fix(coverage): retry transient trusted uv archive failures without widening trust

[seonghobae]

Observed exact failure

Central OpenCode coverage run 31002427460, attempt 2, failed before executing pull-request code while reviewing ContextualWisdomLab/newsdom-api#524 at exact head 86f579ee6964642b98f3d44464adbdc7f0c8fa5b:

Could not materialize base Python locks: trusted uv archive download failed: HTTPError

The same exact-head review had already passed source materialization, archive extraction, replay protection, and changed-file syntax. The only changed file was AGENTS.md, so the subsequent requested-change review is infrastructure evidence, not a product-code finding.

The pinned uv 0.12.1 release and x86_64 Linux archive are current official immutable assets. The materializer correctly fixes the origin, disables proxies, rejects redirects, bounds bytes/time, verifies SHA-256, validates the exact regular archive member, and checks uv --version. It currently performs only one network attempt, so a transient 408/425/429/5xx response converts otherwise valid current-head coverage into a persistent CHANGES_REQUESTED review.

Required bounded behavior

Add test-first retry support without weakening the existing trust boundary:

• retain the exact literal https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-x86_64-unknown-linux-gnu.tar.gz sink;
• retain no-proxy and no-redirect behavior;
• retry only a closed set of transient HTTP statuses (408, 425, 429, 500, 502, 503, 504) and transient connection/DNS/timeout failures;
• never retry certificate-verification, malformed-URL, redirect, checksum, archive-shape, member-type, size, or version failures;
• use a bounded attempt count and deterministic bounded backoff;
• open a fresh response for each attempt and discard every partial payload;
• preserve secret-free bounded diagnostics and final failure behavior;
• keep exact 100% statement/branch coverage and public docstrings.

Permanent regression evidence

Add deterministic tests that prove:

1. transient 503 followed by a valid short-read response succeeds on the second attempt;
2. repeated transient failures stop at the exact attempt ceiling;
3. 404 and TLS certificate verification fail immediately with no sleep;
4. each retry uses the same literal trusted origin and timeout;
5. partial bytes from a failed attempt never prefix the successful payload; and
6. the official archive SHA/member/version verification remains unchanged.

Update CHANGELOG.md and authoritative doctoring with availability, rollback, and APA 7 references to Python urllib.error, RFC 9110 retry-relevant status semantics, and the official immutable uv 0.12.1 release.

Acceptance

Merge only after the central quality workflow, Python Security, CodeQL, Semgrep, Security Scan, Secret Scan, OSV, SBOM, Scorecard, OpenCode, Noema, Strix, CodeRabbit, independent current-head approval, and branch protection succeed. Do not introduce a mutable downloader, alternate origin, unverified cache, GitHub Copilot credential, or reviewer-credential change.

[seonghobae]

Fresh fleet reproduction — RankWeave #36

The same central availability defect reproduced while reviewing ContextualWisdomLab/RankWeave#36 at exact head d6600113abeed42a7a782053f4837b1bedd9701b.

Central OpenCode Review Dispatch run 31300875609, job 93213339754, successfully completed target metadata binding, PR merge-tree materialization, archive extraction, replay protection, and changed-file syntax validation. It then failed before executing pull-request-controlled tests with:

Could not materialize base Python locks: trusted uv archive download failed: HTTPError

The failure caused OpenCode to submit CHANGES_REQUESTED for absent coverage evidence even though the leaf repository's same-head ci, SAST Semgrep, and Security Scan had completed successfully. This is additional evidence that the causal mechanism is the central trusted-uv bootstrap's live availability dependency—not RankWeave source coverage or a missing leaf-repository credential.

Current remediation path

• Existing central PR fix(coverage): retry transient trusted uv downloads #790 is the correct owner path; do not duplicate its implementation in RankWeave.
• Revalidate fix(coverage): retry transient trusted uv downloads #790's live head and base before integration; its PR description's embedded head identity is historical and must not substitute for the current GitHub ref.
• Preserve the immutable Astral origin, no-proxy/no-redirect checks, digest/member/version verification, bounded transient-only retries, partial-payload isolation, and fail-closed permanent/TLS/checksum behavior.
• After fix(coverage): retry transient trusted uv downloads #790 reaches protected main, rerun the exact-current-head RankWeave ⚡ Bolt: scripts/ci/opencode_review_normalize_output.py 내 JSON 파싱 성능 최적화 #36 OpenCode coverage/review dispatch. Acceptance requires coverage evidence to reach actual repository tests rather than fail in uv bootstrap, followed by a fresh formal review that supersedes the infrastructure-derived CHANGES_REQUESTED submissions.

No leaf workaround, network-wide retry, alternate mutable origin, PAT, COPILOT_GITHUB_TOKEN, or review-policy weakening is justified.