Review #37 coverage diagnostics workflow delta under manual authority

[seonghobae]

Exact owning boundary

Canonical HTTP reconstruction PR #37 remains the owner of the HTTP/1.1 source/tests/docs at exact contributor head c8e0f1de85caf31299eb49730510aabf5c8f379a, and it still contains the pre-existing .github/workflows/ci.yml coverage-diagnostics delta.

Protected main has since advanced to b05d5acca82b9d916ada2c8e82f59f92a89817e1. A fresh PR read now reports #37 open, Ready, but non-mergeable, with its recorded base snapshot still at predecessor main 0841d2ab3d8b5e60a03c0a8e818cf438e2716829. Therefore the old native CI/security/coverage results remain exact evidence for c8e0f1de85caf31299eb49730510aabf5c8f379a against that predecessor base only; they are not current-live-base merge evidence.

Fresh source inspection still identifies the workflow delta as the governance-owned boundary: the Record uncovered production lines step uses Bash pipefail plus tee so cargo llvm-cov report failure propagation is preserved while diagnostics are materialized.

Why this needs a separate owner decision

Protected-main AGENTS.md explicitly says scheduled agents may not alter workflows. The scheduled OriginWeave writer therefore cannot safely adopt, revert, rewrite, or otherwise mutate this workflow delta while repairing #37. Product-code churn or synthetic restacking that hides the workflow authority problem would be incorrect.

An authorized manual/non-scheduled owner must inspect the then-current #37 workflow diff and decide whether the coverage-diagnostic hardening should remain in #37, move through an independently authorized workflow change, or be reverted without weakening failure propagation. Because protected main moved, that decision must also reconstruct/revalidate the branch against the live base without treating predecessor checks as transferable.

Historical exact-head evidence

On exact head c8e0f1de85caf31299eb49730510aabf5c8f379a against predecessor main 0841d2ab3d8b5e60a03c0a8e818cf438e2716829:

• CI run 32652915332: success;
• Rust contracts job 97227194086: success;
• Production coverage job 97227194202: success with 492/492 functions, 5956/5956 regions, 4398/4398 lines, 612/612 branches = 100%;
• exact coverage artifact 9496705860, digest sha256:02c7749a939e21315b2afeb2bff94740b27a1a75bc2a5a7ececcfe8e2e2bb7ff;
• SAST Semgrep run 32652915292: success; and
• Security Scan run 32652915253: success.

Those results remain useful branch-history evidence only. They are not promoted as live-base or merge evidence after main advanced.

The two unresolved governance threads remain:

• PRRT_kwDOTulPlM6a8XuD; and
• PRRT_kwDOTulPlM6a8eIj.

Both point to .github/workflows/ci.yml and remain unresolved because this scheduled writer is not authorized to mutate that workflow or resolve a finding it cannot address.

Acceptance evidence

Before any integration decision for #37:

• refetch exact protected main and exact feat(http): rebuild bounded HTTP/1.1 authority on current main #37 head;
• inspect the intervening protected-main delta and reconstruct/revalidate feat(http): rebuild bounded HTTP/1.1 authority on current main #37 against that live base without force-push or predecessor-evidence transfer;
• verify the workflow delta and current repository authority;
• ensure cargo llvm-cov report failure still propagates;
• preserve exact production function/line/region/branch coverage diagnostics and enforcement;
• remove or independently authorize the workflow delta through an eligible governance path;
• resolve the two workflow threads only after the authority defect is actually addressed; and
• regenerate applicable exact-head CI/security/scanner/review evidence on the resulting current branch/base relationship.

This issue is owner routing only. It does not authorize this scheduled writer to modify .github/workflows/ci.yml, merge #37, or treat stale/predecessor evidence as passing current proof.

[seonghobae]

Fresh owner-routing evidence: PR #40 now independently contains the same protected-workflow authority defect class. Exact current #40 head is 0d12ad507b3a9bbf9765f04f57298eb02c012219 on protected main 0841d2ab3d8b5e60a03c0a8e818cf438e2716829. Current unresolved review thread PRRT_kwDOTulPlM6a2_0K is on .github/workflows/ci.yml:95 and identifies the feature PR's > missing-lines.txt -> | tee missing-lines.txt workflow delta as outside the feature slice and outside scheduled-agent authority. The browser-authority source lane must not be churned to mask this governance defect, and this scheduled writer will not alter .github/**.

Please include #40 in the same authorized manual decision: inspect the exact workflow delta on #37 and #40, preserve failure propagation for cargo llvm-cov report, and either place the diagnostic hardening in an independently authorized governance change or restore the feature branches to the authorized workflow without weakening coverage enforcement. Do not resolve #40's review thread until the workflow delta is actually addressed and the resulting exact head is revalidated.

[seonghobae]

Fresh owner-routing update for PR #37: the canonical branch has moved to exact head 3d3a2a0d51d3058e37ea656062c0163dca928f50 on protected main 0841d2ab3d8b5e60a03c0a8e818cf438e2716829. The forbidden workflow delta is still present and is exactly the Record uncovered production lines change from folded cargo llvm-cov report ... > missing-lines.txt to shell: bash, set -o pipefail, and cargo llvm-cov report ... | tee missing-lines.txt.

Two fresh unresolved Devin review threads independently classify that exact delta as outside scheduled-agent authority: PRRT_kwDOTulPlM6a8XuD and PRRT_kwDOTulPlM6a8eIj, both on .github/workflows/ci.yml:90-97. Protected-main AGENTS.md forbids scheduled agents from altering workflows, and CLAUDE.md additionally forbids .github/** edits unless the human task explicitly targets governance and the change is independently reviewed. This scheduled writer therefore will not adopt, revert, or rewrite the workflow file and will not resolve those threads prematurely.

Please treat current head 3d3a2a0d51d3058e37ea656062c0163dca928f50 as the exact #37 owner-action input. An authorized manual/governance path should remove the workflow mutation from the feature lane or independently authorize the hardening without weakening cargo llvm-cov report failure propagation. After that exact branch movement, refetch/revalidate all current-head CI, coverage, SAST/security, reviews, and both review threads before integration.

[seonghobae]

Fresh owner-routing cleanup: PR #40 no longer belongs to this manual workflow-authority handoff. Its exact current head is 1248ccf3bda5b08b23709e3317d76a8d354973ce; the current changed-file inventory contains no .github/** path, and the prior workflow review thread PRRT_kwDOTulPlM6a2_0K is now resolved/outdated with an explicit note that the workflow edit is absent. Do not carry the earlier #40 workflow finding forward as a current blocker or owner action.

Issue #187 therefore remains scoped to PR #37's still-current protected-workflow delta and its two unresolved threads (PRRT_kwDOTulPlM6a8XuD, PRRT_kwDOTulPlM6a8eIj) at exact #37 head 3d3a2a0d51d3058e37ea656062c0163dca928f50. The scheduled writer still will not mutate .github/**; an authorized manual/governance path must address #37, then revalidate the resulting exact head before resolving those threads.

[seonghobae]

Fresh closure proof: PR #37 is now exact head e1fca7c65ce738de3406b0e408708e08c283552e on live main@f658f329c83a106b68385e17cb714c4147c12f49, GitHub reports it mergeable, and its current changed-file inventory contains no .github/** path. The two workflow-governance threads named in this issue are both resolved/outdated because the current PR diff no longer contains the cited workflow edit. The manual-authority workflow-delta lane is therefore no longer present and this routing issue is superseded by the verified reconstruction. This does not assert PR #37 is merge-ready: exact-head approval/review evidence remains a separate live governance gate.