diff --git a/.github/workflows/codeql-pr.yml b/.github/workflows/codeql-pr.yml
index 2a170fa8a..cda5e7f62 100644
--- a/.github/workflows/codeql-pr.yml
+++ b/.github/workflows/codeql-pr.yml
@@ -90,13 +90,13 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}"
           upload: false
@@ -197,13 +197,13 @@ jobs:
           ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}-merge"
           upload: false
diff --git a/.github/workflows/pr-review-autofix.yml b/.github/workflows/pr-review-autofix.yml
index e5475be1b..cc0611eef 100644
--- a/.github/workflows/pr-review-autofix.yml
+++ b/.github/workflows/pr-review-autofix.yml
@@ -42,6 +42,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ContextualWisdomLab/.github
+          ref: ${{ github.sha }}
           fetch-depth: 1
           persist-credentials: false
           path: trusted-autofix-source
@@ -231,9 +232,9 @@ jobs:
           EOF
           jq -n --arg workspace "$TARGET_WORKSPACE" '{
             "$schema": "https://opencode.ai/config.json",
-            "model": "github-models/openai/gpt-5",
-            "small_model": "github-models/deepseek/deepseek-v3-0324",
-            "enabled_providers": ["github-models"],
+            "model": "nvidia-nim/mistralai/mistral-nemotron",
+            "small_model": "nvidia-nim/nvidia/nemotron-3-nano-30b-a3b",
+            "enabled_providers": ["nvidia-nim"],
             "permission": {
               "edit": "allow",
               "bash": "deny",
@@ -242,10 +243,13 @@ jobs:
               "glob": "allow",
               "list": "allow",
               "task": "deny",
+              "skill": "deny",
+              "question": "deny",
               "webfetch": "deny",
               "websearch": "deny",
               "lsp": "deny",
-              "external_directory": "deny"
+              "external_directory": "deny",
+              "doom_loop": "deny"
             },
             "agent": {
               "ci-autofix": {
@@ -261,45 +265,40 @@ jobs:
                   "glob": "allow",
                   "list": "allow",
                   "task": "deny",
+                  "skill": "deny",
+                  "question": "deny",
                   "webfetch": "deny",
                   "websearch": "deny",
                   "lsp": "deny",
-                  "external_directory": "deny"
+                  "external_directory": "deny",
+                  "doom_loop": "deny"
                 }
               }
             },
             "provider": {
-              "github-models": {
+              "nvidia-nim": {
                 "npm": "@ai-sdk/openai-compatible",
-                "name": "GitHub Models",
+                "name": "NVIDIA NIM",
                 "options": {
-                  "baseURL": "https://models.github.ai/inference",
-                  "apiKey": "{env:STRIX_GITHUB_MODELS_TOKEN}"
+                  "baseURL": "https://integrate.api.nvidia.com/v1",
+                  "apiKey": "{env:NVIDIA_API_KEY}"
                 },
                 "models": {
-                  "openai/gpt-5": {
-                    "name": "OpenAI GPT-5",
+                  "mistralai/mistral-nemotron": {
+                    "name": "Mistral Nemotron",
                     "tool_call": true,
-                    "reasoning": true,
-                    "options": {
-                      "reasoningEffort": "high"
-                    },
-                    "variants": {
-                      "high": {
-                        "reasoningEffort": "high"
-                      }
-                    },
                     "limit": {
-                      "context": 200000,
-                      "output": 100000
+                      "context": 128000,
+                      "output": 4096
                     }
                   },
-                  "deepseek/deepseek-v3-0324": {
-                    "name": "DeepSeek V3 0324",
+                  "nvidia/nemotron-3-nano-30b-a3b": {
+                    "name": "Nemotron 3 Nano 30B A3B",
                     "tool_call": true,
+                    "reasoning": true,
                     "limit": {
                       "context": 128000,
-                      "output": 4096
+                      "output": 32768
                     }
                   }
                 }
@@ -310,16 +309,18 @@ jobs:
       - name: Run OpenCode review autofix
         if: env.RESOLVE_CONFLICT != 'true'
         env:
-          STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
-          GITHUB_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.target_app_token.outputs.token || github.token }}
-          MODEL: github-models/openai/gpt-5
-          USE_GITHUB_TOKEN: "true"
+          NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
+          MODEL: nvidia-nim/mistralai/mistral-nemotron
           SHARE: "false"
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
           NO_COLOR: "1"
           OPENCODE_AUTOFIX_WORKDIR: ${{ runner.temp }}/opencode-autofix-project
         run: |
           set -euo pipefail
+          if [ -z "${NVIDIA_API_KEY:-}" ]; then
+            echo "::error::NVIDIA_NIM_API_KEY is required for scheduled OpenCode autofix."
+            exit 1
+          fi
           prompt_file="${RUNNER_TEMP}/opencode-autofix-prompt.md"
           allowed_paths_context="$(
             awk '
@@ -374,7 +375,8 @@ jobs:
           }
           trap restore_workspace_config EXIT
           cd "$TARGET_WORKSPACE"
-          timeout 18000 opencode run "$(cat "$prompt_file")" \
+          env -u GITHUB_TOKEN -u GH_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL \
+            timeout 18000 opencode run "$(cat "$prompt_file")" \
             --pure \
             --agent ci-autofix \
             --model "$MODEL" \
@@ -446,17 +448,20 @@ jobs:
       - name: Merge base branch and resolve conflicts with OpenCode
         if: env.RESOLVE_CONFLICT == 'true'
         env:
-          STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
+          NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.target_app_token.outputs.token || github.token }}
           GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.target_app_token.outputs.token || github.token }}
-          MODEL: github-models/openai/gpt-5
-          USE_GITHUB_TOKEN: "true"
+          MODEL: nvidia-nim/mistralai/mistral-nemotron
           SHARE: "false"
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
           NO_COLOR: "1"
           OPENCODE_AUTOFIX_WORKDIR: ${{ runner.temp }}/opencode-autofix-project
         run: |
           set -euo pipefail
+          if [ -z "${NVIDIA_API_KEY:-}" ]; then
+            echo "::error::NVIDIA_NIM_API_KEY is required for scheduled OpenCode autofix."
+            exit 1
+          fi
           cd "$TARGET_WORKSPACE"
 
           # Merge the base branch into the detached head. A clean merge stays
@@ -516,7 +521,8 @@ jobs:
               fi
             }
             trap restore_workspace_config EXIT
-            timeout 18000 opencode run "$(cat "$prompt_file")" \
+            env -u GITHUB_TOKEN -u GH_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL \
+              timeout 18000 opencode run "$(cat "$prompt_file")" \
               --pure \
               --agent ci-autofix \
               --model "$MODEL" \
diff --git a/.github/workflows/pr-review-fix-scheduler.yml b/.github/workflows/pr-review-fix-scheduler.yml
index cc7875bc8..7bc09c378 100644
--- a/.github/workflows/pr-review-fix-scheduler.yml
+++ b/.github/workflows/pr-review-fix-scheduler.yml
@@ -26,7 +26,7 @@ on:
       retry_hours:
         description: Minimum hours before redispatching autofix for the same head
         required: false
-        default: "24"
+        default: "1"
         type: string
       autofix_workflow:
         description: Autofix workflow file to dispatch
@@ -44,14 +44,16 @@ on:
         default: ""
         type: string
       canonical_ref:
-        description: Ref of ContextualWisdomLab/.github to use for scheduler code
+        description: Deprecated compatibility input; accepted and ignored because privileged source is bound to the called workflow SHA
         required: false
-        default: "main"
+        default: ""
         type: string
   repository_dispatch:
     types: [pr-review-fix-scheduler]
   schedule:
-    - cron: "23 */2 * * *"
+    # Run away from minute zero, where scheduled GitHub Actions are more likely
+    # to be delayed, while preserving a bounded one-dispatch-per-run repair loop.
+    - cron: "23 * * * *"
 
 concurrency:
   group: central-pr-review-fix-scheduler-${{ github.event.client_payload.target_repository || inputs.target_repository || vars.PR_REVIEW_FIX_TARGET_REPOSITORY || github.repository }}
@@ -80,19 +82,87 @@ jobs:
       DRY_RUN: ${{ github.event.client_payload.dry_run == true || github.event.client_payload.dry_run == 'true' || inputs.dry_run == true }}
       MAX_PRS: ${{ github.event.client_payload.max_prs || inputs.max_prs || '50' }}
       MAX_DISPATCHES: ${{ github.event.client_payload.max_dispatches || inputs.max_dispatches || '1' }}
-      RETRY_HOURS: ${{ github.event.client_payload.retry_hours || inputs.retry_hours || '24' }}
+      RETRY_HOURS: ${{ github.event.client_payload.retry_hours || inputs.retry_hours || '1' }}
       AUTOFIX_WORKFLOW: pr-review-autofix.yml
       AUTOFIX_REPOSITORY: ContextualWisdomLab/.github
-      CANONICAL_REF: main
     steps:
-      - name: Checkout canonical scheduler
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Resolve immutable called-workflow source
+        id: trusted_source
+        env:
+          WORKFLOW_REPOSITORY: ${{ job.workflow_repository }}
+          WORKFLOW_SHA: ${{ job.workflow_sha }}
+          WORKFLOW_REF: ${{ job.workflow_ref }}
+          WORKFLOW_FILE_PATH: ${{ job.workflow_file_path }}
+        run: |
+          set -euo pipefail
+          expected_repository="ContextualWisdomLab/.github"
+          expected_file=".github/workflows/pr-review-fix-scheduler.yml"
+
+          if [ "$WORKFLOW_REPOSITORY" != "$expected_repository" ]; then
+            printf '::error::Called workflow repository resolved to %s, expected %s.\n' \
+              "${WORKFLOW_REPOSITORY:-<empty>}" "$expected_repository"
+            exit 1
+          fi
+          if ! [[ "$WORKFLOW_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            printf '::error::Called workflow SHA is missing or malformed: %s.\n' \
+              "${WORKFLOW_SHA:-<empty>}"
+            exit 1
+          fi
+          if [ "$WORKFLOW_FILE_PATH" != "$expected_file" ]; then
+            printf '::error::Called workflow file resolved to %s, expected %s.\n' \
+              "${WORKFLOW_FILE_PATH:-<empty>}" "$expected_file"
+            exit 1
+          fi
+          expected_ref_prefix="${WORKFLOW_REPOSITORY}/${WORKFLOW_FILE_PATH}@"
+          case "$WORKFLOW_REF" in
+            "$expected_ref_prefix"*) ;;
+            *)
+              printf '::error::Called workflow ref is missing or inconsistent: %s.\n' \
+                "${WORKFLOW_REF:-<empty>}"
+              exit 1
+              ;;
+          esac
+
+          {
+            printf 'repository=%s\n' "$WORKFLOW_REPOSITORY"
+            printf 'sha=%s\n' "$WORKFLOW_SHA"
+            printf 'workflow_ref=%s\n' "$WORKFLOW_REF"
+            printf 'workflow_file_path=%s\n' "$WORKFLOW_FILE_PATH"
+          } >>"$GITHUB_OUTPUT"
+          printf 'Resolved immutable called-workflow source repository=%s file=%s sha=%s ref=%s.\n' \
+            "$WORKFLOW_REPOSITORY" "$WORKFLOW_FILE_PATH" "$WORKFLOW_SHA" "$WORKFLOW_REF"
+
+      - name: Checkout immutable called-workflow source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          repository: ContextualWisdomLab/.github
-          ref: ${{ env.CANONICAL_REF }}
+          # GitHub documents job.workflow_repository and job.workflow_sha as
+          # the called workflow identity. The preceding step validates every
+          # field before checkout so an absent property cannot select defaults.
+          repository: ${{ steps.trusted_source.outputs.repository }}
+          ref: ${{ steps.trusted_source.outputs.sha }}
           fetch-depth: 1
           persist-credentials: false
 
+      - name: Verify immutable called-workflow checkout
+        env:
+          EXPECTED_SHA: ${{ steps.trusted_source.outputs.sha }}
+          EXPECTED_FILE: ${{ steps.trusted_source.outputs.workflow_file_path }}
+        run: |
+          set -euo pipefail
+          actual_sha="$(git rev-parse HEAD)"
+          if [ "$actual_sha" != "$EXPECTED_SHA" ]; then
+            printf '::error::Checked-out scheduler SHA %s does not match called-workflow SHA %s.\n' \
+              "$actual_sha" "$EXPECTED_SHA"
+            exit 1
+          fi
+          if [ ! -f "$EXPECTED_FILE" ] || [ -L "$EXPECTED_FILE" ]; then
+            printf '::error::Called workflow source file is missing or symlinked: %s.\n' \
+              "$EXPECTED_FILE"
+            exit 1
+          fi
+          printf 'Verified immutable scheduler checkout at %s (%s).\n' \
+            "$actual_sha" "$EXPECTED_FILE"
+
       - name: Self-test fix scheduler contract
         run: python3 scripts/ci/pr_review_fix_scheduler.py --self-test
 
diff --git a/.github/workflows/sbom-generation.yml b/.github/workflows/sbom-generation.yml
index b62f0b3d3..b56a261be 100644
--- a/.github/workflows/sbom-generation.yml
+++ b/.github/workflows/sbom-generation.yml
@@ -19,9 +19,19 @@
 # NOTE: contents: write is required for release-asset upload and for the
 # dependency submission API. Fork PR heads run without write and simply skip
 # those side effects; the artifact is still produced.
+#
+# NOTE on the push trigger: it exists so the DEFAULT BRANCH has a dependency
+# snapshot. dependency-review compares base...head in the dependency graph; with
+# PR-only runs the base commit never has one, so every comparison reports "the
+# number of snapshots compared for the base SHA (0) and the head SHA (1) do not
+# match" and the whole dependency set reads as newly added. That re-flags
+# pre-existing vulnerabilities on every PR instead of only the ones the PR adds.
+# Snapshotting pushes to the default branch gives the comparison a real base.
 name: SBOM Generation
 
 on:
+  push:
+    branches: [main, master, develop]
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review, closed]
     branches: [main, master, develop]
@@ -29,7 +39,10 @@ on:
     types: [published]
 
 concurrency:
-  group: sbom-generation-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{ github.event.pull_request.number || github.event.release.tag_name || github.ref }}
+  # Final fallback is the SHA, not the ref, so two pushes landing close together
+  # do not cancel each other: a cancelled push run leaves that commit without a
+  # snapshot, which is exactly the base-side gap this trigger exists to close.
+  group: sbom-generation-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{ github.event.pull_request.number || github.event.release.tag_name || github.sha }}
   cancel-in-progress: true
 
 permissions:
diff --git a/.github/workflows/scheduled-security-scan.yml b/.github/workflows/scheduled-security-scan.yml
index 8ecb5185b..331de634f 100644
--- a/.github/workflows/scheduled-security-scan.yml
+++ b/.github/workflows/scheduled-security-scan.yml
@@ -90,13 +90,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
         continue-on-error: true
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}-scheduled"
 
@@ -131,7 +131,7 @@ jobs:
       - name: Upload Trivy SARIF to code scanning
         if: always() && hashFiles('trivy-results.sarif') != ''
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           sarif_file: trivy-results.sarif
           category: trivy-fs-scheduled
diff --git a/docs/automation/hourly-review-repair.md b/docs/automation/hourly-review-repair.md
new file mode 100644
index 000000000..1924dba5b
--- /dev/null
+++ b/docs/automation/hourly-review-repair.md
@@ -0,0 +1,72 @@
+# Hourly PR review-repair scheduler
+
+The central `PR Review Fix Scheduler` provides a bounded organization-wide
+review → fix → revalidate → merge support loop. It runs at minute 23 of every
+hour and may dispatch at most one existing autofix workflow per run. Merge
+eligibility remains owned by the separate merge scheduler, branch protection,
+required checks, independent review, and unresolved-thread policy.
+
+## Execution and compatibility contract
+
+- The scheduled heartbeat is `23 * * * *`.
+- The default same-head retry floor is one hour.
+- `max_dispatches` remains one by default.
+- Repository-scoped concurrency and `cancel-in-progress: true` prevent two
+  superseded scheduler runs from mutating the same repository concurrently.
+- `canonical_ref` remains an accepted deprecated input only so callers pinned to
+  older workflow interfaces can upgrade without a coordinated breaking change.
+  It is never read and cannot choose executable scheduler code.
+
+## Immutable reusable-workflow source
+
+GitHub associates the ordinary `github` context in a reusable workflow with the
+caller. Consequently, a called privileged workflow must not use caller-derived
+`github.sha`, a caller payload, or a mutable branch such as `main` to select its
+co-located implementation.
+
+The checkout step instead uses:
+
+```yaml
+repository: ${{ job.workflow_repository }}
+ref: ${{ job.workflow_sha }}
+```
+
+`job.workflow_repository` identifies the repository that contains the called
+workflow and `job.workflow_sha` identifies its immutable resolved commit. This
+keeps the scheduler implementation aligned with the exact workflow revision
+selected by the caller's `uses: ...@<sha>` reference. Checkout credentials are
+not persisted.
+
+## Security and MSA boundary
+
+The scheduler can inspect review state and dispatch the already-reviewed bounded
+autofix workflow. It cannot approve its own changes, lower branch protection,
+convert queued checks to success, publish releases, or bypass independent
+review. Product repositories remain independently operable and consume the
+central policy as a reusable module rather than copying privileged automation.
+
+CWL repositories and naruon retain their own product tests, authorization,
+release, deployment, data-governance, and runtime responsibilities. The central
+workflow owns only organization-level queue inspection and bounded repair
+dispatch.
+
+## Verification
+
+Dependency-free static tests pin the hourly cron, one-hour retry default,
+one-dispatch budget, single-flight concurrency, immutable called-workflow
+checkout, ignored compatibility input, and least-privilege token boundary. The
+exact PR head must also pass all central security, coverage, workflow-contract,
+and independent-review gates before merge.
+
+## References (APA 7th edition)
+
+GitHub. (n.d.). *Contexts reference: Job context*. GitHub Docs. Retrieved August
+4, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#job-context
+
+GitHub. (n.d.). *Reusing workflow configurations*. GitHub Docs. Retrieved August
+4, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
+
+GitHub. (n.d.). *Reusing workflows*. GitHub Docs. Retrieved August 4, 2026, from
+https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
diff --git a/docs/doctoring/central-security-and-review-baseline.md b/docs/doctoring/central-security-and-review-baseline.md
new file mode 100644
index 000000000..81495cb0c
--- /dev/null
+++ b/docs/doctoring/central-security-and-review-baseline.md
@@ -0,0 +1,131 @@
+# Central security and review baseline: evidence record
+
+## Decision
+
+The organization-level `.github` repository owns reusable review, security,
+dependency-snapshot, and bounded repair workflows. Product repositories remain
+independently operable and consume those controls as modules; they retain their
+own application tests, authorization, deployment, release, and data-governance
+responsibilities.
+
+The baseline repair makes five controls atomic because they participate in the
+same protected-branch decision:
+
+1. CodeQL initialization, analysis, and SARIF upload use one immutable action
+   revision within each affected workflow.
+2. The central Strix dependency closure removes known-vulnerable package pins
+   and remains fully hash-pinned.
+3. Trusted-base Python dependency preflight defers only narrowly classified
+   incomplete closures, interpreter incompatibility, or binary-unavailable and
+   stale pins proven by paired diagnostics for the same exact requirement on a
+   reachable index. Every resolver line must carry a comma-separated list whose
+   alternatives are concrete, conservatively recognized PEP 440 versions;
+   blank values, `none`, arbitrary prose, mixed version/prose lists, duplicate
+   malformed evidence, integrity, transport, and unknown errors fail closed.
+4. Default-branch pushes submit dependency snapshots so pull-request dependency
+   review compares a head snapshot with a real base snapshot.
+5. Review repair runs once per hour, dispatches at most one bounded repair job,
+   and resolves privileged code from the reusable workflow's immutable source
+   identity rather than caller data or mutable `main`.
+
+## Standards and current-platform rationale
+
+NIST SSDF version 1.1 is the current final publication; version 1.2 remained a
+public draft at the time of this decision. The baseline follows SSDF's final
+risk-reduction direction by integrating vulnerability detection, dependency
+integrity, repeatable verification, and root-cause regression controls into the
+software lifecycle without claiming formal conformance.
+
+The approved SLSA specification is version 1.2. Its source model distinguishes
+trusted automation whose identity and codebase cannot be unilaterally
+influenced. Immutable action pins, exact-revision dependency materialization,
+and called-workflow source binding reduce mutable control-plane inputs in line
+with that model without claiming a SLSA level.
+
+GitHub documents that a reusable workflow's ordinary `github` context belongs
+to the caller. GitHub's current contexts reference separately defines
+`job.workflow_repository`, `job.workflow_sha`, `job.workflow_ref`, and
+`job.workflow_file_path` as the repository, immutable commit, full ref, and path
+of the workflow file that defines the current job. The same reference gives
+`job.workflow_repository` plus `job.workflow_sha` as the supported pattern for
+checking out files co-located with a reusable workflow; these properties are a
+GitHub.com capability and are not available on GitHub Enterprise Server.
+
+The scheduler therefore keeps the documented `job.workflow_*` identity rather
+than substituting caller-associated `github.workflow_*` values. Before checkout,
+it rejects an empty, malformed, unexpected-repository, unexpected-file, or
+inconsistent workflow identity and exports only the validated repository and
+full SHA. After checkout, it compares `git rev-parse HEAD` with that SHA and
+requires the workflow file to be a regular non-symlink file before any scheduler
+self-test or credential-bearing dispatch can execute. Caller and compatibility
+inputs remain excluded as executable-source selectors, and contents-write and
+pull-requests-write permissions remain absent.
+
+GitHub also documents that scheduled events can be delayed at the start of an
+hour. The hourly heartbeat therefore runs at minute 23. A one-hour same-head
+retry floor matches the requested cadence while the one-dispatch budget and
+repository-scoped concurrency keep mutation bounded.
+
+GitHub's dependency submission API associates snapshots with commit SHAs and can
+submit build-time or SBOM-derived dependencies that static manifest analysis
+misses. Snapshotting default-branch pushes supplies the base-side evidence that
+pull-request dependency review needs and prevents the entire existing graph from
+appearing newly introduced.
+
+## Verification contract
+
+The exact pull-request head must prove:
+
+- one immutable CodeQL revision per affected workflow;
+- the central hash lock installs and vulnerability scanners accept it;
+- stale-pin deferral requires paired exact-requirement resolver diagnostics and
+  a nonempty list on every matching resolver line in which every alternative is
+  a conservatively valid PEP 440 version, including epoch, prerelease,
+  postrelease, development, and local forms used by pip;
+- blank, `none`, arbitrary prose, mixed version/prose lists, duplicate malformed
+  lines, single-sided or mismatched resolver evidence, integrity, retry,
+  transport, mixed-unknown, and unclassified installer failures remain fatal;
+- the changed installer has 100% statement and branch coverage and 100%
+  production docstrings;
+- default-branch snapshot triggers, commit-SHA concurrency, and job-scoped write
+  permissions remain pinned by tests;
+- hourly cadence, one-hour retry, single dispatch, least-privilege permissions,
+  pre-checkout validation of every `job.workflow_*` identity field, and
+  post-checkout SHA/file verification remain pinned by tests; and
+- every current-head security, review, unresolved-thread, and branch-protection
+  gate succeeds before merge.
+
+## References
+
+Booth, H., Ogata, M., Kent, K., Souppaya, M., & Dodson, D. (2025). *Secure
+software development framework (SSDF) version 1.2: Recommendations for
+mitigating the risk of software vulnerabilities* (Initial Public Draft, NIST SP
+800-218 Rev. 1). National Institute of Standards and Technology.
+https://doi.org/10.6028/NIST.SP.800-218r1.ipd
+
+GitHub. (n.d.). *Contexts reference*. GitHub Docs. Retrieved August 5, 2026,
+from
+https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
+
+GitHub. (n.d.). *Reusing workflow configurations*. GitHub Docs. Retrieved August
+5, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
+
+GitHub. (n.d.). *Troubleshooting workflows*. GitHub Docs. Retrieved August 5,
+2026, from https://docs.github.com/en/actions/how-tos/troubleshoot-workflows
+
+GitHub. (n.d.). *Using the dependency submission API*. GitHub Docs. Retrieved
+August 5, 2026, from
+https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api
+
+Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure software development
+framework (SSDF) version 1.1: Recommendations for mitigating the risk of software
+vulnerabilities* (NIST SP 800-218). National Institute of Standards and
+Technology. https://doi.org/10.6028/NIST.SP.800-218
+
+Supply-chain Levels for Software Artifacts. (2025). *SLSA specification
+(version 1.2)*. https://slsa.dev/spec/v1.2/
+
+Supply-chain Levels for Software Artifacts. (2025). *Source: Requirements for
+producing source (version 1.2)*.
+https://slsa.dev/spec/v1.2/source-requirements
diff --git a/docs/doctoring/hourly-nvidia-nim-autofix.md b/docs/doctoring/hourly-nvidia-nim-autofix.md
new file mode 100644
index 000000000..5806c766a
--- /dev/null
+++ b/docs/doctoring/hourly-nvidia-nim-autofix.md
@@ -0,0 +1,240 @@
+# Hourly NVIDIA NIM Review-Autofix Boundary
+
+## Decision
+
+The write-capable scheduled pull-request autofix agent uses OpenCode with the
+NVIDIA NIM API and the organization Actions secret `NVIDIA_NIM_API_KEY`. The
+independent read-only review agent remains unchanged and continues to use its
+existing credential and model-pool contract.
+
+This separation is intentional. Review and repair have different privileges:
+the review path publishes a verdict, while the autofix path may modify and push
+a same-repository pull-request branch. Sharing or silently replacing the review
+credential would couple two independent controls and weaken incident
+containment.
+
+## Central MSA ownership
+
+`ContextualWisdomLab/.github` owns the scheduler, dispatch authorization,
+model-provider configuration, credential binding, immutable worker source, and
+fail-closed repair contract. Leaf repositories receive the behavior through the
+central reusable workflow and do not copy provider credentials or scheduler
+implementation.
+
+The central scheduler established by the baseline repair runs once per hour,
+dispatches at most one repair per invocation, and binds its scheduler
+implementation to the immutable called-workflow source. The NVIDIA migration
+changes only the model transport used by the write-capable autofix worker and
+hardens that worker's own default-branch source checkout.
+
+## Immutable repository-dispatch worker source
+
+`PR Review Autofix` is a default-branch-only `repository_dispatch` workflow.
+GitHub defines `GITHUB_SHA` for `repository_dispatch` as the last commit on the
+default branch and runs only a workflow file present on that branch. The
+workflow therefore checks out its co-located context builder and policy source
+at the exact workflow-run commit:
+
+```yaml
+repository: ContextualWisdomLab/.github
+ref: ${{ github.sha }}
+fetch-depth: 1
+persist-credentials: false
+```
+
+Without the explicit `ref`, `actions/checkout` would resolve the repository's
+moving default branch at checkout time. A later default-branch push could then
+replace trusted scripts after GitHub had already selected the workflow run,
+creating a time-of-check/time-of-use gap around a job that receives OIDC and
+branch-write capability. The explicit SHA keeps the executed helper source
+aligned with the workflow revision selected for the dispatch.
+
+The client payload remains untrusted metadata. It can identify the intended
+target PR only after the workflow re-reads live PR state and verifies exact base
+and head refs and SHAs.
+
+## Provider contract
+
+The pinned OpenCode runtime is configured with one enabled provider,
+`nvidia-nim`, using the OpenAI-compatible adapter and NVIDIA hosted endpoint:
+
+```text
+https://integrate.api.nvidia.com/v1
+```
+
+The primary repair model is `mistralai/mistral-nemotron`; the small model used
+for bounded helper work is `nvidia/nemotron-3-nano-30b-a3b`. NVIDIA documents
+both identifiers. Mistral-Nemotron supports tool calling for agentic workflows.
+Nemotron 3 Nano is used as a lower-active-parameter reasoning helper, not as a
+fallback provider.
+
+Only the `nvidia-nim` provider is enabled. GitHub Models configuration, model
+identifiers, base URLs, and model-auth fallbacks are absent from the scheduled
+autofix execution path.
+
+## Credential boundary
+
+The organization secret is bound as:
+
+```yaml
+NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
+```
+
+It is present only on the two steps that execute OpenCode: ordinary
+review-feedback repair and merge-conflict repair. Earlier metadata collection,
+checkout, context preparation, validation, commit, and push steps do not receive
+the NVIDIA credential.
+
+The workflow passes the key through an environment variable and OpenCode
+substitutes `{env:NVIDIA_API_KEY}` into provider configuration. The key is never
+written to repository files, command arguments, generated prompts, or logs. A
+missing secret is a fatal configuration error; the workflow does not fall back
+to `GITHUB_TOKEN`, a GitHub Models token, or another provider.
+
+The ordinary repair step no longer binds a GitHub write token at step scope. The
+conflict-repair shell retains GitHub credentials because the same shell must
+re-read the live PR and push a verified merge result after model execution. In
+both paths, the OpenCode child process is launched through:
+
+```text
+env -u GITHUB_TOKEN -u GH_TOKEN \
+  -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL
+```
+
+Consequently, model-controlled file operations receive the NVIDIA model
+credential and non-secret execution controls, but cannot call GitHub APIs or
+mint an OIDC token. GitHub credentials remain available only to reviewed shell
+logic before or after the child process. This reduces the consequence of prompt
+injection without removing the worker's independently validated branch-update
+capability.
+
+GitHub documents that a missing secret expression resolves to an empty string
+and recommends delivering secrets through inputs or environment variables rather
+than embedding them in command lines. The explicit preflight prevents an
+ambiguous unauthenticated provider request and preserves fail-closed behavior.
+
+## OpenCode repair sandbox
+
+OpenCode permissions are permissive unless explicitly restricted. The workflow
+therefore denies every non-file interaction that is unnecessary for a bounded
+review repair in both the global permission map and the named `ci-autofix`
+agent:
+
+- `bash`
+- `task`
+- `skill`
+- `question`
+- `webfetch`
+- `websearch`
+- `lsp`
+- `external_directory`
+- `doom_loop`
+
+The agent may read, search, list, and edit only the validated same-repository PR
+worktree. It receives an authoritative file allowlist derived from current
+file-scoped actionable review context. The workflow rejects any changed path
+outside that allowlist, syntax-checks changed Python, validates workflow files
+when `actionlint` is available, rechecks the live head before push, and refuses
+to publish unresolved merge markers.
+
+Explicitly denying `skill`, `question`, and `doom_loop` matters for unattended
+execution. OpenCode exposes these as independent permissions; omitted
+permissions are not implicitly denied. The worker must not load a broader skill,
+pause for interactive approval, or repeat an identical tool action beyond the
+bounded workflow contract.
+
+## GitHub write boundary
+
+The model transport change does not expand GitHub permissions. GitHub repository
+credentials and the NVIDIA model credential remain separate. The existing
+short-lived GitHub App/OIDC exchange and branch-write token chain are not used
+for model authentication. Conversely, `NVIDIA_NIM_API_KEY` is not used for
+GitHub reads or writes.
+
+Before editing, the workflow validates repository syntax, numeric PR identity,
+forty-character base and head SHAs, same-repository branch ownership, open PR
+state, and exact live base/head metadata. Before pushing, it re-reads the live
+head and fails if the branch moved. The scheduler and worker cannot approve
+their own changes, lower branch protection, convert queued checks into success,
+or publish a release.
+
+## Independent review-agent boundary
+
+`.github/workflows/opencode-review-dispatch.yml` is not modified by this
+migration. The regression contract pins that workflow's Git blob SHA
+byte-for-byte rather than inferring independence from provider-name strings.
+This allows the existing reviewer to retain its own evolving, separately
+reviewed model-pool and credential design while proving that this autofix change
+did not alter it.
+
+This is not cosmetic separation: review produces the verdict that gates merge,
+whereas autofix proposes branch changes. Keeping their credentials, workflow
+sources, and change histories independent limits the blast radius of either
+path.
+
+## Verification contract
+
+Automated tests must prove all of the following:
+
+1. The repair scheduler retains the approved hourly cron expression.
+2. The OpenCode configuration enables only `nvidia-nim`.
+3. Primary and small model identifiers match NVIDIA's published identifiers.
+4. The provider uses the OpenAI-compatible package, NVIDIA base URL, and
+   environment substitution.
+5. Exactly two OpenCode execution steps receive `NVIDIA_API_KEY` from
+   `secrets.NVIDIA_NIM_API_KEY`.
+6. GitHub Models credentials, providers, model identifiers, base URLs, and
+   `USE_GITHUB_TOKEN` model-auth fallback are absent from the autofix workflow.
+7. The trusted autofix checkout is pinned to `${{ github.sha }}`, does not use
+   mutable `main`, and does not persist credentials.
+8. Both OpenCode permission maps explicitly deny every non-file interaction
+   listed in the sandbox section.
+9. Both OpenCode subprocesses explicitly remove GitHub and OIDC credentials;
+   the ordinary model step has no step-level GitHub token binding.
+10. The independent review workflow retains its exact reviewed Git blob SHA and
+    contains no coupling to the autofix event.
+11. A missing NVIDIA secret fails before either model process executes.
+12. The exact current head passes complete workflow, Python, security,
+    CodeRabbit, independent-review, unresolved-thread, and branch-protection
+    gates before merge.
+
+## Scheduling and activation
+
+The NVIDIA worker does not create a second scheduler. It is consumed by the
+hourly central review-fix scheduler established in the stacked baseline PR. The
+hourly production loop becomes active only after both the baseline and this
+migration are merged into the protected default branch. Draft or feature-branch
+workflow files are not represented as active organization automation.
+
+## Rollback
+
+Rollback is a normal revert of the NVIDIA transport commit. A rollback must not
+reintroduce an implicit GitHub-token model-auth fallback, GitHub or OIDC
+credentials inside the model child process, a mutable trusted source checkout,
+permissive unattended-agent tools, or any change to the independent review-agent
+credential system. If NVIDIA NIM is unavailable, scheduled autofix must fail
+closed while review, checks, and manual maintenance remain available.
+
+## References
+
+GitHub, Inc. (n.d.-a). *Events that trigger workflows*. GitHub Docs. Retrieved
+August 4, 2026, from
+https://docs.github.com/en/enterprise-cloud@latest/actions/reference/workflows-and-actions/events-that-trigger-workflows
+
+GitHub, Inc. (n.d.-b). *Secrets reference*. GitHub Docs. Retrieved August 4,
+2026, from https://docs.github.com/en/actions/reference/security/secrets
+
+NVIDIA Corporation. (n.d.-a). *LLM APIs*. NVIDIA API Catalog. Retrieved August
+4, 2026, from https://docs.api.nvidia.com/nim/reference/llm-apis
+
+NVIDIA Corporation. (n.d.-b). *Mistralai / mistral-nemotron*. NVIDIA API
+Catalog. Retrieved August 4, 2026, from
+https://docs.api.nvidia.com/nim/reference/mistralai-mistral-nemotron
+
+NVIDIA Corporation. (n.d.-c). *NVIDIA / nemotron-3-nano-30b-a3b*. NVIDIA API
+Catalog. Retrieved August 4, 2026, from
+https://docs.api.nvidia.com/nim/re/reference/nvidia-nemotron-3-nano-30b-a3b
+
+OpenCode. (2026a). *Permissions*. https://opencode.ai/docs/permissions
+
+OpenCode. (2026b, July 28). *Providers*. https://opencode.ai/docs/providers
diff --git a/requirements-strix-ci-hashes.txt b/requirements-strix-ci-hashes.txt
index e2c8f00eb..c305e9c84 100644
--- a/requirements-strix-ci-hashes.txt
+++ b/requirements-strix-ci-hashes.txt
@@ -4,127 +4,128 @@ aiohappyeyeballs==2.7.1 \
     --hash=sha256:065665c041c42a5938ed220bdcd7230f22527fbec085e1853d2402c8a3615d9d \
     --hash=sha256:9243213661e29250eb41368e5daa826fc017156c3b8a11440826b2e3ed376472
     # via aiohttp
-aiohttp==3.14.1 \
-    --hash=sha256:03ab4530fdcb3a543a122ba4b65ac9919da9fe9f78a03d328a6e38ff962f7aa5 \
-    --hash=sha256:07eabb979d236335fed927e137a928c9adfb7df3b9ec7aa31726f133a62be983 \
-    --hash=sha256:092e4ce3619a7c6dee52a6bdabda973d9b34b66781f840ce93c7e0cec30cf521 \
-    --hash=sha256:10ee9c1753a8f706345b22496c79fbddb5be0599e0823f3738b1534058e25340 \
-    --hash=sha256:1601cc37baf5750ccacae618ec2daf020769581695550e3b654a911f859c563d \
-    --hash=sha256:1ac8531b638959718e18c2207fbfe297819875da46a740b29dfa29beba64355a \
-    --hash=sha256:1b9748363260121d2927704f5d4fc498150669ca3ae93625986ee89c8f80dcd4 \
-    --hash=sha256:1c1421eb01d4fd608d88cc8290211d177a58532b55ad94076fb349c5bf467f0a \
-    --hash=sha256:1c1af67559445498b502030c35c59db59966f47041ca9de5b4e707f86bd10b5f \
-    --hash=sha256:1d459b98a932296c6f0e94f87511a0b1b90a8a02c30a50e60a297619cd5a58ee \
-    --hash=sha256:20205f7f5ade7aaec9f4b500549bbc071b046453aed72f9c06dcab87896a83e8 \
-    --hash=sha256:23119f8fd4f5d16902ed459b63b100bcd269628075162bddac56cc7b5273b3fb \
-    --hash=sha256:237651caadc3a59badd39319c54642b5299e9cc98a3a194310e55d5bb9f5e397 \
-    --hash=sha256:24ba13339fed9251d9b1a1bec8c7ab84c0d1675d79d33501e11f94f8b9a84e05 \
-    --hash=sha256:250d14af67f6b6a1a4a811049b1afa69d61d617fca6bf33149b3ab1a6dbcf7b8 \
-    --hash=sha256:269b76ac5394092b95bc4a098f4fc6c191c083c3bd12775d1e30e663132f6a09 \
-    --hash=sha256:27fd7c91e51729b4f7e1577865fa6d34c9adccbc39aabe9000285b48af9f0ec2 \
-    --hash=sha256:2964cbf553df4d7a57348da44d961d871895fc1ee4e8c322b2a95612c7b17fba \
-    --hash=sha256:2a73f487ab8ef5abbb24b7aa9b73e98eaba9e9e031804ff2416f02eca315ccaf \
-    --hash=sha256:2aa92c87868cd13674989f9ee83e5f9f7ea4237589b728048e1f0c8f6caa3271 \
-    --hash=sha256:2b7edd08e0a5deb1e8564a2fcd8f4561014a3f05252334671bbf55ddd47db0e5 \
-    --hash=sha256:2c840c90759922cb5e6dda94596e079a30fb5a5ba548e7e0dc00574703940847 \
-    --hash=sha256:2f73e01dc37122325caf079982621262f96d74823c179038a82fddfc50359264 \
-    --hash=sha256:2fbc3ed048b3475b9f0cbcb9978e9d2d3511acd91ead203af26ed9f0056004cf \
-    --hash=sha256:2fe3607e71acc6ebb0ec8e492a247bf7a291226192dc0084236dfc12478916f6 \
-    --hash=sha256:30099eda75a53c32efb0920e9c33c195314d2cc1c680fbfd30894932ac5f27df \
-    --hash=sha256:307f2cff90a764d329e77040603fa032db89c5c24fdad50c4c15334cba744035 \
-    --hash=sha256:313701e488100074ce99850404ee36e741abf6330179fec908a1944ecf570126 \
-    --hash=sha256:317acd9f8602858dc7d59679812c376c7f0b97bcbbf16e0d6237f54141d8a8a6 \
-    --hash=sha256:335c0cc3e3545ce98dcb9cfcb836f40c3411f43fa03dab757597d80c89af8a35 \
-    --hash=sha256:34b257ec41345c1e8f2df68fa908a7952f5de932723871eb633ecbbff396c9a4 \
-    --hash=sha256:367a9314fdc79dab0fac96e216cb41dd73c85bdca85306ce8999118ba7e0f333 \
-    --hash=sha256:38e1e7daaea81df51c952e18483f323d878499a1e2bfe564790e0f9701d6f203 \
-    --hash=sha256:3e6fc1a85fa7194a1a7d19f44e8609180f4a8eb5fa4c7ed8b4355f080fad235c \
-    --hash=sha256:4132e72c608fe9fecb8f409113567605915b83e9bdd3ea56538d2f9cd35002f1 \
-    --hash=sha256:4691802dda97be727f79d86818acaad7eb8e9252626a1d6b519fedbb92d5e251 \
-    --hash=sha256:47ddf841cdecc810749921d25606dee45857d12d2ad5ddb7b5bd7eab12e4b365 \
-    --hash=sha256:486f7d16ed54c39c2cbd7ca71fd8ba2b8bb7860df65bd7b6ed640bab96a38a8b \
-    --hash=sha256:4cd96b5ba05d67ed0cf00b5b405c8cd99586d8e3481e8ee0a831057591af7621 \
-    --hash=sha256:4d6e0ac9da31c9c04c84e1c0182ad8d6df35965a85cae29cd71d089621b3ae94 \
-    --hash=sha256:4dfd6e47d3c44c2279907607f73a4240b88c69eb8b90da7e2441a8045dfd21da \
-    --hash=sha256:4f7215cb3933784f79ed20e5f050e15984f390424339b22375d5a53c933a0491 \
-    --hash=sha256:4fe1f1087cbadb280b5e1bb054a4f00d1423c74d6626c5e48400d871d34ecefe \
-    --hash=sha256:52cdac9432d8b4a719f35094a818d95adcae0f0b4fe9b9b921909e0c87de9e7d \
-    --hash=sha256:5663ee9257cfa1add7253a7da3035a02f31b6600ec48261585e1800a81533080 \
-    --hash=sha256:57fc6745a4b7d0f5a9eb4f40a69718be6c0bc1b8368cc9fe89e90118719f4f42 \
-    --hash=sha256:5a837f49d901f9e368651b676912bff1104ed8c1a83b280bcd7b29adccef5c9c \
-    --hash=sha256:5c0b3e614340c889d575451696374c9d17affd54cd607ca0babed8f8c37b9397 \
-    --hash=sha256:5e78b522b7a6e27e0b25d19b247b75039ac4c94f99823e3c9e53ae1603a9f7e9 \
-    --hash=sha256:5f2504bc0322437c9a1ff6d3333ca56c7477b727c995f036b976ae17b98372c8 \
-    --hash=sha256:603a2c834142172ffddc054067f5ec0ca65d57a0aa98a71bc81952573208e345 \
-    --hash=sha256:62a759436b29e677181a9e76bab8b8f689a29cb9c535f45f7c48c9c830d3f8c3 \
-    --hash=sha256:634e385930fb6d2d479cf3aa66515955863b77a5e3c2b5894ca259a25b308602 \
-    --hash=sha256:64c567bf9eaf664280116a8688f63016e6b32db2505908e2bdaca1b6438142f2 \
-    --hash=sha256:672ac254412a24d0d0cf00a9e6c238877e4be5e5fa2d188832c1244f45f31966 \
-    --hash=sha256:672b9d65f42eb877f5c3f234a4547e4e1a226ca8c2eed879bb34670a0ce51192 \
-    --hash=sha256:686b6c0d3911ec387b444ddf5dc62fb7f7c0a7d5186a7861626496a5ab4aff95 \
-    --hash=sha256:6f71173be42d3241d428f760122febb748de0623f44308a6f120d0dd9ec572e3 \
-    --hash=sha256:6fd35beba67c4183b09375c5fff9accb47524191a244a99f95fd4472f5402c2b \
-    --hash=sha256:6ffbb2f4ec1ceaff7e07d43922954da26b223d188bf30658e561b98e23089444 \
-    --hash=sha256:73f05ea02013e02512c3bf42714f1208c57168c779cc6fe23516e4543089d0a6 \
-    --hash=sha256:764457a7be60825fb770a644852ff717bcbb5042f189f2bd16df61a81b3f6573 \
-    --hash=sha256:797457503c2d426bee06eef808d07b31ede30b65e054444e7de64cad0061b7af \
-    --hash=sha256:7c106c26852ca1c2047c6b80384f17100b4e439af276f21ef3d4e2f450ae7e15 \
-    --hash=sha256:7fb4bdf95b0561a79f259f9d28fbc109728c5ee7f27aff6391f0ca703a329abe \
-    --hash=sha256:819c054312f1af92947e6a55883d1b66feefab11531a7fc45e0fb9b63880b5c2 \
-    --hash=sha256:8560b4d712474335d08907db7973f71912d3a9a8f1dee992ec06b5d2fe359496 \
-    --hash=sha256:86a6dab78b0e43e2897a3bbe15745aa60dc5423ca437b7b0b164c069bf91b876 \
-    --hash=sha256:87a5eea1b2a5e21e1ebdbb33ad4165359189327e63fc4e4894693e7f821ac817 \
-    --hash=sha256:896e12dfdbbab9d8f7e16d2b28c6769a60126fa92095d1ebf9473d02593a2448 \
-    --hash=sha256:8f6bb621e5863cfe8fe5ff5468002d200ec31f30f1280b259dc505b02595099e \
-    --hash=sha256:90d53f1609c29ccc2193945ef732428382a28f78d0456ae4d3daf0d48b74f0f6 \
-    --hash=sha256:915fbb7b41b115192259f8c9ae58f3ddc444d2b5579917270211858e606a4afd \
-    --hash=sha256:93b032b5ec3255473c143627d21a69ac74ae12f7f33974cb587c564d11b1066f \
-    --hash=sha256:94da27378da0610e341c4d30de29a191672683cc82b8f9556e8f7c7212a020fe \
-    --hash=sha256:979ed4717f59b8bb12e3963378fa285d93d367e15bcd66c721311826d3c44a6c \
-    --hash=sha256:97e704dcd26271f5bda3fa07c3ce0fb76d6d3f8659f4baa1a24442cc9ba177ca \
-    --hash=sha256:99abd37084b82f5830c635fddd0b4993b9742a66eb746dacf433c8590e8f9e3c \
-    --hash=sha256:9af6779bfb46abf124068327abcdf9ce95c9ef8287a3e8da76ccf2d0f16c28fa \
-    --hash=sha256:9e8f2d660c350b3d0e259c7a7e3d9b7fc8b41210cbcc3d4a7076ff0a5e5c2fdc \
-    --hash=sha256:a24f677ebe83749039e7bdf862ff0bbb16818ae4193d4ef96505e269375bcce0 \
-    --hash=sha256:a9875b46d910cff3ea2f5962f9d266b465459fe634e22556ab9bd6fc1192eea0 \
-    --hash=sha256:aa00140699487bd435fde4342d85c94cb256b7cd3a5b9c3396c67f19922afda2 \
-    --hash=sha256:ae6be797afdef264e8a84864a85b196ca06045586481b3df8a967322fd2fa844 \
-    --hash=sha256:af8b4b81a960eeaf1234971ac3cd0ba5901f3cd42eae42a46b4d089a8b492719 \
-    --hash=sha256:b165790117eea512d7f3fb22f1f6dad3d55a7189571993eb015591c1401276d1 \
-    --hash=sha256:b238af795833d5731d049d82bc84b768ae6f8f97f0495963b3ed9935c5901cc3 \
-    --hash=sha256:b3a03285a7f9c7b016324574a6d92a1c895da6b978cb8f1deee3ac72bc6da178 \
-    --hash=sha256:b6feea921016eb3d4e04d65fc4e9ca402d1a3801f562aef94989f54694917af3 \
-    --hash=sha256:b6ff7fcee63287ae57b5df3e4f5957ce032122802509246dec1a5bcc55904c95 \
-    --hash=sha256:b821a1f7dedf7e37450654e620038ac3b2e81e8fa6ea269337e97101978ec730 \
-    --hash=sha256:bb2c0c80d431c0d03f2c7dbf125150fedd4f0de17366a7ca33f7ccb822391842 \
-    --hash=sha256:bb33777ea21e8b7ecde0e6fc84f598be0a1192eab1a63bc746d75aa75d38e7bd \
-    --hash=sha256:bcfb80a2cc36fba2534e5e5b5264dc7ae6fcd9bf15256da3e53d2f499e6fa29d \
-    --hash=sha256:bd869c427324e5cb15195793de951295710db28be7d818247f3097b4ab5d4b96 \
-    --hash=sha256:bedb0cd073cc2dc035e30aeb99444389d3cd2113afe4ef9fcd23d439f5bade85 \
-    --hash=sha256:c389c482a7e9b9dc3ee2701ac46c4125297a3818875b9c305ddb603c04828fd1 \
-    --hash=sha256:c6fa4dc7ad6f8109c70bb1499e589f76b0b792baf39f9b017eb92c8a81d0a199 \
-    --hash=sha256:c83afe0ba876be7e943d2e0ba645809ad441575d2840c895c21ee5de93b9377a \
-    --hash=sha256:cb21957bb8aca671c1765e32f58164cf0c50e6bf41c0bbbd16da20732ecaf588 \
-    --hash=sha256:cf4491381b1b57425c315a56a439251b1bdac07b2275f19a8c44bc57744532ec \
-    --hash=sha256:d03f281ed22579314ba00821ce20115a7c0ac430660b4cc05704a3f818b3e004 \
-    --hash=sha256:d35143e27778b4bb0fb189562d7f275bff79c62ab8e98459717c0ea617ff2480 \
-    --hash=sha256:d3b1a184a9a8f548a6b73f1e26b96b052193e4b3175ed7342aaf1151a1f00a04 \
-    --hash=sha256:d44ec478e713ee7f29b439f7eb8dc2b9d4079e11ae114d2c2ac3d5daf30516c8 \
-    --hash=sha256:d9d4e294455b23a68c9b8f042d0e8e377a265bcb15332753695f6e5b6819e0ce \
-    --hash=sha256:de538791a80e5d862addbc183f70f0158ac9b9bb872bb147f1fd2a683691e087 \
-    --hash=sha256:e4e5e0ae56914ecdbf446493addefc0159053dd53962cef37d7839f37f73d505 \
-    --hash=sha256:e509a55f681e6158c20f70f102f9cf61fb20fbc382272bc6d94b7343f2582780 \
-    --hash=sha256:ec8dc383ee57ea3e883477dcca3f11b65d58199f1080acaf4cd6ad9a99698be4 \
-    --hash=sha256:ed09c7eb1c391271c2ed0314a51903e72a3acb653d5ccfc264cdf3ef11f8269d \
-    --hash=sha256:eeea07c4397bbc57719c4eed8f9c284874d4f175f9b6d57f7a1546b976d455ca \
-    --hash=sha256:eefd9cc9b6d4a2db5f00a26bc3e4f9acf71926a6ec557cd56c9c6f27c290b665 \
-    --hash=sha256:f234b4deb12f3ad59127e037bc57c40c21e45b45282df7d3a55a0f409f595296 \
-    --hash=sha256:f380468b09d2a81633ee863b0ec5648d364bd17bb8ecfb8c2f387f7ac1faf42c \
-    --hash=sha256:f5e6ff2bdbb8f4cd3fbe41f99e25bbcd58e3bf9f13d3dd31a11e7917251cc77a \
-    --hash=sha256:f7a16ef45b081454ef844502d87a848876c490c4cb5c650c230f6ec79ed2c1e7 \
-    --hash=sha256:faccab372e66bc76d5731525e7f1143c922271725b9d38c9f97edcc66266b451 \
-    --hash=sha256:fc0cacab7ba4e56f0f81c82a98c09bed2f39c940107b03a34b168bdf7597edd3
+aiohttp==3.14.3 \
+    --hash=sha256:03cd2bde3d7f085b64e549c985f4bb928cad7e8ecf5323bfca320db548d81b39 \
+    --hash=sha256:041badb8f84396357c4d3ad26de6afd7a32b112f43d3c63045c0c8278cfd2043 \
+    --hash=sha256:0a5ff2dfbb9ce645fa5b8ef3e02c6c0b9cc3f6030ff863d0c51fffc50cb5541b \
+    --hash=sha256:0fdea2281997af69da84c77ffa6f5938a0285f21fb3887c249d67419ca865b3d \
+    --hash=sha256:11fb37ef075669eee52ab1928fbf6e1741fada40409fa309ebde9607a962aebf \
+    --hash=sha256:134ac5ddcf61c6fad984b9a5727d83492ada43d63471db20fb73042c13fca62f \
+    --hash=sha256:152516815ef926786a0b6ae2b8f1fd2e0c71582dee0b435636865316fd4891b7 \
+    --hash=sha256:1576145bdceeb92382d899751e12743a3a5b8e460a841e3e50543859e54864dc \
+    --hash=sha256:16100ad3ab8d649fdfbee87602d9d2dcdca9df0b9eda8a1b5fdc0d41f96da559 \
+    --hash=sha256:16ea7e24c309fb7c0bbd505d149abe4fe4dccfb8db911db7dbec0921bc889a6f \
+    --hash=sha256:18c441d0a8fca6de8d1f546849b9f0ab20d435993e2c5b59562b2fae6be2f929 \
+    --hash=sha256:18cb43369747b2ae007bd2655fb8e63a099c2ff1d207962943636dac989b3147 \
+    --hash=sha256:1b59533861b70a2185c8f4f350f791f39d64358ef6944ce71c5240c9ec0982c9 \
+    --hash=sha256:1c5281acc88b92396f88c7e1e2748f8466689df22b80170e4f51efa712fb47a8 \
+    --hash=sha256:1c5ec8fb1bcc31a8466f74aaf26c345d5c386fa4bd08a3f0eb9c7a4a3fe8b5bf \
+    --hash=sha256:1caa7b0d05f3e3a36f87788c59e970a7ee1cefcfcbb924a9f138c4a6551c9cb7 \
+    --hash=sha256:21c016079415ed3fd676963e9793700a566d85dbbd6bfc564b9b2d209147dcc8 \
+    --hash=sha256:2498f0fe69ead802f9675beca44a7c21c62fdaa4ec5145ea1c3ad6edbee29f85 \
+    --hash=sha256:25bd2708db6bdf6a6630dd37bdcdfcb47c4434d22ac69c64665b802910140b30 \
+    --hash=sha256:270d3dace9ca2f10f0da5d8ebe519b7a310fc6112ed916e32df5866df0888553 \
+    --hash=sha256:2e1161602f45a54de2ce0905243a95f58cb42dcd378402f3697f5e0b21e9d2e7 \
+    --hash=sha256:2e9878ae68e4a5f1c0abe4dd497dbc3d51946f5837b56759e2a02e78fa90ef86 \
+    --hash=sha256:30402d03a7c0ff52bce290b57e564e9079fd9d0cb545c8aba73f86a103162d2e \
+    --hash=sha256:33a2d7c28d33797a2e99923dffa63f83d908a19b6bf26cfe80fa790aa5e1a75a \
+    --hash=sha256:362a3fd481769cac1a824514bcd86fda51c65e8fe6e051099e008fddde6db17c \
+    --hash=sha256:38901a84da3ce22249f6e860bf8f90d141bcab7da090cc398f8bb58c0e44b7da \
+    --hash=sha256:39aded8c7f3b935b54aab1d8d73c70ec0ee2d3ec3b943e0e86611bc150ba47f5 \
+    --hash=sha256:3a26434dafe408229ff3403458ca58de24fb51936504decac49ce6755f77e59d \
+    --hash=sha256:3ae5b3a59436d089b5395d910121a390feed4d00578eb95a0fd1a329fe963100 \
+    --hash=sha256:3d4f72af88ac2474bb5bca640030320e3d38a0163a1d7533500e87be458eef71 \
+    --hash=sha256:3f42e9b78301f11c8f861746175d8b9c1ccef713fcad9eab396e2f6db8ed4a22 \
+    --hash=sha256:42a67efc36300d052fb4508a53e8b6901b9284b599ae63945c377569c5fcc1e1 \
+    --hash=sha256:48d67b87db6279c044760787eb01f6413032c2e6f3ba1cafaa492b1c8e578479 \
+    --hash=sha256:498c6c623134f8e09a3c4e60bcd607a0b4590dd7dbf08dd40851b27cbb520ccb \
+    --hash=sha256:49f7325beb0f85ef4aef5f48f490269575f83e6e2acad00a1d80b807eb027062 \
+    --hash=sha256:4e3ac92d90e92773b2362d506068e9a948192bd553e743c5b2429e28527c8661 \
+    --hash=sha256:530125ee1163c4219af35dc3aa1206e541e7b31b6efc1a3f93b70a136f65d427 \
+    --hash=sha256:5373dc80ad1aa2fb9ad95c83f24eef418bbda3a61375f128e5b0192e4f3f9b32 \
+    --hash=sha256:53e5179d8abb5710f8e83ba207c41c8d1261fcffd4616500e15ca2b7a33be10a \
+    --hash=sha256:53e7b4ce82b54a8bcc71b3b67a5cbd177ca1d7f592cbc92cd38b7349f73482db \
+    --hash=sha256:543906c127fb1d929b95076db19b83fa2d46751006ff1e23b093aa5ac4d8db42 \
+    --hash=sha256:54cfcdee2770dac994417cbb0ee1f3eb0e7cb6b30c79bf44f2c02ff79ec5124a \
+    --hash=sha256:55bdcc472aafe2de4a253045cc128007a64f1e0264fb675791e132ea5edaa3bd \
+    --hash=sha256:56f355e79f71aef2a85c80305cc915f894b170dba76de5fe84f6351939b83c06 \
+    --hash=sha256:5895ef58c4620afe02fa16044f023dc4dafec08158f9d08874a46a7dbc0341b8 \
+    --hash=sha256:5bcb6ff3fdab1258a192679ff1a05d44f59626430aa05cd1a9d2447423599228 \
+    --hash=sha256:5f08ec777f35ee70720233b8b9811d3bb5d728137f30ac91b7457709c3261ac0 \
+    --hash=sha256:614c61d478b83953e261d02bb2df750f17227cd33ef8002945bf5aebbde21919 \
+    --hash=sha256:617105e2c3018ee38d0c8ce5ee3c84f621a6d8b9f723202aacaff28449ca91ee \
+    --hash=sha256:6debfa7312ff9d4c124dc71d72e9a0a4b9e0879e48ba6fcb42bef5c3300289e2 \
+    --hash=sha256:7041d52c3a7fa20c9e8c182b534704abb19502c8bdcbde7ab23bfda6f642394f \
+    --hash=sha256:70c987b27534f9ae1a723f47ae921571d616da21d3208282bf4c52af5164ac43 \
+    --hash=sha256:74ab5b6a9fb13e873e5a90946588baecaf488745e1db1a4a5c433f971f035098 \
+    --hash=sha256:78253b573e6ffab5028924fc98bc281aae05445969982a10864bc360dea2016c \
+    --hash=sha256:7a75aa63cbf9b21cfaf60dc2657e19df2c2867d91707d653fee171ffeedd1371 \
+    --hash=sha256:8800c996b01c2772a783e3e46f3e1abd5823029adca0df54231960de9bfefa5b \
+    --hash=sha256:89176250f686cb9853c0fb7ead90e639e915b84a6f43eedc2a4e7ec21f1037f0 \
+    --hash=sha256:8a5fd34f7f7410d1730d5c2ba873cacb2eed3fede366feb268a70ba22581ed8f \
+    --hash=sha256:8b3b60de05f3dcb6f6a00f818bb2ec781cee4de0645f59ccaf99b1d1823b6100 \
+    --hash=sha256:8f2f1c4c032c7cedd7d8da6f54c97b70266c6570c3108d3fdffee7188bb70529 \
+    --hash=sha256:9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc \
+    --hash=sha256:9aa6e61fdf20105c4144e755bd586008ff450791d67b1c8146fdc15959c4d51c \
+    --hash=sha256:9d9edccfe496b476db5f398d97b865e9a6752bcf8aec4eef8390ce20fb64bb41 \
+    --hash=sha256:9fc7b5bfec6573f3ae844f457fdde5adeb713f8b8e4a81ad64fc207b49383716 \
+    --hash=sha256:a0dc483c00da8b673abbb367eb6f8d8f4bcec30eb58529ea13cb42e7fd2dfa33 \
+    --hash=sha256:a3a8296e7ab5c295f53f1041487cb088e1480775aafbf7fe545d93b770a0f96f \
+    --hash=sha256:a3e22975f905b89a55a488c2a08f2fdb2186175349e917d48985cc468a3d4c6e \
+    --hash=sha256:a4af35c443e0b1a1bd6a8af3f3485d7fda15c142751a00f3ff8090f0b93346fa \
+    --hash=sha256:a94dbaae5ae27bd849c93570669bff91e0510f33a80805738e3de72a7be0447b \
+    --hash=sha256:ac74facc01463f138b0da5580329cfcc82818dea5656e83ddcd11268fc12ff80 \
+    --hash=sha256:ad4c8b7488d745d2ca4838ebd8ae5ba9b56341d30b1da43640e4ce87f9f49646 \
+    --hash=sha256:b014a6ed7cf912e787149fdc529166d3ceabac23f26efeea3158c9aba2354e7e \
+    --hash=sha256:b20032766aedf6261c7a566585a40867d092ac03a0d81592d5370ef9b054f99b \
+    --hash=sha256:b2466434105a4e03113c36ec775cc2ebe6676b62eae326fa670bb607ef788c1c \
+    --hash=sha256:b304db572b4368edd8dda8a2274f73156fe15558fca4a917cb8a09fc47af5963 \
+    --hash=sha256:ba59d59aba08ac02fc03b0c8983ccd5ee39a199d0552ce9e6d2b4845b34d59ae \
+    --hash=sha256:bd52f811e65f6fb634b1047159657c98f52b407f8efec907bcfc09da9a4c0a25 \
+    --hash=sha256:bdd0e2834dce1a26c1bbe26464861e16bbe217042cbff619247c11594472518c \
+    --hash=sha256:c23ec8ee9d5ab2f5421f9c7fffce208435607af27fd46d4a44e031954352838f \
+    --hash=sha256:c39846c3aad97a8530c89d7a3869a8f8e9e3762c6ac0504481e5c80948f7e807 \
+    --hash=sha256:c3c200cf9757edd785051dc699c7ecbec22110dbfcb3fefc7a9f9695eda8ea7a \
+    --hash=sha256:c7d3a97c678d34fc5b59da671ee9cd630096ddc643e7b5a30d54a2a6f3574d3f \
+    --hash=sha256:c8653fd547c93a61aadc612007790f5555cdd18946fa48cf45e26d8ea4ea473d \
+    --hash=sha256:cc7cb243a68167172f48c1fd43cee91ec4b1d40cefd190edd43369d1a6bc9c82 \
+    --hash=sha256:ccd4893707b3e2a13e39c90d43cf80edf2e4d0457935bcc103bf2346214c3f15 \
+    --hash=sha256:cd817772b2fcf2b8c0905795318485f9ec16eae60b29feb7f4c77085311637f0 \
+    --hash=sha256:cda5fd5c95ad7a125a2e8464acc78b98b94c475a3780d6aa0aa157c93f470f4d \
+    --hash=sha256:cef89a58e628c4efcac3275c2d68083f82426dcdc89c1492a6f654f9f7ea6ab9 \
+    --hash=sha256:d1558173930a5a8d3069cee5c92fc91c87c4dbcb099debbb3622053717145a19 \
+    --hash=sha256:d6088ec9894113802bddb3c09e974929aed2c7b3a8c456219b8aab4481f1a239 \
+    --hash=sha256:d6218d92e450824e9b4881f44e8c09f1853b490f9a64130801024a4793b1b3b0 \
+    --hash=sha256:d77640cc618c1d99fc4f8589c0f24a730adfa54eb1e57ef7bf0c8dfb78da898c \
+    --hash=sha256:d7d2deec16eeedf55f2c7cf75b521ea3856a5177e123844f8fd0f114ce252cb5 \
+    --hash=sha256:db332af25642007330fca8be5c4d194caf2bea7a7fc84415aff3497af5dfee6b \
+    --hash=sha256:dd54d0e8717de95939766febac482ac0474d8ac3b048115f9f2b1d23a16e7db4 \
+    --hash=sha256:ddcac3c6b382e81f1dd0499199d4136b877beb4cb5ef770bbbfba56c4b8f55d2 \
+    --hash=sha256:df82f3787c940c94986b34222d59c9e38843fba85139f36e85255a82ad5355a9 \
+    --hash=sha256:dfa68deb2a443bdaa3ea5297b0699c1464f08aef3812b486d1348eee61b07dc0 \
+    --hash=sha256:dff9461ec275f22135650d5ba4b4931a11f3958df7dfbb8db630000d4dee0883 \
+    --hash=sha256:e1e74298bab6ee0d6e749ed4fd1901c7e604bdda32c03d787a2cc71c46d0433d \
+    --hash=sha256:e2667f0bbe7eb6c74eae5e9691441ad186e5845ca3cff63230fc09c4e7514f5d \
+    --hash=sha256:e3be98a7c30b8c25d573dafba7171d66dfb05ee6a9070fc46535464ff97700a6 \
+    --hash=sha256:e568e14940c09955aa51f4e645b6daa18a581c5dcfcd73744dcc86a856e3ced3 \
+    --hash=sha256:e72ee89e28d907a18f46959b4eb0bb06701cc7f8cf4366e00029e2ccfaaf5924 \
+    --hash=sha256:e92eb8acc45eb6a9f4935071a77edf5b85cc6f8dfad5cd99e97653c26593cdde \
+    --hash=sha256:ea05e1f97ceea523942d9b2a7d7c0359d781d683d6b043f5943a602b14da4787 \
+    --hash=sha256:eac645b09bcfdf73df7536331f0678c1086ea250981118ddb5199e17ccef72bb \
+    --hash=sha256:eb0495d778817619273c108784292be161a924b9f5ae5cbbc70a2caa6838250b \
+    --hash=sha256:ebe8e504f058fe91223351cecd2d9d6946c9d241bb0250d898ffbdf584cc72b0 \
+    --hash=sha256:ed099d105449c4f9e84f24af203cd131349d4761d8813fa7e02c32e7128cd910 \
+    --hash=sha256:f0f177d1b195b9e06376cfd7d308d8a1b920909a609d03ac82a8c73bbb16d3b9 \
+    --hash=sha256:f3d2669fe7dec7fc359ecdb5984b29b50d85d5d00f8c1cb61de4f4a24ee42627 \
+    --hash=sha256:f4e05329faa0ea1a404b37de4f034fd2c2defcca06a68dc6745e4e56c88e8a48 \
+    --hash=sha256:f53bcd52f585e1ac3e590d61434eb61f9a88c38df041b4ea126d97144344a77b \
+    --hash=sha256:f55119f7bf25f49ed210f6096090715da24f2943c62102448915fde3c62877ce \
+    --hash=sha256:f631fe87a6f30df5fbe6d79640b25e4cffb38c31c7fb6f10871517b84b0f8c1a \
+    --hash=sha256:f8fb78a83c9e5f741ca3a68cfb455c1f5bb83b4e7249a3848b3cd78d0a8563b0 \
+    --hash=sha256:fa9467a8113aa69d3d7c55a70ef0b7c636010a40993f3df9d9d0d73b3eb7ef24 \
+    --hash=sha256:fd51ebf9d3a00c074df4ede271023f4d2dba289bcc740b88191872716014e3c5
     # via
+    #   -r requirements-strix-ci.txt
     #   gql
     #   litellm
 aiosignal==1.4.0 \
@@ -401,53 +402,53 @@ click==8.4.1 \
     #   litellm
     #   typer
     #   uvicorn
-cryptography==49.0.0 \
-    --hash=sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001 \
-    --hash=sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122 \
-    --hash=sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6 \
-    --hash=sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c \
-    --hash=sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325 \
-    --hash=sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69 \
-    --hash=sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d \
-    --hash=sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36 \
-    --hash=sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc \
-    --hash=sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6 \
-    --hash=sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b \
-    --hash=sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27 \
-    --hash=sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61 \
-    --hash=sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18 \
-    --hash=sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db \
-    --hash=sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b \
-    --hash=sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb \
-    --hash=sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2 \
-    --hash=sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459 \
-    --hash=sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e \
-    --hash=sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21 \
-    --hash=sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8 \
-    --hash=sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7 \
-    --hash=sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa \
-    --hash=sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9 \
-    --hash=sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db \
-    --hash=sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64 \
-    --hash=sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505 \
-    --hash=sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5 \
-    --hash=sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615 \
-    --hash=sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f \
-    --hash=sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866 \
-    --hash=sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6 \
-    --hash=sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561 \
-    --hash=sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838 \
-    --hash=sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9 \
-    --hash=sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7 \
-    --hash=sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68 \
-    --hash=sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8 \
-    --hash=sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3 \
-    --hash=sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e \
-    --hash=sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a \
-    --hash=sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d \
-    --hash=sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4 \
-    --hash=sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493 \
-    --hash=sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b
+cryptography==50.0.0 \
+    --hash=sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03 \
+    --hash=sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7 \
+    --hash=sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437 \
+    --hash=sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987 \
+    --hash=sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025 \
+    --hash=sha256:11b74db56cdbe3cdee6e3f6982ecb70334fa10dce99ed58bf7894aaaa3b2a037 \
+    --hash=sha256:12b9c6996425c76ea6c457ace4f3073e715b8c545add07cd1a8f3a4f90691269 \
+    --hash=sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105 \
+    --hash=sha256:19736989797678c6af1e55cd49055cdbcb55d8f6b5583ac5335f933aba9101dc \
+    --hash=sha256:1b4a266766514614f8aa60416e71f2fc6e575d36e7bdc90f644fadb2f4b75b95 \
+    --hash=sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b \
+    --hash=sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47 \
+    --hash=sha256:3f5735ffe4996d28b809371756219f5354864902a3b9e7c0b9ee87041209fc9c \
+    --hash=sha256:49e7d93abdbd2990caced757e5fade25302f719c3c8fb6e6fff2dde98999fc41 \
+    --hash=sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c \
+    --hash=sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d \
+    --hash=sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7 \
+    --hash=sha256:6ba6a53445bd3cfa809ef3ef5f1589aa6ba08784a1d962bf47d0940e871dab1c \
+    --hash=sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708 \
+    --hash=sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef \
+    --hash=sha256:80b63928fa35083b33966ce1efb70e5b9607181e49dcd1c22c8c005e319f667f \
+    --hash=sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f \
+    --hash=sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a \
+    --hash=sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f \
+    --hash=sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a \
+    --hash=sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a \
+    --hash=sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e \
+    --hash=sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3 \
+    --hash=sha256:9aa87839c383bdbab6ef865787a1fb877af8dd03464c4400322726feaaadfc6d \
+    --hash=sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3 \
+    --hash=sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f \
+    --hash=sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae \
+    --hash=sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30 \
+    --hash=sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9 \
+    --hash=sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9 \
+    --hash=sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07 \
+    --hash=sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba \
+    --hash=sha256:d58c3db7cd6eed54e6c06744db55456b65ebd7492ddeae9c1e93cfca7aa857d3 \
+    --hash=sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f \
+    --hash=sha256:df2a58a472f332225671c35b0a830208b86d004f82baa8530fa3782c85646533 \
+    --hash=sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5 \
+    --hash=sha256:ecfed7367f965a0328cfbdd70da860f15441f002f613185668c6e6ebf5a0ac11 \
+    --hash=sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9 \
+    --hash=sha256:f59e38625469987d7ef6d495323c55e7db6c212eaf6112267e0d3b565a2e9c9f \
+    --hash=sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169 \
+    --hash=sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645
     # via
     #   -r requirements-strix-ci.txt
     #   google-auth
@@ -1680,9 +1681,9 @@ pyjwt==2.13.0 \
     --hash=sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423 \
     --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728
     # via mcp
-pyopenssl==26.3.0 \
-    --hash=sha256:46367f8f66b92271e6d218da9c87607e1ef5a0bc5c8dea5bb3db82f395c385a3 \
-    --hash=sha256:589de7fae1c9ea670d18422ed00fc04da787bbde8e1454aea872aa57b49ad341
+pyopenssl==26.4.0 \
+    --hash=sha256:28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7 \
+    --hash=sha256:f0eb0cb2d581d3ad2b9c489468485e7f2ab6727d08401bcf9d824c3caddf3c1c
     # via google-auth
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
diff --git a/requirements-strix-ci.txt b/requirements-strix-ci.txt
index e32bd39a9..441e79a26 100644
--- a/requirements-strix-ci.txt
+++ b/requirements-strix-ci.txt
@@ -1,6 +1,11 @@
 strix-agent==1.0.4
 google-cloud-aiplatform==1.133.0
 protobuf<7.0.0
-cryptography==49.0.0
+cryptography==50.0.0
 python-multipart==0.0.32
 pyasn1==0.6.4
+# Transitive via strix-agent. 3.14.3 clears GHSA-cq5v-8q36-5273 (HIGH, OOB heap
+# read in the C HTTP response parser), GHSA-mq44-7p77-q5h7 (unnegotiated
+# permessage-deflate frames accepted) and GHSA-mfx4-hv73-q22v (request smuggling
+# via WebSocket upgrade). Floor, not a pin, so Dependabot can keep moving it.
+aiohttp>=3.14.3
diff --git a/scripts/ci/install_base_python_locks.py b/scripts/ci/install_base_python_locks.py
index 518fcd689..253544976 100644
--- a/scripts/ci/install_base_python_locks.py
+++ b/scripts/ci/install_base_python_locks.py
@@ -1,12 +1,12 @@
 """Install independently complete base-commit Python hash locks.
 
 The coverage image build may discover several hash-bearing requirements files
-from a trusted base commit.  A file can hash every requirement it names while
+from a trusted base commit. A file can hash every requirement it names while
 still being only a supplement to another lock, so syntax alone cannot prove
-that pip can install it as an independent dependency closure.  Preflight every
+that pip can install it as an independent dependency closure. Preflight every
 candidate with pip's hash enforcement, recover supplements only with sibling
 locks from the same source directory, and skip candidates that still cannot
-prove a complete closure.  Later coverage execution remains responsible for
+prove a complete closure. Later coverage execution remains responsible for
 proving that the resulting offline environment is sufficient for the target
 repository.
 """
@@ -39,6 +39,70 @@
     ),
     re.compile(r"requires a different Python", re.IGNORECASE),
 )
+# A recognized deferable diagnostic must never hide independent integrity or
+# transport evidence emitted by the same failed pip process. These markers are
+# deliberately narrow and correspond to pip's stable failure wording already
+# enforced by the trusted-build regression suite.
+FATAL_PREFLIGHT_FAILURES = (
+    re.compile(
+        r"THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE",
+        re.IGNORECASE,
+    ),
+    re.compile(r"WARNING:\s*Retrying\b", re.IGNORECASE),
+    re.compile(r"Could not fetch URL", re.IGNORECASE),
+)
+# Defer only exact pip error lines that explain an incomplete hash closure or
+# interpreter mismatch. Binary-unavailability lines are handled separately and
+# must form a same-requirement pair; a second unknown ``ERROR:`` line therefore
+# remains fatal.
+DEFERABLE_ERROR_LINES = (
+    re.compile(
+        r"^ERROR:\s*In --require-hashes mode, all requirements must have "
+        r"their versions pinned with ==",
+        re.IGNORECASE,
+    ),
+    re.compile(
+        r"^ERROR:\s*Hashes are required in --require-hashes mode, but they "
+        r"are missing from some requirements",
+        re.IGNORECASE,
+    ),
+    re.compile(r"^ERROR:.*requires a different Python", re.IGNORECASE),
+    # Pip can emit either context line before a paired binary-unavailability
+    # diagnostic. Neither context line is independently deferable.
+    re.compile(
+        r"^ERROR:\s*Ignored the following yanked versions:",
+        re.IGNORECASE,
+    ),
+    re.compile(
+        r"^ERROR:\s*Ignored the following versions that require a different "
+        r"python version:",
+        re.IGNORECASE,
+    ),
+)
+UNSATISFIED_REQUIREMENT_RE = re.compile(
+    r"^ERROR:\s*Could not find a version that satisfies the requirement "
+    r"(?P<requirement>[^\s(]+)[^\n]*"
+    r"\(from versions:\s*(?P<versions>[^)\n]*)\)",
+    re.IGNORECASE | re.MULTILINE,
+)
+NO_MATCHING_DISTRIBUTION_RE = re.compile(
+    r"^ERROR:\s*No matching distribution found for "
+    r"(?P<requirement>\S+)",
+    re.IGNORECASE | re.MULTILINE,
+)
+# Conservative PEP 440 subset for pip's normalized ``from versions`` tokens.
+# False negatives fail closed and keep the protected base lock blocking; false
+# positives would incorrectly skip a lock, so arbitrary alphanumeric prose is
+# intentionally rejected even when it contains digits.
+CONCRETE_VERSION_RE = re.compile(
+    r"^(?:v)?(?:[0-9]+!)?"
+    r"[0-9]+(?:\.[0-9]+)*"
+    r"(?:(?:a|b|rc)[0-9]+)?"
+    r"(?:(?:\.post|-)[0-9]+)?"
+    r"(?:\.dev[0-9]+)?"
+    r"(?:\+[a-z0-9]+(?:[._-][a-z0-9]+)*)?$",
+    re.IGNORECASE,
+)
 Runner = Callable[..., subprocess.CompletedProcess[str]]
 
 
@@ -146,19 +210,106 @@ def _bounded_failure_output(output: str, *, maximum_lines: int = 120) -> str:
     )
 
 
+def _normalized_requirement_token(requirement: str) -> str:
+    """Normalize harmless diagnostic punctuation for exact token comparison."""
+    return requirement.rstrip(".,").casefold()
+
+
+def _is_concrete_version_list(version_list: str) -> bool:
+    """Return whether every comma-separated token is a concrete PEP 440 version.
+
+    Pip's diagnostic is used as evidence that an index was reached and offered
+    at least one alternative distribution. Empty values, ``none``, arbitrary
+    prose such as ``unavailable``, and mixed version/prose lists are not proof of
+    reachability and therefore fail closed.
+    """
+    tokens = [token.strip() for token in version_list.split(",")]
+    return bool(tokens) and all(
+        bool(token) and CONCRETE_VERSION_RE.fullmatch(token) is not None
+        for token in tokens
+    )
+
+
+def _matching_binary_unavailability_requirements(output: str) -> set[str]:
+    """Return exact pins paired across pip's binary-unavailability diagnostics."""
+    unsatisfied = {
+        _normalized_requirement_token(match.group("requirement"))
+        for match in UNSATISFIED_REQUIREMENT_RE.finditer(output)
+        if _is_concrete_version_list(match.group("versions"))
+    }
+    unmatched = {
+        _normalized_requirement_token(match.group("requirement"))
+        for match in NO_MATCHING_DISTRIBUTION_RE.finditer(output)
+    }
+    return unsatisfied if unsatisfied and unsatisfied == unmatched else set()
+
+
+def _contains_unclassified_error(output: str) -> bool:
+    """Return whether pip emitted an error outside the deferable contract."""
+    matching_requirements = _matching_binary_unavailability_requirements(output)
+    for line in output.splitlines():
+        normalized_line = line.strip()
+        if not normalized_line.casefold().startswith("error:"):
+            continue
+
+        unsatisfied_match = UNSATISFIED_REQUIREMENT_RE.search(normalized_line)
+        if unsatisfied_match is not None:
+            requirement = _normalized_requirement_token(
+                unsatisfied_match.group("requirement")
+            )
+            if requirement in matching_requirements and _is_concrete_version_list(
+                unsatisfied_match.group("versions")
+            ):
+                continue
+            return True
+
+        unmatched_distribution = NO_MATCHING_DISTRIBUTION_RE.search(normalized_line)
+        if unmatched_distribution is not None:
+            requirement = _normalized_requirement_token(
+                unmatched_distribution.group("requirement")
+            )
+            if requirement in matching_requirements:
+                continue
+            return True
+
+        if any(pattern.search(normalized_line) for pattern in DEFERABLE_ERROR_LINES):
+            continue
+        return True
+    return False
+
+
 def _is_deferable_preflight_failure(output: str) -> bool:
     """Return whether a failed candidate may be grouped or safely skipped.
 
     A hash-bearing supplement can fail pip's independent-closure check because a
-    transitive pin/hash lives in a sibling lock, and a base lock can explicitly
-    reject the pinned coverage-image interpreter. Those states are safe to
-    recover through a same-directory group or defer to the later networkless
-    coverage run. Hash mismatches, resolver crashes, empty diagnostics, and
-    registry/network failures remain fatal so a broken trusted build cannot be
-    mistaken for an optional lock.
+    transitive pin/hash lives in a sibling lock, a base lock can explicitly
+    reject the pinned coverage-image interpreter, and a base lock can pin a
+    version for which the reachable index exposes no matching binary for that
+    interpreter. Binary unavailability is deferable only when pip emits both
+    resolver lines for the same exact requirement and every listed alternative
+    is a concrete PEP 440 version. Those states are safe to recover through a
+    same-directory group or defer to the later networkless coverage run. Hash
+    mismatches, resolver crashes, empty diagnostics, and registry/network
+    failures — including fatal evidence mixed with an otherwise deferable
+    diagnostic — remain fatal so a broken trusted build cannot be mistaken for
+    an optional lock. Deferred paths retain a warning and bounded pip diagnostics
+    so the incompatibility stays visible without blocking unrelated coverage
+    evidence.
     """
-    return bool(output.strip()) and any(
-        pattern.search(output) for pattern in DEFERABLE_PREFLIGHT_FAILURES
+    normalized_output = output.strip()
+    return (
+        bool(normalized_output)
+        and not any(
+            pattern.search(normalized_output) for pattern in FATAL_PREFLIGHT_FAILURES
+        )
+        and not _contains_unclassified_error(normalized_output)
+        and (
+            any(
+                pattern.search(normalized_output)
+                for pattern in DEFERABLE_PREFLIGHT_FAILURES
+            )
+            or bool(_matching_binary_unavailability_requirements(normalized_output))
+        )
     )
 
 
@@ -171,8 +322,9 @@ def _report_fatal_preflight_failure(
     """Publish one bounded, source-aware fatal preflight failure."""
     print(
         "::error::Trusted base Python lock preflight failed for "
-        f"{entry_label}; only incomplete hash closures or explicit Python "
-        "interpreter incompatibility may be deferred.",
+        f"{entry_label}; only incomplete hash closures, explicit Python "
+        "interpreter incompatibility, or paired same-requirement binary "
+        "unavailability with concrete version evidence may be deferred.",
         file=stderr,
     )
     failure_output = _bounded_failure_output(output)
@@ -280,9 +432,9 @@ def install_materialized_locks(
         skipped += 1
         print(
             "::warning::Skipping trusted base Python requirement candidate "
-            f"{entry.source}: hash-bearing content is not an independently "
-            "installable dependency closure and no same-directory lock group "
-            "completed it.",
+            f"{entry.source}: it is not an independently complete dependency "
+            "closure for the coverage interpreter and no same-directory lock "
+            "group completed it.",
             file=stderr,
         )
         failure_output = _bounded_failure_output(
diff --git a/tests/test_install_base_python_lock_missing_pin.py b/tests/test_install_base_python_lock_missing_pin.py
new file mode 100644
index 000000000..5de4056ea
--- /dev/null
+++ b/tests/test_install_base_python_lock_missing_pin.py
@@ -0,0 +1,239 @@
+"""Regression tests for unavailable pins in trusted base Python locks."""
+
+from __future__ import annotations
+
+import io
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from scripts.ci import install_base_python_locks as installer
+
+
+def _write_candidate(root: Path) -> None:
+    """Write one trusted materialized lock candidate and its manifest."""
+
+    (root / "manifest.json").write_text(
+        json.dumps(
+            [
+                {
+                    "file": "requirements-000.txt",
+                    "source": "requirements-hashes.txt",
+                }
+            ]
+        ),
+        encoding="utf-8",
+    )
+    (root / "requirements-000.txt").write_text(
+        "pypdf==6.13.3 --hash=sha256:" + ("a" * 64) + "\n",
+        encoding="utf-8",
+    )
+
+
+def _run_preflight_failure(root: Path, output: str) -> tuple[int, str, str]:
+    """Run the installer with one deterministic pip preflight failure."""
+
+    _write_candidate(root)
+
+    def fake_runner(command: list[str], **kwargs):
+        return subprocess.CompletedProcess(command, 1, stdout=output)
+
+    stdout = io.StringIO()
+    stderr = io.StringIO()
+    result = installer.install_materialized_locks(
+        root,
+        runner=fake_runner,
+        stdout=stdout,
+        stderr=stderr,
+    )
+    return result, stdout.getvalue(), stderr.getvalue()
+
+
+def test_reachable_index_missing_pin_is_visible_and_nonfatal(tmp_path: Path) -> None:
+    """A reachable index proving newer versions exist may defer a stale pin."""
+
+    output = (
+        "ERROR: Could not find a version that satisfies the requirement "
+        "pypdf==6.13.3 (from versions: 6.14.1, 6.14.2)\n"
+        "ERROR: No matching distribution found for pypdf==6.13.3"
+    )
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 0
+    assert "candidates=1 installed=0 skipped=1" in stdout
+    assert "Could not find a version that satisfies the requirement" in stderr
+
+
+def test_pep440_version_evidence_is_deferable(tmp_path: Path) -> None:
+    """Epoch, prerelease, postrelease, development, and local versions remain valid."""
+
+    output = (
+        "ERROR: Could not find a version that satisfies the requirement "
+        "pypdf==6.13.3 (from versions: v1!6.14.0rc1.post2.dev3+linux.x86_64)\n"
+        "ERROR: No matching distribution found for pypdf==6.13.3"
+    )
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 0
+    assert "candidates=1 installed=0 skipped=1" in stdout
+    assert "v1!6.14.0rc1.post2.dev3+linux.x86_64" in stderr
+
+
+def test_reachable_index_context_lines_remain_deferable(tmp_path: Path) -> None:
+    """Pip's yanked and incompatible-version context does not mask a proven stale pin."""
+
+    output = (
+        "ERROR: Ignored the following yanked versions: 6.13.3\n"
+        "ERROR: Ignored the following versions that require a different python "
+        "version: 6.13.4 Requires-Python <3.14\n"
+        "ERROR: Could not find a version that satisfies the requirement "
+        "pypdf==6.13.3 (from versions: 6.14.1, 6.14.2)\n"
+        "ERROR: No matching distribution found for pypdf==6.13.3"
+    )
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 0
+    assert "candidates=1 installed=0 skipped=1" in stdout
+    assert "Ignored the following yanked versions" in stderr
+
+
+@pytest.mark.parametrize(
+    "fatal_fragment",
+    [
+        "ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE",
+        "WARNING: Retrying after connection broken by ConnectionError",
+        "ERROR: Could not fetch URL https://pypi.org/simple/pypdf/",
+        "ERROR: pip resolver crashed after candidate enumeration",
+    ],
+)
+def test_reachable_index_message_cannot_mask_fatal_failure(
+    tmp_path: Path,
+    fatal_fragment: str,
+) -> None:
+    """Any independent fatal evidence must dominate a stale-pin diagnostic."""
+
+    output = (
+        "ERROR: Could not find a version that satisfies the requirement "
+        "pypdf==6.13.3 (from versions: 6.14.1, 6.14.2)\n"
+        "ERROR: No matching distribution found for pypdf==6.13.3\n"
+        f"{fatal_fragment}"
+    )
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 1
+    assert "preflight failed" in stderr
+    assert fatal_fragment in stderr
+    assert "installed=" not in stdout
+
+
+@pytest.mark.parametrize(
+    "version_list",
+    [
+        "none",
+        "",
+        "unavailable",
+        "latest",
+        "release-6",
+        "6.14.1, unavailable",
+        "6.14.1 extra-text",
+    ],
+)
+def test_non_version_index_evidence_remains_fatal(
+    tmp_path: Path,
+    version_list: str,
+) -> None:
+    """Only a complete comma-separated PEP 440 version list proves reachability."""
+
+    output = (
+        "ERROR: Could not find a version that satisfies the requirement "
+        f"pypdf==6.13.3 (from versions: {version_list})\n"
+        "ERROR: No matching distribution found for pypdf==6.13.3"
+    )
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 1
+    assert "preflight failed" in stderr
+    assert "installed=" not in stdout
+
+
+def test_valid_pair_cannot_mask_duplicate_malformed_version_evidence(
+    tmp_path: Path,
+) -> None:
+    """Every resolver line for a paired requirement must carry concrete versions."""
+
+    output = (
+        "ERROR: Could not find a version that satisfies the requirement "
+        "pypdf==6.13.3 (from versions: 6.14.1)\n"
+        "ERROR: Could not find a version that satisfies the requirement "
+        "pypdf==6.13.3 (from versions: unavailable)\n"
+        "ERROR: No matching distribution found for pypdf==6.13.3"
+    )
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 1
+    assert "preflight failed" in stderr
+    assert "unavailable" in stderr
+    assert "installed=" not in stdout
+
+
+def test_atheris_binary_wheel_unavailability_is_deferable(tmp_path: Path) -> None:
+    """The real Python 3.14 binary-only diagnostic is a visible skipped lock."""
+
+    output = (
+        "ERROR: Could not find a version that satisfies the requirement "
+        "atheris==3.0.0 (from versions: 3.1.0)\n"
+        "ERROR: No matching distribution found for atheris==3.0.0"
+    )
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 0
+    assert "candidates=1 installed=0 skipped=1" in stdout
+    assert "atheris==3.0.0" in stderr
+
+
+def test_mismatched_binary_diagnostics_remain_fatal(tmp_path: Path) -> None:
+    """Two resolver lines for different exact pins cannot authorize deferral."""
+
+    output = (
+        "ERROR: Could not find a version that satisfies the requirement "
+        "pypdf==6.13.3 (from versions: 6.14.2)\n"
+        "ERROR: No matching distribution found for atheris==3.0.0"
+    )
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 1
+    assert "preflight failed" in stderr
+    assert "installed=" not in stdout
+
+
+@pytest.mark.parametrize(
+    "output",
+    [
+        (
+            "ERROR: Could not find a version that satisfies the requirement "
+            "atheris==3.0.0 (from versions: 3.1.0)"
+        ),
+        "ERROR: No matching distribution found for atheris==3.0.0",
+    ],
+)
+def test_single_binary_diagnostic_remains_fatal(
+    tmp_path: Path,
+    output: str,
+) -> None:
+    """Neither half of pip's binary-unavailability evidence is sufficient alone."""
+
+    result, stdout, stderr = _run_preflight_failure(tmp_path, output)
+
+    assert result == 1
+    assert "preflight failed" in stderr
+    assert "installed=" not in stdout
diff --git a/tests/test_pr_review_autofix_nvidia_nim_contract.py b/tests/test_pr_review_autofix_nvidia_nim_contract.py
new file mode 100644
index 000000000..3a9940d3b
--- /dev/null
+++ b/tests/test_pr_review_autofix_nvidia_nim_contract.py
@@ -0,0 +1,168 @@
+"""Contract tests for the scheduled OpenCode review-autofix trust boundary."""
+
+from pathlib import Path
+import subprocess
+
+
+AUTOFIX_WORKFLOW = Path(".github/workflows/pr-review-autofix.yml")
+FIX_SCHEDULER_WORKFLOW = Path(".github/workflows/pr-review-fix-scheduler.yml")
+REVIEW_DISPATCH_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml")
+REVIEW_DISPATCH_BLOB_SHA = "d826ce67a4299c3730610b2aa5d83803af3406cc"
+
+
+def _workflow_text(path: Path) -> str:
+    """Read one central workflow as UTF-8 text for static trust-boundary checks."""
+
+    return path.read_text(encoding="utf-8")
+
+
+def test_review_fix_scheduler_runs_once_each_hour() -> None:
+    """Keep the actionable-review repair loop on the approved hourly cadence."""
+
+    scheduler = _workflow_text(FIX_SCHEDULER_WORKFLOW)
+
+    assert 'cron: "23 * * * *"' in scheduler
+    assert 'cron: "23 */2 * * *"' not in scheduler
+
+
+def test_scheduled_autofix_uses_only_nvidia_nim() -> None:
+    """Require the write-capable OpenCode autofix agent to use NVIDIA NIM only."""
+
+    workflow = _workflow_text(AUTOFIX_WORKFLOW)
+
+    required_fragments = (
+        '"model": "nvidia-nim/mistralai/mistral-nemotron"',
+        '"small_model": "nvidia-nim/nvidia/nemotron-3-nano-30b-a3b"',
+        '"enabled_providers": ["nvidia-nim"]',
+        '"nvidia-nim": {',
+        '"npm": "@ai-sdk/openai-compatible"',
+        '"baseURL": "https://integrate.api.nvidia.com/v1"',
+        '"apiKey": "{env:NVIDIA_API_KEY}"',
+        'NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}',
+        'MODEL: nvidia-nim/mistralai/mistral-nemotron',
+    )
+    for fragment in required_fragments:
+        assert fragment in workflow, fragment
+
+    forbidden_fragments = (
+        'STRIX_GITHUB_MODELS_TOKEN:',
+        'MODEL: github-models/',
+        'USE_GITHUB_TOKEN:',
+        '"enabled_providers": ["github-models"]',
+        '"apiKey": "{env:STRIX_GITHUB_MODELS_TOKEN}"',
+        '"baseURL": "https://models.github.ai/inference"',
+    )
+    for fragment in forbidden_fragments:
+        assert fragment not in workflow, fragment
+
+
+def test_trusted_autofix_source_is_bound_to_dispatch_sha() -> None:
+    """Prevent a moving default branch from replacing trusted autofix scripts."""
+
+    workflow = _workflow_text(AUTOFIX_WORKFLOW)
+    checkout_start = workflow.index("      - name: Checkout trusted autofix source")
+    checkout_end = workflow.index(
+        "      - name: Exchange OpenCode app token", checkout_start
+    )
+    checkout = workflow[checkout_start:checkout_end]
+
+    assert "ref: ${{ github.sha }}" in checkout
+    assert "ref: main" not in checkout
+    assert "fetch-depth: 1" in checkout
+    assert "persist-credentials: false" in checkout
+
+
+def test_opencode_agent_denies_non_file_interactions() -> None:
+    """Keep unattended repair bounded to local file inspection and edits."""
+
+    workflow = _workflow_text(AUTOFIX_WORKFLOW)
+
+    for permission_name in (
+        "bash",
+        "task",
+        "skill",
+        "question",
+        "webfetch",
+        "websearch",
+        "lsp",
+        "external_directory",
+        "doom_loop",
+    ):
+        assert workflow.count(f'"{permission_name}": "deny"') == 2
+
+
+def test_nvidia_nim_secret_is_scoped_to_agent_execution_steps() -> None:
+    """Prevent the NVIDIA credential from leaking beyond the two OpenCode runs."""
+
+    workflow = _workflow_text(AUTOFIX_WORKFLOW)
+    binding = 'NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}'
+    ordinary_start = workflow.index("      - name: Run OpenCode review autofix")
+    ordinary_end = workflow.index("      - name: Validate changed files", ordinary_start)
+    conflict_start = workflow.index(
+        "      - name: Merge base branch and resolve conflicts with OpenCode"
+    )
+
+    assert workflow.count(binding) == 2
+    assert binding in workflow[ordinary_start:ordinary_end]
+    assert binding in workflow[conflict_start:]
+    assert binding not in workflow[:ordinary_start]
+    assert binding not in workflow[ordinary_end:conflict_start]
+
+
+def test_model_subprocesses_receive_no_github_or_oidc_write_credentials() -> None:
+    """Strip GitHub write and OIDC credentials from both OpenCode processes."""
+
+    workflow = _workflow_text(AUTOFIX_WORKFLOW)
+    ordinary_start = workflow.index("      - name: Run OpenCode review autofix")
+    ordinary_end = workflow.index("      - name: Validate changed files", ordinary_start)
+    ordinary = workflow[ordinary_start:ordinary_end]
+    conflict_start = workflow.index(
+        "      - name: Merge base branch and resolve conflicts with OpenCode"
+    )
+    conflict = workflow[conflict_start:]
+    sanitized_invocation = (
+        "env -u GITHUB_TOKEN -u GH_TOKEN "
+        "-u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL"
+    )
+
+    assert "GITHUB_TOKEN:" not in ordinary
+    assert "GH_TOKEN:" not in ordinary
+    assert sanitized_invocation in ordinary
+    assert sanitized_invocation in conflict
+    assert workflow.count(sanitized_invocation) == 2
+
+
+def test_missing_nvidia_nim_secret_fails_closed_before_model_execution() -> None:
+    """Reject an empty model credential instead of falling back to another provider."""
+
+    workflow = _workflow_text(AUTOFIX_WORKFLOW)
+    guard = (
+        'if [ -z "${NVIDIA_API_KEY:-}" ]; then\n'
+        '            echo "::error::NVIDIA_NIM_API_KEY is required for scheduled '
+        'OpenCode autofix."\n'
+        "            exit 1\n"
+        "          fi"
+    )
+    ordinary_start = workflow.index("      - name: Run OpenCode review autofix")
+    ordinary_end = workflow.index("      - name: Validate changed files", ordinary_start)
+    conflict_start = workflow.index(
+        "      - name: Merge base branch and resolve conflicts with OpenCode"
+    )
+
+    assert workflow.count(guard) == 2
+    assert guard in workflow[ordinary_start:ordinary_end]
+    assert guard in workflow[conflict_start:]
+
+
+def test_independent_review_agent_key_system_is_unchanged() -> None:
+    """Pin the existing read-only reviewer workflow byte-for-byte."""
+
+    result = subprocess.run(
+        ["git", "hash-object", str(REVIEW_DISPATCH_WORKFLOW)],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.stdout.strip() == REVIEW_DISPATCH_BLOB_SHA
+    assert "pr-review-autofix" not in _workflow_text(REVIEW_DISPATCH_WORKFLOW)
diff --git a/tests/test_pr_review_fix_hourly_contract.py b/tests/test_pr_review_fix_hourly_contract.py
new file mode 100644
index 000000000..f55408fc8
--- /dev/null
+++ b/tests/test_pr_review_fix_hourly_contract.py
@@ -0,0 +1,45 @@
+"""Static contract for the central hourly PR review-fix scheduler."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+_WORKFLOW = Path(".github/workflows/pr-review-fix-scheduler.yml")
+
+
+def _workflow_text() -> str:
+    """Return the canonical scheduler workflow text."""
+    return _WORKFLOW.read_text(encoding="utf-8")
+
+
+def test_review_fix_scheduler_runs_once_each_hour() -> None:
+    """The bounded repair dispatcher uses the requested hourly heartbeat."""
+    text = _workflow_text()
+
+    assert 'cron: "23 * * * *"' in text
+    assert 'cron: "23 */2 * * *"' not in text
+
+
+def test_review_fix_scheduler_retries_same_head_after_one_hour() -> None:
+    """A blocked head can be retried on the next hourly cycle, not a day later."""
+    text = _workflow_text()
+
+    retry_block = text.split("retry_hours:", maxsplit=1)[1].split(
+        "autofix_workflow:", maxsplit=1
+    )[0]
+    assert 'default: "1"' in retry_block
+    assert "inputs.retry_hours || '1'" in text
+    assert "inputs.retry_hours || '24'" not in text
+
+
+def test_review_fix_scheduler_remains_bounded_and_single_flight() -> None:
+    """Higher cadence never expands mutation volume or parallel execution."""
+    text = _workflow_text()
+
+    dispatch_block = text.split("max_dispatches:", maxsplit=1)[1].split(
+        "target_repository:", maxsplit=1
+    )[0]
+    assert 'default: "1"' in dispatch_block
+    assert "cancel-in-progress: true" in text
+    assert "MAX_DISPATCHES" in text
diff --git a/tests/test_pr_review_fix_scheduler_source_pin.py b/tests/test_pr_review_fix_scheduler_source_pin.py
new file mode 100644
index 000000000..bb5a6bbc5
--- /dev/null
+++ b/tests/test_pr_review_fix_scheduler_source_pin.py
@@ -0,0 +1,77 @@
+"""Supply-chain contract for the reusable PR-review autofix scheduler."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+_REPO_ROOT = Path(__file__).resolve().parents[1]
+_WORKFLOW = _REPO_ROOT / ".github" / "workflows" / "pr-review-fix-scheduler.yml"
+
+
+def _workflow_text() -> str:
+    """Read the reusable scheduler workflow as UTF-8 text."""
+    return _WORKFLOW.read_text(encoding="utf-8")
+
+
+def test_reusable_scheduler_validates_called_workflow_identity_before_checkout() -> None:
+    """Missing workflow identity must fail before checkout can use defaults."""
+    workflow = _workflow_text()
+    guard = workflow.index("Resolve immutable called-workflow source")
+    checkout = workflow.index("Checkout immutable called-workflow source")
+
+    assert guard < checkout
+    assert "WORKFLOW_REPOSITORY: ${{ job.workflow_repository }}" in workflow
+    assert "WORKFLOW_SHA: ${{ job.workflow_sha }}" in workflow
+    assert "WORKFLOW_REF: ${{ job.workflow_ref }}" in workflow
+    assert "WORKFLOW_FILE_PATH: ${{ job.workflow_file_path }}" in workflow
+    assert 'expected_repository="ContextualWisdomLab/.github"' in workflow
+    assert 'expected_file=".github/workflows/pr-review-fix-scheduler.yml"' in workflow
+    assert '[[ "$WORKFLOW_SHA" =~ ^[0-9a-f]{40}$ ]]' in workflow
+    assert "repository: ${{ steps.trusted_source.outputs.repository }}" in workflow
+    assert "ref: ${{ steps.trusted_source.outputs.sha }}" in workflow
+
+
+def test_reusable_scheduler_verifies_checked_out_called_workflow_sha() -> None:
+    """The checked-out commit must equal the validated called-workflow SHA."""
+    workflow = _workflow_text()
+    verification = workflow.index("Verify immutable called-workflow checkout")
+    self_test = workflow.index("Self-test fix scheduler contract")
+
+    assert verification < self_test
+    assert 'actual_sha="$(git rev-parse HEAD)"' in workflow
+    assert '[ "$actual_sha" != "$EXPECTED_SHA" ]' in workflow
+    assert '[ ! -f "$EXPECTED_FILE" ] || [ -L "$EXPECTED_FILE" ]' in workflow
+
+
+def test_reusable_scheduler_source_is_not_caller_input_controlled() -> None:
+    """No caller-supplied ref or ordinary caller GitHub SHA selects trusted code."""
+    workflow = _workflow_text()
+    assert "inputs.canonical_ref" not in workflow
+    assert "github.event.client_payload.canonical_ref" not in workflow
+    assert "ref: ${{ env.CANONICAL_REF }}" not in workflow
+    assert "ref: ${{ github.sha }}" not in workflow
+    assert "ref: ${{ github.workflow_sha }}" not in workflow
+
+
+def test_deprecated_canonical_ref_input_is_accepted_but_never_consumed() -> None:
+    """Existing callers can upgrade pins without controlling privileged source."""
+    workflow = _workflow_text()
+    declaration = workflow.split("canonical_ref:", 1)[1].split(
+        "repository_dispatch:", 1
+    )[0]
+
+    assert "Deprecated compatibility input" in declaration
+    assert "ignored" in declaration
+    assert 'default: ""' in declaration
+    assert workflow.count("canonical_ref") == 1
+
+
+def test_reusable_scheduler_retains_least_privilege_and_bounded_dispatch() -> None:
+    """Source pinning does not broaden token scope or queue fan-out."""
+    workflow = _workflow_text()
+    assert "contents: write" not in workflow
+    assert "pull-requests: write" not in workflow
+    assert "MAX_DISPATCHES:" in workflow
+    assert "RETRY_HOURS:" in workflow
+    assert "cancel-in-progress: true" in workflow
diff --git a/tests/test_sbom_generation_push_contract.py b/tests/test_sbom_generation_push_contract.py
new file mode 100644
index 000000000..011be9737
--- /dev/null
+++ b/tests/test_sbom_generation_push_contract.py
@@ -0,0 +1,54 @@
+"""Contracts for default-branch dependency snapshot generation."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+WORKFLOW = Path(".github/workflows/sbom-generation.yml")
+
+
+def _workflow_text() -> str:
+    """Return the centrally versioned SBOM workflow as UTF-8 text."""
+
+    return WORKFLOW.read_text(encoding="utf-8")
+
+
+def test_sbom_workflow_snapshots_supported_default_branch_pushes() -> None:
+    """Default-branch commits must receive dependency graph snapshots."""
+
+    workflow = _workflow_text()
+
+    assert "on:\n  push:\n    branches: [main, master, develop]\n" in workflow
+    assert "  pull_request:\n" in workflow
+    assert "  release:\n" in workflow
+    assert "dependency-snapshot: true" in workflow
+
+
+def test_sbom_push_concurrency_is_bound_to_the_commit_sha() -> None:
+    """A later default-branch push must not cancel another commit's snapshot."""
+
+    workflow = _workflow_text()
+    group_line = next(
+        line.strip() for line in workflow.splitlines() if line.strip().startswith("group:")
+    )
+
+    assert "github.event.release.tag_name || github.sha" in group_line
+    assert "github.event.release.tag_name || github.ref" not in group_line
+
+
+def test_sbom_job_conditions_keep_push_runs_active_and_closed_prs_inert() -> None:
+    """Pushes run the snapshot job while closed-PR events only cancel stale work."""
+
+    workflow = _workflow_text()
+
+    assert (
+        "if: github.event_name == 'pull_request' && github.event.action == 'closed'"
+        in workflow
+    )
+    assert (
+        "if: github.event_name != 'pull_request' || github.event.action != 'closed'"
+        in workflow
+    )
+    assert "generate-sbom:\n" in workflow
+    assert "      contents: write\n" in workflow