ci: require exact-head production coverage evidence

[seonghobae]

Purpose

Enforce fail-closed exact-head owned-production coverage, trustworthy Rust test evidence, reproducible release evidence, and realistic production-boundary regressions. Thresholds and owned-production scope are not weakened; predecessor evidence never transfers to a changed head.

Exact current state

• exact branch head: a3803fced0bdbb4f8eb9d19d07a623b1422e5204
• independently resolved protected main: 79067c1160ddedf7fc962cbf8067ce7e83c4564a
• fresh comparison: diverged, ahead_by = 608, behind_by = 229, merge base 959fe2b44769187bd0272ab67716e8e56c308fa5
• this PR remains Draft/non-mergeable; its product history is too far diverged for mechanical rebase/overlay
• no pull-request workflow run is currently attached to this exact head, so no current-head GREEN, exact 100% coverage, provenance completion, or merge readiness is claimed

Current evidence repair — diagnostic failure must not destroy the coverage diagnostic artifact

The previous head correctly preserved the authoritative cargo llvm-cov exit status when auxiliary diagnostic rendering/redaction failed. A second evidence defect remained: when that auxiliary rendering failed during a real coverage failure, coverage-command-diagnostic.log could be absent, causing the subsequent upload-artifact step (if-no-files-found: error) to fail independently and leave no bounded artifact explaining that diagnostic rendering itself failed.

This line repairs the defect test-first:

1. RED commit 0e705002765c21777c59f72ce4bf9ebe7feb243a extends coverageEvidenceWorkflow.test.ts so the Measure step must produce a privacy-safe fallback diagnostic when rendering/redaction fails;
2. fix commit a3803fced0bdbb4f8eb9d19d07a623b1422e5204 writes the constant bounded fallback coverage diagnostic rendering failed; raw diagnostic withheld before the upload step while still returning the original coverage_status;
3. raw coverage logs remain deleted, the fallback cannot expose workspace/home/runner paths, and the upload keeps if-no-files-found: error so evidence remains fail-closed.

The exact 100% thresholds, --branch, --all-features, committed lockfile, --no-cfg-coverage, source scope, and evidence schema are unchanged.

Latest completed coverage diagnostic — predecessor evidence only

The last completed trustworthy measurement on this line remains materially below exact 100%:

• regions: 55,501 / 64,352 = 86.245960%
• branches: 5,098 / 7,023 = 72.590061%
• functions: 2,903 / 3,851 = 75.383017%
• lines: 36,792 / 42,326 = 86.925294%

These figures are diagnostic predecessor evidence only and do not transfer to a3803fced0bdbb4f8eb9d19d07a623b1422e5204.

Safe stale-convergence boundary

Preserve unique coverage/evidence infrastructure and realistic regressions while retaining current-main product implementations and their canonical owner history. Do not force-rebase, blindly overlay, or reintroduce superseded product code from this giant branch.

Required before merge

Keep Draft until one unchanged exact head simultaneously satisfies live repository/organization policy; exact non-vacuous 100% owned-production statement/region-equivalent, branch, function, and line coverage; Test/Release/Security/SAST and every applicable central required workflow; zero valid unresolved findings; fresh live-base ancestry; package/SBOM/provenance/release requirements; and any qualifying independent approval actually required. Pending, queued, skipped-required, failed, stale-head, predecessor, diagnostic-only, status-only, model-only, author-only, no-source-scanner, infrastructure-only, or resource-exhausted evidence is non-passing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact head f249858 fixes the latest coverage compile failure: the stale-delete rollback contract test included src/provider_oauth.rs, which already imports UnicodeNormalization; the test repeated that import at crate scope, producing E0252 only in the all-tests coverage build. The duplicate test import is removed and rustfmt/diff checks pass. Hosted checks restarted at this exact head.

[seonghobae]

Follow-up exact head 25b3e42 fixes the behavioral root cause exposed by the new stale-delete contract: disconnect now deletes stale legacy credentials before the canonical credential. If a stale delete fails, the canonical refresh credential remains available for retry; the durable document is still rolled back. The existing unit and integration contracts now assert legacy-before-canonical ordering.

[seonghobae]

Exact-head coverage evidence at 25b3e42 failed for the measured repository scope, not for the OAuth change: cargo llvm-cov reported regions 86.2368%, branches 72.5630%, functions 75.3830%, and lines 86.9174%. The bounded diagnostic lists existing gaps across commands.rs, cloud.rs, provider_oauth.rs, and other binaries. I am leaving the draft fail-closed rather than weakening the 100% gate or claiming readiness; the next repair must add real coverage or explicitly narrow the measured product boundary with a documented ADR.