fix(pingora): enforce runtime policy on executable test modules

[seonghobae]

Causal defect

Protected main inherited #1435 with current-head review thread PRRT_kwDOS_C14s6dgZuS unresolved. The scanner treated executable tests/test_pingora_edge_policy.py as a blanket source fixture, so active Nginx runtime behavior at that path was accepted although the binding policy exempts only dedicated inert samples under tests/fixtures.

Exact scope

• protected live base: main@1d8e872487838e16a003e96e76df9300c388e258;
• exact contributor head: 7779b20fd0f525c87baa6ccc156ee79c607fa9a1;
• two changed files, mergeable Draft;
• current main's fix(strix): disable SDK streaming for the contextual-orchestrator gateway #1448 Strix request-shape repair and fix(ci): close the org-wide 100%-coverage gap blocking OpenCode review dispatch #1451 pagination-coverage invariant are merged, preserved and no longer duplicated in this delta;
• scanner source itself remains exempt because it must contain its detector patterns;
• dedicated tests/fixtures samples remain exempt; and
• executable test modules no longer receive a path-wide exemption.

RED → GREEN

Deterministic RED on test-only commit e74db80e7da4099dc1779e4b94628f17cc0b9e6c:

• python3 -m pytest tests/test_pingora_edge_policy.py -q
• 1 failed, 60 passed
• exact failure: test_policy_test_module_rejects_active_runtime_content received an empty set because the executable pytest path was blanket-exempt.

GREEN on exact current head 7779b20f...:

• focused policy suite: 62 passed;
• focused policy coverage: 239/239 statements, 88/88 branches (100%);
• full central suite: 1,897 passed, 1 skipped, 21 subtests;
• full central coverage: 9,966/9,966 statements, 3,926/3,926 branches (100%);
• docstrings: 100.0%.

Exact-head operational evidence

For unchanged exact head 7779b20fd0f525c87baa6ccc156ee79c607fa9a1, all generated general security and supply-chain workflows are terminal GitHub-success:

• SAST Semgrep 33311248027, job 99256586045: expected and actual checkout SHA both equal the exact head before scanning and SARIF upload;
• Security Scan 33311248037: Trivy 99256585643, dependency-review 99256585754, Scorecard 99256585700, and dual-revision OSV 99256585778 succeeded; every head-oriented job attested the exact contributor SHA and OSV separately attested live base 1d8e8724...;
• CodeQL 33311248035, Python Security 33311248029, OSV Scanner 33311248208, SBOM 33311248032, Secret Scan 33311248028, and Scorecard 33311248024 succeeded.

These results establish exact-current-head security evidence only. They are not a substantive formal review or merge authority.

Draft review-only acceptance boundary

Keep Draft/unmerged. A targeted @opencode-agent review request for this unchanged exact head was authenticated and forwarded by mention-router run 33313193198 and invocation run 33313202859. The authoritative scheduler run 33313209748, job 99261850925, validated PR #1450 and SHA 7779b20f... but then returned skip: draft PR, so no review workflow or formal verdict materialized.

That is a central scheduler contract defect tracked on canonical owner PR #1443, not a reason to make this PR Ready merely to obtain review evidence. Acceptance requires protected-main integration of the review-only Draft path, followed by a fresh unchanged-head canary that leaves this PR Draft, dispatches an exact-head OpenCode review, and cannot mutate refs, merge, auto-merge, or lifecycle state. Reviews API currently has no formal submission and unresolved threads are zero. Local deterministic evidence and general security workflow success do not substitute for review or approval.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent review

Review-only dispatch for unchanged exact head 7779b20fd0f525c87baa6ccc156ee79c607fa9a1. Keep this PR Draft and do not mutate branch/merge state. Evaluate the two-file Pingora policy repair against protected main@1d8e872487838e16a003e96e76df9300c388e258; predecessor or status-only evidence is non-passing.