fix(review): coverage evidence tooling for numpy and Rust repositories

[seonghobae]

Problem

Since 2026-07-14 the offline coverage sandbox has structurally been unable to produce passing evidence for any repository that needs third-party Python packages or a modern Rust toolchain. Every such PR (all 47 open fast-mlsirm PRs, including the #160 model-design PR) is stuck at REQUEST_CHANGES with "coverage-evidence result was failure":

• Python: the sandbox runs the repository's pytest suite with only the trusted toolchain installed (coverage, interrogate, pytest, pytest-cov, uv). Target dependencies are never installed (scripts/ci/install_python_requirements_for_coverage.py exists but is not wired into any workflow), so every test module fails collection with ModuleNotFoundError: No module named 'numpy' — see run 29875093850 for fast-mlsirm#160.
• Rust: cargo llvm-cov aborts with failed to find llvm-tools-preview. The image only has the Ubuntu-noble rustc/cargo 1.75, which additionally cannot parse version-4 Cargo.lock files (fast-mlsirm, wardnet, …), and the --network=none sandbox has no way to download crates even if it could build.

Fix (fail-closed offline design unchanged)

1. numpy in the trusted toolchain — numpy==2.5.1 added to requirements-opencode-review-ci.txt; the hashes file regenerated with uv pip compile --generate-hashes --no-header --no-annotate --python-version 3.12 --python-platform x86_64-manylinux_2_28. Empirically verified against fast-mlsirm main: with numpy alone the suite passes (156 passed, 72 skipped — the Rust-parity tests importorskip cleanly when fast_mlsirm._core is absent).
2. Pinned rustup toolchain in the image — sha256-pinned rustup-init 1.28.2 provisions Rust 1.94.1 with llvm-tools-preview under /usr/local/rustup, symlinked into /usr/local/bin so it shadows the distribution rustc. No mutable sh.rustup.rs installer is used (the existing contract test forbidding it still passes).
3. Offline crate cache — the online coverage-source-tree job now runs cargo fetch --locked into the tree-local CARGO_HOME (.opencode-sandbox-home/.cargo) that the sandbox already sets, and the sandbox exports CARGO_NET_OFFLINE=true so cargo resolves strictly from that cache. cargo fetch downloads content-addressed crates and executes no build scripts; a failed prefetch keeps today's behavior (the offline build surfaces the missing dependencies).

Verification

• coverage run -m pytest tests — 634 passed, coverage report — 100% over scripts/ci
• interrogate — 100.0%
• Workflow YAML parses; contract assertions about the sandbox (docker build … --network=default before docker run … --network=none, https://sh.rustup.rs absent, pinned cargo-llvm-cov retained, pytest-cov==7.1.0 hash retained) all hold.

Developer experience: unblocks the fast-mlsirm review/merge queue (and every other numpy/Rust repository) without weakening any gate — evidence is still produced offline, from pinned tooling, under the same sandbox identity.

User experience: no user-facing behavior change; review verdicts for scientific-Python/Rust repositories become meaningful instead of unconditionally failing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ERVynrYEjd2TwYvusVpA9f

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/opencode-review.yml:306

• git ls-files 'Cargo.toml' '*/Cargo.toml' only matches Cargo.toml at repo root or one directory deep, so nested workspaces like crates/foo/Cargo.toml (and any deeper) won’t have their locked crate graphs prefetched. That can leave the offline sandbox without a complete crate cache even though the comment says nested manifests are covered.

          prefetch_manifests="$(git -C "$COVERAGE_SOURCE_WORKDIR" ls-files 'Cargo.toml' '*/Cargo.toml')"

[seonghobae]

Closing as functionally superseded. While this PR waited out the provider-pool outage, equivalent fixes landed on main through the parallel repair effort: target-repository Python requirements are now materialized for the offline coverage sandbox (scripts/ci/materialize_base_python_requirements.py, refined by #644), the pnpm/Node coverage path gained the same offline prefetch treatment (#641–#643, #645), and the model pool gained a public free-model fallback (#646). End-to-end proof: fast-mlsirm dependabot PRs #194/#195/#197 were reviewed, approved, and auto-merged on 2026-07-26, which requires both the Python and Rust coverage evidence paths to succeed for that repository.

The diagnosis this PR documented (numpy-less pytest collection failures, missing llvm-tools/v4-lockfile-incapable distro cargo, no offline crate cache) remains accurate as history; if Rust coverage regressions resurface for cargo llvm-cov repositories, the pinned-rustup + cargo fetch --locked prefetch approach here is available to revive from branch claude/fast-mlsirm-pr-review-mt2e1z.

---

Generated by Claude Code