chore(source-repair): reconcile current main into #2174

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -11,6 +11,11 @@ on:
       - "tests/test_noema_two_phase_handoff.py"
       - "tests/test_noema_refreshed_app_identity.py"
       - "tests/test_noema_token_lifetime_stale_run_contract.py"
+      - "scripts/ci/noema_review_document.py"
+      - "scripts/ci/noema_hwp_mcp_reader.mjs"
+      - "scripts/ci/noema-document-reader/package.json"
+      - "scripts/ci/noema-document-reader/package-lock.json"
+      - "tests/test_noema_document_review_context.py"
       - "docs/doctoring/noema-review-token-lifetime.md"
       - "docs/product-technical-gap-baseline.md"
       - ".github/workflows/opencode-review-dispatch.yml"
@@ -103,6 +108,8 @@ on:
       - "docs/doctoring/exact-artifact-sbom-quality-runner-consolidation-20260903.md"
       - "CHANGELOG.d/20260903-exact-artifact-quality-runner-consolidation.md"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci.txt"
+      - "requirements-noema-document-ci-hashes.txt"
 
 # PR validation only: a new head cancels only an older run of this workflow
 # for the same repository and pull request.
@@ -138,7 +145,9 @@ jobs:
         with:
           python-version: "3.14"
           cache: pip
-          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+          cache-dependency-path: |
+            requirements-opencode-review-ci-hashes.txt
+            requirements-noema-document-ci-hashes.txt
 
       - name: Select affected contract suites
         id: affected_suites
@@ -181,6 +190,11 @@ jobs:
               tests/test_noema_two_phase_handoff.py|\
               tests/test_noema_refreshed_app_identity.py|\
               tests/test_noema_token_lifetime_stale_run_contract.py|\
+              scripts/ci/noema_review_document.py|\
+              scripts/ci/noema_hwp_mcp_reader.mjs|\
+              scripts/ci/noema-document-reader/package.json|\
+              scripts/ci/noema-document-reader/package-lock.json|\
+              tests/test_noema_document_review_context.py|\
               docs/doctoring/noema-review-token-lifetime.md)
                 noema_suite=true
                 ;;
@@ -210,6 +224,10 @@ jobs:
                 noema_suite=true
                 opencode_suite=true
                 ;;
+              requirements-noema-document-ci.txt|\
+              requirements-noema-document-ci-hashes.txt)
+                noema_suite=true
+                ;;
               .github/workflows/pr-review-merge-scheduler.yml)
                 queue_suite=true
                 review_repair_suite=true
@@ -327,6 +345,12 @@ jobs:
           python -m pip install --disable-pip-version-check --require-hashes
           -r requirements-opencode-review-ci-hashes.txt
 
+      - name: Install exact Noema document dependencies
+        if: steps.affected_suites.outputs.noema == 'true'
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes --no-deps
+          -r requirements-noema-document-ci-hashes.txt
+
       - name: Verify Noema token-lifetime contracts
         if: steps.affected_suites.outputs.noema == 'true'
         run: |
@@ -335,13 +359,15 @@ jobs:
             tests/test_noema_reviewer_token_lifetime.py \
             tests/test_noema_two_phase_handoff.py \
             tests/test_noema_refreshed_app_identity.py \
-            tests/test_noema_token_lifetime_stale_run_contract.py
+            tests/test_noema_token_lifetime_stale_run_contract.py \
+            tests/test_noema_document_review_context.py
           python -m compileall -q \
             .github/actions/noema-review/two_phase.py \
             tests/test_noema_reviewer_token_lifetime.py \
             tests/test_noema_two_phase_handoff.py \
             tests/test_noema_refreshed_app_identity.py \
-            tests/test_noema_token_lifetime_stale_run_contract.py
+            tests/test_noema_token_lifetime_stale_run_contract.py \
+            tests/test_noema_document_review_context.py
 
       - name: Verify OpenCode Rust coverage toolchain contract
         if: steps.affected_suites.outputs.opencode == 'true'

.github/workflows/noema-review.yml

@@ -650,6 +650,34 @@ jobs:
           set -euo pipefail
           bash "$GITHUB_WORKSPACE/scripts/ci/contextual_orchestrator_review_sidecar.sh"
 
+      - name: Provision local reviewed HWP document reader
+        if: env.PR_NUMBER != ''
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        run: |
+          set -euo pipefail
+          node_major="$(node -p 'process.versions.node.split(".")[0]')"
+          case "$node_major" in
+            20|22) ;;
+            *)
+              echo "::error::Noema HWP reader requires Node.js 20 or 22; found ${node_major:-missing}."
+              exit 1
+              ;;
+          esac
+          python3 -m pip install --quiet --require-hashes --no-deps \
+            -r "$GITHUB_WORKSPACE/requirements-noema-document-ci-hashes.txt"
+          reader_root="${RUNNER_TEMP}/noema-document-reader"
+          rm -rf "$reader_root"
+          mkdir -p "$reader_root"
+          cp "$GITHUB_WORKSPACE/scripts/ci/noema-document-reader/package.json" \
+            "$GITHUB_WORKSPACE/scripts/ci/noema-document-reader/package-lock.json" \
+            "$reader_root/"
+          (
+            cd "$reader_root"
+            npm ci --ignore-scripts --omit=dev --no-audit --no-fund
+          )
+          echo "NOEMA_HWP_MCP_SOURCE=$reader_root/node_modules/hwp-mcp" >>"$GITHUB_ENV"
+
       - name: Prepare Noema model verdict
         if: env.PR_NUMBER != ''
         id: noema_prepare

requirements-noema-document-ci-hashes.txt

@@ -0,0 +1,5 @@
+# Generated with uv pip compile --generate-hashes --python-version 3.12
+# requirements-noema-document-ci.txt
+defusedxml==0.7.1 \
+    --hash=sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69 \
+    --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61

requirements-noema-document-ci.txt

@@ -0,0 +1 @@
+defusedxml==0.7.1