Skip to content

fix(review): update offline Rust coverage toolchain #591

Open
Open
fix(review): update offline Rust coverage toolchain#591
Labels
area: apiAPI, protocol, event, or external contractarea: ci-cdCI, GitHub Actions, checks, release, or supply chainbugSomething isn't workingpriority: highHigh-priority or P1 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behavior

Description

@seonghobae
seonghobae
opened on Jul 19, 2026

Evidence

The required OpenCode repository_dispatch run https://github.com/ContextualWisdomLab/.github/actions/runs/29676953842 evaluated ContextualWisdomLab/codec-carver#250 at current head 4ffe820524640c84f904d93900a735cd21e61375.

  • Python: 561 collected, 486 passed, 75 skipped, 100% line coverage.
  • Python docstrings: 100%.
  • Rust: failed before test execution because the trusted coverage image installed Ubuntu Cargo 1.75.0 and could not parse edition = "2024".
  • Exact failure: feature edition2024 is required and Cargo 1.75.0.

The target crate builds and passes its Rust tests with the current stable toolchain. This is a central evidence-toolchain compatibility defect, not an application test failure.

Scope

  • Replace the stale distro Cargo/rustc pair in the trusted offline coverage image with a digest-pinned official Rust stable amd64 image.
  • Keep all PR-controlled execution under the existing --network=none, tokenless, capability-restricted sandbox.
  • Preserve the hash-pinned cargo-llvm-cov and Python requirements contracts.
  • Add static regression assertions for the pinned Rust image, removal of distro Cargo/rustc, and current toolchain version evidence.

Acceptance criteria

  • The central test suite, Ruff, workflow syntax, and git diff --check pass.
  • A new current-head repository_dispatch run for ContextualWisdomLab/codec-carver#250 reaches Rust coverage rather than failing manifest parsing.
  • Any subsequent Rust coverage gap is reported with exact missing-line evidence.
  • The exact current-head OpenCode review is regenerated only after coverage evidence passes.

Agent: Codex
Recorded: 2026-07-19T15:58:00+09:00
Phase: Ops

Unblocks: ContextualWisdomLab/codec-carver#250

Activity

  1. seonghobae
    added this to naruon Platform Roadmapon Jul 19, 2026
  2. github-project-automation
    moved this to Todo in naruon Platform Roadmapon Jul 19, 2026
  3. seonghobae
    moved this from Todo to In Progress in naruon Platform Roadmapon Jul 19, 2026

  4. seonghobae commented on Jul 19, 2026

    @seonghobae
    seonghobae
    on Jul 19, 2026
    ContributorAuthor

    PR #592 is at current head 137ff8b.

    Current evidence:

    • Strix current-head run 29683525528: success.
    • Required OpenCode repository_dispatch run 29683750497: coverage-evidence succeeded; the real-model review pool is still in progress.
    • Local full suite: 634 passed.
    • Official Python coverage contract: 5,527 statements, 0 missed, 100%.
    • Interrogate: 514/514, 100%.
    • Targeted OpenCode contract/model-pool tests: 54 passed.
    • Ruff, Bash syntax, Actionlint expression/syntax checks, and git diff validation passed.

    The PR now pins the official Rust 1.97.1 linux/amd64 image by exact manifest digest, seals rustup/cargo paths, installs llvm-tools-preview during the trusted networked image build, and preserves the existing tokenless network-disabled PR sandbox. It also caps central review-process candidates at 15 minutes with a one-hour pool budget so an unavailable provider cannot starve every fallback.

    Acceptance remains open until PR #592 merges and a new exact-head review of codec-carver#250 reaches real Rust coverage.

  5. seonghobae commented on Jul 19, 2026

    @seonghobae
    seonghobae
    on Jul 19, 2026
    ContributorAuthor

    Current-head retry 29683750497 reached successful coverage-evidence, then exhausted the real-model pool after about 183 minutes. Publish OpenCode review outcome failed with MODEL_OUTPUT_UNAVAILABLE; no review or comment was posted for head 137ff8b. Deterministic evidence correctly did not create an approval.

    This is systemic rather than PR-local: among completed repository_dispatch OpenCode runs created after 2026-07-19T10:00:00Z, there were no successful runs; every completed run was failure or cancelled.

    Live governance state:

    • Ruleset 17921150 requires 2 approvals and last-push approval.
    • bypass_actors is empty and current_user_can_bypass is never.
    • The only repository collaborator is the PR author, so a human same-head approval is unavailable.
    • No alternate default-branch manual workflow accepts a trusted review verdict or model/timeout override.

    PR #592 remains fully validated locally and blocked only on external real-model reviewer availability. The safe next action requires provider recovery or explicit authority for a temporary governance change; neither is being assumed.

  6. seonghobae commented on Aug 12, 2026

    @seonghobae
    seonghobae
    on Aug 12, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Current protected-main operational acceptance still reproduces this central coverage-toolchain defect.

    • Central workflow revision: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
    • Consumer evidence: OpenCode dispatch run 31576614667 for ContextualWisdomLab/disksage#181@ea192535bd467dc1a0121ca2886fcdecd04da502.
    • Exact first failing boundary: coverage-evidence job 94050254880; metadata validation, bootstrap, and source-tree materialization all succeeded first.
    • Immediate error: cargo-llvm-cov could not find llvm-tools-preview, so the coverage sandbox failed before it could produce qualifying Rust coverage evidence.
    • This is central infrastructure/toolchain evidence, not a semantic source finding against disksage.

    PR #592 carried the intended pinned Rust/llvm-tools-preview repair but closed unmerged on 2026-08-03. The recurrence on the current protected head proves the issue is not resolved. Acceptance remains: port the bounded offline Rust toolchain repair onto the then-current protected base, rerun this exact coverage boundary successfully, and obtain a current-head consumer dispatch proving the installed LLVM tools are usable without network access.

  7. seonghobae commented on Aug 16, 2026

    @seonghobae
    seonghobae
    on Aug 16, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Fresh protected-main consumer reproduction from ContextualWisdomLab/OriginWeave#37 at exact leaf head fe324f71ccd154f7759f009d8c34fb6247c7d070 and protected OriginWeave main 0c376acf059be9ddddddfbde1d0189e4f39ef014.

    Central OpenCode workflow revision is the same affected protected .github revision already recorded here: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.

    Exact central evidence:

    • OpenCode run 31916575003, workflow_dispatch, completed failure.
    • First failing job: coverage-evidence job 95089261092.
    • Job steps reached checkout and trusted astral-sh/setup-uv; the named Enforce real coverage step then failed.
    • Check annotations report Coverage sandbox reported failing test, build, or coverage evidence (exit 1) and process exit 1.
    • OpenCode consequently submitted exact-leaf-head CHANGES_REQUESTED for absent coverage proof.

    Independent leaf evidence on the unchanged same OriginWeave head contradicts a leaf coverage-gap diagnosis: current OriginWeave CI run 31913805978 completed successfully, including its exact 100% production coverage job, and current SAST/Security/MV3 evidence is also green. The leaf branch is mergeable against the same protected main and does not need a source mutation merely to retrigger central coverage.

    The central job log body is not currently retrievable through the available connector, so this reproduction does not invent whether the immediate stderr was specifically missing llvm-tools-preview. However, it is the same central revision and same Rust coverage-evidence boundary as the already-proven DiskSage recurrence in this issue. Please include OriginWeave#37 in #591 acceptance/reproduction coverage and preserve the existing requirement: repair the central offline Rust coverage toolchain, then rerun the exact unchanged leaf head and regenerate the formal OpenCode verdict. A leaf workaround, weakened threshold, stale-review dismissal, or source churn is not justified by the evidence.

  8. seonghobae commented on Aug 16, 2026

    @seonghobae
    seonghobae
    on Aug 16, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Additional same-class OriginWeave reproductions on unchanged direct-main heads, with independent leaf coverage green:

    • OriginWeave#45 exact head 6e615ecb9b946943f2e360a4ba4fe3ed8003ce6b: native CI 31683160261 succeeded, including Production coverage job 94393052343; central OpenCode run 31695895087 at .github@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba had coverage-source-tree success, then coverage-evidence job 94448811048 failed specifically in Measure test and docstring evidence, producing exact-head formal CHANGES_REQUESTED.
    • OriginWeave#46 exact head 2132617a7eaa2d36b061c61841b34c744df63a50: native CI/SAST/Security are green; current exact-head formal OpenCode reviews report coverage-evidence failure in central runs 31793734494 and 31799176620. Fresh fetch of 31799176620 confirms the same central source revision .github@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.

    These join the already-routed OriginWeave#37@fe324f71ccd154f7759f009d8c34fb6247c7d070 reproduction. Please treat #37/#45/#46 as protected-main consumer acceptance cases for the same central Rust coverage-evidence owner path: repair centrally, rerun the unchanged exact leaf heads, and regenerate formal OpenCode verdicts. Do not require leaf source churn, lower coverage thresholds, or dismissal of current-head reviews as a substitute for fixing the control plane.

  9. opencode-agent
    added
    area: apiAPI, protocol, event, or external contract
    area: ci-cdCI, GitHub Actions, checks, release, or supply chain
    priority: mediumNormal-priority or P2 work
    status: triagedOpen issue has an organization taxonomy assignment
    type: bugDefect or incorrect behavior
    on Aug 22, 2026
  10. seonghobae
    added
    bugSomething isn't working
    priority: highHigh-priority or P1 work
    on Sep 7, 2026

  11. seonghobae commented on Sep 15, 2026

    @seonghobae
    seonghobae
    on Sep 15, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Fresh protected-main OriginWeave reproduction narrows the still-open offline Rust evidence defect beyond the earlier missing-toolchain cases.

    Consumer: ContextualWisdomLab/OriginWeave#229@3c0e8eb318db98eafdb477e726f77ecdf92883e8 on main@87c4daa1830bac5a5228b6036752ad5633232085. Its repository-owned native CI is runner-backed GREEN, including Production coverage job 103574226026 and Rust contracts job 103574226152.

    Central OpenCode run 34701932468, coverage job 103575361404, trusted workflow fb17ef556f94f673234aa557254ae52779e9a7b0 reached the Rust command and failed because the network-disabled sandbox had no Cargo registry/index materialized: cargo llvm-cov --workspace --all-features --fail-under-lines 100 --show-missing-lines emitted Updating crates.io index, then Could not resolve host: index.crates.io, failing first on unicode-normalization for originweave-core and exiting 101. Replay guard and syntax gate had already passed; the final Coverage Decision failed after this Rust boundary.

    This matches the defect class and acceptance already embodied by open PR #1391 (fix(coverage): prefetch locked Rust dependencies for offline evidence). #1391 currently has the intended cargo fetch --locked + credential stripping + content-addressed Cargo cache + CARGO_NET_OFFLINE=true design, but live state is 7464d9d57c8434c6347125b7ed1070836ef460a3, mergeable=false, 11 commits ahead and 131 behind protected .github/main@91be6442906c7b6b4f600272c953699708394327. Its body’s older 36ac3aa... head receipt is stale.

    Acceptance should therefore include a current-main ordinary non-force successor/restack of #1391 followed by an unchanged-head replay of OriginWeave #229 proving that the Rust graph resolves entirely from the bounded prefetched cache while the sandbox stays tokenless and network-disabled. No OriginWeave source mutation, threshold weakening, or network enablement is justified by this evidence.

  12. seonghobae
    removed
    priority: mediumNormal-priority or P2 work
    on Sep 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: apiAPI, protocol, event, or external contractarea: ci-cdCI, GitHub Actions, checks, release, or supply chainbugSomething isn't workingpriority: highHigh-priority or P1 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behavior

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions