fix(coverage): retry transient trusted uv downloads

.github/workflows/trusted-uv-materializer-quality-ci.yml

@@ -8,6 +8,7 @@ on:
       - "scripts/ci/materialize_base_python_requirements.py"
       - "tests/conftest.py"
       - "tests/test_materialize*.py"
+      - "tests/test_trusted_git_executable.py"
       - "tests/test_trusted_uv*.py"
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
@@ -20,6 +21,7 @@ on:
       - "scripts/ci/materialize_base_python_requirements.py"
       - "tests/conftest.py"
       - "tests/test_materialize*.py"
+      - "tests/test_trusted_git_executable.py"
       - "tests/test_trusted_uv*.py"
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
@@ -125,9 +127,13 @@ jobs:
           python -m coverage erase
           python -m coverage run -m pytest \
             tests/test_materialize_base_python_requirements.py \
+            tests/test_materialize_fifo_output_security.py \
+            tests/test_materialize_output_directory_security.py \
             tests/test_materialize_uv_export_hash_contract.py \
+            tests/test_trusted_git_executable.py \
             tests/test_trusted_uv_download_contract.py \
             tests/test_trusted_uv_portability_and_streaming.py \
+            tests/test_trusted_uv_retry_documentation.py \
             tests/test_uv_export_isolation_contract.py \
             tests/test_uv_flat_lock_publication_boundary.py \
             tests/test_uv_redirect_and_coverage_contract.py \
@@ -152,9 +158,13 @@ jobs:
           python -m compileall -q \
             scripts/ci/materialize_base_python_requirements.py \
             tests/test_materialize_base_python_requirements.py \
+            tests/test_materialize_fifo_output_security.py \
+            tests/test_materialize_output_directory_security.py \
             tests/test_materialize_uv_export_hash_contract.py \
+            tests/test_trusted_git_executable.py \
             tests/test_trusted_uv_download_contract.py \
             tests/test_trusted_uv_portability_and_streaming.py \
+            tests/test_trusted_uv_retry_documentation.py \
             tests/test_uv_export_isolation_contract.py \
             tests/test_uv_flat_lock_publication_boundary.py \
             tests/test_uv_redirect_and_coverage_contract.py \

AGENTS.md

@@ -3,7 +3,8 @@
 <!-- CWL-ENTRY -->
 > **Agents: read the master context FIRST.** Before any work, read [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission · naruon-as-platform + inter-component UML · cross-cutting disciplines · conventions · roadmap · current state), the live **GitHub Project #1** <https://github.com/orgs/ContextualWisdomLab/projects/1> (work/roadmap source of truth), the full spec **ContextualWisdomLab/naruon#974**, and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth.
 
-Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md).
+Materialize accepts only complete exact SHA-256 pins or a bounded two-token `-r`/`--requirement` include. An include target must be a normalized relative POSIX path with no absolute, `.`, `..`, option-like, home-expansion, backslash, URL/scheme, query, fragment, or extra-inline-option form, and it must name either a conventional `requirements.lock`/`requirements*.txt` lock (excluding generated `requirements-*-ci-hashes.txt`) or a direct `.txt` child of a directory named `requirements`. A lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md).
 Conflict-scope roots fail closed when the immediate parent directory is a symbolic link.
 OriginWeave hourly NVIDIA NIM repair is a thin caller at minute 10. See [`docs/doctoring/originweave-hourly-review-caller.md`](docs/doctoring/originweave-hourly-review-caller.md).
 nonnest2 hourly NVIDIA NIM repair is a thin caller at minute 16. See [`docs/doctoring/nonnest2-hourly-review-caller.md`](docs/doctoring/nonnest2-hourly-review-caller.md).
+Trusted-uv accepts only the fixed GitHub Releases HTTPS origin and retries HTTP 408, 425, 429, 500, 502, 503, 504, and 522 plus explicitly classified transient DNS, timeout, connection, host, or network failures. TLS, permanent DNS, malformed transport evidence, and every other unclassified failure fail closed. See [`docs/doctoring/trusted-uv-transient-download-retry.md`](docs/doctoring/trusted-uv-transient-download-retry.md).

ARCHITECTURE.md

@@ -70,6 +70,30 @@ Product callers stagger Clearfolio at minute 23, DiskSage at minute 37, and
 fast-mlsirm at minute 49. Each caller is read-only, dispatches at most one
 repair, and delegates all privileged logic to the same sealed scheduler.
 
+## Trusted uv transient retry
+
+```mermaid
+flowchart TD
+  Get["GET pinned GitHub Releases HTTPS archive"]
+  Status{"408 / 425 / 429 / 500 / 502 / 503 / 504 / 522 or temporary DNS (EAI_AGAIN), timeout, connection reset/refused/aborted, host/network unreachable?"}
+  Retry["At most three attempts; discard partial bytes"]
+  Verify["SHA-256 then versioned executable"]
+  Fail["Fail closed after one attempt"]
+
+  Get --> Status
+  Status -->|"yes, attempts remain"| Retry
+  Retry --> Get
+  Status -->|"yes, exhausted"| Fail
+  Status -->|"TLS, permanent DNS, 404, malformed, unclassified"| Fail
+  Status -->|"200 + exact size"| Verify
+```
+
+A retry cannot change the origin, follow a redirect, or accept an
+unverified payload. Transport evidence is classified before retry: only the
+closed HTTP set and explicit temporary DNS, timeout, connection, host, or
+network failures receive another attempt; certificate verification, permanent
+DNS, malformed exception reasons, and other `OSError` classes fail immediately.
+
 ## Control-plane data flow
 
 ```mermaid
@@ -103,6 +127,13 @@ sequenceDiagram
   review-agent key schemes stay unchanged.
 - Rust remains the psychometric arithmetic owner. Repair never substitutes
   Python for scoring math.
+- Generated output directories and files are opened descriptor-relative without
+  following symlinks. Pre-existing destinations use `O_NONBLOCK | O_NOFOLLOW`;
+  `ENXIO` and every non-regular destination fail closed before mutation. The
+  writer verifies regular-file type, device/inode identity, and a single link
+  before writing, synchronizes bytes, then revalidates the same properties after
+  `fsync` so pathname replacement, symlink, FIFO, and hard-link races cannot be
+  silently accepted.
 
 ## Quality gates
 
@@ -123,4 +154,6 @@ trusted `uv` exporter is downloaded from the literal GitHub Releases URL for
 - [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md)
   — current increment's repair-worker decision and APA 7th citations.
 - [`docs/doctoring/fast-mlsirm-hourly-review-caller.md`](docs/doctoring/fast-mlsirm-hourly-review-caller.md)
-  — product-specific psychometric repair heartbeat and scientific gates.
+  — product-specific psychometric repair heartbeat and scientific gates.
+- [`docs/doctoring/trusted-uv-transient-download-retry.md`](docs/doctoring/trusted-uv-transient-download-retry.md)
+  — current increment's retry decision and APA 7th citations.

CHANGELOG.md

@@ -35,14 +35,21 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
-- Parsed `opencode.jsonc` as JSONC (stripping `//` and `/* */` comments outside string literals) in the reasoning-effort guard and its contract tests, instead of raw `json.loads`, which rejected the file the moment it carried its first explanatory comment (added for the `contextual-orchestrator` provider block) with `Expecting property name enclosed in double quotes`. Comment markers inside string values, such as the `$schema` URL, are left untouched.
-- Download the pinned `uv` 0.12.1 exporter from the official GitHub Releases URL instead of `releases.astral.sh`, which now returns HTTP 403 and blocks org-wide OpenCode `coverage-evidence`. The SHA-256 pin is unchanged. The opener may follow one hop onto `release-assets.githubusercontent.com` or `objects.githubusercontent.com` and still rejects every other host, userinfo, non-HTTPS scheme, and nondefault port (ContextualWisdomLab/.github#1109).
-- Compared the trusted `uv` executable's post-install `--version` output against the real GitHub Releases build's full string, `uv 0.12.1 (x86_64-unknown-linux-gnu)`, instead of the bare `uv 0.12.1` the prior check required; the genuine release binary always prints the target triple, so every installation was failing the pin check immediately after the archive download itself was fixed (ContextualWisdomLab/.github#1109).
-- Excluded relative `-r` and `--requirement` referrers from generated flat base-lock publication while retaining bounded include syntax diagnostics and discovering independently complete direct `.txt` children of `requirements` directories.
-- Refused a conflict-scope repository root whose immediate parent is a symbolic link, so a swapped parent cannot redirect the canonical worktree after the last-component check (CWE-367).
+ - Parsed `opencode.jsonc` as JSONC (stripping `//` and `/* */` comments outside string literals) in the reasoning-effort guard and its contract tests, instead of raw `json.loads`, which rejected the file the moment it carried its first explanatory comment (added for the `contextual-orchestrator` provider block) with `Expecting property name enclosed in double quotes`. Comment markers inside string values, such as the `$schema` URL, are left untouched.
+ - Download the pinned `uv` 0.12.1 exporter from the official GitHub Releases URL instead of `releases.astral.sh`, which now returns HTTP 403 and blocks org-wide OpenCode `coverage-evidence`. The SHA-256 pin is unchanged. The opener may follow one hop onto `release-assets.githubusercontent.com` or `objects.githubusercontent.com` and still rejects every other host, userinfo, non-HTTPS scheme, and nondefault port (ContextualWisdomLab/.github#1109).
+ - Compared the trusted `uv` executable's post-install `--version` output against the real GitHub Releases build's full string, `uv 0.12.1 (x86_64-unknown-linux-gnu)`, instead of the bare `uv 0.12.1` the prior check required; the genuine release binary always prints the target triple, so every installation was failing the pin check immediately after the archive download itself was fixed (ContextualWisdomLab/.github#1109).
+ - Excluded relative `-r` and `--requirement` referrers from generated flat base-lock publication while retaining bounded include syntax diagnostics and discovering independently complete direct `.txt` children of `requirements` directories.
+ - Refused a conflict-scope repository root whose immediate parent is a symbolic link, so a swapped parent cannot redirect the canonical worktree after the last-component check (CWE-367).
+ - Trusted-uv archive download retries HTTP 522 (CDN connection timed out) with the same closed delay set as 502/504, without widening origin or skipping SHA-256 verification.
+  - Trusted-uv archive download retries HTTP 522 (CDN connection timed out) with the same closed delay set as 502/504, without widening origin or skipping SHA-256 verification.
+ - Materialized base Python locks only when every package line is an exact SHA-256 pin or a bounded relative `-r`/`--requirement` include. A lone `--require-hashes` directive, a dotted include such as `./lock.txt`, or `-r other-hashes.txt` no longer enters the trusted build context.
 - Bounded the Strix quality self-test's deterministic timeout fixtures to 3-second process and 5-second fake-sleep budgets so exact-head policy evidence completes inside the existing job limit without changing production Strix scanner timeouts, providers, credentials, or review semantics.
 - Allowed commas and ASCII parentheses in the bounded Strix changed-file path policy so legal tracked Packrat fixtures can receive exact-head security analysis, while rejecting raw `..` components before normalization and keeping controls, backslashes, whitespace ambiguity, and shell punctuation fail-closed.
 - Bound each review-agent invocation key to the wrapper's complete canonical payload, including the base branch and requesting actor; altered fields with a valid-format key now fail before durable-leader election or forwarding, and wrapper write permission is job-scoped.
+- Pinned generated Python lock output to no-follow directory and file descriptors, rejected symbolic and multiply linked destinations before mutation, revalidated inode and single-link bindings after synchronized writes, and added deterministic regressions for output-path races, hard links introduced during writes, file swaps, and stalled writes.
+- Opened existing generated-lock outputs non-blocking before regular-file validation so attacker-controlled FIFOs and other special entries cannot stall trusted materialization; `ENXIO` now fails closed and a permanent regression is included in the exact-head 100% coverage gate.
+- Resolved Git only through the operating system default executable path and rejected missing or relative results before trusted base-lock materialization, preventing pull-request-controlled `PATH` selection.
+- Restricted trusted uv retries to HTTP 408/425/429/500/502/503/504 and explicitly classified temporary DNS, timeout, connection, host, or network failures; every retry reuses the immutable request contract and discards failed-attempt bytes, while TLS, permanent DNS, malformed, and unclassified local errors fail after one attempt. The decision record now cites NIST SP 800-218 PW.4.1 so a transient retry cannot change the pinned GitHub origin or accept an unverified payload.
 - Bound both trusted-uv quality jobs to `github.event.pull_request.head.sha` and added a permanent two-checkout regression contract so exact-head compatibility, coverage, docstring, and compilation claims cannot silently measure GitHub's generated pull-request merge revision.
 - Made Strix treat only a single LiteLLM provider-error line containing NVIDIA NIM context and model-catalog 404 evidence as cross-model fallback evidence, rejecting cross-line signal assembly and provider-like target source literals; moved the public default to Nemotron 3 Super 120B and added a second NVIDIA hosted candidate before GitHub Models without neutralizing reported vulnerabilities.
 - Bind reusable scheduler implementation to the validated called-workflow repository, SHA, ref, and file path, and verify the checked-out commit before executing privileged scheduler logic.
@@ -75,3 +82,5 @@ Semantic Versioning where the repository publishes a release.
 - Added fast-mlsirm operational documentation for the hourly RCA loop, psychometric scientific gates, Rust ownership, bounded retry cadence, credential isolation, modular reuse, rollback, and APA 7 references.
 - Documented the ordinary and conflict repair write-scope parity, ignored-path and symlink inventory, Git-control-file denial, hook suppression, explicit push destination, RED/GREEN evidence, operator response, and local-versus-protected evidence boundary.
 - Documented the review-authentication boundary that excludes autonomous writer control-plane paths from review-derived file authority, its test-first Strix security evidence, exact-head coverage contract, and rollback prohibition.
+- Pinned generated Python lock output to no-follow directory and file descriptors, rejected symbolic and multiply linked destinations before mutation, revalidated inode bindings before success, and added deterministic regressions for output-path races, file swaps, and stalled writes.
+- Recorded the org control-plane architecture, including the trusted-uv retry boundary, so agents reconstruct the download trust boundary from the repo instead of private memory.

CLAUDE.md

@@ -68,7 +68,8 @@ Details: `README.md` and `PR_GOVERNANCE_AUDIT.md`.
 - `docs/` — master context, Project protocol, `org-required-workflow-rollout.md`,
   `scorecard-governance.md`, SBOM inventory. Doctoring records live under
   `docs/doctoring/`. [`ARCHITECTURE.md`](ARCHITECTURE.md) is the control-plane
-  diagram for review, hourly NVIDIA NIM repair, and merge trust boundaries.
+  diagram for review, hourly NVIDIA NIM repair, trusted-uv retry, and merge
+  trust boundaries.
 - `.jules/` — recorded performance (`bolt.md`) and security (`sentinel.md`) learnings from past work
   on `scripts/ci/`; worth scanning before optimizing or hardening those scripts.
 
@@ -133,3 +134,6 @@ repeatable compile command.
   cross-repo references as `owner/repo#num` or full URLs; durable knowledge in the repo/Project, not
   private memory; one roadmap phase at a time) are defined in `docs/CWL-MASTER-CONTEXT.md` §7 and
   apply here.
+
+Trusted-uv download retries HTTP 522. See
+`docs/doctoring/trusted-uv-transient-download-retry.md`.