feat: read requirements.txt contents to judge pinning (feature 037)

[mlieberman85]

Closes #429.

repro_deps_pinned judged dependency pinning by filename and never opened the files it judged. A requirements.txt produced by pip-compile --generate-hashes received the same hard FAIL as one containing a bare numpy. Reported by @Jaydeep869 while evaluating darnit-reproducibility against real repositories.

What the control does now

When no lock file is present, it reads the file.

requirements.txt	Verdict	Message says
every line == + --hash=	PASS	pinning was confirmed by reading the file
every line ==, no hashes	WARN	transitive dependencies resolve at install time
any open specifier	FAIL	names an offending requirement
unreadable, undecodable, unresolved -r	FAIL	contents could not be inspected
empty or comments-only	treated as absent	--

Lock files still decide first and their contents are never consulted.

The WARN tier has a cost, and it is intentional

Because WARN counts as FAIL for compliance arithmetic (Principle II), a project that pins every direct dependency still cannot reach compliance on this control without adopting a lock file. Its transitive dependencies resolve at install time, so the build is not reproducible and the control cannot honestly assert that it is. For a framework whose subject is reproducibility that is the correct message rather than an unfortunate side effect, but it will generate pushback from users who feel they have done the work.

A commit-SHA VCS reference is exactly identified but is never hash evidence, so it caps a file at WARN. pip cannot enforce hashes on a git reference, so a file containing one is not a require-hashes file and must not borrow that tier's PASS.

Framework change: HandlerResultStatus gains WARN

This is the part worth reviewer attention, because it changes what any handler is allowed to conclude.

A handler could report PASS, FAIL, INCONCLUSIVE or ERROR. One that had read the evidence and found it insufficient had to return INCONCLUSIVE, which sends the pipeline onward and eventually produces a WARN carrying the fixed string "Could not automatically verify - manual verification required". The operator then reads, about a file the tool parsed successfully, that the tool could not verify it -- the same confusion #427 was about, arriving by a different route.

WARN is now conclusive and carries the handler's own message. Gated by the RFC-0001 Stage 1 authority rule exactly as PASS and FAIL are:

Handler outcome	Terminal authority	Non-terminal, not last	Non-terminal, last step
PASS	CONCLUDE_PASS	ATTACH_AND_CONTINUE	TERMINATE_INCONCLUSIVE
FAIL	CONCLUDE_FAIL	ATTACH_AND_CONTINUE	TERMINATE_INCONCLUSIVE
WARN	CONCLUDE_WARN	ATTACH_AND_CONTINUE	TERMINATE_INCONCLUSIVE
INCONCLUSIVE	ATTACH_AND_CONTINUE	ATTACH_AND_CONTINUE	TERMINATE_INCONCLUSIVE

The WARN row is the PASS/FAIL row. A suggestive step cannot manufacture a WARN that halts verification any more than it can manufacture a PASS. INCONCLUSIVE behaviour is unchanged, and the all-inconclusive fallthrough still produces its WARN for controls that exhaust their passes.

docs/architecture/framework-design.md documents the outcome and the table, per Development Workflow item 3. Note that validate_sync.py cannot check this -- validate_pass_types_sync greps a hardcoded list of seven handler names against builtin_handlers.py, so it passes regardless. A test asserts the documentation instead.

Verification

• SC-008 (no existing control's status changes): 213 controls across 6 framework/repo pairs are captured twice in the same environment -- once normally, once with the WARN outcome routed the way it was routed before this change -- and the two agree exactly.

  A committed golden was tried first and is worth mentioning because it failed in CI while passing locally. Seven OSPS controls resolve FAIL on a developer machine and WARN on a GitHub runner, so a golden of absolute control statuses pins the environment as much as the code. The differential capture has no such problem: whatever the environment does, it does identically to both runs and cancels.

• SC-004 / SC-005 (lock-file and no-dependency paths byte-identical, including confidence): same ordering.

• 3207 tests pass, ruff check . clean, validate_sync.py passes.

Two bugs found along the way, filed and not fixed here

#442 -- controls leak across frameworks within a process. A reproducibility audit returns 5 controls in a clean process and 71 (65 of them OSPS baseline) if an openssf-baseline audit ran earlier in the same process. The MCP server is long-lived, so this affects the product surface, not just tests. It surfaced because the in-process baseline capture reported 46% of the corpus as nondeterministic -- none of it flaky, all of it this leak. baseline_capture.py runs each pair in a subprocess, which is a workaround rather than a fix.

#441 -- darnit-core imports packaging at runtime without declaring it. composition.py:363 and framework_schema.py:1445; uv pip show packaging reports Required-by: pytest. This PR declares packaging for darnit-reproducibility's own use, which does not cover core's call sites.

Also worth knowing: run_checks writes a .project/ directory into the repository it audits. The baseline capture copies fixtures into scratch space before auditing for that reason -- auditing them in place leaves untracked files in the tree, which is what broke CI on #435.

Scope held deliberately

File discovery is unchanged (root requirements.txt only -- requirements-dev.txt and requirements/base.txt stay undiscovered), other loose manifests are still judged by presence alone, confidence stays 0.8 everywhere, and -r/-c includes are not followed. Each is a requirement with a test asserting the non-change.

Stacked on #439

This branch is built on fix-plugin-handler-registration (#427, #428), which is still open, so its commit appears here until that merges. Rebasing off it is not an option: the committed SC-008 baseline was captured with it present, and without it repro_deps_pinned does not execute via the CLI path at all. Merge #439 first.

[Marc-cn]

Tested on Linux, after #439 merged.All five requirements.txt shapes match the table:.
Framework change: WARN routes through StepDisposition.CONCLUDE_WARN in the same mapping as PASS/FAIL (orchestrator.py:83), so a suggestive step can't conclude one. 60 warn/authority tests pass.
SC-008: openssf-baseline on tqdm is byte-identical between main and this branch across all controls.
567 passed in tests/darnit_reproducibility + tests/darnit/sieve.
LGTM