fix(coverage): replace stale LLVM runtime-boundary repair

[seonghobae]

Replacement purpose

Rebuild the Rust coverage LLVM runtime-boundary repair directly from protected main 1131b1bbafb24e455fc8619cdf316813e8721861. Historical PR #816 is based on an older protected-main generation; its checks, reviews, approvals, comments, and synthetic merge results do not transfer.

Do not close #816 until this replacement proves the same bounded repair on the current protected base.

Test-first state

Exact RED head: 3887faba96b50f34cff0ad58e5706427d818ec7d.

This head adds only tests/test_opencode_rust_coverage_toolchain_contract.py. Protected main does not provision/propagate/revalidate the reviewed LLVM 19 paths required by the contract, so the focused test is intentionally RED before production changes.

The permanent contract requires:

1. Debian llvm-19 in the digest-pinned trusted coverage image;
2. exact image bindings LLVM_COV=/usr/bin/llvm-cov-19 and LLVM_PROFDATA=/usr/bin/llvm-profdata-19;
3. build-time executable checks before admitting the pinned cargo-llvm-cov archive;
4. literal propagation of both constants through the isolated docker run boundary; and
5. exact-value plus executable revalidation inside the networkless runtime before Rust coverage.

Required bounded repair

Implement only the minimum contract in .github/workflows/opencode-review-dispatch.yml, add a permanent exact-head quality workflow, current authoritative doctoring/APA 7 evidence, and CHANGELOG traceability. Preserve the digest-pinned image, pinned cargo-llvm-cov artifact and SHA-256, exact-head materialization, --network=none, credential/Git isolation, native-fuzz separation, reviewer identities and credentials, 100% coverage policy, and branch protection.

Current cargo-llvm-cov documentation states that LLVM_COV and LLVM_PROFDATA override those tool paths and must be compatible with rustc's LLVM. Debian bookworm publishes llvm-19 with the versioned coverage tools. No fallback to unversioned LLVM binaries is permitted.

Exact-current-head RED evidence

Current exact head: edddecdfa2b66b61f472db8f754270ffc2fd147c on protected-base generation 1131b1bbafb24e455fc8619cdf316813e8721861.

The current production diff satisfies contract items 1–3: the trusted digest-pinned image installs llvm-19, binds exact /usr/bin/llvm-cov-19 and /usr/bin/llvm-profdata-19 image environment paths, and verifies both executables before admitting the pinned cargo-llvm-cov archive. The exact-head focused quality run remains intentionally RED on the three missing runtime-boundary assertions:

• propagate literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 through the existing isolated docker run before "$coverage_tool_image";
• inside isolated-runtime ensure_rust_toolchain(), fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} exactly equal those reviewed paths;
• require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" inside that runtime validation before the first cargo llvm-cov invocation.

The authoritative workflow blob observed for this exact head is b17cf37758abf508d42a7bed8e896bdfb43adc1d. Any source or head movement invalidates this repair plan and requires a fresh read before mutation. Do not weaken the permanent contract, accept unversioned LLVM fallbacks, move coverage outside the networkless sandbox, or reuse #816 evidence.

Keep Draft until the exact final head passes the focused and complete central suites, all security/supply-chain checks, current-head automated review, zero valid unresolved findings, qualifying independent non-author approval, and branch protection without bypass.

Refs #816 and downstream DiskSage coverage blockers.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 367fa0a3-7a98-40a2-a768-009a60eee957

📥 Commits

Reviewing files that changed from the base of the PR and between 1131b1b and 7f9c197.

📒 Files selected for processing (7)

• .github/workflows/opencode-review-dispatch.yml
• .github/workflows/opencode-rust-coverage-toolchain-quality-ci.yml
• .github/workflows/strix-changed-path-quality-ci.yml
• CHANGELOG.md
• docs/doctoring/strix-quality-timeout-fixtures.md
• tests/test_opencode_rust_coverage_toolchain_contract.py
• tests/test_strix_quality_timeout_fixture_budget.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Complete the bounded Rust coverage runtime-boundary repair on exact current Draft head edddecdfa2b66b61f472db8f754270ffc2fd147c, protected base 1131b1bbafb24e455fc8619cdf316813e8721861. The authoritative .github/workflows/opencode-review-dispatch.yml blob is still b17cf37758abf508d42a7bed8e896bdfb43adc1d; abort and re-read if either identity moves.

Exact-head security/supply-chain workflows are GREEN; only OpenCode Rust Coverage Toolchain Quality CI is RED. The current production diff already satisfies the build-image half of the permanent contract: Debian llvm-19, exact ENV LLVM_COV=/usr/bin/llvm-cov-19, exact ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19, and build-time executable validation before the pinned cargo-llvm-cov archive. Implement only the remaining runtime-boundary contract:

1. In the existing isolated docker run --rm ... "$coverage_tool_image" launch, propagate the reviewed constants literally before the image argument:
   --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19.
2. Inside the isolated-runtime ensure_rust_toolchain(), fail closed unless ${LLVM_COV:-} is exactly /usr/bin/llvm-cov-19 and ${LLVM_PROFDATA:-} is exactly /usr/bin/llvm-profdata-19.
3. In that same runtime validation, require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the first cargo llvm-cov invocation.

Keep tests/test_opencode_rust_coverage_toolchain_contract.py authoritative; do not weaken or bypass it. Preserve the digest-pinned image, pinned cargo-llvm-cov artifact/SHA-256, --network=none, exact-head/base materialization, credential/Git isolation, reviewer identities and credential chain, NVIDIA NIM usage, native-fuzz separation, and existing 100% coverage policy. Do not add any temporary, one-shot, self-modifying, encoded-patch, branch-local repair, competing branch-writer, or write-capable helper workflow.

After the minimal permanent edit, rerun the focused contract plus complete central tests/security/supply-chain gates on the exact new head, and keep Draft until all required exact-head evidence, current automated review, zero actionable threads, qualifying independent non-author approval, and branch protection are satisfied. Do not reuse PR #816 evidence.

[seonghobae]

@opencode-agent Please repair the exact current RED head only if it is still edddecdfa2b66b61f472db8f754270ffc2fd147c on base 1131b1bbafb24e455fc8619cdf316813e8721861, and only if .github/workflows/opencode-review-dispatch.yml still has blob b17cf37758abf508d42a7bed8e896bdfb43adc1d. Refetch all three identities immediately before writing; if any moved, do not mutate and instead review the new state.

The current exact-head OpenCode Rust Coverage Toolchain Quality CI is RED while the same-head security/supply-chain workflows are green. Preserve the existing test-first contract and make only the minimum production repair for the three remaining assertions:

1. In the existing isolated docker run --rm --init --network=none invocation, before "$coverage_tool_image", propagate the reviewed constants literally:
   --env LLVM_COV=/usr/bin/llvm-cov-19 \\
--env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 \\
2. In isolated-runtime ensure_rust_toolchain(), after the existing cargo-llvm-cov availability check and before ensure_rust_gpu_adapter, fail closed unless ${LLVM_COV:-} is exactly /usr/bin/llvm-cov-19 and ${LLVM_PROFDATA:-} is exactly /usr/bin/llvm-profdata-19.
3. In that same runtime validation, require literal executable checks test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before any cargo llvm-cov invocation. Do not accept unversioned fallbacks.

Keep the digest-pinned tool image, cargo-llvm-cov 0.8.7 artifact/SHA-256, --network=none, credential/Git isolation, reviewer identities/credential chain, and coverage policy unchanged. Run the focused tests/test_opencode_rust_coverage_toolchain_contract.py first, then the relevant complete central suite. If green, update the PR with exact new head evidence; do not self-approve, undraft, merge, or reuse #816 evidence.

[seonghobae]

@opencode-agent address

Repair the exact current Draft head 4f57decdd3641b54a42ce78253c7c027234d6206 only, on protected base 1131b1bbafb24e455fc8619cdf316813e8721861. Before writing, refetch and require both the PR head and .github/workflows/opencode-review-dispatch.yml blob to remain unchanged; the live workflow blob observed now is b17cf37758abf508d42a7bed8e896bdfb43adc1d.

Exact-head OpenCode Rust Coverage Toolchain Quality CI run 31246896010, job 93076884382, checked out this literal head with persisted credentials disabled and failed exactly the three permanent LLVM runtime-boundary contracts:

1. only one test -x "$LLVM_COV" / test -x "$LLVM_PROFDATA" pair exists; add the second validation inside the isolated runtime;
2. propagate literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 through the existing docker run --rm boundary before the trusted coverage image;
3. inside the isolated-runtime ensure_rust_toolchain(), fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} exactly equal /usr/bin/llvm-cov-19 and /usr/bin/llvm-profdata-19, then require both paths executable before any cargo llvm-cov invocation.

Make only the minimum production correction in .github/workflows/opencode-review-dispatch.yml. Preserve the digest-pinned coverage image, installed llvm-19, image-level ENV bindings and build-time checks, cargo-llvm-cov pinned archive/SHA, exact-head materialization, --network=none, credential/Git isolation, reviewer identities and credential chain, native-fuzz separation, and 100% coverage policy. Do not accept unversioned LLVM fallback, weaken the tests, alter branch protection, or broaden the diff.

Run tests/test_opencode_rust_coverage_toolchain_contract.py first, then the complete current-head central/Strix quality contracts and syntax checks. If the head or target blob moved, do not write; reconcile the new state instead.

[seonghobae]

@opencode-agent address

Exact-head GREEN repair for current Draft head 4f57decdd3641b54a42ce78253c7c027234d6206. Before any write, refetch the PR head/base and .github/workflows/opencode-review-dispatch.yml; the observed workflow blob is b17cf37758abf508d42a7bed8e896bdfb43adc1d. If either moved, do not write.

The exact-head focused quality run 31246896010 / job 93076884382 proves the remaining contract is exactly three RED failures; Security Scan, SAST, CodeQL, Python Security, Secret Scan, OSV, Scorecard, and SBOM are otherwise successful on this head. Preserve the already-green image/build boundary and implement only the missing runtime boundary in .github/workflows/opencode-review-dispatch.yml:

1. In the existing isolated docker run, before "$coverage_tool_image", propagate literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19.
2. Inside the isolated runtime ensure_rust_toolchain(), fail closed unless ${LLVM_COV:-} equals /usr/bin/llvm-cov-19 and ${LLVM_PROFDATA:-} equals /usr/bin/llvm-profdata-19 exactly.
3. In that same runtime validation, require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the first cargo llvm-cov invocation.

Do not add unversioned LLVM fallback, change the digest-pinned coverage image, cargo-llvm-cov artifact/hash, --network=none, credential/Git isolation, reviewer identity/key chain, coverage thresholds, native-fuzz separation, or any workflow entrypoint. Keep the existing RED tests unchanged except for any strictly necessary test maintenance caused by current protected main.

Run python -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py, the complete central pytest/coverage/docstring gates, compile/syntax/diff hygiene, and let exact-head Strix/security/supply-chain workflows rerun. Commit normally to the existing branch only after revalidating the pre-write head/blob identities. Keep Draft; do not approve, merge, or create temporary/write-capable repair workflows.

[seonghobae]

@opencode-agent address

Exact-head bounded GREEN repair for 4f57decdd3641b54a42ce78253c7c027234d6206; target .github/workflows/opencode-review-dispatch.yml blob is b17cf37758abf508d42a7bed8e896bdfb43adc1d. Do not write if either identity has moved.

Current-head OpenCode Rust Coverage Toolchain Quality run 31246896010, job 93076884382, is an intentional RED contract with exactly three failures. The trusted image already satisfies build-time provisioning; finish only the missing runtime boundary:

1. In the existing isolated docker run --rm --init --network=none invocation, before "$coverage_tool_image", propagate the reviewed literal bindings:
   --env LLVM_COV=/usr/bin/llvm-cov-19
--env LLVM_PROFDATA=/usr/bin/llvm-profdata-19
2. Inside the isolated-runtime ensure_rust_toolchain() path, fail closed unless ${LLVM_COV:-} is exactly /usr/bin/llvm-cov-19 and ${LLVM_PROFDATA:-} is exactly /usr/bin/llvm-profdata-19.
3. In that same runtime validation, require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the first cargo llvm-cov invocation.

Preserve the digest-pinned image, llvm-19 package, build-time executable checks, pinned cargo-llvm-cov archive/SHA-256, --network=none, credential/Git isolation, sandbox UID/GID, native-fuzz separation, exact-head coverage evidence, reviewer identities/credentials, and branch protection. Do not add unversioned LLVM fallback, move coverage outside the sandbox, change unrelated workflow behavior, weaken the RED tests, or create temporary/self-modifying/write-capable workflows.

Run the focused LLVM contract first, then the complete central pytest suite, bash scripts/ci/test_strix_quick_gate.sh, Bash/Python syntax/compile gates, exact 100% production statement/branch/public-docstring contracts, and all security/supply-chain checks on the resulting unchanged head. Keep Draft until every exact-head gate and current-head review is clean; do not merge or synthesize approval.

[seonghobae]

@coderabbitai review

@cwl-noema-review @opencode-agent Review only exact current head 7f9c197e2c03e19330a21bcc11d7066d6a9543f1. Protected main is an ancestor at 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba; all ten exact-head quality/security/supply-chain workflows are successful and no inline thread is open. Verify exact LLVM 19 image installation, literal LLVM_COV/LLVM_PROFDATA propagation through the networkless Docker boundary, in-runtime exact-value/executable revalidation before cargo-llvm-cov, immutable tool/archive pins, no unversioned fallback, and unchanged credential/reviewer authority. Review only; do not modify, merge, retarget, or alter branch protection.

[coderabbitai]

@seonghobae I will review only head 7f9c197e2c03e19330a21bcc11d7066d6a9543f1.

I will verify the LLVM 19 image setup, literal Docker environment propagation, runtime validation before cargo llvm-cov, immutable pins, absence of unversioned fallbacks, and unchanged credential and reviewer authority. I will not modify, merge, retarget, or change branch protection.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.