for the failed SDK attempt or unchanged upstream tests. This follows the acceptance evidence policy and user A18. Exact structured attempt metadata and earlier failed test conditions/corrections remain in evidence/artifacts/github-ci-r5-20261005.json. The earlier #735 rebase conflicted only in the registry; the current-main rebase was clean. Main's registry copy was taken and this branch's evidence re-registered both times, without a hand merge.

Decision record

docs/decisions/2026-10-05-ci-decision-metadata.md names the alternatives, actual-landing baseline, non-success pending/unknown states, owner wiring, source correction and overturn conditions. Receipt: evidence/artifacts/github-ci-r5-20261005.json.

Host evidence

No evidence/hosts or platform-status change. Native pip performed a dry-run only; parser upstream acceptance is reused historical evidence with matching inputs.

Checklist

• No workflow/action pin changed.
• Existing binary-only, hash-locked installer and calendar include retained.
• No secret printed, logged or committed; no required secret added.
• No new paid hosting/subscription/billing surface.
• Peer-owned files/worktrees preserved; PR-metadata gates in their own workflow, reading the current PR; suite counts in the validate summary (G-1, G-6) #706 caller untouched.
• Registry committed last.
• Owner workflow wiring after R5 lands and hosted enforcement acceptance.
• Command center Claude exact-head cross-family read; keep draft.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[seathatflowsinourveins]

Closed with a record by the PR triage of 2026-10-07 (the command center's ruling, item review-ns2604-coop-20261007T023012Z (the command center's PR-triage ruling of 2026-10-07; proposal by github-ci-finalize, triage-20261007.json)). Not merged; the branch codex/ns2604-ci-r5-20261005 stays on origin at bb3832b.

What it holds: docs/decisions/2026-10-05-ci-decision-metadata.md; docs/decisions/decision-metadata-index.json; scripts/decision_metadata.py with tests/test_decision_metadata.py; evidence/artifacts/github-ci-r5-20261005.json; scripts/validate.py and scripts/currency_due.py (modified); .github/requirements-ci.txt (PyYAML 6.0.3, hash-pinned)

Superseded by: not superseded; unprioritized under the 2026-10-07 PR triage (confidence: high that nothing supersedes it: scripts/decision_metadata.py and the index are absent on main, and validate.py, currency_due.py and requirements-ci.txt are unchanged since its base)

Reopen trigger: The repository adopts machine-readable MADR metadata for new decision records. Reopen with gh pr reopen 745.