fix(ci): restore inherited coverage and docstring gates

[seonghobae]

RCA

Exact base 7900ba4c4d68c378023592252f2579646fad9aaa passed its tests but failed the hard quality gates: coverage 99% and docstrings 97.1%. The gaps mixed uninstrumented subprocess CLI execution, untested error paths, incomplete helper documentation, and duplicated late runtime-matrix validation.

Change

Restored explicit in-process CLI and failure-boundary tests, documentation for the tested helper contracts, strict runtime matrix admission before native I/O, and response cleanup on downloader errors. The original quality repair plus the npm SemVer security-floor successor are preserved by ordinary merge. No coverage threshold, dependency pin, workflow, or Air-owned contract file is changed.

Verification

• Base plus first quality repair: 5,274 passed / 4 skipped / 40 subtests; coverage and docstrings 100%.
• Fixed package candidate a5557f439143b5661481fae0ee4aac0ec4014cd4: exhaustive frozen-tree verification executed 5,327 collected nodes in 16 disjoint receipts, with 5,323 passed / 4 skipped / 40 subtests; statement and branch coverage 100%, docstrings 100%. Receipt: .claude/worktrees/.verification-evidence/runs/package-a5557f439143b5661481fae0ee4aac0ec4014cd4-302a1d0a1c2634ac/aggregate-1791077570010765000/result.json.
• The result is local exhaustive-partition evidence, not hosted acceptance or merge authorization.

Stack

This PR is a successor of #2571 and remains based on #2531. Parent protected-main integration, current-head hosted checks, formal non-author approval, and resolved threads remain required.

Developer experience: the hard gate now exercises actual CLI and error behavior instead of losing coverage in child interpreters.
User experience: malformed release and runtime evidence continues to fail closed while valid builds retain a verifiable path.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 67246ed0-ba9a-43e0-8bc8-33cf12e78a65

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Gyeot consumer full-gate dependency receipt — October9 KST

Consumer central #2611 now has exact head87a371a7783fa16f6988c9c98da8e5eb5820eae7. Inherited complete-test/source investigation on base7554587 reproduced interrogate97.1% (43 missing docstrings across12 production files); the missing source bytes were identical to that base. Your b37356d retains this gate ownership. The consumer did not edit these files or lower the100% docstring/coverage thresholds, and did not cherry-pick docstrings while omitting your runtime/security fixes. A post-repair complete exact-head test/coverage/interrogate collection is running; verdict not yet available.

Consumer repair scope is distinct: deterministic CodeQL UTC tests preserving35day/microsecond boundary, plus resolved sandbox executable admission and regressions. Local independently reviewed117tests/23construction-onlyprobes and parent219focusedtests pass, but this is NOT wholecentralgate, livebwrap or qualifyingAppapproval. Please retain inherited quality-gate ownership; updated evidence will bind actual complete exits, never a green subset or missingcoverage exemption. No protected merge or source-ownership takeover was performed.

[seonghobae]

Updated dependency from Gyeot consumer — exact #2611 head 87a371a

Post-repair full local run on the Gyeot consumer tree now has a clean pytest leg: 5,330 tests, 0 failures, 0 errors, 4 skips; source stayed stable. The remaining hard gate failures are exactly the inherited quality gates this PR owns:

• coverage report exits 2: total 99%, fixed threshold 100%.
• interrogate exits 1: actual 97.1%, fixed threshold 100%.

The current missing coverage list from the consumer exact head includes materialize_base_rust_dependencies, noema_preflight_capacity, noema_review_gate, opencode_queue_priority, pingora_edge_policy, place_maturin_extension, prescreen_release_runtime_archives, release_dependency_gate, resolve_base_rust_toolchain, spdx_license_policy, strix_report_scope and strix_unverified_dependency. The consumer did not lower thresholds or edit those owner files. Please preserve the owner lane and ensure any successor remains compatible with #2611 instead of deleting the new Gyeot helper files/tests.

Local evidence paths are recorded in #2611; this comment is a dependency receipt, not approval or closure authorization.

[seonghobae]

Gyeot consumer integration compatibility verified

Private no-commit merge of #261187a371a with this unchanged owner head b37356d produced conflict-free tree 152d8668f72016293928c22fbbc177bf3da18fe8. Parent verified 28 retained artifact hashes, all ten Gyeot file bytes preserved, source stability and actual exits. Complete Python3.14.5 tests: 5,405 passed, 4 skipped, 40 subtests passed. Statement18,280/18,280 and branch7,506/7,506 coverage; interrogate1,473/1,473 = 100%, both exit0. Evidence directory /Users/seonghobae/.hermes/cache/scratch/gyeot-2572-private-accept-20261009/; no security or threshold bypass.

This supplies compatibility evidence, not protected integration, native/Linux execution, real Noema/OpenCode review or approval. Your branch and #2611 branch remain unchanged; normal owner publication and review gates still apply.