fix(rl): restore Python HTTPS support

[svvarom]

Summary

PR #1623 copied CPython 3.13.15 from Debian Trixie into the Ubuntu 24.04 RL base, and the resulting interpreter cannot open HTTPS URLs. That breaks causal-conv1d's prebuilt-wheel fetch with unknown url type: https, causing nmp-rl-training to fail.

This keeps Python 3.13.15 but sources it from Bookworm, which uses the same OpenSSL 3.0 generation as the CUDA base, and adds an early import ssl assertion so this incompatibility fails before the expensive RL dependency build.

Changes

• Switch the RL CPython source image from slim-trixie to slim-bookworm.
• Assert that the copied interpreter can load SSL immediately after installation.
• Keep the RL image documentation aligned with the source image.

Human attention needed

• Decision: approve Bookworm as the compatibility boundary for copied CPython 3.13.15.
• Proof: the image tag resolves for amd64 and arm64, and the multi-arch Bake graph renders successfully.
• Biggest risk: the full nmp-rl-training build and security scan are CI-only and remain pending.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with documentation updates
• Documentation only
• Contributor tooling or automation
• CI, build, or test infrastructure

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Documentation updated for user-visible behavior
• Documentation not applicable — justification: build-environment-only change; the internal RL README is updated for maintainers.

Verification

• Pull request title follows the repository's Conventional Commit format
• Every commit includes an appropriate Signed-off-by: trailer
• uv run pre-commit run -a passes, or any blocked checks are identified below
• Targeted tests pass, or tests are marked not applicable above
• No secrets, API keys, or credentials are included

Targeted validation:

• git diff --check — passed.
• docker buildx imagetools inspect python:3.13.15-slim-bookworm — resolved linux/amd64 and linux/arm64 manifests.
• docker buildx bake --print nmp-rl-training — passed; the target renders for linux/amd64 and linux/arm64.
• Full multi-arch nmp-rl-training build, RL smoke test, and security scan — pending CI; the repository explicitly keeps this cold GPU build out of local validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cc70da1f-95ec-4f33-a921-d7300fcd15fa

📥 Commits

Reviewing files that changed from the base of the PR and between c5e739c and 6071314.

📒 Files selected for processing (2)

• docker/rl/Dockerfile.nmp-rl-base
• docker/rl/README.md

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The RL base image now uses Python 3.13.15 on Debian Bookworm. The Docker build verifies that the copied CPython installation can import ssl and reports its OpenSSL version. The README reflects the new image.

Changes

RL base image

Layer / File(s)	Summary
Bookworm image and SSL validation docker/rl/Dockerfile.nmp-rl-base, docker/rl/README.md	The Dockerfile changes the CPython source image from slim Trixie to slim Bookworm, adds an SSL import check, and updates the documented image reference.

Suggested reviewers: a2bondar

Merge Risk: ⚪ Minimal · up to 60713

This change restores HTTPS support in the RL Python environment and adds an early failure check, with no actionable merge-blocking risk remaining after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: restoring Python HTTPS support in the RL base image.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch svvarom/fix-rl-python-ssl

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	36742/46663	78.7%	63.1%
Integration Tests	21653/43917	49.3%	22.5%