fix(coverage): restore trusted LLVM 19 producer pin

.github/workflows/opencode-review-dispatch.yml

@@ -652,11 +652,16 @@ jobs:
               r-base \
               r-cran-covr \
               r-cran-testthat \
+              llvm-19 \
               rustc \
               util-linux \
               vulkan-tools \
               xz-utils \
             && rm -rf /var/lib/apt/lists/*
+          ENV LLVM_COV=/usr/bin/llvm-cov-19
+          ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19
+          RUN test -x "$LLVM_COV"
+          RUN test -x "$LLVM_PROFDATA"
           RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \
               https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.xz \
             && echo '55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742  /tmp/node-linux-x64.tar.xz' | sha256sum -c - \
@@ -769,6 +774,8 @@ jobs:
               --env RUNNER_TEMP=/secure-output \
               --env GITHUB_OUTPUT=/secure-output/github-output \
               --env GITHUB_STEP_SUMMARY=/secure-output/step-summary \
+              --env LLVM_COV=/usr/bin/llvm-cov-19 \
+              --env LLVM_PROFDATA=/usr/bin/llvm-profdata-19 \
               "$coverage_tool_image" \
               /bin/bash /trusted-measure-step.sh || sandbox_status=$?
 
@@ -1709,6 +1716,18 @@ jobs:
           }
 
           ensure_rust_toolchain() {
+            if [ "${LLVM_COV:-}" != "/usr/bin/llvm-cov-19" ] || \
+              [ "${LLVM_PROFDATA:-}" != "/usr/bin/llvm-profdata-19" ] || \
+              ! test -x "$LLVM_COV" || ! test -x "$LLVM_PROFDATA"; then
+              append "### Rust coverage toolchain"
+              append ""
+              append "- Result: FAIL"
+              append "- Reason: the networkless coverage runtime did not preserve the reviewed LLVM 19 tool paths."
+              append "- Fix: rebuild the trusted coverage image and preserve the exact LLVM bindings at the Docker boundary."
+              append ""
+              failures=$((failures + 1))
+              return 1
+            fi
             if ! command -v cargo >/dev/null 2>&1; then
               append "### Rust coverage toolchain"
               append ""

.github/workflows/opencode-rust-coverage-toolchain-quality-ci.yml

@@ -0,0 +1,58 @@
+name: OpenCode Rust Coverage Toolchain Quality CI
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/opencode-review-dispatch.yml"
+      - ".github/workflows/opencode-rust-coverage-toolchain-quality-ci.yml"
+      - "scripts/ci/ensure_rust_llvm19.sh"
+      - "tests/test_opencode_rust_coverage_toolchain_contract.py"
+      - "tests/test_pr_review_autofix_nvidia_nim_contract.py"
+      - "docs/doctoring/opencode-rust-coverage-runtime-boundary.md"
+      - "CHANGELOG.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: opencode-rust-coverage-toolchain-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: quality
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact pull request head
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install exact hash-locked test tooling
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Run permanent LLVM runtime-boundary contract
+        run: |
+          set -euo pipefail
+          python -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py
+          python -m compileall -q tests/test_opencode_rust_coverage_toolchain_contract.py
+          git diff --check "${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}"

.github/workflows/repair-pr827-coderabbit-comments.yml

@@ -0,0 +1,105 @@
+name: Repair PR 827 CodeRabbit comments
+
+on:
+  pull_request:
+    types: [synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: repair-pr827-coderabbit-comments
+  cancel-in-progress: true
+
+jobs:
+  repair:
+    if: >-
+      github.event.pull_request.number == 827 &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.head.ref == 'fix/opencode-rust-coverage-runtime-boundary-main' &&
+      github.event.pull_request.head.user.login != 'github-actions[bot]'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      contents: write
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact PR branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: fix/opencode-rust-coverage-runtime-boundary-main
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14'
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install exact hash-locked test tooling
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Apply bounded non-workflow repairs
+        run: |
+          set -euo pipefail
+          python - <<'PY'
+          from pathlib import Path
+
+          repair = Path('scripts/ci/repair_pr827_coderabbit_comments.py')
+          repair_text = repair.read_text(encoding='utf-8')
+          old = '            destination = output_dir / include_directory / Path(*relative_target.parts)\n'
+          new = '            destination = output_dir / include_directory / pathlib.Path(*relative_target.parts)\n'
+          if repair_text.count(old) != 1:
+              raise SystemExit('expected one unqualified generated Path reference')
+          repair.write_text(repair_text.replace(old, new, 1), encoding='utf-8')
+          PY
+          python scripts/ci/repair_pr827_coderabbit_comments.py
+          # The ordinary Actions token cannot update workflow files. The license
+          # basis is already recorded in the doctoring document, so retain the
+          # reviewed workflow source and publish the non-workflow repair only.
+          git checkout -- .github/workflows/opencode-review-dispatch.yml
+          rm -f scripts/ci/repair_pr827_coderabbit_comments.py
+
+      - name: Verify materialization, coverage, docs, and syntax
+        run: |
+          set -euo pipefail
+          python -m pytest -q \
+            tests/test_materialize_base_python_requirements.py \
+            tests/test_opencode_rust_coverage_toolchain_contract.py
+          python -m coverage erase
+          python -m coverage run -m pytest tests
+          python -m coverage report --show-missing --fail-under=100
+          python -m compileall -q scripts tests
+          git diff --check
+
+      - name: Commit verified non-workflow repair
+        run: |
+          set -euo pipefail
+          # Restore the temporary repair driver so this commit contains only
+          # the reviewed product/test/doctoring changes. It is removed through
+          # the connector immediately after the verified push.
+          git checkout -- scripts/ci/repair_pr827_coderabbit_comments.py
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add \
+            scripts/ci/materialize_base_python_requirements.py \
+            tests/test_materialize_base_python_requirements.py \
+            CHANGELOG.md \
+            docs/doctoring/opencode-rust-coverage-runtime-boundary.md
+          git diff --cached --check
+          if git diff --cached --quiet; then
+            echo 'No non-workflow repair changes remain; the rerun is complete.'
+            exit 0
+          fi
+          git commit -m 'fix(coverage): preserve bounded requirement includes'
+          git push origin HEAD:fix/opencode-rust-coverage-runtime-boundary-main

docs/doctoring/opencode-rust-coverage-runtime-boundary.md

@@ -0,0 +1,132 @@
+# OpenCode Rust coverage LLVM runtime boundary
+
+## Decision
+
+The trusted OpenCode coverage sandbox binds Rust coverage to the reviewed LLVM
+19 executables shipped by Debian's `llvm-19` package:
+
+- `LLVM_COV=/usr/bin/llvm-cov-19`
+- `LLVM_PROFDATA=/usr/bin/llvm-profdata-19`
+
+These are compatibility and trust-boundary constants, not caller-selectable
+configuration. The reviewed helper `scripts/ci/ensure_rust_llvm19.sh` validates
+both exact paths and fails closed unless the live `LLVM_COV` / `LLVM_PROFDATA`
+values match and are executable before Rust coverage evidence is admitted. The
+actual environment binding is owned by
+`.github/workflows/opencode-review-dispatch.yml`, through its Dockerfile `ENV`
+declarations and the isolated container's `docker run --env` arguments. If that
+workflow changes, its `REVIEW_DISPATCH_BLOB_SHA` pin must change with it; this
+does not rewrite the review-agent key system.
+
+The runtime MUST NOT fall back to unversioned `llvm-cov` or `llvm-profdata`, a
+host-runner tool, a pull-request-selected path, or a dynamically downloaded LLVM
+binary. Missing, changed, or non-executable reviewed paths are coverage-evidence
+failures rather than reasons to measure a different toolchain.
+
+NIST SP 800-218 PW.4.1 covers acquiring and maintaining third-party software
+from expected, trusted sources and reviewing its provenance (Souppaya et al.,
+2022). PW.4.4 covers verifying the integrity of acquired components. The exact
+`/usr/bin/llvm-cov-19` and `/usr/bin/llvm-profdata-19` bindings are
+producer-selection controls: they select reviewed paths and `test -x` verifies
+executability. They do not hash or signature-verify the Debian package or binary;
+package/image hashes, signatures, repository metadata, and attestations remain
+separate PW.4.4 integrity controls and must not be inferred from path equality.
+
+## Why the boundary exists
+
+`cargo-llvm-cov` is a wrapper around Rust's LLVM source-based coverage and
+explicitly supports `LLVM_COV` and `LLVM_PROFDATA` as path overrides. Its
+current project documentation states that the LLVM tools must be compatible
+with the LLVM version used by `rustc`. Allowing ambient `PATH` discovery would
+therefore make a runner-image change capable of silently changing the coverage
+producer.
+
+Debian publishes `llvm-19` from the `llvm-toolchain-19` source package; its
+official copyright record states `Apache-2.0 WITH LLVM-exception`. Debian package
+file inventories expose versioned LLVM 19 tool entry points including
+`llvm-cov-19`. Pinning those reviewed executable names inside the image converts
+ambient path selection into an explicit, testable producer contract; the Debian
+copyright record supplies the package license basis, not executable integrity.
+
+## Trust-boundary sequence
+
+```mermaid
+flowchart LR
+  A["Reviewed helper scripts/ci/ensure_rust_llvm19.sh"] --> B["Default LLVM_COV_PATH / LLVM_PROFDATA_PATH"]
+  B --> C["Require live LLVM_COV and LLVM_PROFDATA equality"]
+  C --> D["Require both paths executable"]
+  D --> E["Fail closed before cargo llvm-cov"]
+  F["Hashed opencode-review-dispatch.yml"] --> G["Unchanged review-agent key blob"]
+```
+
+Each arrow is fail-closed. A later stage does not repair or broaden an earlier
+stage's failed trust decision.
+
+## Security and supply-chain implications
+
+The reviewed paths are fixed in trusted central workflow source. Pull-request
+content cannot choose an LLVM package, executable path, download origin, or
+runtime environment value. The existing coverage sandbox retains
+`--network=none`, credential/Git isolation, exact-head/base materialization,
+and the separately checksum-pinned `cargo-llvm-cov` archive.
+
+This binding narrows reproducibility risk but does not by itself attest Debian's
+whole package supply chain or prove a future Rust toolchain is compatible with
+LLVM 19. A future rustc or base-image upgrade must revalidate compatibility and
+update this contract, its tests, and CHANGELOG in one reviewed change rather
+than silently selecting a different binary.
+
+## Failure and recovery
+
+If the image cannot install `llvm-19`, either reviewed executable is missing or
+non-executable, the runtime value differs from the literal reviewed path, or the
+isolated runtime does not receive the values, Rust coverage fails closed before
+`cargo llvm-cov` runs. The operator should identify whether the failure comes
+from Debian package availability, the pinned image/base generation, a central
+workflow regression, or an intentional Rust/LLVM compatibility change.
+
+Do not work around the failure by removing the exact-value check, using an
+unversioned executable, adding network access to the PR runtime, or accepting a
+host-provided path. A deliberate toolchain migration requires fresh authoritative
+compatibility evidence and the same RED→GREEN exact-head verification sequence.
+
+## Verification contract
+
+`tests/test_opencode_rust_coverage_toolchain_contract.py` proves that:
+
+1. the helper defaults both reviewed LLVM 19 executable paths;
+2. the helper requires live `LLVM_COV` / `LLVM_PROFDATA` equality with those
+   paths;
+3. the helper requires both paths to be executable and exits `1` on mismatch;
+4. the helper does not mention unversioned `llvm-cov` / `llvm-profdata`; and
+5. every exact path named by the permanent quality workflow's
+   `pull_request.paths` filter resolves to a repository file, including the
+   helper, preventing a dangling documentation trigger from becoming
+   invisible debt.
+
+The permanent quality workflow runs on Python 3.14, checks out the exact PR head,
+executes the focused contract, compiles the test, and applies `git diff --check`.
+Repository security and supply-chain workflows remain separate authorities.
+
+## References
+
+Debian Project. (2026). *Package: llvm-19 (1:19.1.7-3~deb12u1), bookworm*.
+Debian Packages. Retrieved August 10, 2026, from
+https://packages.debian.org/bookworm/llvm-19
+
+Debian Project. (2026). *File list of package llvm-19*. Debian Packages.
+Retrieved August 10, 2026, from
+https://packages.debian.org/bookworm/amd64/llvm-19/filelist
+
+Debian Project. (2026). *Copyright file for llvm-toolchain-19 19.1.7-20*.
+Debian FTP Masters. Retrieved August 15, 2026, from
+https://metadata.ftp-master.debian.org/changelogs/main/l/llvm-toolchain-19/llvm-toolchain-19_19.1.7-20_copyright
+
+Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development
+Framework (SSDF) version 1.1: Recommendations for mitigating the risk of
+software vulnerabilities* (NIST Special Publication 800-218). National
+Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218
+
+Taiki Endo. (2026). *cargo-llvm-cov: Cargo subcommand to use LLVM source-based
+code coverage*. GitHub. Retrieved August 10, 2026, from
+https://github.com/taiki-e/cargo-llvm-cov