apropos of nothing: found this thread (while searching for whether tox support lockfiles for its environments): https://discuss.python.org/t/structured-exchangeable-lock-file-format-requirements-txt-2-0/876

It would be surprising on 1st principles if tox supported lockfiles since it just creates venvs using virtualenv / pip by default and there is really no lockfile for those. The pip --hash thing may be used to effectively have a lockfile, but it's certainly not a standard file format for any reasonable definition of that. Which leads to what you found.