build(deps): bump coverage from 7.15.0 to 7.15.2

[dependabot]

Summary

Update the OpenCode coverage-evidence toolchain from coverage.py 7.15.0 to 7.15.2 and regenerate its hash-locked dependency closure.

Coverage 7.15.2 contains the follow-up memory-use correction after 7.15.1's reporting performance work, while retaining the HTML context-label escaping fix from 7.15.1.

Scope

• requirements-opencode-review-ci.in
• requirements-opencode-review-ci.txt
• No production code, API, workflow permission, runtime package, or database change

Current evidence classification

• Contributor head: dd4e62b46fbc651a6696cb04438751122e161d8c
• Base branch: fix/atheris-interpreter-lock
• Live base tip: 3703d0da9823b8258a0be94f1801aa5d61bfad9f
• PR base metadata: ecad520fc3bd3e2591fa79e473e0666223d6d427 (stale)
• State: Draft

Every result below is classified by the commit actually checked out. Synthetic-merge, mixed, failed, skipped-required, status-only, author-only, stale-base, and predecessor evidence is not exact contributor-head success.

• Tests run 29700836398, job 92218536317: success on a synthetic merge, with 300 tests passing. This is integration evidence, not exact contributor-head success.
• Fuzz run 29700836388, jobs 88229502005 and 88229502019: success on a synthetic merge. Eight Hypothesis properties and bounded Atheris targets completed; this remains integration evidence.
• Security run 29700836410, jobs 88229502035 and 88229502040: success on a synthetic merge. Python supply-chain and CodeQL completed without a reported vulnerability; this remains integration evidence.
• Security Scan run 29700836402: mixed evidence. Dependency Review, Scorecard, and Trivy checked out a synthetic merge. OSV separately reported zero findings for the base and contributor head, but that slice does not make the aggregate workflow exact-head evidence.
• SAST Semgrep run 29700836377, job 92848705740: failed on a synthetic merge with five old-base findings: three raw-query construction findings in cost_ledger.py, one unverified TLS-context finding, and one dynamic-urllib finding in orchestrator.py. PR fix(security): pin provider egress and repair the Atheris lock #96 repairs this finding set, but that does not transfer a passing result to this PR.
• Required opencode-review, coverage-evidence, and coverage-source-tree contexts: skipped, so required review/coverage evidence is absent.
• Formal reviews: three OpenCode CHANGES_REQUESTED submissions and one author approval. The author approval is not a qualifying independent non-author approval.
• Inline review threads: none.
• CodeRabbit commit status: absent.

The prior body incorrectly promoted workflow conclusions without inspecting checkout identity and incorrectly called the author-only approval independent. The narrow remediation is this evidence correction; no code or branch rewrite can make predecessor or synthetic evidence exact-head evidence.

Dependency and refresh contract

PR #96 supersedes closed, unmerged PR #76. Keep this PR Draft while #96 remains Draft, blocked, or mutable.

PR #84 changes the same generated lock. After #96 reaches a final accepted stable head—preferably after protected merge—refresh the surviving dependency update from that exact base, combine the coverage and uv intents as needed, regenerate the hash-locked closure, and obtain every required exact-head check, automated verdict, and qualifying independent approval. No current or predecessor evidence transfers.

Do not auto-merge this stale stack. If Dependabot branch behavior prevents a durable refresh, recreate the controlled dependency update only after preserving and validating the combined lock intent.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for dd4e62b46fbc651a6696cb04438751122e161d8c.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• SAST Semgrep/Semgrep (multi-language SAST): FAILURE (https://github.com/ContextualWisdomLab/contextual-orchestrator/actions/runs/29700836377/job/88229501978)
• Semgrep (multi-language SAST) check run: failure (https://github.com/ContextualWisdomLab/contextual-orchestrator/actions/runs/29700836377/job/88229501978)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: dd4e62b46fbc651a6696cb04438751122e161d8c
• Workflow run: 30974091428
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head dd4e62b46fbc651a6696cb04438751122e161d8c.

• Head SHA: dd4e62b46fbc651a6696cb04438751122e161d8c

• Workflow run: 30974091428

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for dd4e62b46fbc651a6696cb04438751122e161d8c.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• SAST Semgrep/Semgrep (multi-language SAST): FAILURE (https://github.com/ContextualWisdomLab/contextual-orchestrator/actions/runs/29700836377/job/88229501978)
• Semgrep (multi-language SAST) check run: failure (https://github.com/ContextualWisdomLab/contextual-orchestrator/actions/runs/29700836377/job/88229501978)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

Reviewed the exact Dependabot head. The input constraint and generated hash lock consistently move coverage.py from 7.15.0 to 7.15.2 without changing unrelated dependencies. Tests, Fuzz, Security, and Security Scan pass. The remaining Semgrep failure is the repository base finding set addressed by the ordered security PR #76, not a finding introduced by this dependency-only diff; branch protection must still wait for a green rebased current head.

[seonghobae]

@dependabot rebase

Rebase onto the integrated security/Atheris prerequisite base fix/atheris-interpreter-lock (cfd42f309ea39a189635ff8ba573c5d3b0e332ba). Treat all earlier checks and approvals as stale. Because #84 changes the same generated lock, preserve a single coherent closure and rerun exact-head validation plus fresh independent approval before merge.

[dependabot]

The base commit for this pull request has not changed.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head dd4e62b46fbc651a6696cb04438751122e161d8c.

• Head SHA: dd4e62b46fbc651a6696cb04438751122e161d8c

• Workflow run: 30974091428

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading