fix(coverage): keep native fuzz locks out of generic images - #763

#!/bin/bash
set -euo pipefail

head='e4a704c25761de68b288d8c3b17d09dd395f7a9b'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'

printf '%s\n' '== Commit identities =='
git show -s --format='HEAD %H%nParents %P%nSubject %s' "$head"
git show -s --format='BASE %H%nSubject %s' "$base"

printf '%s\n' '== Changed files =='
git diff --name-status "$base" "$head"

printf '%s\n' '== Materializer outline =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true

printf '%s\n' '== Materializer diff =='
git diff --unified=100 "$base" "$head" -- scripts/ci/materialize_base_python_requirements.py

printf '%s\n' '== Relevant test outline =='
ast-grep outline tests/test_coverage_native_fuzz_lock_boundary.py --items all || true

printf '%s\n' '== Relevant test content =='
cat -n tests/test_coverage_native_fuzz_lock_boundary.py

printf '%s\n' '== Materializer contract tests and configuration locations =='
rg -n -C 3 --glob '*.py' --glob 'pyproject.toml' --glob 'pytest.ini' --glob '.coveragerc' \
  '(materialize_base_python_requirements|branch|coverage|docstring)' .

printf '%s\n' '== CodeQL revision diff and current workflow =='
git diff --unified=30 "$base" "$head" -- .github/workflows/scheduled-security-scan.yml
cat -n .github/workflows/scheduled-security-scan.yml

printf '%s\n' '== Fuzz workflow references =='
rg -n -C 4 --glob '*.yml' --glob '*.yaml' '(atheris|Atheris|fuzz)' .github

printf '%s\n' '== Boundary documentation and changelog =='
cat -n docs/doctoring/coverage-native-fuzz-lock-boundary.md
cat -n CHANGELOG.md

#!/bin/bash
set -euo pipefail

head='e4a704c25761de68b288d8c3b17d09dd395f7a9b'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'

printf '%s\n' '== Exact commit and file delta =='
git rev-parse "$head"
git rev-parse "$base"
git diff --name-status "$base" "$head"

printf '%s\n' '== Current materializer =='
cat -n scripts/ci/materialize_base_python_requirements.py

printf '%s\n' '== Materializer change =='
git diff --unified=35 "$base" "$head" -- scripts/ci/materialize_base_python_requirements.py

printf '%s\n' '== New boundary test =='
cat -n tests/test_coverage_native_fuzz_lock_boundary.py

printf '%s\n' '== Existing materializer tests =='
rg -n -C 5 --glob '*.py' \
  'materialize_base_python_requirements|_is_candidate_lock_name|_is_native_fuzz_engine_lock_name|symlink|ls-tree|hash' \
  tests scripts/ci/materialize_base_python_requirements.py

printf '%s\n' '== Fuzz workflow filenames =='
fd -t f -e yml -e yaml .github/workflows | sort | while read -r path; do
  if rg -q -i 'atheris|requirements-atheris|fuzz' "$path"; then
    printf '\n--- %s ---\n' "$path"
    rg -n -i -C 6 'atheris|requirements-atheris|fuzz' "$path"
  fi
done

printf '%s\n' '== PR state and checks =='
gh pr view 763 --repo ContextualWisdomLab/.github \
  --json number,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
  --jq '{number, headRefOid, baseRefOid, state, isDraft, mergeStateStatus, reviewDecision, checks: [.statusCheckRollup[]? | {name, status, conclusion}], reviews: [.reviews[]? | {author: .author.login, state, commit: .commit.oid}]}' || true

#!/bin/bash
set -euo pipefail

head='e4a704c25761de68b288d8c3b17d09dd395f7a9b'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'

printf '%s\n' '== Existing malformed-tree and output-symlink tests =='
sed -n '157,210p;300,355p' tests/test_materialize_base_python_requirements.py

printf '%s\n' '== Candidate-name contract, including similar Atheris names =='
sed -n '128,156p' tests/test_materialize_base_python_requirements.py
rg -n -C 3 --glob '*.py' 'requirements-atheris-regression\.txt|requirements-atheris[^[:space:]]*\.txt' tests

printf '%s\n' '== Dedicated fuzz workflow references =='
fd . .github/workflows -t f -e yml -e yaml -0 |
  xargs -0 rg -l -i 'atheris|requirements-atheris|fuzz' |
  sort |
  while read -r path; do
    printf '\n--- %s ---\n' "$path"
    rg -n -i -C 8 'atheris|requirements-atheris|fuzz' "$path"
  done

printf '%s\n' '== Strix requirement changes =='
git diff --unified=12 "$base" "$head" -- requirements-strix-ci.txt requirements-strix-ci-hashes.txt
printf '%s\n' '== Current selected Strix versions =='
rg -n '^(aiohttp|cryptography|pyopenssl|pyOpenSSL)==' requirements-strix-ci.txt requirements-strix-ci-hashes.txt

printf '%s\n' '== Current PR state and checks =='
gh pr view 763 --repo ContextualWisdomLab/.github \
  --json number,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
  --jq '{number, headRefOid, baseRefOid, state, isDraft, mergeStateStatus, reviewDecision, checks: [.statusCheckRollup[]? | {name, status, conclusion}], reviews: [.reviews[]? | {author: .author.login, state, commit: .commit.oid}]}' \
  || printf '%s\n' 'GitHub CLI query was unavailable.'

printf '%s\n' '== Current-head workflow contract assertions =='
rg -n -C 3 --glob '*.py' \
  'test_codeql_action_steps_use_one_version_per_workflow|scheduled-security-scan|100%|interrogate' \
  tests

#!/bin/bash
set -euo pipefail

head='c2120a2bc8b7d52c100b4271a5fad17ef716ab39'
base='08d83dd2c2e4ba3ff577c9c8e53442260b3b0ff9'
repo='ContextualWisdomLab/.github'

echo '== Exact revisions =='
git show -s --format='HEAD %H%nPARENTS %P%nSUBJECT %s' "$head"
git show -s --format='BASE %H%nSUBJECT %s' "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=true'
echo 'checked-out=' "$(git rev-parse HEAD)"

echo '== Changed files =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"

echo '== Focused diff =='
git diff --unified=80 "$base" "$head" -- \
  scripts/ci/materialize_base_python_requirements.py \
  tests/test_coverage_native_fuzz_lock_boundary.py \
  tests/test_materialize_base_python_requirements.py \
  .github/workflows \
  pyproject.toml \
  CHANGELOG.md \
  docs/doctoring/coverage-native-fuzz-lock-boundary.md

echo '== Materializer structure and source =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all
sed -n '1,420p' scripts/ci/materialize_base_python_requirements.py

echo '== Boundary test structure and source =='
ast-grep outline tests/test_coverage_native_fuzz_lock_boundary.py --items all
sed -n '1,360p' tests/test_coverage_native_fuzz_lock_boundary.py

echo '== Existing materializer security contracts =='
rg -n -C 6 --glob '*.py' \
  '(_is_native_fuzz_engine_lock_name|_is_candidate_lock_name|requirements-atheris|symlink|malformed|non-blob|ls-tree|require-hashes|determin|base_sha|rev-parse|git show)' \
  tests scripts/ci

echo '== Coverage and docstring enforcement =='
rg -n -i -C 5 \
  -g '*.toml' -g '*.ini' -g '*.yml' -g '*.yaml' -g 'Makefile' -g '*.py' \
  '(coverage run|coverage report|--branch|branch[[:space:]]*=[[:space:]]*true|--cov-branch|fail_under|fail-under|interrogate|test_docstrings|coverage-evidence)' \
  .github pyproject.toml tests scripts 2>/dev/null || true

echo '== Fuzz workflow references and workflow delta =='
fd -t f -e yml -e yaml . .github/workflows | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    echo "--- $path"
    rg -n -i -C 5 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done
git diff --name-status "$base" "$head" -- .github/workflows

echo '== Documentation =='
sed -n '1,260p' docs/doctoring/coverage-native-fuzz-lock-boundary.md
sed -n '1,220p' CHANGELOG.md

echo '== Current PR status and checks =='
gh pr view 763 --repo "$repo" \
  --json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
  --jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}],reviews:[.reviews[]? | {author:.author.login,state,commit:.commit.oid}]}' \
  || true

#!/bin/bash
set -euo pipefail

log='/tmp/coderabbit-shell-logs/shell-output-bASNaF'
head='c2120a2bc8b7d52c100b4271a5fad17ef716ab39'
base='08d83dd2c2e4ba3ff577c9c8e53442260b3b0ff9'

echo '== Revision and changed-file evidence from first inspection =='
rg -n -A35 -B2 '== Exact revisions ==|== Changed files ==|== Focused diff ==' "$log" | head -n 160

echo '== Current classifier and materialization path =='
rg -n -C 5 \
  'NATIVE_FUZZ_ENGINE_LOCK_NAMES|def _is_native_fuzz_engine_lock_name|def _is_candidate_lock_name|def materialize|sorted\(|ls-tree|base_sha|require_hash' \
  scripts/ci/materialize_base_python_requirements.py

echo '== Boundary fixture assertions =='
rg -n -C 8 \
  'requirements-atheris|requirements-property|requirements-fuzz-regression|materialize|manifest|native_fuzz' \
  tests/test_coverage_native_fuzz_lock_boundary.py

echo '== Docstring test and its enforcement =='
if [ -f tests/test_docstrings.py ]; then
  sed -n '1,260p' tests/test_docstrings.py
else
  echo 'tests/test_docstrings.py is absent'
fi
rg -n -C 4 --glob 'test_docstrings.py' \
  'interrogate|fail-under|100|subprocess|returncode|assert' tests

echo '== Dedicated Fuzz workflow and exact workflow changes =='
fd -t f -e yml -e yaml .github/workflows | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    printf '%s\n' "--- $path"
    rg -n -i -C 4 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done
git diff --name-status "$base" "$head" -- .github/workflows

echo '== Current check state =='
gh pr view 763 --repo ContextualWisdomLab/.github \
  --json headRefOid,mergeStateStatus,statusCheckRollup \
  --jq '{headRefOid,mergeStateStatus,checks:[.statusCheckRollup[]? | select(.name=="strix" or .name=="coverage-evidence" or .name=="opencode-review") | {name,status,conclusion}]}' \
  || true

#!/bin/bash
set -euo pipefail

head='54591186557d8251f9c2967c11cd98ff926d6464'
base='4d076f636b6de5043e8501e93c06ed0a8c896eb3'
repo='ContextualWisdomLab/.github'

printf '%s\n' '== Exact revision identity =='
git show -s --format='HEAD %H%nPARENTS %P%nSUBJECT %s' "$head"
git show -s --format='BASE %H%nSUBJECT %s' "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=true'
printf 'checked-out=%s\n' "$(git rev-parse HEAD)"

printf '%s\n' '== Exact changed files =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"

printf '%s\n' '== Focused diff =='
git diff --unified=80 "$base" "$head" -- \
  scripts/ci/materialize_base_python_requirements.py \
  tests/test_coverage_native_fuzz_lock_boundary.py \
  tests/test_materialize_base_python_requirements.py \
  .github/workflows \
  pyproject.toml \
  CHANGELOG.md \
  docs/doctoring/coverage-native-fuzz-lock-boundary.md

printf '%s\n' '== Materializer map and relevant implementation =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all
rg -n -C 8 \
  'NATIVE_FUZZ_ENGINE_LOCK_NAMES|def _is_native_fuzz_engine_lock_name|def _is_candidate_lock_name|def materialize|ls-tree|rev-parse|git show|sorted\(|require-hashes|failure' \
  scripts/ci/materialize_base_python_requirements.py

printf '%s\n' '== Boundary and existing security test maps =='
ast-grep outline tests/test_coverage_native_fuzz_lock_boundary.py --items all
ast-grep outline tests/test_materialize_base_python_requirements.py --items all
sed -n '1,360p' tests/test_coverage_native_fuzz_lock_boundary.py
rg -n -C 6 --glob '*.py' \
  'requirements-atheris|native_fuzz|symlink|malformed|non_blob|non-blob|base_sha|require_hash|determin|failure.summary|failure_summary|diagnostic' \
  tests scripts/ci

printf '%s\n' '== Coverage and docstring gate configuration =='
rg -n -i -C 5 \
  -g '*.toml' -g '*.ini' -g '*.yml' -g '*.yaml' -g 'Makefile' -g '*.py' \
  '(coverage run|coverage report|--branch|branch[[:space:]]*=[[:space:]]*true|--cov-branch|fail_under|fail-under|interrogate|test_docstrings|coverage-evidence|diagnostics)' \
  .github pyproject.toml tests scripts 2>/dev/null || true

printf '%s\n' '== Dedicated fuzz workflow and workflow delta =='
fd -t f -e yml -e yaml .github/workflows | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    printf '%s\n' "--- $path"
    rg -n -i -C 5 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done
git diff --name-status "$base" "$head" -- .github/workflows

printf '%s\n' '== Documentation =='
sed -n '1,260p' docs/doctoring/coverage-native-fuzz-lock-boundary.md
sed -n '1,220p' CHANGELOG.md

printf '%s\n' '== Current PR state and specified workflow run =='
gh pr view 763 --repo "$repo" \
  --json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
  --jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}],reviews:[.reviews[]? | {author:.author.login,state,commit:.commit.oid}]}' \
  || true
gh run view 30990945724 --repo "$repo" \
  --json databaseId,headSha,status,conclusion,name,workflowName,event,url,jobs \
  --jq '{databaseId,headSha,status,conclusion,name,workflowName,event,url,jobs:[.jobs[]? | {name,status,conclusion}]}' \
  || true

#!/bin/bash
set -euo pipefail

head='54591186557d8251f9c2967c11cd98ff926d6464'
base='4d076f636b6de5043e8501e93c06ed0a8c896eb3'
repo='ContextualWisdomLab/.github'
log='/tmp/coderabbit-shell-logs/shell-output-fFiD7S'

printf '%s\n' '== Identity and exact changed-file summary from prior log =='
sed -n '1,180p' "$log"

printf '%s\n' '== Exact diff: materializer, boundary fixture, diagnostics workflow, and documentation =='
git diff --unified=55 "$base" "$head" -- \
  scripts/ci/materialize_base_python_requirements.py \
  tests/test_coverage_native_fuzz_lock_boundary.py \
  .github/workflows/opencode-coverage-diagnostics-ci.yml \
  CHANGELOG.md \
  docs/doctoring/coverage-native-fuzz-lock-boundary.md

printf '%s\n' '== Current materializer: complete relevant section =='
sed -n '1,290p' scripts/ci/materialize_base_python_requirements.py

printf '%s\n' '== Current boundary fixture =='
cat -n tests/test_coverage_native_fuzz_lock_boundary.py

printf '%s\n' '== Existing hostile-input and diagnostics tests =='
rg -n -C 8 --glob 'test_materialize_base_python_requirements.py' \
  '(invalid_base|malformed_git_tree|non_blob|symlink_output|require_hash|determin|candidate_lock|base_sha)' \
  tests
cat -n tests/test_coverage_materializer_failure_diagnostics.py

printf '%s\n' '== Permanent diagnostics workflow coverage and docstring steps =='
sed -n '1,190p' .github/workflows/opencode-coverage-diagnostics-ci.yml

printf '%s\n' '== Dedicated Fuzz workflow references and PR workflow delta =='
fd -t f -e yml -e yaml .github/workflows | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    printf '%s\n' "--- $path"
    rg -n -i -C 5 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done
git diff --name-status "$base" "$head" -- .github/workflows

printf '%s\n' '== Exact PR state and exact run =='
gh pr view 763 --repo "$repo" \
  --json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup \
  --jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}]}' \
  || true
gh run view 30990945724 --repo "$repo" \
  --json databaseId,headSha,status,conclusion,name,workflowName,event,url,jobs \
  --jq '{databaseId,headSha,status,conclusion,name,workflowName,event,url,jobs:[.jobs[]? | {name,status,conclusion}]}' \
  || true

printf '%s\n' '== Exact run evidence for diagnostics, branch coverage, and docstring coverage =='
gh run view 30990945724 --repo "$repo" --log 2>&1 | \
  rg -n -i -C 5 \
  '(Run diagnostics and lock contracts|--cov-branch|--cov-fail-under=100|TOTAL|coverage|Enforce complete production docstrings|interrogate|100%|passed|failed)' \
  || true

#!/bin/bash
set -euo pipefail

head='54591186557d8251f9c2967c11cd98ff926d6464'
base='4d076f636b6de5043e8501e93c06ed0a8c896eb3'
repo='ContextualWisdomLab/.github'

printf '%s\n' '== Dedicated Fuzz workflow references =='
fd -t f -e yml -e yaml . .github/workflows | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    printf '%s\n' "--- $path"
    rg -n -i -C 6 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done

printf '%s\n' '== Workflow changes in the exact diff =='
git diff --name-status "$base" "$head" -- .github/workflows
git diff --unified=20 "$base" "$head" -- .github/workflows/opencode-coverage-diagnostics-ci.yml

printf '%s\n' '== Current PR status and check results =='
gh pr view 763 --repo "$repo" \
  --json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup \
  --jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}]}' \
  || true

printf '%s\n' '== Exact run identity and job results =='
gh run view 30990945724 --repo "$repo" \
  --json databaseId,headSha,status,conclusion,name,workflowName,event,url,jobs \
  --jq '{databaseId,headSha,status,conclusion,name,workflowName,event,url,jobs:[.jobs[]? | {name,status,conclusion}]}' \
  || true

printf '%s\n' '== Exact run contract evidence =='
gh run view 30990945724 --repo "$repo" --log 2>&1 | \
  rg -n -i -C 4 \
  '(Run diagnostics and lock contracts with full branch coverage|--cov-branch|--cov-fail-under=100|TOTAL|Enforce complete production docstrings|interrogate|100\.0%|100%|passed|failed)' \
  || true

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='763'

echo '== Current PR identity and checks =='
pr_json="$(gh pr view "$pr" --repo "$repo" \
  --json headRefOid,baseRefOid,baseRefName,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews)"
printf '%s\n' "$pr_json" | jq '{
  headRefOid, baseRefOid, baseRefName, state, isDraft, mergeStateStatus, reviewDecision,
  checks: [.statusCheckRollup[]? | {name, status, conclusion, detailsUrl}],
  reviews: [.reviews[]? | {author: .author.login, state, commit: .commit.oid}]
}'

head="$(printf '%s\n' "$pr_json" | jq -r '.headRefOid')"
base="$(printf '%s\n' "$pr_json" | jq -r '.baseRefOid')"
printf 'head=%s\nbase=%s\n' "$head" "$base"

echo '== Exact commit identities and changed files =='
git show -s --format='HEAD %H%nPARENTS %P%nSUBJECT %s' "$head"
git show -s --format='BASE %H%nSUBJECT %s' "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=true'
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"

echo '== Exact focused diff =='
git diff --unified=60 "$base" "$head" -- \
  scripts/ci/materialize_base_python_requirements.py \
  tests/test_coverage_native_fuzz_lock_boundary.py \
  tests/test_materialize_base_python_requirements.py \
  .github/workflows \
  pyproject.toml \
  CHANGELOG.md \
  docs/doctoring/coverage-native-fuzz-lock-boundary.md

echo '== Materializer and test structure =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all
ast-grep outline tests/test_coverage_native_fuzz_lock_boundary.py --items all
rg -n -C 7 \
  'NATIVE_FUZZ_ENGINE_LOCK_NAMES|_is_native_fuzz_engine_lock_name|_is_candidate_lock_name|PurePosixPath|ls-tree|rev-parse|git show|require-hashes|sorted\(|symlink|malformed' \
  scripts/ci/materialize_base_python_requirements.py \
  tests/test_coverage_native_fuzz_lock_boundary.py \
  tests/test_materialize_base_python_requirements.py

echo '== Coverage/docstring gate definitions =='
rg -n -i -C 5 \
  -g '*.toml' -g '*.yml' -g '*.yaml' -g '*.py' \
  '(coverage.*branch|--cov-branch|coverage run.*--branch|branch[[:space:]]*=[[:space:]]*true|cov-fail-under|fail_under|interrogate|fail-under|test_docstrings|coverage-evidence|diagnostics)' \
  .github pyproject.toml tests scripts 2>/dev/null || true

echo '== Dedicated fuzz workflow and documentation delta =='
fd -t f -e yml -e yaml .github/workflows | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    echo "--- $path"
    rg -n -i -C 5 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done
git diff --name-status "$base" "$head" -- .github/workflows
if [ -f docs/doctoring/coverage-native-fuzz-lock-boundary.md ]; then
  cat -n docs/doctoring/coverage-native-fuzz-lock-boundary.md
fi
if [ -f CHANGELOG.md ]; then
  sed -n '1,180p' CHANGELOG.md
fi

echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,headSha,name,workflowName,status,conclusion,url \
  --jq '.[] | {databaseId,headSha,name,workflowName,status,conclusion,url}' || true

echo '== Protected-branch settings =='
branch="$(printf '%s\n' "$pr_json" | jq -r '.baseRefName')"
gh api "repos/$repo/branches/$branch/protection" \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,required_signatures,enforce_admins}' \
  || true

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
head='66d5a26498503361aa814e5be742ac8c6335246b'
branch='fix/opencode-coverage-failure-diagnostics'

echo '== Exact-head check runs, grouped by latest check name =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
  --jq '
    [.check_runs[]
      | {name, status, conclusion, started_at, completed_at, details_url, app: .app.slug}]
    | sort_by(.name, .completed_at)
    | group_by(.name)
    | map(last)
    | sort_by(.name)' || true

echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,headSha,name,workflowName,status,conclusion,url \
  --jq '.[] | {databaseId, headSha, name, workflowName, status, conclusion, url}' || true

echo '== Exact-head coverage diagnostics run details =='
run_ids="$(gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,workflowName,conclusion \
  --jq -r '.[] | select(.workflowName == "OpenCode Coverage Diagnostics CI") | .databaseId' || true)"
if [ -z "$run_ids" ]; then
  echo 'No exact-head OpenCode Coverage Diagnostics CI run was found.'
else
  while IFS= read -r run_id; do
    [ -n "$run_id" ] || continue
    echo "--- run $run_id ---"
    gh run view "$run_id" --repo "$repo" \
      --json databaseId,headSha,status,conclusion,workflowName,jobs,url \
      --jq '{databaseId,headSha,status,conclusion,workflowName,url,jobs:[.jobs[] | {name,status,conclusion}]}' || true
    gh run view "$run_id" --repo "$repo" --log 2>&1 | rg -n -i -C 3 \
      '(Run diagnostics and lock contracts|--cov-branch|--cov-fail-under=100|TOTAL|100%|Enforce complete production docstrings|interrogate|passed|failed)' \
      || true
  done <<<"$run_ids"
fi

echo '== Dedicated fuzz workflow references and exact workflow delta =='
fd . .github/workflows -t f -e yml -e yaml | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    echo "--- $path"
    rg -n -i -C 4 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done
git diff --name-status '4d076f636b6de5043e8501e93c06ed0a8c896eb3' "$head" -- .github/workflows

echo '== Protected-branch settings =='
if ! gh api "repos/$repo/branches/$branch/protection" \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,required_signatures,enforce_admins}'; then
  echo 'Branch-protection settings were not accessible to this review token.'
fi

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='763'

echo '== Exact current PR identity and checks =='
pr_json="$(gh pr view "$pr" --repo "$repo" \
  --json headRefOid,baseRefOid,baseRefName,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews)"
printf '%s\n' "$pr_json" | jq '{
  headRefOid, baseRefOid, baseRefName, state, isDraft, mergeStateStatus, reviewDecision,
  checks: [.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}],
  reviews: [.reviews[]? | {author:.author.login,state,commit:.commit.oid}]
}'
head="$(printf '%s\n' "$pr_json" | jq -r '.headRefOid')"
base="$(printf '%s\n' "$pr_json" | jq -r '.baseRefOid')"
printf 'head=%s\nbase=%s\n' "$head" "$base"

echo '== Revision relationship and changed files =='
git show -s --format='HEAD %H%nPARENTS %P%nSUBJECT %s' "$head"
git show -s --format='BASE %H%nSUBJECT %s' "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=true'
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"

echo '== Materializer map and focused implementation =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all
rg -n -C 8 \
  'NATIVE_FUZZ_ENGINE_LOCK_NAMES|_is_native_fuzz_engine_lock_name|_is_candidate_lock_name|PurePosixPath|ls-tree|rev-parse|git show|require-hashes|sorted\(|symlink|malformed' \
  scripts/ci/materialize_base_python_requirements.py \
  tests/test_coverage_native_fuzz_lock_boundary.py \
  tests/test_materialize_base_python_requirements.py

echo '== Exact boundary fixture =='
cat -n tests/test_coverage_native_fuzz_lock_boundary.py

echo '== Focused diff =='
git diff --unified=70 "$base" "$head" -- \
  scripts/ci/materialize_base_python_requirements.py \
  tests/test_coverage_native_fuzz_lock_boundary.py \
  tests/test_materialize_base_python_requirements.py \
  .github/workflows \
  pyproject.toml \
  CHANGELOG.md \
  docs/doctoring/coverage-native-fuzz-lock-boundary.md

echo '== Coverage, docstring, fuzz, and credential controls =='
rg -n -i -C 5 \
  -g '*.toml' -g '*.yml' -g '*.yaml' -g '*.py' \
  '(--cov-branch|--cov-fail-under=100|coverage.*branch|interrogate.*fail-under|requirements-atheris\.txt|atheris|fuzz|NVIDIA|NIM|reviewer.*token|reviewer.*credential|OPENCODE|credential)' \
  .github pyproject.toml tests scripts 2>/dev/null || true
git diff --unified=45 "$base" "$head" -- .github/workflows

echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,headSha,name,workflowName,status,conclusion,url \
  --jq '.[] | {databaseId,headSha,name,workflowName,status,conclusion,url}' || true

echo '== Protected-branch settings =='
branch="$(printf '%s\n' "$pr_json" | jq -r '.baseRefName')"
gh api "repos/$repo/branches/$branch/protection" \
  --jq '{required_status_checks,required_pull_request_reviews,required_linear_history,required_signatures,enforce_admins}' \
  || true

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='763'
head='66d5a26498503361aa814e5be742ac8c6335246b'
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"

echo '== Current PR state =='
gh pr view "$pr" --repo "$repo" \
  --json state,mergedAt,headRefOid,baseRefOid,mergeStateStatus,reviewDecision \
  --jq '{state,mergedAt,headRefOid,baseRefOid,mergeStateStatus,reviewDecision}'

echo '== Exact changed files =='
git diff --name-status "$base" "$head"

echo '== Exact materializer change =='
git diff --unified=45 "$base" "$head" -- scripts/ci/materialize_base_python_requirements.py
echo '== Current relevant materializer code =='
sed -n '1,260p' scripts/ci/materialize_base_python_requirements.py

echo '== Boundary fixture assertions =='
cat -n tests/test_coverage_native_fuzz_lock_boundary.py

echo '== Existing hostile-tree and hash contracts =='
rg -n -C 5 --glob 'test_materialize_base_python_requirements.py' \
  '(malformed|symlink|non_blob|non-blob|require_hash|require-hashes|base_sha|determin|candidate_lock)' \
  tests/test_materialize_base_python_requirements.py

echo '== Exact changed workflow files =='
git diff --name-status "$base" "$head" -- .github/workflows
echo '== Credential-sensitive diff only =='
git diff --unified=25 "$base" "$head" -- \
  .github/workflows/opencode-review-dispatch.yml \
  .github/workflows/opencode-review.yml \
  .github/workflows/strix.yml \
  opencode.jsonc

echo '== Dedicated fuzz workflow changes and current references =='
git diff --name-status "$base" "$head" -- .github/workflows | rg -i 'fuzz|atheris' || true
fd -t f -e yml -e yaml .github/workflows | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    printf '%s\n' "--- $path"
    rg -n -i -C 3 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done

echo '== Exact coverage run results =='
gh run view 30991153826 --repo "$repo" \
  --json headSha,status,conclusion,workflowName,jobs \
  --jq '{headSha,status,conclusion,workflowName,jobs:[.jobs[] | {name,status,conclusion}]}' 
gh run view 30991153826 --repo "$repo" --log 2>&1 | \
  rg -n -i -C 4 \
  '(Run diagnostics and lock contracts|--cov-branch|--cov-fail-under=100|TOTAL|100%|Enforce complete production docstrings|interrogate|passed|failed)' || true

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
head='66d5a26498503361aa814e5be742ac8c6335246b'
base='4d076f636b6de5043e8501e93c06ed0a8c896eb3'

echo '== Dedicated fuzz workflow references =='
fd -t f -e yml -e yaml . .github/workflows | sort | while IFS= read -r path; do
  if rg -qi '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"; then
    printf '%s\n' "--- $path"
    rg -n -i -C 4 '(requirements-atheris\.txt|atheris|clusterfuzz|fuzz)' "$path"
  fi
done

echo '== Dedicated fuzz workflow delta =='
git diff --name-status "$base" "$head" -- .github/workflows | rg -i '(fuzz|atheris)' || true

echo '== Exact diagnostics-run status =='
gh run view 30991153826 --repo "$repo" \
  --json headSha,status,conclusion,workflowName,jobs \
  --jq '{headSha,status,conclusion,workflowName,jobs:[.jobs[] | {name,status,conclusion}]}'

echo '== Exact branch-coverage and docstring evidence =='
log_file="$(mktemp)"
gh run view 30991153826 --repo "$repo" --log >"$log_file" 2>&1 || true
rg -n -i -C 5 \
  '(Run diagnostics and lock contracts|--cov-branch|--cov-fail-under=100|TOTAL|100%|Enforce complete production docstrings|interrogate|passed|failed)' \
  "$log_file" || true
rm -f "$log_file"