test(support): bind support-bundle counts and secret redaction

[seonghobae]

Problem

Protected main already carries the shutdown-listener race repair, so the unique delta on this branch is the support-bundle regression contract.

Current exact delta

• require the support-bundle top-level runtime counts to match the KPI snapshot
• require the same counts to match the buyer evidence manifest runtime counts
• serialize the support bundle and assert the quoted administrator secret is absent

This is a test-only hardening slice in src/lib.rs; it does not change production runtime behavior.

Fresh protected-main restack — 2026-09-05 KST

Protected main advanced through #159 to 5829a0f08d78de464dd24393ce5d0f25fba9d126. The intervening protected delta is limited to CI/Fuzz/Scorecard workflow ownership, AGENTS.md, and workflow-contract tests; it does not touch src/lib.rs.

The branch was therefore repaired non-destructively with merge commit 4db75680dcfa03d0592c62f08278fdef09c33694, preserving the complete prior branch as one parent and current protected main as the other. No force push, destructive rebase, or source reconstruction was used. Fresh comparison against live main reports behind_by=0; the effective protected-main-relative delta remains exactly 38 added test lines in src/lib.rs.

All predecessor workflow/review conclusions are historical after the head movement. The previous head had repository-owned CI/Fuzz/Security/SAST/coverage/CodeQL GREEN but central OpenCode/Strix cancellation and Noema failure; none transfers. The current exact head must obtain its own then-live repository/security/coverage/central review/thread/governance evidence before merge.

Merge only on unchanged 4db75680dcfa03d0592c62f08278fdef09c33694 through the ordinary protected path after all deterministic and central gates are terminal-valid and the live solo-maintainer governance policy is satisfiable without self/model approval or routine bypass.

Summary by CodeRabbit

• 테스트
  • 지원 번들의 카운트 정보가 KPI 스냅샷 및 증거 매니페스트의 실제 값과 일치하는지 검증을 추가했습니다.
  • 지원 번들 JSON에 "secret" 문자열이 포함되지 않는지 확인하는 검사를 추가했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 46997863-ab45-40c6-96a6-61b883366546

📥 Commits

Reviewing files that changed from the base of the PR and between 5829a0f and 4db7568.

📒 Files selected for processing (1)

• src/lib.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

지원 번들 테스트가 KPI 및 증거 매니페스트의 런타임 카운트 일치성을 검증합니다. JSON 직렬화 결과에 "secret" 문자열이 없는지도 검증합니다. 프로덕션 로직은 변경하지 않습니다.

Changes

지원 번들 검증

Layer / File(s)	Summary
지원 번들 출력 검증 src/lib.rs	SupportBundle의 6개 카운트 필드가 KPI 및 증거 매니페스트의 대응 카운트와 일치하는지 검증합니다. JSON 직렬화 결과에 "secret" 문자열이 없는지 검증합니다.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 4db75

This change adds regression coverage for support-bundle runtime counts and secret exclusion without altering production behavior. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 지원 번들 카운트 검증과 비밀값 비노출 검사를 추가한 테스트 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/support-bundle-regression-coverage

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.