chore(docs): restore bounded automation specification tree

Author: seonghobae

AGENTS.md

@@ -3,8 +3,6 @@
 <!-- CWL-ENTRY -->
 > **Agents: read the master context FIRST.** Before any work, read [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission · naruon-as-platform + inter-component UML · cross-cutting disciplines · conventions · roadmap · current state), the live **GitHub Project #1** <https://github.com/orgs/ContextualWisdomLab/projects/1> (work/roadmap source of truth), the full spec **ContextualWisdomLab/naruon#974**, and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth.
 
-Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/automation-control-plane-standards.md`](docs/doctoring/automation-control-plane-standards.md).
-
 For central review, security, merge, fix, sandbox, or autonomous-maintenance work,
 also read the authoritative [automation documentation graph](docs/automation/README.md)
 and update its traceability/ADR entries whenever an authority, trust, failure,

ARCHITECTURE.md

@@ -15,37 +15,3 @@ shared automation control plane.
 The durable boundary is central shared policy and trusted execution with thin,
 versioned consumers. Product repositories remain independently operable and own
 their domain code, data, tests, releases, deployments, and migrations.
-
-```mermaid
-flowchart LR
-  Buyer["Commercial buyer / reviewer"]
-  Agents["Agents on AGENTS.md"]
-  Project["GitHub Project #1"]
-  Hub["This repo: org .github"]
-  Products["Owned products<br/>naruon · orchestrator · engines"]
-  Runner["Required workflows in each repo context"]
-
-  Buyer --> Hub
-  Agents --> Project
-  Agents --> Hub
-  Project --> Hub
-  Hub --> Runner
-  Runner --> Products
-  Products -->|"standalone or as module"| Buyer
-```
-
-```mermaid
-sequenceDiagram
-  participant PR as Pull request
-  participant RW as Required workflows
-  participant OC as OpenCode reviewer
-  participant SV as sandboxed_verify / web E2E
-  participant MS as Merge scheduler
-
-  PR->>RW: pull_request_target on trusted base
-  RW->>OC: bounded evidence + NVIDIA NIM / OpenCode
-  OC->>SV: PoC command in isolated copy
-  SV-->>OC: redacted stdout/stderr + command metadata
-  OC-->>PR: APPROVE or request changes
-  MS->>PR: merge only on current-head approval + green checks
-```

CHANGELOG.md

@@ -18,7 +18,6 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
-- Materialized base Python locks only when every package line is an exact SHA-256 pin or a bounded relative `-r`/`--requirement` include. A lone `--require-hashes` directive, a dotted include such as `./lock.txt`, or `-r other-hashes.txt` no longer enters the trusted build context.
 - Reconciled superseded autonomous-loop guidance so historical fixed 45-minute/minute-35 cutoffs cannot replace practical-budget plus double-sweep exit proof, and retired the historical `COPILOT_GITHUB_TOKEN` Agent Tasks API alias in favor of purpose-bound GitHub authority separated from `NVIDIA_NIM_API_KEY` model access.
 - Bounded the Strix quality self-test's deterministic timeout fixtures to 3-second process and 5-second fake-sleep budgets so exact-head policy evidence completes inside the existing job limit without changing production Strix scanner timeouts, providers, credentials, or review semantics.
 - Allowed commas and ASCII parentheses in the bounded Strix changed-file path policy so legal tracked Packrat fixtures can receive exact-head security analysis, while rejecting raw `..` components before normalization and keeping controls, backslashes, whitespace ambiguity, and shell punctuation fail-closed.

docs/doctoring/automation-control-plane-standards.md

@@ -1,7 +1,5 @@
 # Doctoring — automation control-plane standards baseline
 
-Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include; a lone `--require-hashes` line is not lock evidence.
-
 Research date: 2026-08-09
 Scope: architecture, requirements engineering, product quality, secure development, CI/CD supply chain, GitHub trust, AI-assisted review, observability, and testing
 

scripts/ci/materialize_base_python_requirements.py

@@ -87,58 +87,6 @@ def _is_candidate_lock_name(name: str) -> bool:
     )
 
 
-
-def _is_candidate_lock_path(path: pathlib.PurePosixPath) -> bool:
-    """Return whether one safe tracked path can name a pip requirements lock.
-
-    In addition to conventional ``requirements*.txt`` names, repositories often
-    keep concrete environment closures as direct children such as
-    ``requirements/ci.txt`` or ``service/requirements/package.txt``. Only direct
-    ``.txt`` children of a directory named ``requirements`` gain this path-based
-    eligibility; content must still pass the independent complete hash-pin
-    validation before it reaches the trusted image build context.
-    """
-    return _is_candidate_lock_name(path.name) or (
-        path.suffix == ".txt" and path.parent.name == "requirements"
-    )
-
-
-def _is_bounded_requirement_include(line: str) -> bool:
-    """Return whether one requirements include names a bounded relative file.
-
-    Includes are accepted only as a two-token ``-r``/``--requirement`` form
-    whose target is itself a candidate lock path written as a normalized
-    relative POSIX path. Absolute paths, ``.`` or ``..`` components, double
-    slashes, URLs, option-like targets, shell/Windows path separators,
-    fragments, queries, extra inline options or hashes, and includes of
-    non-lock files are rejected before a base-owned file can enter the
-    trusted build context.
-    The downstream installer still proves that the candidate is an independently
-    complete hash closure; this predicate grants syntax eligibility only.
-    """
-    fields = line.split()
-    if len(fields) != 2 or fields[0] not in {"-r", "--requirement"}:
-        return False
-    target = fields[1]
-    if (
-        target.startswith(("-", "~"))
-        or "\\" in target
-        or ":" in target
-        or "?" in target
-        or "#" in target
-    ):
-        return False
-    include_path = pathlib.PurePosixPath(target)
-    return (
-        bool(include_path.parts)
-        and target == include_path.as_posix()
-        and not include_path.is_absolute()
-        and "." not in include_path.parts
-        and ".." not in include_path.parts
-        and _is_candidate_lock_path(include_path)
-    )
-
-
 def _requirement_lines(content: bytes) -> list[str]:
     """Return logical requirement lines, joining backslash line-continuations.
 
@@ -159,27 +107,26 @@ def _requirement_lines(content: bytes) -> list[str]:
 
 
 def _is_hash_pinned(content: bytes) -> bool:
-    """Return whether content carries only trusted pins or bounded includes.
-
-    Discovery is content-based rather than name-based so exact hash-pinned locks
-    in service subdirectories and role-specific requirements files can be
-    considered for offline coverage. Candidate syntax is deliberately stricter
-    than a substring search: each package line must be an exact ``==`` pin with
-    one or more complete SHA-256 hashes, or a bounded relative requirements
-    include. A global ``--require-hashes`` directive is not trust evidence by
-    itself. The downstream installer separately preflights every candidate as an
-    independent ``pip --require-hashes`` closure, so syntax eligibility never
-    substitutes for dependency-closure proof.
+    """Return whether content carries hash pins and is safe to preflight.
+
+    Discovery is content-based rather than name-based so hash-pinned locks in any
+    location (a service subdirectory, ``requirements-dev.txt``,
+    ``requirements-test.txt``) can be considered for offline coverage, while an
+    unpinned or PR-mutable requirements file is still excluded from the networked
+    build context. Hash syntax cannot prove that a file includes every transitive
+    dependency, so the trusted image installer separately preflights every
+    candidate as an independent ``--require-hashes`` closure. An empty file
+    carries no installable dependency and is not materialized.
     """
     lines = _requirement_lines(content)
-    requirement_lines = [line for line in lines if line != "--require-hashes"]
-    if not requirement_lines:
+    if not lines:
         return False
-    return all(
-        _is_fully_hash_pinned_requirement(line)
-        or _is_bounded_requirement_include(line)
-        for line in requirement_lines
+    return any(line == "--require-hashes" for line in lines) or all(
+        "--hash=" in line or line.startswith(("-r ", "--requirement "))
+        for line in lines
     )
+
+
 def _is_fully_hash_pinned_requirement(line: str) -> bool:
     """Return whether one uv-export line is an exact package pin with SHA-256 hashes."""
     fields = re.split(r"\s+(?=--hash=)", line)

tests/test_materialize_base_python_requirements.py

@@ -30,13 +30,6 @@ def _created_tool_directory(path: Path) -> str:
     return str(path)
 
 
-def _force_linux_x86_64_installer(monkeypatch: pytest.MonkeyPatch) -> None:
-    """Exercise the installer path that GitHub-hosted linux x86_64 runners use."""
-    monkeypatch.setattr(materializer.sys, "platform", "linux")
-    monkeypatch.setattr(materializer.platform, "machine", lambda: "x86_64")
-    materializer._install_trusted_uv.cache_clear()
-
-
 def test_materializes_only_regular_hash_locks_from_exact_base(tmp_path: Path) -> None:
     """A PR-modified lock cannot enter the networked coverage image build context."""
     repo = tmp_path / "repo"
@@ -157,24 +150,9 @@ def test_lock_name_candidates_are_pip_requirements_files() -> None:
 def test_hash_pin_detection_includes_pinned_and_excludes_unpinned_or_empty() -> None:
     """Only fully hash-pinned, non-empty lock content is materialized."""
     assert not materializer._is_hash_pinned(b"# comment only\n\n")
-    assert not materializer._is_hash_pinned(b"--require-hashes\ndemo==1\n")
+    assert materializer._is_hash_pinned(b"--require-hashes\ndemo==1\n")
     assert materializer._is_hash_pinned(b"demo==1 --hash=sha256:" + b"a" * 64 + b"\n")
-    assert materializer._is_hash_pinned(b"-r requirements-other.txt\n")
-    assert not materializer._is_hash_pinned(b"-r other-hashes.txt\n")
-    assert not materializer._is_hash_pinned(b"-r ./requirements-other.txt\n")
-    assert not materializer._is_hash_pinned(b"-r ../escape.txt\n")
-    assert materializer._is_bounded_requirement_include(
-        "--requirement requirements-other.txt"
-    )
-    assert not materializer._is_bounded_requirement_include("-r .")
-    assert not materializer._is_bounded_requirement_include("-r -evil.txt")
-    assert not materializer._is_bounded_requirement_include("-r ~evil.txt")
-    assert not materializer._is_bounded_requirement_include("-r C:foo.txt")
-    assert not materializer._is_bounded_requirement_include("-r foo?bar.txt")
-    assert not materializer._is_bounded_requirement_include("-r foo#bar.txt")
-    assert not materializer._is_bounded_requirement_include(r"-r foo\\bar.txt")
-    assert not materializer._is_bounded_requirement_include("-r")
-    assert not materializer._is_bounded_requirement_include("-r /abs/requirements.txt")
+    assert materializer._is_hash_pinned(b"-r other-hashes.txt\n")
     assert not materializer._is_hash_pinned(b"untrusted==1\n")
     # uv export / pip-compile multi-line continuation format (spec, then --hash= lines).
     assert materializer._is_hash_pinned(
@@ -666,7 +644,6 @@ def test_install_trusted_uv_verifies_version_and_caches_path(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     """The installer writes one executable, verifies its version, and caches it."""
-    _force_linux_x86_64_installer(monkeypatch)
     tool_dir = tmp_path / "uv"
     monkeypatch.setattr(
         materializer.tempfile,
@@ -713,7 +690,6 @@ def test_install_trusted_uv_rejects_version_process_failures(
     failure: OSError | subprocess.TimeoutExpired,
 ) -> None:
     """A missing or hung downloaded executable is removed and rejected."""
-    _force_linux_x86_64_installer(monkeypatch)
     tool_dir = tmp_path / "uv"
     monkeypatch.setattr(
         materializer.tempfile,
@@ -745,7 +721,6 @@ def test_install_trusted_uv_rejects_wrong_version_or_exit_status(
     completed: subprocess.CompletedProcess[bytes],
 ) -> None:
     """Unexpected version output or a nonzero status cannot satisfy the pin."""
-    _force_linux_x86_64_installer(monkeypatch)
     tool_dir = tmp_path / f"uv-{completed.returncode}-{len(completed.stdout)}"
     monkeypatch.setattr(
         materializer.tempfile,