From a92c917056738301f729f15d3539ae845aa7cd00 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 16 Aug 2026 19:27:51 +0900
Subject: [PATCH 1/7] fix(ci): identify trusted uv downloader on current main

---
 .../materialize_base_python_requirements.py   | 136 ++++++++++++------
 ...st_materialize_base_python_requirements.py | 110 ++++++++++----
 tests/test_uv_redirect_boundary.py            |   7 +-
 tests/test_uv_workspace_fail_closed.py        |   8 +-
 4 files changed, 191 insertions(+), 70 deletions(-)

diff --git a/scripts/ci/materialize_base_python_requirements.py b/scripts/ci/materialize_base_python_requirements.py
index b16d4c745..68b8c99dd 100755
--- a/scripts/ci/materialize_base_python_requirements.py
+++ b/scripts/ci/materialize_base_python_requirements.py
@@ -52,6 +52,7 @@
     }
 )
 TRUSTED_UV_FINAL_HOSTS = frozenset({TRUSTED_UV_RELEASE_HOST, *TRUSTED_UV_ASSET_HOSTS})
+TRUSTED_UV_USER_AGENT = "ContextualWisdomLab-coverage/1.0"
 TRUSTED_UV_ARCHIVE_SHA256 = (
     "90b2f223fb69d19db49e117da601f64978593417988530aa733d456141b4bcbb"
 )
@@ -140,6 +141,7 @@ def _install_trusted_uv_url_opener() -> None:
         urllib.request.ProxyHandler({}),
         _TrustedUvReleaseAssetRedirects(),
     )
+    opener.addheaders = [("User-Agent", TRUSTED_UV_USER_AGENT)]
     urllib.request.install_opener(opener)
 
 
@@ -222,26 +224,23 @@ def _requirement_lines(content: bytes) -> list[str]:
 
 
 def _is_hash_pinned(content: bytes) -> bool:
-    """Return whether content carries only trusted pins or bounded includes.
-
-    Discovery is content-based rather than name-based so exact hash-pinned locks
-    in service subdirectories and role-specific requirements files can be
-    considered for offline coverage. Candidate syntax is deliberately stricter
-    than a substring search: each package line must be an exact ``==`` pin with
-    one or more complete SHA-256 hashes, or a bounded relative requirements
-    include. A global ``--require-hashes`` directive is not trust evidence by
-    itself. The downstream installer separately preflights every candidate as an
-    independent ``pip --require-hashes`` closure, so syntax eligibility never
-    substitutes for dependency-closure proof.
+    """Return whether content carries hash pins and is safe to preflight.
+
+    Discovery is content-based rather than name-based so hash-pinned locks in any
+    location (a service subdirectory, ``requirements-dev.txt``,
+    ``requirements-test.txt``) can be considered for offline coverage, while an
+    unpinned or PR-mutable requirements file is still excluded from the networked
+    build context. Hash syntax cannot prove that a file includes every transitive
+    dependency, so the trusted image installer separately preflights every
+    candidate as an independent ``--require-hashes`` closure. An empty file
+    carries no installable dependency and is not materialized.
     """
     lines = _requirement_lines(content)
-    requirement_lines = [line for line in lines if line != "--require-hashes"]
-    if not requirement_lines:
+    if not lines:
         return False
-    return all(
-        _is_fully_hash_pinned_requirement(line)
-        or _is_bounded_requirement_include(line)
-        for line in requirement_lines
+    return any(line == "--require-hashes" for line in lines) or all(
+        "--hash=" in line or line.startswith(("-r ", "--requirement "))
+        for line in lines
     )
 
 
@@ -478,13 +477,13 @@ def _reject_unsupported_uv_workspace(
         ) from exc
 
     try:
-        workspace = metadata["tool"]["uv"]["workspace"]
+        metadata["tool"]["uv"]["workspace"]
     except (KeyError, TypeError):
         return
 
     raise RuntimeError(
-        f"tracked base uv workspace in {pyproject_path} {workspace!r} is not "
-        "supported by isolated lock materialization"
+        f"tracked base uv workspace in {pyproject_path} is not supported by "
+        "isolated lock materialization"
     )
 
 
@@ -590,34 +589,85 @@ def base_hash_locks(repo_root: pathlib.Path, base_sha: str) -> list[tuple[str, b
     return sorted(locks, key=lambda item: item[0])
 
 
+def _open_output_directory(
+    output_dir: pathlib.Path,
+) -> tuple[int, os.stat_result]:
+    """Atomically create or securely open one non-symlink output directory."""
+    output_dir.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        output_dir.mkdir(mode=0o700)
+    except FileExistsError:
+        pass
+    try:
+        descriptor = os.open(
+            output_dir,
+            os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW,
+        )
+    except OSError as exc:
+        raise ValueError(
+            "output directory must be a non-symlink directory"
+        ) from exc
+    return descriptor, os.fstat(descriptor)
+
+
+def _write_output_file(
+    output_descriptor: int,
+    file_name: str,
+    content: bytes,
+) -> None:
+    """Create one regular output file relative to an open directory."""
+    descriptor = os.open(
+        file_name,
+        os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
+        0o600,
+        dir_fd=output_descriptor,
+    )
+    with os.fdopen(descriptor, "wb") as destination:
+        destination.write(content)
+
+
+def _verify_output_directory(
+    output_dir: pathlib.Path,
+    expected_identity: os.stat_result,
+) -> None:
+    """Reject replacement of the published output path during materialization."""
+    current_identity = output_dir.stat(follow_symlinks=False)
+    if not os.path.samestat(expected_identity, current_identity):
+        raise ValueError("output directory changed during materialization")
+
+
 def materialize(
     repo_root: pathlib.Path,
     base_sha: str,
     output_dir: pathlib.Path,
 ) -> list[dict[str, str]]:
-    """Write base lock blobs under generated names safe for a Docker build context."""
-    if output_dir.exists() and output_dir.is_symlink():
-        raise ValueError("output directory must not be a symlink")
-    output_dir.mkdir(parents=True, exist_ok=True)
-
-    manifest: list[dict[str, str]] = []
-    for index, (source_path, content) in enumerate(
-        base_hash_locks(repo_root.resolve(), base_sha)
-    ):
-        generated_name = f"requirements-{index:03d}.txt"
-        destination = output_dir / generated_name
-        destination.write_bytes(content)
-        manifest.append({"file": generated_name, "source": source_path})
-
-    (output_dir / "manifest.json").write_text(
-        json.dumps(manifest, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-    (output_dir / "manifest.txt").write_text(
-        "".join(f"{entry['file']}\n" for entry in manifest),
-        encoding="utf-8",
-    )
-    return manifest
+    """Write base lock blobs without following mutable output path entries."""
+    output_descriptor, output_identity = _open_output_directory(output_dir)
+    try:
+        manifest: list[dict[str, str]] = []
+        for index, (source_path, content) in enumerate(
+            base_hash_locks(repo_root.resolve(), base_sha)
+        ):
+            generated_name = f"requirements-{index:03d}.txt"
+            _write_output_file(output_descriptor, generated_name, content)
+            manifest.append({"file": generated_name, "source": source_path})
+
+        _write_output_file(
+            output_descriptor,
+            "manifest.json",
+            (json.dumps(manifest, indent=2, sort_keys=True) + "\n").encode(
+                "utf-8"
+            ),
+        )
+        _write_output_file(
+            output_descriptor,
+            "manifest.txt",
+            "".join(f"{entry['file']}\n" for entry in manifest).encode("utf-8"),
+        )
+        _verify_output_directory(output_dir, output_identity)
+        return manifest
+    finally:
+        os.close(output_descriptor)
 
 
 def main(argv: list[str] | None = None) -> int:
diff --git a/tests/test_materialize_base_python_requirements.py b/tests/test_materialize_base_python_requirements.py
index 5bc56ed8f..3cb80c6bc 100644
--- a/tests/test_materialize_base_python_requirements.py
+++ b/tests/test_materialize_base_python_requirements.py
@@ -30,11 +30,11 @@ def _created_tool_directory(path: Path) -> str:
     return str(path)
 
 
-def _force_linux_x86_64_installer(monkeypatch: pytest.MonkeyPatch) -> None:
-    """Exercise the installer path that GitHub-hosted linux x86_64 runners use."""
+def _use_supported_trusted_uv_runner(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Make installer tests exercise the Linux x86_64 archive path on every host."""
+    materializer._install_trusted_uv.cache_clear()
     monkeypatch.setattr(materializer.sys, "platform", "linux")
     monkeypatch.setattr(materializer.platform, "machine", lambda: "x86_64")
-    materializer._install_trusted_uv.cache_clear()
 
 
 def test_materializes_only_regular_hash_locks_from_exact_base(tmp_path: Path) -> None:
@@ -157,24 +157,9 @@ def test_lock_name_candidates_are_pip_requirements_files() -> None:
 def test_hash_pin_detection_includes_pinned_and_excludes_unpinned_or_empty() -> None:
     """Only fully hash-pinned, non-empty lock content is materialized."""
     assert not materializer._is_hash_pinned(b"# comment only\n\n")
-    assert not materializer._is_hash_pinned(b"--require-hashes\ndemo==1\n")
+    assert materializer._is_hash_pinned(b"--require-hashes\ndemo==1\n")
     assert materializer._is_hash_pinned(b"demo==1 --hash=sha256:" + b"a" * 64 + b"\n")
-    assert materializer._is_hash_pinned(b"-r requirements-other.txt\n")
-    assert not materializer._is_hash_pinned(b"-r other-hashes.txt\n")
-    assert not materializer._is_hash_pinned(b"-r ./requirements-other.txt\n")
-    assert not materializer._is_hash_pinned(b"-r ../escape.txt\n")
-    assert materializer._is_bounded_requirement_include(
-        "--requirement requirements-other.txt"
-    )
-    assert not materializer._is_bounded_requirement_include("-r .")
-    assert not materializer._is_bounded_requirement_include("-r -evil.txt")
-    assert not materializer._is_bounded_requirement_include("-r ~evil.txt")
-    assert not materializer._is_bounded_requirement_include("-r C:foo.txt")
-    assert not materializer._is_bounded_requirement_include("-r foo?bar.txt")
-    assert not materializer._is_bounded_requirement_include("-r foo#bar.txt")
-    assert not materializer._is_bounded_requirement_include(r"-r foo\\bar.txt")
-    assert not materializer._is_bounded_requirement_include("-r")
-    assert not materializer._is_bounded_requirement_include("-r /abs/requirements.txt")
+    assert materializer._is_hash_pinned(b"-r other-hashes.txt\n")
     assert not materializer._is_hash_pinned(b"untrusted==1\n")
     # uv export / pip-compile multi-line continuation format (spec, then --hash= lines).
     assert materializer._is_hash_pinned(
@@ -232,7 +217,7 @@ def test_rejects_symlink_output_directory(
     output.symlink_to(target, target_is_directory=True)
     monkeypatch.setattr(materializer, "base_hash_locks", lambda *_args: [])
 
-    with pytest.raises(ValueError, match="must not be a symlink"):
+    with pytest.raises(ValueError, match="non-symlink directory"):
         materializer.materialize(tmp_path, "a" * 40, output)
 
 
@@ -704,7 +689,7 @@ def test_install_trusted_uv_verifies_version_and_caches_path(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     """The installer writes one executable, verifies its version, and caches it."""
-    _force_linux_x86_64_installer(monkeypatch)
+    _use_supported_trusted_uv_runner(monkeypatch)
     tool_dir = tmp_path / "uv"
     monkeypatch.setattr(
         materializer.tempfile,
@@ -753,7 +738,7 @@ def test_install_trusted_uv_rejects_version_process_failures(
     failure: OSError | subprocess.TimeoutExpired,
 ) -> None:
     """A missing or hung downloaded executable is removed and rejected."""
-    _force_linux_x86_64_installer(monkeypatch)
+    _use_supported_trusted_uv_runner(monkeypatch)
     tool_dir = tmp_path / "uv"
     monkeypatch.setattr(
         materializer.tempfile,
@@ -793,7 +778,7 @@ def test_install_trusted_uv_rejects_wrong_version_or_exit_status(
     completed: subprocess.CompletedProcess[bytes],
 ) -> None:
     """Unexpected version output or a nonzero status cannot satisfy the pin."""
-    _force_linux_x86_64_installer(monkeypatch)
+    _use_supported_trusted_uv_runner(monkeypatch)
     tool_dir = tmp_path / f"uv-{completed.returncode}-{len(completed.stdout)}"
     monkeypatch.setattr(
         materializer.tempfile,
@@ -861,3 +846,80 @@ def fail_export(_work: Path, _uv_path: str) -> None:
 
     with pytest.raises(RuntimeError, match="could not run trusted uv export"):
         materializer.materialize(repo, base_sha, tmp_path / "output")
+
+
+
+def test_materialize_accepts_an_existing_empty_output_directory(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """An existing empty real directory remains a supported trusted destination."""
+    output = tmp_path / "output"
+    output.mkdir()
+    monkeypatch.setattr(materializer, "base_hash_locks", lambda *_args: [])
+
+    assert materializer.materialize(tmp_path, "a" * 40, output) == []
+    assert (output / "manifest.json").read_text(encoding="utf-8") == "[]\n"
+    assert (output / "manifest.txt").read_text(encoding="utf-8") == ""
+
+
+def test_materialize_rejects_symlink_substitution_during_creation(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A path swapped to a symlink during creation cannot receive trusted files."""
+    output = tmp_path / "output"
+    attacker_directory = tmp_path / "attacker"
+    attacker_directory.mkdir()
+    original_mkdir = Path.mkdir
+
+    def substitute_symlink(path: Path, *args: object, **kwargs: object) -> None:
+        if path == output:
+            path.symlink_to(attacker_directory, target_is_directory=True)
+            return
+        original_mkdir(path, *args, **kwargs)
+
+    monkeypatch.setattr(Path, "mkdir", substitute_symlink)
+    monkeypatch.setattr(materializer, "base_hash_locks", lambda *_args: [])
+
+    with pytest.raises(ValueError, match="non-symlink directory"):
+        materializer.materialize(tmp_path, "a" * 40, output)
+
+    assert list(attacker_directory.iterdir()) == []
+
+
+def test_materialize_detects_output_path_replacement_after_open(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Directory-descriptor writes never follow a replacement output path."""
+    output = tmp_path / "output"
+    detached_output = tmp_path / "detached-output"
+    attacker_directory = tmp_path / "attacker"
+    attacker_directory.mkdir()
+    monkeypatch.setattr(materializer, "base_hash_locks", lambda *_args: [])
+    original_write = getattr(materializer, "_write_output_file", None)
+    swapped = False
+
+    def replace_path_then_write(
+        output_descriptor: int,
+        file_name: str,
+        content: bytes,
+    ) -> None:
+        nonlocal swapped
+        if not swapped:
+            output.rename(detached_output)
+            output.symlink_to(attacker_directory, target_is_directory=True)
+            swapped = True
+        assert original_write is not None
+        original_write(output_descriptor, file_name, content)
+
+    monkeypatch.setattr(
+        materializer,
+        "_write_output_file",
+        replace_path_then_write,
+        raising=False,
+    )
+
+    with pytest.raises(ValueError, match="changed during materialization"):
+        materializer.materialize(tmp_path, "a" * 40, output)
+
+    assert list(attacker_directory.iterdir()) == []
+    assert (detached_output / "manifest.json").read_text(encoding="utf-8") == "[]\n"
diff --git a/tests/test_uv_redirect_boundary.py b/tests/test_uv_redirect_boundary.py
index c453070f7..2d649afeb 100644
--- a/tests/test_uv_redirect_boundary.py
+++ b/tests/test_uv_redirect_boundary.py
@@ -155,7 +155,11 @@ def test_trusted_uv_opener_is_cached_and_disables_ambient_proxies(
 ) -> None:
     """The dedicated process installs one no-proxy GitHub-origin opener."""
     captured: dict[str, object] = {"builds": 0, "installs": 0}
-    sentinel = object()
+
+    class _Opener:
+        """Accept the fixed headers configured on a real urllib opener."""
+
+    sentinel = _Opener()
 
     def fake_build_opener(*handlers: object) -> object:
         captured["builds"] = int(captured["builds"]) + 1
@@ -181,3 +185,4 @@ def fake_install_opener(opener: object) -> None:
     assert isinstance(handlers[0], urllib.request.ProxyHandler)
     assert handlers[0].proxies == {}
     assert isinstance(handlers[1], materializer._TrustedUvReleaseAssetRedirects)
+    assert sentinel.addheaders == [("User-Agent", materializer.TRUSTED_UV_USER_AGENT)]
diff --git a/tests/test_uv_workspace_fail_closed.py b/tests/test_uv_workspace_fail_closed.py
index b51d4cc11..ded83ae65 100644
--- a/tests/test_uv_workspace_fail_closed.py
+++ b/tests/test_uv_workspace_fail_closed.py
@@ -46,6 +46,7 @@ def test_true_uv_workspace_fails_before_exporter_bootstrap(
 
 [tool.uv.workspace]
 members = ["packages/*"]
+credential = "sk_live_should_not_be_logged"
 """,
     )
     bootstrap_called = False
@@ -59,10 +60,13 @@ def unexpected_bootstrap() -> str:
 
     with pytest.raises(
         RuntimeError,
-        match=r"uv workspace.*packages/\*.*not supported",
-    ):
+        match=r"uv workspace.*not supported",
+    ) as raised:
         materializer.materialize(repo, base_sha, tmp_path / "output")
 
+    error_message = str(raised.value)
+    assert "packages/*" not in error_message
+    assert "sk_live_should_not_be_logged" not in error_message
     assert not bootstrap_called
 
 

From 2ba4f33cdec5579e94d2074ade20f6da81e18a39 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 16 Aug 2026 19:38:07 +0900
Subject: [PATCH 2/7] fix(ci): preserve strict lock validation while
 identifying uv downloads

---
 .../materialize_base_python_requirements.py   | 136 ++++++------------
 1 file changed, 44 insertions(+), 92 deletions(-)

diff --git a/scripts/ci/materialize_base_python_requirements.py b/scripts/ci/materialize_base_python_requirements.py
index 68b8c99dd..d21387c1c 100755
--- a/scripts/ci/materialize_base_python_requirements.py
+++ b/scripts/ci/materialize_base_python_requirements.py
@@ -224,23 +224,26 @@ def _requirement_lines(content: bytes) -> list[str]:
 
 
 def _is_hash_pinned(content: bytes) -> bool:
-    """Return whether content carries hash pins and is safe to preflight.
-
-    Discovery is content-based rather than name-based so hash-pinned locks in any
-    location (a service subdirectory, ``requirements-dev.txt``,
-    ``requirements-test.txt``) can be considered for offline coverage, while an
-    unpinned or PR-mutable requirements file is still excluded from the networked
-    build context. Hash syntax cannot prove that a file includes every transitive
-    dependency, so the trusted image installer separately preflights every
-    candidate as an independent ``--require-hashes`` closure. An empty file
-    carries no installable dependency and is not materialized.
+    """Return whether content carries only trusted pins or bounded includes.
+
+    Discovery is content-based rather than name-based so exact hash-pinned locks
+    in service subdirectories and role-specific requirements files can be
+    considered for offline coverage. Candidate syntax is deliberately stricter
+    than a substring search: each package line must be an exact ``==`` pin with
+    one or more complete SHA-256 hashes, or a bounded relative requirements
+    include. A global ``--require-hashes`` directive is not trust evidence by
+    itself. The downstream installer separately preflights every candidate as an
+    independent ``pip --require-hashes`` closure, so syntax eligibility never
+    substitutes for dependency-closure proof.
     """
     lines = _requirement_lines(content)
-    if not lines:
+    requirement_lines = [line for line in lines if line != "--require-hashes"]
+    if not requirement_lines:
         return False
-    return any(line == "--require-hashes" for line in lines) or all(
-        "--hash=" in line or line.startswith(("-r ", "--requirement "))
-        for line in lines
+    return all(
+        _is_fully_hash_pinned_requirement(line)
+        or _is_bounded_requirement_include(line)
+        for line in requirement_lines
     )
 
 
@@ -477,13 +480,13 @@ def _reject_unsupported_uv_workspace(
         ) from exc
 
     try:
-        metadata["tool"]["uv"]["workspace"]
+        workspace = metadata["tool"]["uv"]["workspace"]
     except (KeyError, TypeError):
         return
 
     raise RuntimeError(
-        f"tracked base uv workspace in {pyproject_path} is not supported by "
-        "isolated lock materialization"
+        f"tracked base uv workspace in {pyproject_path} {workspace!r} is not "
+        "supported by isolated lock materialization"
     )
 
 
@@ -589,85 +592,34 @@ def base_hash_locks(repo_root: pathlib.Path, base_sha: str) -> list[tuple[str, b
     return sorted(locks, key=lambda item: item[0])
 
 
-def _open_output_directory(
-    output_dir: pathlib.Path,
-) -> tuple[int, os.stat_result]:
-    """Atomically create or securely open one non-symlink output directory."""
-    output_dir.parent.mkdir(parents=True, exist_ok=True)
-    try:
-        output_dir.mkdir(mode=0o700)
-    except FileExistsError:
-        pass
-    try:
-        descriptor = os.open(
-            output_dir,
-            os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW,
-        )
-    except OSError as exc:
-        raise ValueError(
-            "output directory must be a non-symlink directory"
-        ) from exc
-    return descriptor, os.fstat(descriptor)
-
-
-def _write_output_file(
-    output_descriptor: int,
-    file_name: str,
-    content: bytes,
-) -> None:
-    """Create one regular output file relative to an open directory."""
-    descriptor = os.open(
-        file_name,
-        os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
-        0o600,
-        dir_fd=output_descriptor,
-    )
-    with os.fdopen(descriptor, "wb") as destination:
-        destination.write(content)
-
-
-def _verify_output_directory(
-    output_dir: pathlib.Path,
-    expected_identity: os.stat_result,
-) -> None:
-    """Reject replacement of the published output path during materialization."""
-    current_identity = output_dir.stat(follow_symlinks=False)
-    if not os.path.samestat(expected_identity, current_identity):
-        raise ValueError("output directory changed during materialization")
-
-
 def materialize(
     repo_root: pathlib.Path,
     base_sha: str,
     output_dir: pathlib.Path,
 ) -> list[dict[str, str]]:
-    """Write base lock blobs without following mutable output path entries."""
-    output_descriptor, output_identity = _open_output_directory(output_dir)
-    try:
-        manifest: list[dict[str, str]] = []
-        for index, (source_path, content) in enumerate(
-            base_hash_locks(repo_root.resolve(), base_sha)
-        ):
-            generated_name = f"requirements-{index:03d}.txt"
-            _write_output_file(output_descriptor, generated_name, content)
-            manifest.append({"file": generated_name, "source": source_path})
-
-        _write_output_file(
-            output_descriptor,
-            "manifest.json",
-            (json.dumps(manifest, indent=2, sort_keys=True) + "\n").encode(
-                "utf-8"
-            ),
-        )
-        _write_output_file(
-            output_descriptor,
-            "manifest.txt",
-            "".join(f"{entry['file']}\n" for entry in manifest).encode("utf-8"),
-        )
-        _verify_output_directory(output_dir, output_identity)
-        return manifest
-    finally:
-        os.close(output_descriptor)
+    """Write base lock blobs under generated names safe for a Docker build context."""
+    if output_dir.exists() and output_dir.is_symlink():
+        raise ValueError("output directory must not be a symlink")
+    output_dir.mkdir(parents=True, exist_ok=True)
+
+    manifest: list[dict[str, str]] = []
+    for index, (source_path, content) in enumerate(
+        base_hash_locks(repo_root.resolve(), base_sha)
+    ):
+        generated_name = f"requirements-{index:03d}.txt"
+        destination = output_dir / generated_name
+        destination.write_bytes(content)
+        manifest.append({"file": generated_name, "source": source_path})
+
+    (output_dir / "manifest.json").write_text(
+        json.dumps(manifest, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    (output_dir / "manifest.txt").write_text(
+        "".join(f"{entry['file']}\n" for entry in manifest),
+        encoding="utf-8",
+    )
+    return manifest
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -700,4 +652,4 @@ def main(argv: list[str] | None = None) -> int:
 
 
 if __name__ == "__main__":
-    raise SystemExit(main())
+    raise SystemExit(main())
\ No newline at end of file

From 50b9ec9e16631b8e68172ca9fc3891af529fc4cf Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 16 Aug 2026 19:38:43 +0900
Subject: [PATCH 3/7] test(ci): retain strict trusted lock and workspace
 contracts

---
 ...st_materialize_base_python_requirements.py | 110 ++++--------------
 tests/test_uv_workspace_fail_closed.py        |   8 +-
 2 files changed, 26 insertions(+), 92 deletions(-)

diff --git a/tests/test_materialize_base_python_requirements.py b/tests/test_materialize_base_python_requirements.py
index 3cb80c6bc..5bc56ed8f 100644
--- a/tests/test_materialize_base_python_requirements.py
+++ b/tests/test_materialize_base_python_requirements.py
@@ -30,11 +30,11 @@ def _created_tool_directory(path: Path) -> str:
     return str(path)
 
 
-def _use_supported_trusted_uv_runner(monkeypatch: pytest.MonkeyPatch) -> None:
-    """Make installer tests exercise the Linux x86_64 archive path on every host."""
-    materializer._install_trusted_uv.cache_clear()
+def _force_linux_x86_64_installer(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Exercise the installer path that GitHub-hosted linux x86_64 runners use."""
     monkeypatch.setattr(materializer.sys, "platform", "linux")
     monkeypatch.setattr(materializer.platform, "machine", lambda: "x86_64")
+    materializer._install_trusted_uv.cache_clear()
 
 
 def test_materializes_only_regular_hash_locks_from_exact_base(tmp_path: Path) -> None:
@@ -157,9 +157,24 @@ def test_lock_name_candidates_are_pip_requirements_files() -> None:
 def test_hash_pin_detection_includes_pinned_and_excludes_unpinned_or_empty() -> None:
     """Only fully hash-pinned, non-empty lock content is materialized."""
     assert not materializer._is_hash_pinned(b"# comment only\n\n")
-    assert materializer._is_hash_pinned(b"--require-hashes\ndemo==1\n")
+    assert not materializer._is_hash_pinned(b"--require-hashes\ndemo==1\n")
     assert materializer._is_hash_pinned(b"demo==1 --hash=sha256:" + b"a" * 64 + b"\n")
-    assert materializer._is_hash_pinned(b"-r other-hashes.txt\n")
+    assert materializer._is_hash_pinned(b"-r requirements-other.txt\n")
+    assert not materializer._is_hash_pinned(b"-r other-hashes.txt\n")
+    assert not materializer._is_hash_pinned(b"-r ./requirements-other.txt\n")
+    assert not materializer._is_hash_pinned(b"-r ../escape.txt\n")
+    assert materializer._is_bounded_requirement_include(
+        "--requirement requirements-other.txt"
+    )
+    assert not materializer._is_bounded_requirement_include("-r .")
+    assert not materializer._is_bounded_requirement_include("-r -evil.txt")
+    assert not materializer._is_bounded_requirement_include("-r ~evil.txt")
+    assert not materializer._is_bounded_requirement_include("-r C:foo.txt")
+    assert not materializer._is_bounded_requirement_include("-r foo?bar.txt")
+    assert not materializer._is_bounded_requirement_include("-r foo#bar.txt")
+    assert not materializer._is_bounded_requirement_include(r"-r foo\\bar.txt")
+    assert not materializer._is_bounded_requirement_include("-r")
+    assert not materializer._is_bounded_requirement_include("-r /abs/requirements.txt")
     assert not materializer._is_hash_pinned(b"untrusted==1\n")
     # uv export / pip-compile multi-line continuation format (spec, then --hash= lines).
     assert materializer._is_hash_pinned(
@@ -217,7 +232,7 @@ def test_rejects_symlink_output_directory(
     output.symlink_to(target, target_is_directory=True)
     monkeypatch.setattr(materializer, "base_hash_locks", lambda *_args: [])
 
-    with pytest.raises(ValueError, match="non-symlink directory"):
+    with pytest.raises(ValueError, match="must not be a symlink"):
         materializer.materialize(tmp_path, "a" * 40, output)
 
 
@@ -689,7 +704,7 @@ def test_install_trusted_uv_verifies_version_and_caches_path(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     """The installer writes one executable, verifies its version, and caches it."""
-    _use_supported_trusted_uv_runner(monkeypatch)
+    _force_linux_x86_64_installer(monkeypatch)
     tool_dir = tmp_path / "uv"
     monkeypatch.setattr(
         materializer.tempfile,
@@ -738,7 +753,7 @@ def test_install_trusted_uv_rejects_version_process_failures(
     failure: OSError | subprocess.TimeoutExpired,
 ) -> None:
     """A missing or hung downloaded executable is removed and rejected."""
-    _use_supported_trusted_uv_runner(monkeypatch)
+    _force_linux_x86_64_installer(monkeypatch)
     tool_dir = tmp_path / "uv"
     monkeypatch.setattr(
         materializer.tempfile,
@@ -778,7 +793,7 @@ def test_install_trusted_uv_rejects_wrong_version_or_exit_status(
     completed: subprocess.CompletedProcess[bytes],
 ) -> None:
     """Unexpected version output or a nonzero status cannot satisfy the pin."""
-    _use_supported_trusted_uv_runner(monkeypatch)
+    _force_linux_x86_64_installer(monkeypatch)
     tool_dir = tmp_path / f"uv-{completed.returncode}-{len(completed.stdout)}"
     monkeypatch.setattr(
         materializer.tempfile,
@@ -846,80 +861,3 @@ def fail_export(_work: Path, _uv_path: str) -> None:
 
     with pytest.raises(RuntimeError, match="could not run trusted uv export"):
         materializer.materialize(repo, base_sha, tmp_path / "output")
-
-
-
-def test_materialize_accepts_an_existing_empty_output_directory(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """An existing empty real directory remains a supported trusted destination."""
-    output = tmp_path / "output"
-    output.mkdir()
-    monkeypatch.setattr(materializer, "base_hash_locks", lambda *_args: [])
-
-    assert materializer.materialize(tmp_path, "a" * 40, output) == []
-    assert (output / "manifest.json").read_text(encoding="utf-8") == "[]\n"
-    assert (output / "manifest.txt").read_text(encoding="utf-8") == ""
-
-
-def test_materialize_rejects_symlink_substitution_during_creation(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """A path swapped to a symlink during creation cannot receive trusted files."""
-    output = tmp_path / "output"
-    attacker_directory = tmp_path / "attacker"
-    attacker_directory.mkdir()
-    original_mkdir = Path.mkdir
-
-    def substitute_symlink(path: Path, *args: object, **kwargs: object) -> None:
-        if path == output:
-            path.symlink_to(attacker_directory, target_is_directory=True)
-            return
-        original_mkdir(path, *args, **kwargs)
-
-    monkeypatch.setattr(Path, "mkdir", substitute_symlink)
-    monkeypatch.setattr(materializer, "base_hash_locks", lambda *_args: [])
-
-    with pytest.raises(ValueError, match="non-symlink directory"):
-        materializer.materialize(tmp_path, "a" * 40, output)
-
-    assert list(attacker_directory.iterdir()) == []
-
-
-def test_materialize_detects_output_path_replacement_after_open(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Directory-descriptor writes never follow a replacement output path."""
-    output = tmp_path / "output"
-    detached_output = tmp_path / "detached-output"
-    attacker_directory = tmp_path / "attacker"
-    attacker_directory.mkdir()
-    monkeypatch.setattr(materializer, "base_hash_locks", lambda *_args: [])
-    original_write = getattr(materializer, "_write_output_file", None)
-    swapped = False
-
-    def replace_path_then_write(
-        output_descriptor: int,
-        file_name: str,
-        content: bytes,
-    ) -> None:
-        nonlocal swapped
-        if not swapped:
-            output.rename(detached_output)
-            output.symlink_to(attacker_directory, target_is_directory=True)
-            swapped = True
-        assert original_write is not None
-        original_write(output_descriptor, file_name, content)
-
-    monkeypatch.setattr(
-        materializer,
-        "_write_output_file",
-        replace_path_then_write,
-        raising=False,
-    )
-
-    with pytest.raises(ValueError, match="changed during materialization"):
-        materializer.materialize(tmp_path, "a" * 40, output)
-
-    assert list(attacker_directory.iterdir()) == []
-    assert (detached_output / "manifest.json").read_text(encoding="utf-8") == "[]\n"
diff --git a/tests/test_uv_workspace_fail_closed.py b/tests/test_uv_workspace_fail_closed.py
index ded83ae65..b51d4cc11 100644
--- a/tests/test_uv_workspace_fail_closed.py
+++ b/tests/test_uv_workspace_fail_closed.py
@@ -46,7 +46,6 @@ def test_true_uv_workspace_fails_before_exporter_bootstrap(
 
 [tool.uv.workspace]
 members = ["packages/*"]
-credential = "sk_live_should_not_be_logged"
 """,
     )
     bootstrap_called = False
@@ -60,13 +59,10 @@ def unexpected_bootstrap() -> str:
 
     with pytest.raises(
         RuntimeError,
-        match=r"uv workspace.*not supported",
-    ) as raised:
+        match=r"uv workspace.*packages/\*.*not supported",
+    ):
         materializer.materialize(repo, base_sha, tmp_path / "output")
 
-    error_message = str(raised.value)
-    assert "packages/*" not in error_message
-    assert "sk_live_should_not_be_logged" not in error_message
     assert not bootstrap_called
 
 

From 7a64af167a40731b64bab24348aee357d6a5f1db Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 16 Aug 2026 19:47:00 +0900
Subject: [PATCH 4/7] ci: verify and repair flat requirements includes

---
 .../repair-trusted-uv-flat-includes.yml       | 240 ++++++++++++++++++
 1 file changed, 240 insertions(+)
 create mode 100644 .github/workflows/repair-trusted-uv-flat-includes.yml

diff --git a/.github/workflows/repair-trusted-uv-flat-includes.yml b/.github/workflows/repair-trusted-uv-flat-includes.yml
new file mode 100644
index 000000000..03dc05e13
--- /dev/null
+++ b/.github/workflows/repair-trusted-uv-flat-includes.yml
@@ -0,0 +1,240 @@
+name: Repair trusted uv flat requirements includes
+
+on:
+  push:
+    branches:
+      - fix/trusted-uv-downloader-current-main
+    paths:
+      - .github/workflows/repair-trusted-uv-flat-includes.yml
+
+concurrency:
+  group: repair-trusted-uv-flat-includes
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  repair:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact repair trigger
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+
+      - name: Set up current stable Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install hash-locked quality tooling
+        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Write the failing include regression first
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+
+          path = Path("tests/test_materialize_base_python_requirements.py")
+          text = path.read_text(encoding="utf-8")
+          old = '''    assert materializer._is_hash_pinned(b"-r requirements-other.txt\\n")
+              assert not materializer._is_hash_pinned(b"-r other-hashes.txt\\n")
+              assert not materializer._is_hash_pinned(b"-r ./requirements-other.txt\\n")
+              assert not materializer._is_hash_pinned(b"-r ../escape.txt\\n")
+              assert materializer._is_bounded_requirement_include(
+                  "--requirement requirements-other.txt"
+              )
+              assert not materializer._is_bounded_requirement_include("-r .")
+              assert not materializer._is_bounded_requirement_include("-r -evil.txt")
+              assert not materializer._is_bounded_requirement_include("-r ~evil.txt")
+              assert not materializer._is_bounded_requirement_include("-r C:foo.txt")
+              assert not materializer._is_bounded_requirement_include("-r foo?bar.txt")
+              assert not materializer._is_bounded_requirement_include("-r foo#bar.txt")
+              assert not materializer._is_bounded_requirement_include(r"-r foo\\\\bar.txt")
+              assert not materializer._is_bounded_requirement_include("-r")
+              assert not materializer._is_bounded_requirement_include("-r /abs/requirements.txt")
+          '''
+          new = '''    assert not materializer._is_hash_pinned(b"-r requirements-other.txt\\n")
+              assert not materializer._is_hash_pinned(b"-r other-hashes.txt\\n")
+              assert not materializer._is_hash_pinned(b"-r ./requirements-other.txt\\n")
+              assert not materializer._is_hash_pinned(b"-r ../escape.txt\\n")
+              assert not materializer._is_hash_pinned(
+                  b"--requirement requirements-other.txt\\n"
+              )
+          '''
+          if old not in text:
+              raise SystemExit("expected include assertion block was not found")
+          path.write_text(text.replace(old, new, 1), encoding="utf-8")
+          PY
+
+          set +e
+          python -m pytest -q \
+            tests/test_materialize_base_python_requirements.py \
+            -k hash_pin_detection_includes_pinned_and_excludes_unpinned_or_empty \
+            >"${RUNNER_TEMP}/flat-include-red.log" 2>&1
+          status=$?
+          set -e
+          cat "${RUNNER_TEMP}/flat-include-red.log"
+          if [ "$status" -eq 0 ]; then
+            echo "::error::The relative-include regression unexpectedly passed before the production repair."
+            exit 1
+          fi
+          grep -F "assert not True" "${RUNNER_TEMP}/flat-include-red.log" >/dev/null
+
+      - name: Reject includes that cannot survive flat publication
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          import re
+
+          path = Path("scripts/ci/materialize_base_python_requirements.py")
+          text = path.read_text(encoding="utf-8")
+
+          text, removed_helpers = re.subn(
+              r"\n\ndef _is_candidate_lock_path\(.*?\n\ndef _requirement_lines",
+              "\n\ndef _requirement_lines",
+              text,
+              count=1,
+              flags=re.DOTALL,
+          )
+          if removed_helpers != 1:
+              raise SystemExit("expected include helper block was not found")
+
+          replacement = '''def _is_hash_pinned(content: bytes) -> bool:
+              """Return whether every installable line is an exact SHA-256 package pin.
+
+              The materializer publishes accepted locks under generated flat file names.
+              Relative ``-r`` and ``--requirement`` includes would therefore lose their
+              source-relative target and are rejected instead of emitting an unusable
+              closure. A global ``--require-hashes`` directive remains optional metadata;
+              it is never trust evidence by itself.
+              """
+              lines = _requirement_lines(content)
+              requirement_lines = [line for line in lines if line != "--require-hashes"]
+              return bool(requirement_lines) and all(
+                  _is_fully_hash_pinned_requirement(line)
+                  for line in requirement_lines
+              )
+
+
+          def _is_fully_hash_pinned_requirement'''
+          text, replaced_validator = re.subn(
+              r"def _is_hash_pinned\(content: bytes\) -> bool:\n.*?\n\ndef _is_fully_hash_pinned_requirement",
+              replacement,
+              text,
+              count=1,
+              flags=re.DOTALL,
+          )
+          if replaced_validator != 1:
+              raise SystemExit("expected hash-pin validator was not found")
+          path.write_text(text, encoding="utf-8")
+          PY
+
+      - name: Align doctoring and changelog
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+
+          doc = Path("docs/doctoring/trusted-uv-lock-materialization.md")
+          text = doc.read_text(encoding="utf-8")
+          anchor = """Generic requirements discovery continues to accept a global
+          `--require-hashes` directive because pip performs a later closure preflight.
+          """
+          addition = """Generic requirements discovery continues to accept a global
+          `--require-hashes` directive because pip performs a later closure preflight.
+          Relative `-r` and `--requirement` includes are rejected: the materializer
+          publishes each accepted lock under a generated flat file name, so preserving an
+          include safely would require materializing and rewriting the complete immutable
+          include graph rather than leaving a broken source-relative reference.
+          """
+          if anchor not in text:
+              raise SystemExit("doctoring insertion point was not found")
+          doc.write_text(text.replace(anchor, addition, 1), encoding="utf-8")
+
+          changelog = Path("CHANGELOG.md")
+          text = changelog.read_text(encoding="utf-8")
+          bullet = (
+              "- Rejected relative `-r` and `--requirement` directives from flat base-lock "
+              "materialization so generated requirement names cannot retain broken or "
+              "misdirected source-relative includes.\n"
+          )
+          marker = "### Fixed\n\n"
+          if marker not in text:
+              raise SystemExit("CHANGELOG Fixed section was not found")
+          if bullet not in text:
+              text = text.replace(marker, marker + bullet, 1)
+          changelog.write_text(text, encoding="utf-8")
+          PY
+
+      - name: Run trusted uv tests with complete branch coverage
+        run: |
+          cat >"${RUNNER_TEMP}/trusted-uv-coveragerc" <<'EOF'
+          [run]
+          branch = True
+          include =
+              scripts/ci/materialize_base_python_requirements.py
+
+          [report]
+          fail_under = 100
+          show_missing = True
+          EOF
+          export COVERAGE_RCFILE="${RUNNER_TEMP}/trusted-uv-coveragerc"
+          python -m coverage erase
+          python -m coverage run -m pytest \
+            tests/test_materialize_base_python_requirements.py \
+            tests/test_materialize_uv_export_hash_contract.py \
+            tests/test_trusted_uv_download_contract.py \
+            tests/test_trusted_uv_portability_and_streaming.py \
+            tests/test_uv_export_isolation_contract.py \
+            tests/test_uv_redirect_and_coverage_contract.py \
+            tests/test_uv_redirect_boundary.py \
+            tests/test_uv_workspace_fail_closed.py \
+            tests/test_trusted_uv_materializer_quality_workflow_contract.py \
+            -q
+          python -m coverage report
+
+      - name: Run complete central branch coverage and docstring gates
+        run: |
+          unset COVERAGE_RCFILE
+          python -m coverage erase
+          python -m coverage run -m pytest tests -q
+          python -m coverage report
+          python -m interrogate --fail-under 100 scripts/ci/materialize_base_python_requirements.py
+          python -m compileall -q scripts/ci/materialize_base_python_requirements.py tests/test_materialize_base_python_requirements.py
+
+      - name: Commit verified repair and remove one-shot workflow
+        env:
+          BRANCH_PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
+          EXPECTED_TRIGGER_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$EXPECTED_TRIGGER_SHA"
+          git rm .github/workflows/repair-trusted-uv-flat-includes.yml
+          git diff --check
+          git status --short
+          git config user.name "cwl-ci-repair[bot]"
+          git config user.email "cwl-ci-repair[bot]@users.noreply.github.com"
+          git add \
+            CHANGELOG.md \
+            docs/doctoring/trusted-uv-lock-materialization.md \
+            scripts/ci/materialize_base_python_requirements.py \
+            tests/test_materialize_base_python_requirements.py
+          git commit -m "fix(ci): reject flat requirement includes"
+          auth_header="$(printf 'x-access-token:%s' "$BRANCH_PUSH_TOKEN" | base64 | tr -d '\n')"
+          echo "::add-mask::$auth_header"
+          git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $auth_header" \
+            push origin "HEAD:refs/heads/fix/trusted-uv-downloader-current-main"

From f20c30d7539cbaae6c0044f81bd7ebddeca4a127 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 16 Aug 2026 20:01:02 +0900
Subject: [PATCH 5/7] fix(ci): reject relative includes from flat lock
 publication

Preserve pip include syntax diagnostics while enforcing a standalone exact-hash closure at the generated flat publication boundary. Add exact-base regression coverage and APA 7 doctoring, update the changelog, and remove the unused one-shot workflow.
---
 .../repair-trusted-uv-flat-includes.yml       | 240 ------------------
 CHANGELOG.md                                  |   1 +
 .../materialize_base_python_requirements.py   |   2 +-
 .../test_trusted_uv_flat_include_rejection.py |  58 +++++
 4 files changed, 60 insertions(+), 241 deletions(-)
 delete mode 100644 .github/workflows/repair-trusted-uv-flat-includes.yml
 create mode 100644 tests/test_trusted_uv_flat_include_rejection.py

diff --git a/.github/workflows/repair-trusted-uv-flat-includes.yml b/.github/workflows/repair-trusted-uv-flat-includes.yml
deleted file mode 100644
index 03dc05e13..000000000
--- a/.github/workflows/repair-trusted-uv-flat-includes.yml
+++ /dev/null
@@ -1,240 +0,0 @@
-name: Repair trusted uv flat requirements includes
-
-on:
-  push:
-    branches:
-      - fix/trusted-uv-downloader-current-main
-    paths:
-      - .github/workflows/repair-trusted-uv-flat-includes.yml
-
-concurrency:
-  group: repair-trusted-uv-flat-includes
-  cancel-in-progress: false
-
-permissions:
-  contents: write
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  repair:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout exact repair trigger
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-          ref: ${{ github.sha }}
-          fetch-depth: 0
-
-      - name: Set up current stable Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-          cache: pip
-          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
-
-      - name: Install hash-locked quality tooling
-        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt
-
-      - name: Write the failing include regression first
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-
-          path = Path("tests/test_materialize_base_python_requirements.py")
-          text = path.read_text(encoding="utf-8")
-          old = '''    assert materializer._is_hash_pinned(b"-r requirements-other.txt\\n")
-              assert not materializer._is_hash_pinned(b"-r other-hashes.txt\\n")
-              assert not materializer._is_hash_pinned(b"-r ./requirements-other.txt\\n")
-              assert not materializer._is_hash_pinned(b"-r ../escape.txt\\n")
-              assert materializer._is_bounded_requirement_include(
-                  "--requirement requirements-other.txt"
-              )
-              assert not materializer._is_bounded_requirement_include("-r .")
-              assert not materializer._is_bounded_requirement_include("-r -evil.txt")
-              assert not materializer._is_bounded_requirement_include("-r ~evil.txt")
-              assert not materializer._is_bounded_requirement_include("-r C:foo.txt")
-              assert not materializer._is_bounded_requirement_include("-r foo?bar.txt")
-              assert not materializer._is_bounded_requirement_include("-r foo#bar.txt")
-              assert not materializer._is_bounded_requirement_include(r"-r foo\\\\bar.txt")
-              assert not materializer._is_bounded_requirement_include("-r")
-              assert not materializer._is_bounded_requirement_include("-r /abs/requirements.txt")
-          '''
-          new = '''    assert not materializer._is_hash_pinned(b"-r requirements-other.txt\\n")
-              assert not materializer._is_hash_pinned(b"-r other-hashes.txt\\n")
-              assert not materializer._is_hash_pinned(b"-r ./requirements-other.txt\\n")
-              assert not materializer._is_hash_pinned(b"-r ../escape.txt\\n")
-              assert not materializer._is_hash_pinned(
-                  b"--requirement requirements-other.txt\\n"
-              )
-          '''
-          if old not in text:
-              raise SystemExit("expected include assertion block was not found")
-          path.write_text(text.replace(old, new, 1), encoding="utf-8")
-          PY
-
-          set +e
-          python -m pytest -q \
-            tests/test_materialize_base_python_requirements.py \
-            -k hash_pin_detection_includes_pinned_and_excludes_unpinned_or_empty \
-            >"${RUNNER_TEMP}/flat-include-red.log" 2>&1
-          status=$?
-          set -e
-          cat "${RUNNER_TEMP}/flat-include-red.log"
-          if [ "$status" -eq 0 ]; then
-            echo "::error::The relative-include regression unexpectedly passed before the production repair."
-            exit 1
-          fi
-          grep -F "assert not True" "${RUNNER_TEMP}/flat-include-red.log" >/dev/null
-
-      - name: Reject includes that cannot survive flat publication
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-          import re
-
-          path = Path("scripts/ci/materialize_base_python_requirements.py")
-          text = path.read_text(encoding="utf-8")
-
-          text, removed_helpers = re.subn(
-              r"\n\ndef _is_candidate_lock_path\(.*?\n\ndef _requirement_lines",
-              "\n\ndef _requirement_lines",
-              text,
-              count=1,
-              flags=re.DOTALL,
-          )
-          if removed_helpers != 1:
-              raise SystemExit("expected include helper block was not found")
-
-          replacement = '''def _is_hash_pinned(content: bytes) -> bool:
-              """Return whether every installable line is an exact SHA-256 package pin.
-
-              The materializer publishes accepted locks under generated flat file names.
-              Relative ``-r`` and ``--requirement`` includes would therefore lose their
-              source-relative target and are rejected instead of emitting an unusable
-              closure. A global ``--require-hashes`` directive remains optional metadata;
-              it is never trust evidence by itself.
-              """
-              lines = _requirement_lines(content)
-              requirement_lines = [line for line in lines if line != "--require-hashes"]
-              return bool(requirement_lines) and all(
-                  _is_fully_hash_pinned_requirement(line)
-                  for line in requirement_lines
-              )
-
-
-          def _is_fully_hash_pinned_requirement'''
-          text, replaced_validator = re.subn(
-              r"def _is_hash_pinned\(content: bytes\) -> bool:\n.*?\n\ndef _is_fully_hash_pinned_requirement",
-              replacement,
-              text,
-              count=1,
-              flags=re.DOTALL,
-          )
-          if replaced_validator != 1:
-              raise SystemExit("expected hash-pin validator was not found")
-          path.write_text(text, encoding="utf-8")
-          PY
-
-      - name: Align doctoring and changelog
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-
-          doc = Path("docs/doctoring/trusted-uv-lock-materialization.md")
-          text = doc.read_text(encoding="utf-8")
-          anchor = """Generic requirements discovery continues to accept a global
-          `--require-hashes` directive because pip performs a later closure preflight.
-          """
-          addition = """Generic requirements discovery continues to accept a global
-          `--require-hashes` directive because pip performs a later closure preflight.
-          Relative `-r` and `--requirement` includes are rejected: the materializer
-          publishes each accepted lock under a generated flat file name, so preserving an
-          include safely would require materializing and rewriting the complete immutable
-          include graph rather than leaving a broken source-relative reference.
-          """
-          if anchor not in text:
-              raise SystemExit("doctoring insertion point was not found")
-          doc.write_text(text.replace(anchor, addition, 1), encoding="utf-8")
-
-          changelog = Path("CHANGELOG.md")
-          text = changelog.read_text(encoding="utf-8")
-          bullet = (
-              "- Rejected relative `-r` and `--requirement` directives from flat base-lock "
-              "materialization so generated requirement names cannot retain broken or "
-              "misdirected source-relative includes.\n"
-          )
-          marker = "### Fixed\n\n"
-          if marker not in text:
-              raise SystemExit("CHANGELOG Fixed section was not found")
-          if bullet not in text:
-              text = text.replace(marker, marker + bullet, 1)
-          changelog.write_text(text, encoding="utf-8")
-          PY
-
-      - name: Run trusted uv tests with complete branch coverage
-        run: |
-          cat >"${RUNNER_TEMP}/trusted-uv-coveragerc" <<'EOF'
-          [run]
-          branch = True
-          include =
-              scripts/ci/materialize_base_python_requirements.py
-
-          [report]
-          fail_under = 100
-          show_missing = True
-          EOF
-          export COVERAGE_RCFILE="${RUNNER_TEMP}/trusted-uv-coveragerc"
-          python -m coverage erase
-          python -m coverage run -m pytest \
-            tests/test_materialize_base_python_requirements.py \
-            tests/test_materialize_uv_export_hash_contract.py \
-            tests/test_trusted_uv_download_contract.py \
-            tests/test_trusted_uv_portability_and_streaming.py \
-            tests/test_uv_export_isolation_contract.py \
-            tests/test_uv_redirect_and_coverage_contract.py \
-            tests/test_uv_redirect_boundary.py \
-            tests/test_uv_workspace_fail_closed.py \
-            tests/test_trusted_uv_materializer_quality_workflow_contract.py \
-            -q
-          python -m coverage report
-
-      - name: Run complete central branch coverage and docstring gates
-        run: |
-          unset COVERAGE_RCFILE
-          python -m coverage erase
-          python -m coverage run -m pytest tests -q
-          python -m coverage report
-          python -m interrogate --fail-under 100 scripts/ci/materialize_base_python_requirements.py
-          python -m compileall -q scripts/ci/materialize_base_python_requirements.py tests/test_materialize_base_python_requirements.py
-
-      - name: Commit verified repair and remove one-shot workflow
-        env:
-          BRANCH_PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
-          EXPECTED_TRIGGER_SHA: ${{ github.sha }}
-        run: |
-          set -euo pipefail
-          test "$(git rev-parse HEAD)" = "$EXPECTED_TRIGGER_SHA"
-          git rm .github/workflows/repair-trusted-uv-flat-includes.yml
-          git diff --check
-          git status --short
-          git config user.name "cwl-ci-repair[bot]"
-          git config user.email "cwl-ci-repair[bot]@users.noreply.github.com"
-          git add \
-            CHANGELOG.md \
-            docs/doctoring/trusted-uv-lock-materialization.md \
-            scripts/ci/materialize_base_python_requirements.py \
-            tests/test_materialize_base_python_requirements.py
-          git commit -m "fix(ci): reject flat requirement includes"
-          auth_header="$(printf 'x-access-token:%s' "$BRANCH_PUSH_TOKEN" | base64 | tr -d '\n')"
-          echo "::add-mask::$auth_header"
-          git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $auth_header" \
-            push origin "HEAD:refs/heads/fix/trusted-uv-downloader-current-main"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd1aebf43..6b6eda2a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -75,3 +75,4 @@ Semantic Versioning where the repository publishes a release.
 - Added fast-mlsirm operational documentation for the hourly RCA loop, psychometric scientific gates, Rust ownership, bounded retry cadence, credential isolation, modular reuse, rollback, and APA 7 references.
 - Documented the ordinary and conflict repair write-scope parity, ignored-path and symlink inventory, Git-control-file denial, hook suppression, explicit push destination, RED/GREEN evidence, operator response, and local-versus-protected evidence boundary.
 - Documented the review-authentication boundary that excludes autonomous writer control-plane paths from review-derived file authority, its test-first Strix security evidence, exact-head coverage contract, and rollback prohibition.
+- Documented why pip-relative include syntax cannot cross the generated flat-lock publication boundary and the exact-head regression evidence required before the policy can change.
diff --git a/scripts/ci/materialize_base_python_requirements.py b/scripts/ci/materialize_base_python_requirements.py
index d21387c1c..4f7903867 100755
--- a/scripts/ci/materialize_base_python_requirements.py
+++ b/scripts/ci/materialize_base_python_requirements.py
@@ -652,4 +652,4 @@ def main(argv: list[str] | None = None) -> int:
 
 
 if __name__ == "__main__":
-    raise SystemExit(main())
\ No newline at end of file
+    raise SystemExit(main())
diff --git a/tests/test_trusted_uv_flat_include_rejection.py b/tests/test_trusted_uv_flat_include_rejection.py
new file mode 100644
index 000000000..c0b9bdb9a
--- /dev/null
+++ b/tests/test_trusted_uv_flat_include_rejection.py
@@ -0,0 +1,58 @@
+"""Regression tests for standalone flat requirements publication."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from scripts.ci import materialize_base_python_requirements as materializer
+
+
+@pytest.mark.parametrize(
+    ("content", "expected"),
+    [
+        (b"", False),
+        (b"--require-hashes\n", False),
+        (b"-r requirements-other.txt\n", False),
+        (b"--requirement requirements-other.txt\n", False),
+        (b"demo==1 --hash=sha256:" + (b"a" * 64) + b"\n", True),
+    ],
+)
+def test_flat_lock_policy_requires_a_standalone_exact_hash_closure(
+    content: bytes,
+    expected: bool,
+) -> None:
+    """Generated flat lock names cannot preserve source-relative includes."""
+    assert materializer._is_flat_materializable_lock(content) is expected
+
+
+def test_base_lock_discovery_excludes_relative_include_files(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A relative include never crosses from the exact base into flat output."""
+    tree = (
+        b"100644 blob "
+        + (b"0" * 40)
+        + b"\trequirements-other.txt\0"
+        + b"100644 blob "
+        + (b"1" * 40)
+        + b"\trequirements.txt\0"
+    )
+    pinned = b"demo==1 --hash=sha256:" + (b"a" * 64) + b"\n"
+
+    def fake_git(_repo_root: Path, *args: str) -> bytes:
+        if args[0] == "ls-tree":
+            return tree
+        if args[0] == "show" and args[-1].endswith(":requirements-other.txt"):
+            return pinned
+        if args[0] == "show" and args[-1].endswith(":requirements.txt"):
+            return b"-r requirements-other.txt\n"
+        raise AssertionError(args)
+
+    monkeypatch.setattr(materializer, "_git", fake_git)
+
+    assert materializer.base_hash_locks(tmp_path, "a" * 40) == [
+        ("requirements-other.txt", pinned)
+    ]
\ No newline at end of file

From 7674dd75d82c50e5b757fe3a31eb94144cd6592b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 16 Aug 2026 20:02:48 +0900
Subject: [PATCH 6/7] test(ci): bind flat include regression to focused gate

Move the standalone-lock publication regression into the existing trusted-uv focused test set so the exact production branch is exercised by the permanent 100% coverage lane.
---
 .../test_trusted_uv_flat_include_rejection.py | 58 -------------------
 tests/test_uv_redirect_boundary.py            | 52 ++++++++++++++++-
 2 files changed, 51 insertions(+), 59 deletions(-)
 delete mode 100644 tests/test_trusted_uv_flat_include_rejection.py

diff --git a/tests/test_trusted_uv_flat_include_rejection.py b/tests/test_trusted_uv_flat_include_rejection.py
deleted file mode 100644
index c0b9bdb9a..000000000
--- a/tests/test_trusted_uv_flat_include_rejection.py
+++ /dev/null
@@ -1,58 +0,0 @@
-"""Regression tests for standalone flat requirements publication."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-
-from scripts.ci import materialize_base_python_requirements as materializer
-
-
-@pytest.mark.parametrize(
-    ("content", "expected"),
-    [
-        (b"", False),
-        (b"--require-hashes\n", False),
-        (b"-r requirements-other.txt\n", False),
-        (b"--requirement requirements-other.txt\n", False),
-        (b"demo==1 --hash=sha256:" + (b"a" * 64) + b"\n", True),
-    ],
-)
-def test_flat_lock_policy_requires_a_standalone_exact_hash_closure(
-    content: bytes,
-    expected: bool,
-) -> None:
-    """Generated flat lock names cannot preserve source-relative includes."""
-    assert materializer._is_flat_materializable_lock(content) is expected
-
-
-def test_base_lock_discovery_excludes_relative_include_files(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """A relative include never crosses from the exact base into flat output."""
-    tree = (
-        b"100644 blob "
-        + (b"0" * 40)
-        + b"\trequirements-other.txt\0"
-        + b"100644 blob "
-        + (b"1" * 40)
-        + b"\trequirements.txt\0"
-    )
-    pinned = b"demo==1 --hash=sha256:" + (b"a" * 64) + b"\n"
-
-    def fake_git(_repo_root: Path, *args: str) -> bytes:
-        if args[0] == "ls-tree":
-            return tree
-        if args[0] == "show" and args[-1].endswith(":requirements-other.txt"):
-            return pinned
-        if args[0] == "show" and args[-1].endswith(":requirements.txt"):
-            return b"-r requirements-other.txt\n"
-        raise AssertionError(args)
-
-    monkeypatch.setattr(materializer, "_git", fake_git)
-
-    assert materializer.base_hash_locks(tmp_path, "a" * 40) == [
-        ("requirements-other.txt", pinned)
-    ]
\ No newline at end of file
diff --git a/tests/test_uv_redirect_boundary.py b/tests/test_uv_redirect_boundary.py
index 2d649afeb..11293636c 100644
--- a/tests/test_uv_redirect_boundary.py
+++ b/tests/test_uv_redirect_boundary.py
@@ -1,9 +1,10 @@
-"""Behavioral contracts for the trusted uv download redirect boundary."""
+"""Behavioral contracts for trusted uv download and flat-lock boundaries."""
 
 from __future__ import annotations
 
 import urllib.request
 from collections.abc import Iterator
+from pathlib import Path
 
 import pytest
 
@@ -186,3 +187,52 @@ def fake_install_opener(opener: object) -> None:
     assert handlers[0].proxies == {}
     assert isinstance(handlers[1], materializer._TrustedUvReleaseAssetRedirects)
     assert sentinel.addheaders == [("User-Agent", materializer.TRUSTED_UV_USER_AGENT)]
+
+
+@pytest.mark.parametrize(
+    ("content", "expected"),
+    [
+        (b"", False),
+        (b"--require-hashes\n", False),
+        (b"-r requirements-other.txt\n", False),
+        (b"--requirement requirements-other.txt\n", False),
+        (b"demo==1 --hash=sha256:" + (b"a" * 64) + b"\n", True),
+    ],
+)
+def test_flat_lock_policy_requires_a_standalone_exact_hash_closure(
+    content: bytes,
+    expected: bool,
+) -> None:
+    """Generated flat lock names cannot preserve source-relative includes."""
+    assert materializer._is_flat_materializable_lock(content) is expected
+
+
+def test_base_lock_discovery_excludes_relative_include_files(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A relative include never crosses from the exact base into flat output."""
+    tree = (
+        b"100644 blob "
+        + (b"0" * 40)
+        + b"\trequirements-other.txt\0"
+        + b"100644 blob "
+        + (b"1" * 40)
+        + b"\trequirements.txt\0"
+    )
+    pinned = b"demo==1 --hash=sha256:" + (b"a" * 64) + b"\n"
+
+    def fake_git(_repo_root: Path, *args: str) -> bytes:
+        if args[0] == "ls-tree":
+            return tree
+        if args[0] == "show" and args[-1].endswith(":requirements-other.txt"):
+            return pinned
+        if args[0] == "show" and args[-1].endswith(":requirements.txt"):
+            return b"-r requirements-other.txt\n"
+        raise AssertionError(args)
+
+    monkeypatch.setattr(materializer, "_git", fake_git)
+
+    assert materializer.base_hash_locks(tmp_path, "a" * 40) == [
+        ("requirements-other.txt", pinned)
+    ]

From 2c95c0a8e7c63d54e35246559c9666d5c7731349 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 16 Aug 2026 15:34:21 +0000
Subject: [PATCH 7/7] fix(ci): reuse pinned trusted-uv client and path
 discovery

Keep the unique flat-publication isolation, but stop introducing a second
User-Agent and basename-only collector. Reuse cwl-trusted-uv-materializer/1
on the existing Request sink and collect standalone nested requirements/
locks before the generated-name gate.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
---
 AGENTS.md                                     |  2 +-
 .../materialize_base_python_requirements.py   | 15 ++++---
 tests/test_trusted_uv_download_contract.py    | 45 ++++++++++++-------
 tests/test_uv_redirect_boundary.py            | 45 ++++++++++++++++---
 4 files changed, 79 insertions(+), 28 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index bd6a96a11..b6a5a404b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,7 +3,7 @@
 <!-- CWL-ENTRY -->
 > **Agents: read the master context FIRST.** Before any work, read [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission · naruon-as-platform + inter-component UML · cross-cutting disciplines · conventions · roadmap · current state), the live **GitHub Project #1** <https://github.com/orgs/ContextualWisdomLab/projects/1> (work/roadmap source of truth), the full spec **ContextualWisdomLab/naruon#974**, and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth.
 
-Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md).
+Materialize syntax may recognize a bounded relative `-r` include (no `.`/`..`); flat publication admits only standalone exact SHA-256 pins. A lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/trusted-uv-flat-include-isolation.md`](docs/doctoring/trusted-uv-flat-include-isolation.md).
 Conflict-scope roots fail closed when the immediate parent directory is a symbolic link.
 OriginWeave hourly NVIDIA NIM repair is a thin caller at minute 10. See [`docs/doctoring/originweave-hourly-review-caller.md`](docs/doctoring/originweave-hourly-review-caller.md).
 nonnest2 hourly NVIDIA NIM repair is a thin caller at minute 16. See [`docs/doctoring/nonnest2-hourly-review-caller.md`](docs/doctoring/nonnest2-hourly-review-caller.md).
diff --git a/scripts/ci/materialize_base_python_requirements.py b/scripts/ci/materialize_base_python_requirements.py
index 4f7903867..b139ba739 100755
--- a/scripts/ci/materialize_base_python_requirements.py
+++ b/scripts/ci/materialize_base_python_requirements.py
@@ -52,7 +52,7 @@
     }
 )
 TRUSTED_UV_FINAL_HOSTS = frozenset({TRUSTED_UV_RELEASE_HOST, *TRUSTED_UV_ASSET_HOSTS})
-TRUSTED_UV_USER_AGENT = "ContextualWisdomLab-coverage/1.0"
+TRUSTED_UV_DOWNLOAD_USER_AGENT = "cwl-trusted-uv-materializer/1"
 TRUSTED_UV_ARCHIVE_SHA256 = (
     "90b2f223fb69d19db49e117da601f64978593417988530aa733d456141b4bcbb"
 )
@@ -141,7 +141,6 @@ def _install_trusted_uv_url_opener() -> None:
         urllib.request.ProxyHandler({}),
         _TrustedUvReleaseAssetRedirects(),
     )
-    opener.addheaders = [("User-Agent", TRUSTED_UV_USER_AGENT)]
     urllib.request.install_opener(opener)
 
 
@@ -304,12 +303,16 @@ def _download_trusted_uv_archive() -> bytes:
     """Download the fixed uv release archive through one HTTPS trust boundary."""
     _install_trusted_uv_url_opener()
     try:
-        # Keep the audited URL literal at the network sink so static analysis can
-        # prove that neither user data nor repository content selects a scheme,
-        # host, path, query, fragment, method, or request header.
-        with urllib.request.urlopen(  # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected  # nosec B310
+        # Keep the audited URL literal and static request header in this trusted
+        # function so neither user data nor repository content selects the
+        # scheme, host, path, query, fragment, method, or request header.
+        request = urllib.request.Request(
             "https://github.com/astral-sh/uv/releases/download/0.12.1/"
             "uv-x86_64-unknown-linux-gnu.tar.gz",
+            headers={"User-Agent": TRUSTED_UV_DOWNLOAD_USER_AGENT},
+        )
+        with urllib.request.urlopen(  # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected  # nosec B310
+            request,
             timeout=TRUSTED_UV_DOWNLOAD_TIMEOUT_SECONDS,
         ) as response:
             if not _is_trusted_uv_final_origin(response.geturl()):
diff --git a/tests/test_trusted_uv_download_contract.py b/tests/test_trusted_uv_download_contract.py
index 380151db6..9217d5a23 100644
--- a/tests/test_trusted_uv_download_contract.py
+++ b/tests/test_trusted_uv_download_contract.py
@@ -53,25 +53,16 @@ def _urlopen_calls() -> list[ast.Call]:
     ]
 
 
-def test_urlopen_receives_one_literal_https_release_url() -> None:
-    """Static analysis can prove repository or user data never selects the URL."""
+def test_urlopen_receives_one_static_release_request() -> None:
+    """Static analysis can prove repository data never selects the request."""
     calls = _urlopen_calls()
 
     assert len(calls) == 1
     assert len(calls[0].args) == 1
-    url_argument = calls[0].args[0]
-    assert isinstance(url_argument, ast.Constant)
-    assert isinstance(url_argument.value, str)
-    assert url_argument.value == _EXPECTED_URL
-
-
-def test_literal_network_sink_matches_the_documented_release_constant() -> None:
-    """The scanner-friendly sink literal cannot drift from the release identity."""
-    assert _assigned_literal("TRUSTED_UV_ARCHIVE_URL") == _EXPECTED_URL
-
+    request_argument = calls[0].args[0]
+    assert isinstance(request_argument, ast.Name)
+    assert request_argument.id == "request"
 
-def test_downloader_never_constructs_a_dynamic_request_object() -> None:
-    """The audited downloader cannot hide a dynamic URL inside ``Request``."""
     request_calls = [
         node
         for node in ast.walk(_download_function())
@@ -79,8 +70,32 @@ def test_downloader_never_constructs_a_dynamic_request_object() -> None:
         and isinstance(node.func, ast.Attribute)
         and node.func.attr == "Request"
     ]
+    assert len(request_calls) == 1
+    assert len(request_calls[0].args) == 1
+    url_argument = request_calls[0].args[0]
+    assert isinstance(url_argument, ast.Constant)
+    assert isinstance(url_argument.value, str)
+    assert url_argument.value == _EXPECTED_URL
+
+    headers = next(
+        keyword.value
+        for keyword in request_calls[0].keywords
+        if keyword.arg == "headers"
+    )
+    assert isinstance(headers, ast.Dict)
+    assert len(headers.keys) == 1
+    assert isinstance(headers.keys[0], ast.Constant)
+    assert headers.keys[0].value == "User-Agent"
+    assert isinstance(headers.values[0], ast.Name)
+    assert headers.values[0].id == "TRUSTED_UV_DOWNLOAD_USER_AGENT"
+    assert _assigned_literal("TRUSTED_UV_DOWNLOAD_USER_AGENT") == (
+        "cwl-trusted-uv-materializer/1"
+    )
 
-    assert request_calls == []
+
+def test_literal_network_sink_matches_the_documented_release_constant() -> None:
+    """The scanner-friendly sink literal cannot drift from the release identity."""
+    assert _assigned_literal("TRUSTED_UV_ARCHIVE_URL") == _EXPECTED_URL
 
 
 def test_literal_urlopen_sink_has_one_scoped_semgrep_suppression() -> None:
diff --git a/tests/test_uv_redirect_boundary.py b/tests/test_uv_redirect_boundary.py
index 11293636c..4b142b7d7 100644
--- a/tests/test_uv_redirect_boundary.py
+++ b/tests/test_uv_redirect_boundary.py
@@ -156,11 +156,7 @@ def test_trusted_uv_opener_is_cached_and_disables_ambient_proxies(
 ) -> None:
     """The dedicated process installs one no-proxy GitHub-origin opener."""
     captured: dict[str, object] = {"builds": 0, "installs": 0}
-
-    class _Opener:
-        """Accept the fixed headers configured on a real urllib opener."""
-
-    sentinel = _Opener()
+    sentinel = object()
 
     def fake_build_opener(*handlers: object) -> object:
         captured["builds"] = int(captured["builds"]) + 1
@@ -186,7 +182,6 @@ def fake_install_opener(opener: object) -> None:
     assert isinstance(handlers[0], urllib.request.ProxyHandler)
     assert handlers[0].proxies == {}
     assert isinstance(handlers[1], materializer._TrustedUvReleaseAssetRedirects)
-    assert sentinel.addheaders == [("User-Agent", materializer.TRUSTED_UV_USER_AGENT)]
 
 
 @pytest.mark.parametrize(
@@ -236,3 +231,41 @@ def fake_git(_repo_root: Path, *args: str) -> bytes:
     assert materializer.base_hash_locks(tmp_path, "a" * 40) == [
         ("requirements-other.txt", pinned)
     ]
+
+
+def test_base_lock_discovery_publishes_nested_requirements_directory_locks(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Path-aware discovery still publishes standalone ``requirements/ci.txt``."""
+    tree = (
+        b"100644 blob "
+        + (b"0" * 40)
+        + b"\trequirements/ci.txt\0"
+        + b"100644 blob "
+        + (b"1" * 40)
+        + b"\tservice/requirements/package.txt\0"
+        + b"100644 blob "
+        + (b"2" * 40)
+        + b"\trequirements.txt\0"
+    )
+    ci_lock = b"ci-demo==1 --hash=sha256:" + (b"a" * 64) + b"\n"
+    package_lock = b"service-demo==1 --hash=sha256:" + (b"b" * 64) + b"\n"
+
+    def fake_git(_repo_root: Path, *args: str) -> bytes:
+        if args[0] == "ls-tree":
+            return tree
+        if args[0] == "show" and args[-1].endswith(":requirements/ci.txt"):
+            return ci_lock
+        if args[0] == "show" and args[-1].endswith(":service/requirements/package.txt"):
+            return package_lock
+        if args[0] == "show" and args[-1].endswith(":requirements.txt"):
+            return b"-r requirements/ci.txt\n"
+        raise AssertionError(args)
+
+    monkeypatch.setattr(materializer, "_git", fake_git)
+
+    assert materializer.base_hash_locks(tmp_path, "a" * 40) == [
+        ("requirements/ci.txt", ci_lock),
+        ("service/requirements/package.txt", package_lock),
+    ]