ci: require exact-head production coverage evidence

[seonghobae]

Purpose

Enforce fail-closed exact-head owned-production coverage, trustworthy Rust test evidence, reproducible release evidence, and realistic production-boundary regressions. This historical branch is an evidence donor only: thresholds and owned-production scope are not weakened, predecessor evidence never transfers, and superseded product history must not be mechanically rebased onto current main.

Exact current state — 2026-09-05 KST

• historical branch head: a3803fced0bdbb4f8eb9d19d07a623b1422e5204;
• protected main: 0e90f9cebadbd7f59606baaec4ca1d2f178c899a (#343);
• canonical release/Test foundation: fix: verify Windows release artifact namespace #264 3e33229b4157a084a1985a1c7e952f98a64f25e3;
• canonical Test path-filter parent: fix(ci): repair contract-doc path filtering #338 eb255b92a0c63f44947a5d932694bf1df0678914;
• canonical current-stack coverage owner: ci: converge exact-head coverage foundation on current main #337 7d9d5040941650bf8ed8678b15092cffc439415a, non-force restacked parent-first through fix(ci): repair contract-doc path filtering #338/fix: verify Windows release artifact namespace #264;
• canonical provider-OAuth owner: security: reject unknown OAuth connection authority fields #339 42c89e253f07b4c0bfe4ea75c47bcaa790e95a85, downstream of reusable publication owner security: restore object-bound private evidence publication #344 2a23a1d7de5b929a76b432c192d2b9e537fbbbdd;
• shipped provider-OAuth CLI/process/platform owner: fix: make cloud operational help a successful terminal action #212 72665604821994b1f396c57e7a0ee271bea76de1;
• this PR remains Draft and is not a direct merge candidate. No current-head GREEN, exact 100% coverage, provenance completion, or merge readiness is claimed.

Verified inheritance into current owners

#337 carries the bounded coverage-diagnostic fallback, exact-head Test/coverage infrastructure, command/environment, cloud, minimally adapted iCloud-health, and real Git-worktree coverage fixtures. The adopted Git-worktree fixtures use real temporary Git repositories and preserve dirty retained worktrees; stale/prunable registration is diagnostic evidence only and never deletion authority.

Provider-OAuth domain evidence remains #339-owned and consumes #344's object-bound private-publication foundation; shipped CLI/process/platform-host evidence remains #212-owned. Release-specific Cargo/Tauri binary isolation, stable artifact identity, rerun/verifier and provenance contracts are #264-owned. Re-copying current-owner contracts into this historical line is rejected.

Coverage evidence boundary

The last usable current-stack predecessor measurement recorded on #337 before its latest restack was:

• regions 64,391 / 80,218 = 80.270014%;
• branches 5,292 / 8,991 = 58.858859%;
• functions 3,357 / 4,924 = 68.176280%;
• lines 42,867 / 53,111 = 80.712094%.

Those numbers are diagnostic predecessor evidence only. #337 current exact head 7d9d504... must produce its own hosted compile/runtime and repository-wide measurement before any coverage progress or GREEN claim. Thresholds remain exact 100%; exclusions or denominator reduction are not acceptable substitutes.

The older historical #156 measurement (55,501/64,352 regions, 5,098/7,023 branches, 2,903/3,851 functions, 36,792/42,326 lines) remains historical diagnostic evidence only and does not transfer.

Remaining inheritance work

#156 stays open until every still-useful unique test, fixture, contract, and evidence delta has either a verified canonical current owner/current-lineage implementation or an exact technical rejection because the assertion is duplicate, superseded, unrealistic, or no longer describes current behavior. Do not close merely to reduce PR count. Do not force-rebase or blindly overlay this historical product branch onto current main.

Required before closure

Closure is valid only after every useful delta is demonstrably inherited or technically rejected. Every current owner still requires its own unchanged-head live policy, exact non-vacuous coverage where applicable, Test/Release/Security/SAST/OSV/Scorecard/central workflows, zero valid unresolved findings, fresh ancestry, and package/SBOM/provenance/release evidence. Pending, queued, skipped-required, failed, stale-head, predecessor, diagnostic-only, status-only, model-only, author-only, no-source-scanner, infrastructure-only, or resource-exhausted evidence is non-passing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Follow-up exact head 25b3e42 fixes the behavioral root cause exposed by the new stale-delete contract: disconnect now deletes stale legacy credentials before the canonical credential. If a stale delete fails, the canonical refresh credential remains available for retry; the durable document is still rolled back. The existing unit and integration contracts now assert legacy-before-canonical ordering.

[seonghobae]

Exact-head coverage evidence at 25b3e42 failed for the measured repository scope, not for the OAuth change: cargo llvm-cov reported regions 86.2368%, branches 72.5630%, functions 75.3830%, and lines 86.9174%. The bounded diagnostic lists existing gaps across commands.rs, cloud.rs, provider_oauth.rs, and other binaries. I am leaving the draft fail-closed rather than weakening the 100% gate or claiming readiness; the next repair must add real coverage or explicitly narrow the measured product boundary with a documented ADR.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: a3803fced0bdbb4f8eb9d19d07a623b1422e5204

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: a3803fced0bdbb4f8eb9d19d07a623b1422e5204

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: a3803fced0bdbb4f8eb9d19d07a623b1422e5204

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: a3803fced0bdbb4f8eb9d19d07a623b1422e5204

[seonghobae]

Inheritance ledger update (2026-09-04): latest RED 0e705002765c21777c59f72ce4bf9ebe7feb243a and fix a3803fced0bdbb4f8eb9d19d07a623b1422e5204 are already represented on canonical coverage owner #337 exact head af39bce9bb6ac3186e3940e2c94dd8381080f619. Fresh source comparison confirms #337 requires and writes the same privacy-safe fallback coverage diagnostic rendering failed; raw diagnostic withheld while preserving authoritative coverage exit status; #337 also carries newer current-stack evidence-build semantics. These two #156 deltas are therefore verified inherited, not copied again. #156 stays open until its other unique deltas/tests/fixtures/contracts/evidence are similarly classified.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: a3803fced0bdbb4f8eb9d19d07a623b1422e5204

[seonghobae]

2026-09-04 current-owner inheritance update: old exact #337 coverage run 33779617794 produced a real bounded diagnostic at af39bce9...: regions 64391/80218 (80.270014%), branches 5292/8991 (58.858859%), functions 3357/4924 (68.176279%), lines 42867/53111 (80.712094%). src-tauri/src/commands.rs is the largest uncovered contributor at 2364 lines. Current-stack coverage owner #337 has therefore adopted this PR's still-valid src-tauri/src/commands_public_tests.rs and src-tauri/src/commands_env_coverage_tests.rs at exact head c820ab5102f173852df3362245c1611179074b73, wired only under #[cfg(test)]. This is pending exact-head hosted GREEN, not yet completed inheritance. No production source, threshold, coverage exclusion, or gate was weakened. Keep #156 open; the remaining historical files still require owner-by-owner classification.

[seonghobae]

Coverage inheritance ledger update — 2026-09-04

Current canonical coverage owner #337 advanced from c820ab5102f173852df3362245c1611179074b73 to exact head 33beca938a8340948edcd1bb433cebbd6fa831b6 with a fast-forward, non-force commit that adds only src-tauri/tests/cloud_public_coverage.rs from this historical line. The source blob is the exact #156 blob 94025f3917e4b9288ec481ef85e99aa5089dda8e; production cloud.rs is not copied or replaced.

Why this donor is still current-compatible: the present cloud.rs continues to expose the public contracts exercised by the suite — cloud/source root admission, canonical/Unicode root matching, provider/account-scope wire values, source snapshot selection, destination candidate limiting, and deterministic provider-root discovery. The fixture uses temporary local directories and in-memory file facts only; it does not discover real user cloud accounts, call provider APIs, upload, move, delete, or require credentials.

This step is driven by the latest trustworthy coverage RED on #337 predecessor af39bce9..., where src-tauri/src/cloud.rs contributed 687 uncovered lines. It does not weaken the exact-100% gate or production scope. Fresh #338→#337 compare is ahead-only (ahead_by=26, behind_by=0, merge base exactly #338 863322958e2ba965421e56b7993883d84919fb85).

Classification: cloud_public_coverage.rs is adopted pending exact-head GREEN. It is not yet marked fully inherited because current head Test 33875684654 and Release 33875684763 are queued, and the next real coverage artifact has not yet measured the delta. #156 therefore remains open; no other cloud fixtures are bulk-classified by this one transfer.

[seonghobae]

Next donor review finding — icloud_sync_health_public_coverage.rs

Do not copy historical blob c799c6795431c8bbf25b043147297800f96a6ab2 verbatim into #337. Its admission_report() constructs IcloudSyncHealthReport using the older shape. Current src-tauri/src/icloud_sync_health.rs has since added native_status: Option<IcloudNativeStatusEvidence> and file_provider_activity: Option<IcloudFileProviderActivityEvidence> to that struct, so the historical literal is no longer source-compatible even though the suite's filesystem/admission semantics remain relevant.

The valid successor path is a minimal current-shape adaptation (native_status: None, file_provider_activity: None) followed by exact-head compile/runtime coverage evidence. Until that is executed and GREEN, classify this file as valid semantics, repair required before adoption, not inherited and not duplicate. This also keeps the 474-line icloud_sync_health.rs measured coverage gap separate from the just-added cloud-domain donor, so any next RED remains attributable.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: a3803fced0bdbb4f8eb9d19d07a623b1422e5204

[seonghobae]

Coverage inheritance update (2026-09-04): src-tauri/tests/icloud_sync_health_public_coverage.rs has now been adopted by canonical coverage owner #337. Historical semantics were still valid, but current IcloudSyncHealthReport added optional native_status and file_provider_activity; commit b478fc174a7b77a60e960053715e55d282a5c166 adapts only those two fields to None, preserving the filesystem/admission assertions and source-database non-mutation checks. b46ed290040f7fc081888c03c0332e156c68ce61 records the decision. Current #337 head is ba1918c5d4a02e26c2189cb182a1e99c6d1e42ad after non-force prerequisite restack. Classification: adopted pending unchanged-head compile/runtime GREEN and a new real coverage measurement. This is not sufficient to close #156; remaining unique deltas still require owner-by-owner classification.

[seonghobae]

Coverage inheritance update (current owner #337): measured RED af39bce9bb6ac3186e3940e2c94dd8381080f619 identified git_worktree.rs with 286 uncovered lines. Historical src-tauri/tests/git_worktree_public_coverage.rs was rechecked against current public API and adopted on #337 at 222343048b8a8d99e47275e12643032666726645; it uses real temporary Git repositories and its destructive case creates/removes only a real temporary secondary worktree after exact approval, then verifies the branch remains. Coverage/owner rationale is current at #337 exact head 8d3ce22f862c7c9669d3e0aba9d732e487b138ad. This delta is adopted pending unchanged-head hosted compile/runtime GREEN and a new repository-wide measurement, not yet inherited/complete. provider_oauth.rs remains canonical on #339. The inspected broad Podman public donor is not being used as destructive/recovery acceptance evidence because its success path relies on synthetic Podman JSON plus a fake executable. #156 remains open; no bulk Close/supersede claim is made.

[seonghobae]

2026-09-05 inheritance classification: historical src-tauri/tests/git_worktree_active_use_process_coverage.rs does not need another #337 copy. Fresh exact #337@1394402fae3f5c04ed0d94994d114245d4cc0f4e already inherits a stronger current-lineage version of this file (blob 1ffda9d51cbc6d97840d4f0403b194dc22a1bfd2). It keeps the same real Git-worktree + independent sleep process + lsof active-use assertions, and additionally fails safely when the probe is unavailable and canonicalizes linked paths before matching. The historical donor is therefore classified as already inherited by current ancestry, not an unowned delta. This classification does not close #156; other historical files remain item-by-item work.