quality: expose exact function and line coverage metrics

[seonghobae]

Purpose

Expose explicit exact line and measurable function-body coverage metrics for owned production code instead of requiring reviewers to infer them from aggregate coverage output. Statement and branch coverage remain the normative exact 100% gate; this adds a bounded, fail-closed evidence layer and does not weaken any existing threshold.

Exact test-first lineage

Initial reporter

• protected/live base: 7faf7a3b8a47980113982914000e724ab6a6cda5;
• initial test-only RED: d3f5d52737c170127f3b6d89917d022e67ac6c37;
• first implementation before the later adversarial audit: 885584ea95d34299c63921719725a12a6f99a70e.

Nested-function ownership

The initial reporter double-charged nested executable bodies to enclosing functions.

• test-only RED: 319e0a3321a14ae957f1a67cd01bb50237651edf;
• RED CI 31660037191, Python 3.11 job 94322756156: 1 failed, 1030 passed; an uncalled inner body falsely made both inner and a fully covered outer uncovered;
• narrow fix: 2b6f230e3d1657cc5468dd8af97d30af63df8c57.

Unmeasurable one-line bodies

Definition-line execution cannot prove whether a same-line function body executed.

• test-only RED: 4b29dd9fd3454d4c9e3539eec3fde32ca3a834f5;
• RED CI 31660651438, Python 3.10 job 94324581060: 1 failed, 1031 passed; the reporter synthesized 2/2 covered functions instead of excluding the unmeasurable one-line inner body;
• narrow fix: 0c645f32eca115baf60e99ee7a4a274a08d36c3a.

Owned-source symlink escape

The reporter followed *.py symlinks discovered under the owned source root, which could read an external target and leak its resolved path in diagnostics.

• test-only RED: 5c7489f69021400024048238aa7bcd2a9a081f23;
• RED CI 31661133512, Python 3.10 job 94326017967: 1 failed, 1032 passed; raw external-path evidence crossed the intended boundary;
• narrow fix: e2b4eeb140921daedc8edbafffc6a4af517a65f8.

Fabricated out-of-range line evidence

A coverage record could include a positive line number beyond the owned source file and inflate the exposed denominator while still reporting 100%.

• test-only RED: 9acb1f910ccfc5ee15499fc6b99a1d20ebe9f7b8;
• RED CI 31661560721, Python 3.14 job 94327252139: 1 failed, 1033 passed; fabricated line 999 was accepted as line=100.00% (7/7);
• narrow fix: da7bcc9c8243caf7258eefea1c7ff174623066df.

Malformed coverage-record path

An embedded-NUL file key reached Path.resolve(...) and produced a raw traceback instead of one bounded evidence error.

• test-only RED: 8fd97bf7c2ad38ab776bd84b6691d30f460df241;
• RED CI 31661928049, Python 3.14 job 94328303196: 1 failed, 1034 passed; exact traceback ended in ValueError: lstat: embedded null character in path;
• narrow fix / exact current head: 298cf5b6c686f7c92443c4317f89ba6693cd4081.

Exact current identity

• protected/live base and PR-base snapshot: 7faf7a3b8a47980113982914000e724ab6a6cda5;
• exact current head: 298cf5b6c686f7c92443c4317f89ba6693cd4081;
• open / Draft / mergeable;
• current delta remains exactly .github/workflows/ci.yml, scripts/ci/report_coverage_metrics.py, and tests/test_coverage_metric_evidence.py;
• formal reviews: none;
• unresolved review threads: none.

Implemented evidence contract

The reporter:

• consumes existing coverage.py JSON and Python AST/source only; it adds no runtime dependency;
• bounds the coverage JSON input to 16 MiB and requires a regular JSON object;
• requires every owned src/egressweave/**/*.py file to have exactly one coverage record;
• rejects malformed/duplicate/overlapping line sets, absent or aliased source records, out-of-range line evidence, owned-source symlinks, source-root escapes, and malformed coverage-record paths;
• assigns nested function bodies only to their own metric rather than double-charging an enclosing function;
• measures only executable body lines distinguishable from the function definition line, excluding bodies for which line tracing cannot provide distinct evidence;
• treats a measurable function as covered only when every directly owned measured executable line executed;
• fails non-zero on malformed/incomplete evidence or anything below 100% line/measurable-function coverage;
• preserves the normative exact coverage report statement/branch gate and runs after coverage run -m pytest -q on every supported Python CI lane.

Exact-current-head hosted evidence

On unchanged 298cf5b6c686f7c92443c4317f89ba6693cd4081:

• repository CI 31662061367: completed success across wheel/sdist package acceptance and Python 3.10, 3.11, 3.12, 3.13, and 3.14;
• Python 3.14 job 94328702901: exact checkout, CPython 3.14.6, Ruff, 1035 passed, product guard and compileall all succeeded;
• normative owned-production coverage: exact 1758/1758 statements and 588/588 branches, zero misses/partials;
• exposed metrics: line=100.00% (1758/1758) and function=100.00% (156/156);
• package build, archive verification, checksums and installed-wheel smoke succeeded;
• SAST Semgrep 31662061363: completed success;
• Security Scan 31662061339: OSV, Trivy and Scorecard completed successfully, but dependency-review job 94328704089 was wrapper-success while its immutable-pinned Dependency review step was skipped. This remains non-passing supply-chain evidence;
• required Strix run 31662060139, exact-head job/check 94328700720: completed a substantive scan of the changed CI workflow and coverage reporter, produced zero vulnerabilities, and uploaded exact-head artifact 9167075714 (strix-reports, SHA-256 4d72d56fa0a751b6104387445fe71c5bb30d1524d74f8b83f45d8c05c0be0339). The report states that Semgrep, Bandit, Gitleaks, Trufflehog and manual CI review found no exploitable vulnerability in the scoped files;
• CodeRabbit has not produced a substantive exact-head review because this PR remains Draft and provider capacity has also been rate-limited. No review is inferred from status text;
• Noema/OpenCode workflow transport is not promoted into a formal approval or source-review verdict.

Acceptance status

Keep Draft. The product/evidence implementation, exact coverage, package, SAST and substantive Strix lanes are passing on this exact head. The actual Dependency Review action remains skipped and therefore non-passing despite wrapper green. The root fail-closed repair is organization-owned and read-only to this writer; no EgressWeave-local substitute or weaker gate is acceptable.

Before integration, obtain current exact-head semantic/source review with zero valid findings, require every live workflow to be substantively passing, and refetch exact head, live base, rules, findings, reviews and threads. No predecessor, synthetic, wrapper-only, model, status, skipped, neutral or stale evidence transfers. Do not churn this clean source head merely to retrigger provider capacity.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d1d1712-e8d1-4629-b6c2-721a31190c44

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review
@opencode-agent review
@cwl-noema-review review

Review exact current head 298cf5b6c686f7c92443c4317f89ba6693cd4081 only against live protected main 7faf7a3b8a47980113982914000e724ab6a6cda5. Validate bounded coverage JSON loading, exact owned-file bijection, malformed and aliased path rejection, source-root/symlink confinement, out-of-range and overlapping line evidence rejection, nested-function body ownership, exclusion of one-line bodies that line tracing cannot distinguish, preservation of the normative statement/branch 100% gate, and the bounded three-file scope. Submit a real current-head source-review verdict; do not mutate, merge, or treat wrapper/status/model evidence as approval.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 14 minutes and 21 seconds before sending another message.

[seonghobae]

Current-head source review for 298cf5b6c686f7c92443c4317f89ba6693cd4081 found no blocking defect in the three-file coverage-evidence scope. The reporter retains coverage.py statement/branch output as normative, bounds and validates the JSON evidence, requires one canonical record per owned non-symlink source file, rejects malformed/aliased/out-of-range data, assigns nested bodies to their own function metrics, excludes line-tracing-unmeasurable one-line bodies, and fails below exact line/measurable-function coverage. This is author-side review evidence only, not independent approval. Keep Draft until corrected Dependency Review executes on the unchanged head and a current independent semantic/source review is present.