[groupthinking]

Canonical issue

Closes #2514

Follow-up to the post-merge review on #2492. The original repair is merged and GRV-861 remains completed.

Outcome

A lock containing runtime split@1.0 and development-only split@2.0 -> dev-child@1.0 now keeps the latter two packages development-scoped. Previously, name-only traversal promoted all three to runtime and the recorder accepted those incorrect rows.

Scope

• Resolve dependency edges against locked name, version, and source; reject unresolved or ambiguous references.
• Track requested extras per locked identity and per scope, including cycles and later extra requests.
• Use exact identities for directness, scopes, and emitted dependency edges. Distinct sources of the same name/version receive distinct snapshot keys.
• Read recorder components from package URLs rather than source-qualified keys. At the existing API name/version boundary, apply runtime precedence for a component present in both scopes.
• Add classifier regressions and 12 recorder cases using real local Git commits and hand-authored API rows. Incorrect rows must fail before any evidence directory is written; correct rows are persisted and read back.

Only the classifier, recorder, and their tests change. This is a classification correction, not a new vulnerability or production-exposure finding.

Risk

Low: CI dependency-graph tooling only. Ambiguous/unresolved references now fail closed rather than assigning guessed scopes. The existing root-selection and dev/docs policy remain as before. The recorder's API projection cannot independently distinguish a source-only change with identical package name/version. Hosted behavior for the new tree is not yet verified.

Rollback: revert this commit; doing so restores the reproduced classification defect.

Verification

Patch commit: c68b06b37253ffce04840e8f137eae625046cc81
Base: f258db8a6cc38c064ba4d7ca1baee02bedbd0534
Tested tree (identical to remote commit tree): 195f14846513dffb4943f862a59fbe42b0d9d12c

Local environment: Python 3.12.14, pytest 9.2.0, pytest-asyncio 1.4.1, PyYAML 6.0.3, Ruff 0.17.3 in an isolated venv.

.venv/bin/python -m pytest tests/unit/test_submit_uv_lock_snapshot.py tests/unit/test_uv_scope_evidence.py tests/unit/test_submit_npm_lock_snapshot.py tests/unit/test_dependency_review_workflow.py -q -o addopts='' --tb=short
# 55 passed in 2.82s; exit 0
.venv/bin/ruff check scripts/ci/submit_uv_lock_snapshot.py scripts/ci/record_dependency_review.py tests/unit/test_submit_uv_lock_snapshot.py tests/unit/test_uv_scope_evidence.py
# All checks passed; exit 0
git diff --check
# exit 0

Before the correction, the first regression set produced 14 failed / 8 passed against the old implementation. That run explicitly reproduced both incorrectly runtime-classified packages and the recorder accepting both incorrect API rows. Four additional source-precedence cases were added before the final 55-test passing run.

• Focused local tests, including current real uv.lock and combined npm/uv submission
• Independent agent review of identity, source, directness, and extras behavior
• Required hosted CI on this exact head
• Hosted review threads resolved

Production evidence

Not applicable to this local classification correction. No production-deployment or hosted snapshot-verification claim is made. Tests use synthetic lockfiles and injected API responses; they do not submit dependency snapshots.

Agent handoff

• One canonical follow-up issue linked
• Current main and newer PRs checked before implementing; no newer matching fix found
• Local acceptance criteria satisfied
• Required hosted checks pass on the current head

Keep this PR in draft for review. Do not merge automatically.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Oct 29, 2026 10:43pm UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}