fix(coverage): preserve LLVM 19 across isolated Rust evidence

[seonghobae]

Purpose

Restore the central OpenCode Rust coverage path required by DiskSage exact-head review without weakening fail-closed coverage, source, credential, network, or approval boundaries.

Exact current state

Current exact head: 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643.

Protected base main: e71fdab2ab088001f218765ecb5e3b7fabfee11a.

This head remains intentionally RED. No predecessor-head test, review, approval, or generated merge-tree evidence authorizes it.

The permanent regression contract requires:

1. Debian LLVM 19 in the trusted coverage image.
2. Exact LLVM_COV=/usr/bin/llvm-cov-19 and LLVM_PROFDATA=/usr/bin/llvm-profdata-19 image bindings.
3. Build-time executable validation for both tools before the pinned cargo-llvm-cov archive is admitted.
4. Literal propagation of both reviewed constants through the isolated docker run boundary.
5. A second fail-closed exact-value and executable validation inside the networkless runtime before the first Rust coverage invocation.

Current implementation and RED evidence

Exact head 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643 now implements items 1–3 directly in the authoritative production workflow:

• Debian llvm-19 is installed in the existing digest-pinned trusted coverage image;
• the image sets literal ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19;
• both executables are validated before the pinned cargo-llvm-cov v0.8.7 archive is downloaded or installed.

Exact-head OpenCode Rust Coverage Toolchain Quality CI run 31170299456, job 92840404399, proves that this partial implementation is visible and also proves the remaining boundary is still absent:

• only the build-time executable checks exist;
• the isolated docker run does not yet receive the literal LLVM path bindings; and
• ensure_rust_toolchain does not yet enforce exact-value equality and executable checks before Rust coverage.

All three focused contract tests therefore fail for the intended remaining production defects. The exact-head OSV, SAST Semgrep, Security Scan, Secret Scan, Scorecard, and SBOM workflows succeeded; CodeQL and Python Security were still queued at the latest inspection and are not treated as passing.

Required GREEN implementation

Complete only the remaining minimum repair directly in .github/workflows/opencode-review-dispatch.yml on this branch:

• add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 to the existing isolated coverage docker run before the image argument;
• inside isolated-runtime ensure_rust_toolchain, fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} equal those reviewed paths;
• require literal test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the first cargo llvm-cov invocation;
• preserve the digest-pinned trusted image, build-time preflight ordering, pinned cargo-llvm-cov URL and SHA-256, exact-head materialization, --network=none, credential isolation, Git isolation, native-fuzz separation, existing reviewer-agent credential contract, and 100% statement/branch/public-docstring gates.

Do not introduce a one-shot, self-modifying, encoded-patch, staged-patch, branch-writer, or competing repair workflow. Any branch movement invalidates predecessor requests and requires fresh exact-head review.

Dependency

This is the focused central prerequisite for fresh DiskSage OpenCode coverage evidence. After protected integration, affected DiskSage PRs must rerun OpenCode coverage/review on their unchanged exact current heads. Their predecessor REQUEST_CHANGES and failed coverage evidence remain historical only.

Merge gate

Keep this PR Draft until a new GREEN exact head has successful focused and complete repository quality/security evidence, no unresolved actionable human or automated finding, a qualifying independent non-author approval, and branch-protection/repository-policy acceptance without bypass. Pending, queued, cancelled, skipped-required, neutral-required, absent, stale-head, status-only, or predecessor-head evidence is not passing.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 387a8c89-4494-48ea-95ea-17890db3fe3e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Implement the GREEN production repair for this PR on the exact current branch. Keep the existing RED contract unchanged. In .github/workflows/opencode-review-dispatch.yml: (1) install llvm-19, set ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19, and validate both executables before the pinned cargo-llvm-cov archive; (2) add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 to the existing isolated docker run before "$coverage_tool_image"; (3) inside ensure_rust_toolchain, before accepting Rust coverage, fail closed unless both variables equal the reviewed versioned paths and both test -x "$LLVM_COV" / test -x "$LLVM_PROFDATA" checks succeed, before the first cargo llvm-cov. Preserve --network=none, exact-head binding, credential isolation, pinned cargo-llvm-cov URL/SHA, native fuzz separation, all 100% coverage/docstring gates, and existing review-agent credentials. Do not add a one-shot/self-modifying/branch-writer workflow. After the source fix, run the focused contract and exact-head repository checks and update authoritative doctoring/CHANGELOG only if their claims match the implemented boundary.

[seonghobae]

/oc Refetch the exact live PR head and abort unless it is 704bd82eca2679f4606c7f32441291fc90ccced2. Direct exact-head inspection and quality run 31158843536 show that the authoritative production .github/workflows/opencode-review-dispatch.yml is still missing all five permanent LLVM-contract requirements, not only the post-boundary pair. Apply the minimum GREEN repair directly on this branch; do not create another branch, PR, patch artifact, helper, or one-shot/self-modifying workflow. In the digest-pinned coverage Dockerfile: add Debian llvm-19; set literal ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19; and run literal test -x "$LLVM_COV" plus test -x "$LLVM_PROFDATA" before the pinned cargo-llvm-cov v0.8.7 archive. In the existing isolated coverage docker run, before "$coverage_tool_image", add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19. Inside the isolated runtime’s ensure_rust_toolchain, before accepting cargo-llvm-cov, fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} equal those reviewed paths and both literal executable checks succeed before the first cargo llvm-cov. Preserve the Python image digest, cargo-llvm-cov URL/SHA-256, exact-head materialization, --network=none, no-credential PID namespace, native-fuzz separation, Git isolation, NVIDIA NIM/review credential boundary, and 100% statement/branch/public-docstring gates. Run tests/test_opencode_rust_coverage_toolchain_contract.py first, then the complete exact-head repository quality/security suite. Keep the PR Draft until the new exact head is green.

[seonghobae]

@opencode-agent Implement the current exact-head RED contract directly on this PR branch; do not open a stacked PR and do not create any one-shot, self-modifying, encoded-patch, staged-patch, repair-* or branch-writer workflow.

Live head when requested: 704bd82eca2679f4606c7f32441291fc90ccced2. Refetch before writing and abort/replan if it moved.

Apply the minimum authoritative-source repair in .github/workflows/opencode-review-dispatch.yml:

1. In the existing digest-pinned coverage Dockerfile, add Debian llvm-19, then set exactly:
   • ENV LLVM_COV=/usr/bin/llvm-cov-19
   • ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19
     and execute literal test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the pinned cargo-llvm-cov v0.8.7 archive is downloaded or installed.
2. In the existing isolated docker run --rm --init --network=none, before the image argument, add exactly:
   • --env LLVM_COV=/usr/bin/llvm-cov-19
   • --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19
3. In ensure_rust_toolchain, before accepting cargo-llvm-cov and before any cargo llvm-cov invocation, fail closed unless ${LLVM_COV:-} equals /usr/bin/llvm-cov-19, ${LLVM_PROFDATA:-} equals /usr/bin/llvm-profdata-19, and both literal executable checks succeed. Preserve the exact strings test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" required by the permanent contract.
4. Preserve every existing image/action/archive pin, checksum, exact-head materialization, --network=none, no-credential/Git isolation, native-fuzz separation, and 100% statement/branch/public-docstring gate.

Run the focused permanent contract first, then the complete repository quality/security suite. Keep the PR Draft until a new exact head is GREEN. Commit only the direct production/test/documentation changes on this branch.

[seonghobae]

@opencode-agent

Operate on the exact live PR head only. Refetch PR #816 and abort unless the head is 704bd82eca2679f4606c7f32441291fc90ccced2. Apply the minimum GREEN source repair directly to branch fix/opencode-rust-coverage-runtime-boundary; do not create another branch, PR, patch artifact, helper, scheduler, or one-shot/self-modifying workflow.

In .github/workflows/opencode-review-dispatch.yml:

1. In the digest-pinned coverage Dockerfile, install Debian llvm-19; set literal ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19; and run literal test -x "$LLVM_COV" plus test -x "$LLVM_PROFDATA" before downloading/installing the pinned cargo-llvm-cov v0.8.7 archive.
2. In the existing isolated docker run, immediately before "$coverage_tool_image", add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19.
3. In ensure_rust_toolchain, before the cargo-llvm-cov availability check, fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} equal the reviewed paths and both literal checks test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" succeed.

Preserve the image digest, cargo-llvm-cov URL/SHA-256, exact-head materialization, --network=none, credential/PID/Git isolation, native-fuzz separation, NVIDIA NIM and review identities, and all 100% statement/branch/public-docstring gates. Run tests/test_opencode_rust_coverage_toolchain_contract.py first, then the complete exact-head quality/security suite. Keep the PR Draft.

[seonghobae]

@opencode-agent address

Implement the existing RED contract directly on exact head 704bd82eca2679f4606c7f32441291fc90ccced2 without creating another PR, temporary workflow, staged patch, encoded patch, self-modifying writer, or force-push.

Modify only the canonical .github/workflows/opencode-review-dispatch.yml plus the permanent test/doctoring/changelog files if a contract update is genuinely required:

1. Add Debian llvm-19 to the trusted coverage image.
2. Set literal ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19 and run literal executable preflight for both before the pinned cargo-llvm-cov v0.8.7 archive is downloaded or installed.
3. Propagate both reviewed constants through the existing networkless Docker boundary before the image argument.
4. In ensure_rust_toolchain, fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} equal the exact reviewed paths and test -x "$LLVM_COV" / test -x "$LLVM_PROFDATA" succeed before the first cargo llvm-cov invocation.
5. Preserve exact-head source materialization, --network=none, credential isolation, pinned archive URL/SHA-256, native-fuzz separation, 100% coverage/docstrings, and current reviewer credentials.

Run the permanent focused contract and full exact-head suite. Keep Draft until the canonical implementation is GREEN and every new-head check/review gate reruns.

[seonghobae]

@opencode-agent Implement the exact-current-head GREEN repair on PR #816 without creating any new repair workflow or weakening protections. Starting from current head 704bd82eca2679f4606c7f32441291fc90ccced2 and base e71fdab2ab088001f218765ecb5e3b7fabfee11a, modify only the authoritative .github/workflows/opencode-review-dispatch.yml plus the existing bounded doctoring/changelog/test evidence if required. Preserve the pinned coverage image, exact-head materialization, --network=none, credential/Git isolation, native-fuzz separation, existing review-agent credentials, and 100% statement/branch/public-docstring gates. Required production changes: install Debian llvm-19; set literal ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19; run literal executable checks for both before the pinned cargo-llvm-cov v0.8.7 download/install; pass literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 through the isolated docker run before the image argument; and inside ensure_rust_toolchain, before the first cargo llvm-cov, reject unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} exactly equal those versioned paths and both test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" succeed. Run the existing focused permanent contract first, then complete repository quality/security evidence. Do not merge or synthesize approval. If you move the head, issue fresh exact-head review evidence only for the new head.

[seonghobae]

@coderabbitai review

[seonghobae]

@opencode-agent Implement the permanent GREEN fix directly on exact Draft head 704bd82eca2679f4606c7f32441291fc90ccced2; do not create any temporary, self-removing, encoded-patch, or branch-writing workflow.

The authoritative failing contract requires one reviewed LLVM 19 chain in .github/workflows/opencode-review-dispatch.yml:

1. Install Debian llvm-19 in the existing digest-pinned coverage image.
2. Set exact image constants:
   • ENV LLVM_COV=/usr/bin/llvm-cov-19
   • ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19
3. Run RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA" before downloading/installing cargo-llvm-cov v0.8.7.
4. Pass exact reviewed constants through the isolated docker run boundary before the image argument:
   • --env LLVM_COV=/usr/bin/llvm-cov-19
   • --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19
5. At the start of ensure_rust_toolchain(), before the first cargo llvm-cov call, fail closed with:
   • ${LLVM_COV:?trusted coverage image must define LLVM_COV}
   • ${LLVM_PROFDATA:?trusted coverage image must define LLVM_PROFDATA}
   • [ "$LLVM_COV" = "/usr/bin/llvm-cov-19" ]
   • [ "$LLVM_PROFDATA" = "/usr/bin/llvm-profdata-19" ]
   • test -x "$LLVM_COV"
   • test -x "$LLVM_PROFDATA"
6. Preserve the existing image digest, cargo-llvm-cov URL/SHA-256, network/credential isolation, exact-head binding, GPU/desktop support, and 100% quality gates.
7. Update permanent workflow contracts, doctoring and CHANGELOG.md only where necessary; run focused plus complete central tests, branch coverage, docstrings, compileall, actionlint, and clean-tree checks.

Keep Draft and do not approve, merge, release, alter reviewer credentials, or weaken branch protection.

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai autofix

Apply the permanent RED→GREEN LLVM runtime-boundary repair directly to exact head 704bd82eca2679f4606c7f32441291fc90ccced2 on branch fix/opencode-rust-coverage-runtime-boundary. Do not open another PR or create a patch artifact/helper workflow.

In .github/workflows/opencode-review-dispatch.yml:

1. Install Debian llvm-19 in the existing digest-pinned trusted coverage image; set literal ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19; run literal test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" before the pinned cargo-llvm-cov v0.8.7 archive is downloaded or installed.
2. Pass literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 through the existing isolated docker run immediately before "$coverage_tool_image".
3. Inside ensure_rust_toolchain, before accepting cargo-llvm-cov, fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} equal those reviewed paths and literal test -x "$LLVM_COV" plus test -x "$LLVM_PROFDATA" succeed.

Run tests/test_opencode_rust_coverage_toolchain_contract.py first, then the complete exact-head quality/security suite. Preserve image digest, archive URL/SHA-256, exact-head materialization, --network=none, credential/PID/Git isolation, native-fuzz separation, NVIDIA NIM/reviewer identity boundaries, and every 100% coverage/docstring gate. Keep Draft and do not merge.

[coderabbitai]

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[seonghobae]

@coderabbitai autofix

Implement the existing exact-head RED contract directly on 704bd82eca2679f4606c7f32441291fc90ccced2 in this PR branch. In .github/workflows/opencode-review-dispatch.yml: add Debian llvm-19; set ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19; run literal executable preflights before the pinned cargo-llvm-cov v0.8.7 archive; pass both exact constants through the isolated docker run; and fail closed inside ensure_rust_toolchain unless both values and executable paths are exact before any cargo llvm-cov. Preserve every pin, checksum, --network=none, exact-head/no-credential/Git/native-fuzz boundary, reviewer credentials, and 100% gates. Commit directly here; do not open another PR or create any repair/self-modifying workflow.

[coderabbitai]

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[seonghobae]

@coderabbitai Please repair .github/workflows/opencode-review-dispatch.yml directly on this PR branch and commit the change, not as a stacked PR. Apply the exact LLVM 19 runtime-boundary contract already stated in the PR description: Debian llvm-19, exact versioned LLVM_COV/LLVM_PROFDATA image ENV and pre-archive executable checks, literal Docker env propagation, and inner ensure_rust_toolchain exact-value plus executable fail-closed validation. Run the focused permanent contract first and then the complete exact-head suite. Preserve every digest, archive SHA-256, network/credential/PID/Git isolation, NVIDIA NIM/reviewer identity, native-fuzz, and 100% coverage/docstring boundary. Keep Draft and do not merge.

[seonghobae]

/oc

Refetch PR #816 and implement the RED LLVM 19 contract directly on the live branch; abort on head movement. Modify the canonical .github/workflows/opencode-review-dispatch.yml, not a patch artifact: install Debian llvm-19; set exact ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19; preflight both executable paths before the pinned cargo-llvm-cov v0.8.7 download/install; pass both constants before the Docker image argument; and fail closed inside ensure_rust_toolchain unless the values and executable checks match before any cargo llvm-cov call. Preserve networkless sandboxing, credential isolation, pinned archive URL/SHA, native-fuzz separation, and complete coverage/docstrings. Run focused and full exact-head suites and commit directly. No staged patch, temporary writer, force-push, or protection change.

[seonghobae]

@opencode-agent

Repair exact current head 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643 only. Items 1–3 are now present directly in the production workflow: Debian llvm-19, literal /usr/bin/llvm-cov-19 and /usr/bin/llvm-profdata-19 image bindings, and build-time executable preflight before the pinned cargo-llvm-cov archive. Complete only the remaining runtime-boundary slice: add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 to the isolated docker run; in ensure_rust_toolchain, fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} equal those reviewed paths and both test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" succeed before the first cargo llvm-cov. Run the focused contract and complete central tests with 100% statement/branch/public-docstring coverage. Keep Draft and remove no permanent gate. Do not create a one-shot or branch-writer workflow, alter reviewer credentials, approve, merge, release, bypass protection, or reuse predecessor-head evidence.

[seonghobae]

/oc Refetch the live pull request and abort without writing unless its exact head is 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643 on branch fix/opencode-rust-coverage-runtime-boundary. Exact-head quality run 31170299456, job 92840404399, is the authoritative RED evidence: the permanent LLVM runtime-boundary contract failed all three focused tests. Preserve the already-added trusted-image llvm-19 package, literal ENV LLVM_COV=/usr/bin/llvm-cov-19, literal ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19, and their build-time executable preflight. Apply only the missing runtime-boundary repair: add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 to the existing isolated docker run --rm command before the image argument; then, at the beginning of the isolated ensure_rust_toolchain() path and before the first cargo llvm-cov invocation, fail closed unless "${LLVM_COV:-}" exactly equals /usr/bin/llvm-cov-19, "${LLVM_PROFDATA:-}" exactly equals /usr/bin/llvm-profdata-19, and literal test -x "$LLVM_COV" plus test -x "$LLVM_PROFDATA" both succeed. Do not weaken or relocate the existing image-build checks, digest-pinned image, cargo-llvm-cov v0.8.7 URL/SHA-256, exact-head source materialization, --network=none, credential and Git isolation, native-fuzz separation, reviewer credential chain, or 100% statement/branch/public-docstring gates. Run tests/test_opencode_rust_coverage_toolchain_contract.py first and require all three tests green, then the complete exact-head central suite, coverage/docstrings, compilation, workflow validation, security/SAST/supply-chain checks, and git diff --check. Do not create another branch, PR, one-shot/self-modifying workflow, patch artifact, encoded patch, or temporary writer. Keep Draft until the new exact head is fully green, current-head actionable threads are zero, and a qualifying independent non-author approval exists.

[seonghobae]

@opencode-agent

Continue the GREEN implementation directly on fix/opencode-rust-coverage-runtime-boundary; refetch and abort unless the live head is 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643. Exact run 31170299456, job 92840404399, shows the image-side half is now present (llvm-19, exact ENV paths, one executable preflight) but all three permanent contracts still fail because the isolated-runtime half is absent.

Apply only the remaining minimum production changes in .github/workflows/opencode-review-dispatch.yml:

1. Immediately before "$coverage_tool_image" in the existing docker run --rm --init --network=none command, add literal arguments:
   • --env LLVM_COV=/usr/bin/llvm-cov-19
   • --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19
     They must occur before the image argument and must not be derived from PR-controlled state.
2. At the beginning of the isolated-runtime ensure_rust_toolchain() { body, before any cargo-llvm-cov invocation or Rust coverage setup, fail closed unless:
   • "${LLVM_COV:-}" = "/usr/bin/llvm-cov-19"
   • "${LLVM_PROFDATA:-}" = "/usr/bin/llvm-profdata-19"
   • test -x "$LLVM_COV"
   • test -x "$LLVM_PROFDATA"
     Emit a bounded coverage-evidence failure and increment the existing failure count rather than silently falling back to another LLVM tool.
3. Preserve the existing image-side executable check before the pinned cargo-llvm-cov archive, the digest-pinned image, v0.8.7 URL/SHA-256, --network=none, source/credential isolation, and native-fuzz separation.
4. Do not change the permanent tests, add compatibility strings elsewhere, or create temporary/one-shot/self-modifying workflows.

Run all three focused contracts, compileall, exact-range git diff --check, then the complete repository quality/security suite. Keep Draft until this exact new head is green.

[seonghobae]

/oc

Refetch live exact head 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643; abort if it moved. The first direct commit correctly added Debian llvm-19, exact image ENV values, and one build-time executable preflight, but exact-head run 31170299456 remains RED with all three permanent tests failing. Complete the canonical implementation in one ordinary source commit:

1. Add a second literal test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" inside ensure_rust_toolchain, after exact-value guards and before the first cargo llvm-cov invocation.
2. Add exact fail-closed guards in ensure_rust_toolchain for "${LLVM_COV:-}" != "/usr/bin/llvm-cov-19" and "${LLVM_PROFDATA:-}" != "/usr/bin/llvm-profdata-19", with bounded diagnostics and failure count/return behavior consistent with the existing toolchain checks.
3. Pass literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 through the existing isolated docker run, before the image argument.
4. Preserve the newly added image provisioning/preflight, pinned cargo-llvm-cov archive, --network=none, credential isolation, and test contract unchanged.

Run the three focused tests first, then the complete exact-head suite and diff checks. Do not create another partial commit, patch artifact, temporary workflow, compatibility weakening, or force-push.

[seonghobae]

/oc

Complete the exact-head LLVM runtime-boundary repair on 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643 directly in .github/workflows/opencode-review-dispatch.yml; keep the PR Draft and do not add a one-shot/self-mutating/branch-writer workflow.

The current head already provisions pinned LLVM 19 at image build time, but run 31170299456 proves three remaining production gaps:

1. Add the exact literal bindings --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 to the existing isolated docker run --rm before the image argument. Do not forward caller- or host-selected values.
2. Inside the isolated-runtime ensure_rust_toolchain(), before accepting cargo-llvm-cov or reaching the first cargo llvm-cov invocation, fail closed unless:
   • "${LLVM_COV:-}" == "/usr/bin/llvm-cov-19";
   • "${LLVM_PROFDATA:-}" == "/usr/bin/llvm-profdata-19";
   • literal test -x "$LLVM_COV" succeeds; and
   • literal test -x "$LLVM_PROFDATA" succeeds.
3. Publish bounded actionable coverage evidence, increment the existing failures counter, and return nonzero when either reviewed path/value/executable contract fails.

Preserve Debian llvm-19, the image-level ENV values and pre-install executable preflight, the pinned cargo-llvm-cov v0.8.7 URL/SHA-256, digest-pinned trusted image, exact-head materialization, --network=none, credential and Git isolation, native-fuzz separation, reviewer credentials, and 100% statement/branch/public-docstring gates.

Run pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py first, then complete central tests/coverage/docstrings, Python 3.10/3.14 compilation, actionlint, all exact-head security/supply-chain workflows, and git diff --check. Keep the final four-file permanent scope workflow-free.

[seonghobae]

@opencode-agent @coderabbitai autofix

Continue the existing exact-head repair directly on live head 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643; refetch before writing and stop if it moved. The build-image half is now present, but exact-head run 31170299456 still fails all three permanent tests because the isolated runtime contract remains incomplete.

Apply only these remaining production changes in .github/workflows/opencode-review-dispatch.yml:

1. In the existing docker run --rm --init --network=none, before the image argument, add the literal reviewed bindings:
   • --env LLVM_COV=/usr/bin/llvm-cov-19
   • --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19
2. In ensure_rust_toolchain, before accepting cargo-llvm-cov and before any cargo llvm-cov, fail closed when either value is not exact or either executable is absent. Preserve the exact permanent-contract strings:
   • "${LLVM_COV:-}" != "/usr/bin/llvm-cov-19"
   • "${LLVM_PROFDATA:-}" != "/usr/bin/llvm-profdata-19"
   • test -x "$LLVM_COV"
   • test -x "$LLVM_PROFDATA"
     Increment the existing failure counter, provide bounded operator guidance, and return nonzero from the toolchain helper.

Do not alter the newly added image package/ENV/preflight, pinned cargo-llvm-cov v0.8.7 URL/SHA, image digest, exact-head source materialization, no-network/no-credential/Git isolation, native-fuzz separation, reviewer credentials, or 100% gates. Commit directly to this PR branch, do not create another PR or any one-shot/self-modifying/branch-writer workflow, and run tests/test_opencode_rust_coverage_toolchain_contract.py before the complete suite.

[seonghobae]

@opencode-agent Refetch exact live head and continue only if it is 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643. The exact-head focused run 31170299456 is still RED for three concrete contract gaps. The image-side LLVM 19 package, ENV LLVM_COV=/usr/bin/llvm-cov-19, ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19, and the first executable preflight are now present. Do not redo or weaken them. Apply only the remaining GREEN requirements directly to the authoritative .github/workflows/opencode-review-dispatch.yml: (1) before "$coverage_tool_image" in the existing isolated docker run, add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19; (2) in ensure_rust_toolchain, before the first cargo llvm-cov, fail closed unless "${LLVM_COV:-}" != "/usr/bin/llvm-cov-19" and "${LLVM_PROFDATA:-}" != "/usr/bin/llvm-profdata-19" are rejected, and run a second literal test -x "$LLVM_COV" plus test -x "$LLVM_PROFDATA". Preserve the existing RED tests, pinned image/archive, --network=none, exact-head materialization, credential/Git/PID isolation, native-fuzz separation, review-agent/NVIDIA credential contract, and all 100% coverage/docstring gates. No helper/repair workflow or new PR. Rerun the focused contract first after the branch moves.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 9 minutes and 15 seconds before sending another message.

[seonghobae]

@opencode-agent

Apply the minimum GREEN implementation directly to exact head 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643 on fix/opencode-rust-coverage-runtime-boundary; do not create a one-shot workflow or competing branch writer.

The trusted image already installs llvm-19 and defines /usr/bin/llvm-cov-19 plus /usr/bin/llvm-profdata-19. Complete the still-missing runtime boundary in .github/workflows/opencode-review-dispatch.yml:

1. Before "$coverage_tool_image" in the isolated docker run, add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 bindings.
2. At the beginning of ensure_rust_toolchain(), before GPU/desktop setup and before any cargo llvm-cov invocation, fail closed unless ${LLVM_COV:-} and ${LLVM_PROFDATA:-} equal those exact reviewed paths and both test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA" succeed. Emit a bounded static failure reason without filesystem detail and increment the existing failure counter.
3. Preserve the digest-pinned image, cargo-llvm-cov v0.8.7 archive and digest, --network=none, exact-head materialization, credential isolation, Git isolation, native-fuzz separation, and existing review credential chain.
4. Run tests/test_opencode_rust_coverage_toolchain_contract.py, then the complete repository suite, workflow YAML/actionlint checks, 100% production statement/branch/public-docstring gates, and git diff --check before pushing.

After branch movement, request fresh exact-head read-only OpenCode/Noema review. Do not approve, merge, release, or alter branch protection.

[seonghobae]

/oc Refetch the live head and continue only if it is 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643. Complete the two remaining permanent LLVM runtime-boundary requirements directly in this branch. Add literal --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 to the existing isolated docker run before the image argument. In ensure_rust_toolchain, before accepting cargo-llvm-cov and before every cargo llvm-cov, fail closed unless "${LLVM_COV:-}" != "/usr/bin/llvm-cov-19" is false, "${LLVM_PROFDATA:-}" != "/usr/bin/llvm-profdata-19" is false, and literal test -x "$LLVM_COV" plus test -x "$LLVM_PROFDATA" succeed. Preserve the already-correct image package/ENV/preflight, all pins/checksums, --network=none, exact-head/no-credential/Git/native-fuzz boundaries, reviewer credentials, and 100% gates. Run the focused three-test contract first, then the complete suite. Commit directly here; no new PR, patch artifact, helper, or repair workflow.

[seonghobae]

/oc Refetch the exact live PR head and abort unless it is 71f74df36bbe322b1022d6eb3fa5aa7ac53d0643. Complete the existing permanent implementation directly in .github/workflows/opencode-review-dispatch.yml; do not create any workflow or change the RED tests. In the isolated Rust coverage docker run, add the literal arguments --env LLVM_COV=/usr/bin/llvm-cov-19 and --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 before the trusted image argument. Inside the networkless runtime ensure_rust_toolchain, before any cargo llvm-cov command, require exact reviewed values with [ "${LLVM_COV:-}" = "/usr/bin/llvm-cov-19" ] and [ "${LLVM_PROFDATA:-}" = "/usr/bin/llvm-profdata-19" ], then require test -x "$LLVM_COV" and test -x "$LLVM_PROFDATA"; emit bounded static errors and fail nonzero on mismatch/absence. Preserve Debian llvm-19 installation and build-time preflight before cargo-llvm-cov download, image digest, pinned cargo-llvm-cov URL/SHA, --network=none, exact-head source materialization, credential/Git isolation, native-fuzz separation, reviewer credentials and all 100% coverage/docstring gates. Run the three focused tests in tests/test_opencode_rust_coverage_toolchain_contract.py first, then the complete central suite, actionlint, compileall and clean diff. Commit normally to the existing branch only after GREEN; no force push, placeholder, temporary/one-shot/self-modifying writer.