fix(coverage): replace stale LLVM runtime-boundary repair

[seonghobae]

Replacement purpose

Rebuild the Rust coverage LLVM runtime-boundary repair directly from protected main 1131b1bbafb24e455fc8619cdf316813e8721861. Historical PR #816 is based on an older protected-main generation; its checks, reviews, approvals, comments, and synthetic merge results do not transfer.

Do not close #816 until this replacement proves the same bounded repair on the current protected base.

Test-first state

Exact RED head: 3887faba96b50f34cff0ad58e5706427d818ec7d.

This head adds only tests/test_opencode_rust_coverage_toolchain_contract.py. Protected main does not provision/propagate/revalidate the reviewed LLVM 19 paths required by the contract, so the focused test is intentionally RED before production changes.

The permanent contract requires:

1. Debian llvm-19 in the digest-pinned trusted coverage image;
2. exact image bindings LLVM_COV=/usr/bin/llvm-cov-19 and LLVM_PROFDATA=/usr/bin/llvm-profdata-19;
3. build-time executable checks before admitting the pinned cargo-llvm-cov archive;
4. literal propagation of both constants through the isolated docker run boundary; and
5. exact-value plus executable revalidation inside the networkless runtime before Rust coverage.

Required bounded repair

Implement only the minimum contract in .github/workflows/opencode-review-dispatch.yml, add a permanent exact-head quality workflow, current authoritative doctoring/APA 7 evidence, and CHANGELOG traceability. Preserve the digest-pinned image, pinned cargo-llvm-cov artifact and SHA-256, exact-head materialization, --network=none, credential/Git isolation, native-fuzz separation, reviewer identities and credentials, 100% coverage policy, and branch protection.

Current cargo-llvm-cov documentation states that LLVM_COV and LLVM_PROFDATA override those tool paths and must be compatible with rustc's LLVM. Debian bookworm publishes llvm-19 with the versioned coverage tools. No fallback to unversioned LLVM binaries is permitted.

Exact-current-head RED evidence

Current exact head: edddecdfa2b66b61f472db8f754270ffc2fd147c on protected-base generation 1131b1bbafb24e455fc8619cdf316813e8721861.

The current production diff satisfies contract items 1–3: the trusted digest-pinned image installs llvm-19, binds exact /usr/bin/llvm-cov-19 and /usr/bin/llvm-profdata-19 image environment paths, and verifies both executables before admitting the pinned cargo-llvm-cov archive. The exact-head focused quality run remains intentionally RED on the three missing runtime-boundary assertions:

• propagate literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 through the existing isolated docker run before "$coverage_tool_image";
• inside isolated-runtime ensure_rust_toolchain(), fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} exactly equal those reviewed paths;
• require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" inside that runtime validation before the first cargo llvm-cov invocation.

The authoritative workflow blob observed for this exact head is b17cf37758abf508d42a7bed8e896bdfb43adc1d. Any source or head movement invalidates this repair plan and requires a fresh read before mutation. Do not weaken the permanent contract, accept unversioned LLVM fallbacks, move coverage outside the networkless sandbox, or reuse #816 evidence.

Keep Draft until the exact final head passes the focused and complete central suites, all security/supply-chain checks, current-head automated review, zero valid unresolved findings, qualifying independent non-author approval, and branch protection without bypass.

Refs #816 and downstream DiskSage coverage blockers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cbe3ad42-3a6c-40a8-b1e9-743f0223d410

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Complete the bounded Rust coverage runtime-boundary repair on exact current Draft head edddecdfa2b66b61f472db8f754270ffc2fd147c, protected base 1131b1bbafb24e455fc8619cdf316813e8721861. The authoritative .github/workflows/opencode-review-dispatch.yml blob is still b17cf37758abf508d42a7bed8e896bdfb43adc1d; abort and re-read if either identity moves.

Exact-head security/supply-chain workflows are GREEN; only OpenCode Rust Coverage Toolchain Quality CI is RED. The current production diff already satisfies the build-image half of the permanent contract: Debian llvm-19, exact ENV LLVM_COV=/usr/bin/llvm-cov-19, exact ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19, and build-time executable validation before the pinned cargo-llvm-cov archive. Implement only the remaining runtime-boundary contract:

1. In the existing isolated docker run --rm ... "$coverage_tool_image" launch, propagate the reviewed constants literally before the image argument:
   --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19.
2. Inside the isolated-runtime ensure_rust_toolchain(), fail closed unless ${LLVM_COV:-} is exactly /usr/bin/llvm-cov-19 and ${LLVM_PROFDATA:-} is exactly /usr/bin/llvm-profdata-19.
3. In that same runtime validation, require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the first cargo llvm-cov invocation.

Keep tests/test_opencode_rust_coverage_toolchain_contract.py authoritative; do not weaken or bypass it. Preserve the digest-pinned image, pinned cargo-llvm-cov artifact/SHA-256, --network=none, exact-head/base materialization, credential/Git isolation, reviewer identities and credential chain, NVIDIA NIM usage, native-fuzz separation, and existing 100% coverage policy. Do not add any temporary, one-shot, self-modifying, encoded-patch, branch-local repair, competing branch-writer, or write-capable helper workflow.

After the minimal permanent edit, rerun the focused contract plus complete central tests/security/supply-chain gates on the exact new head, and keep Draft until all required exact-head evidence, current automated review, zero actionable threads, qualifying independent non-author approval, and branch protection are satisfied. Do not reuse PR #816 evidence.

[seonghobae]

@opencode-agent Please repair the exact current RED head only if it is still edddecdfa2b66b61f472db8f754270ffc2fd147c on base 1131b1bbafb24e455fc8619cdf316813e8721861, and only if .github/workflows/opencode-review-dispatch.yml still has blob b17cf37758abf508d42a7bed8e896bdfb43adc1d. Refetch all three identities immediately before writing; if any moved, do not mutate and instead review the new state.

The current exact-head OpenCode Rust Coverage Toolchain Quality CI is RED while the same-head security/supply-chain workflows are green. Preserve the existing test-first contract and make only the minimum production repair for the three remaining assertions:

1. In the existing isolated docker run --rm --init --network=none invocation, before "$coverage_tool_image", propagate the reviewed constants literally:
   --env LLVM_COV=/usr/bin/llvm-cov-19 \\
--env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 \\
2. In isolated-runtime ensure_rust_toolchain(), after the existing cargo-llvm-cov availability check and before ensure_rust_gpu_adapter, fail closed unless ${LLVM_COV:-} is exactly /usr/bin/llvm-cov-19 and ${LLVM_PROFDATA:-} is exactly /usr/bin/llvm-profdata-19.
3. In that same runtime validation, require literal executable checks test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before any cargo llvm-cov invocation. Do not accept unversioned fallbacks.

Keep the digest-pinned tool image, cargo-llvm-cov 0.8.7 artifact/SHA-256, --network=none, credential/Git isolation, reviewer identities/credential chain, and coverage policy unchanged. Run the focused tests/test_opencode_rust_coverage_toolchain_contract.py first, then the relevant complete central suite. If green, update the PR with exact new head evidence; do not self-approve, undraft, merge, or reuse #816 evidence.

[seonghobae]

@opencode-agent address

Repair the exact current Draft head 4f57decdd3641b54a42ce78253c7c027234d6206 only, on protected base 1131b1bbafb24e455fc8619cdf316813e8721861. Before writing, refetch and require both the PR head and .github/workflows/opencode-review-dispatch.yml blob to remain unchanged; the live workflow blob observed now is b17cf37758abf508d42a7bed8e896bdfb43adc1d.

Exact-head OpenCode Rust Coverage Toolchain Quality CI run 31246896010, job 93076884382, checked out this literal head with persisted credentials disabled and failed exactly the three permanent LLVM runtime-boundary contracts:

1. only one test -x "$LLVM_COV" / test -x "$LLVM_PROFDATA" pair exists; add the second validation inside the isolated runtime;
2. propagate literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 through the existing docker run --rm boundary before the trusted coverage image;
3. inside the isolated-runtime ensure_rust_toolchain(), fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} exactly equal /usr/bin/llvm-cov-19 and /usr/bin/llvm-profdata-19, then require both paths executable before any cargo llvm-cov invocation.

Make only the minimum production correction in .github/workflows/opencode-review-dispatch.yml. Preserve the digest-pinned coverage image, installed llvm-19, image-level ENV bindings and build-time checks, cargo-llvm-cov pinned archive/SHA, exact-head materialization, --network=none, credential/Git isolation, reviewer identities and credential chain, native-fuzz separation, and 100% coverage policy. Do not accept unversioned LLVM fallback, weaken the tests, alter branch protection, or broaden the diff.

Run tests/test_opencode_rust_coverage_toolchain_contract.py first, then the complete current-head central/Strix quality contracts and syntax checks. If the head or target blob moved, do not write; reconcile the new state instead.

[seonghobae]

@opencode-agent address

Exact-head GREEN repair for current Draft head 4f57decdd3641b54a42ce78253c7c027234d6206. Before any write, refetch the PR head/base and .github/workflows/opencode-review-dispatch.yml; the observed workflow blob is b17cf37758abf508d42a7bed8e896bdfb43adc1d. If either moved, do not write.

The exact-head focused quality run 31246896010 / job 93076884382 proves the remaining contract is exactly three RED failures; Security Scan, SAST, CodeQL, Python Security, Secret Scan, OSV, Scorecard, and SBOM are otherwise successful on this head. Preserve the already-green image/build boundary and implement only the missing runtime boundary in .github/workflows/opencode-review-dispatch.yml:

1. In the existing isolated docker run, before "$coverage_tool_image", propagate literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19.
2. Inside the isolated runtime ensure_rust_toolchain(), fail closed unless ${LLVM_COV:-} equals /usr/bin/llvm-cov-19 and ${LLVM_PROFDATA:-} equals /usr/bin/llvm-profdata-19 exactly.
3. In that same runtime validation, require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the first cargo llvm-cov invocation.

Do not add unversioned LLVM fallback, change the digest-pinned coverage image, cargo-llvm-cov artifact/hash, --network=none, credential/Git isolation, reviewer identity/key chain, coverage thresholds, native-fuzz separation, or any workflow entrypoint. Keep the existing RED tests unchanged except for any strictly necessary test maintenance caused by current protected main.

Run python -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py, the complete central pytest/coverage/docstring gates, compile/syntax/diff hygiene, and let exact-head Strix/security/supply-chain workflows rerun. Commit normally to the existing branch only after revalidating the pre-write head/blob identities. Keep Draft; do not approve, merge, or create temporary/write-capable repair workflows.

[seonghobae]

@opencode-agent address

Exact-head bounded GREEN repair for 4f57decdd3641b54a42ce78253c7c027234d6206; target .github/workflows/opencode-review-dispatch.yml blob is b17cf37758abf508d42a7bed8e896bdfb43adc1d. Do not write if either identity has moved.

Current-head OpenCode Rust Coverage Toolchain Quality run 31246896010, job 93076884382, is an intentional RED contract with exactly three failures. The trusted image already satisfies build-time provisioning; finish only the missing runtime boundary:

1. In the existing isolated docker run --rm --init --network=none invocation, before "$coverage_tool_image", propagate the reviewed literal bindings:
   --env LLVM_COV=/usr/bin/llvm-cov-19
--env LLVM_PROFDATA=/usr/bin/llvm-profdata-19
2. Inside the isolated-runtime ensure_rust_toolchain() path, fail closed unless ${LLVM_COV:-} is exactly /usr/bin/llvm-cov-19 and ${LLVM_PROFDATA:-} is exactly /usr/bin/llvm-profdata-19.
3. In that same runtime validation, require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the first cargo llvm-cov invocation.

Preserve the digest-pinned image, llvm-19 package, build-time executable checks, pinned cargo-llvm-cov archive/SHA-256, --network=none, credential/Git isolation, sandbox UID/GID, native-fuzz separation, exact-head coverage evidence, reviewer identities/credentials, and branch protection. Do not add unversioned LLVM fallback, move coverage outside the sandbox, change unrelated workflow behavior, weaken the RED tests, or create temporary/self-modifying/write-capable workflows.

Run the focused LLVM contract first, then the complete central pytest suite, bash scripts/ci/test_strix_quick_gate.sh, Bash/Python syntax/compile gates, exact 100% production statement/branch/public-docstring contracts, and all security/supply-chain checks on the resulting unchanged head. Keep Draft until every exact-head gate and current-head review is clean; do not merge or synthesize approval.