fix(review): update offline Rust coverage toolchain

[seonghobae]

Evidence

The required OpenCode repository_dispatch run https://github.com/ContextualWisdomLab/.github/actions/runs/29676953842 evaluated ContextualWisdomLab/codec-carver#250 at current head 4ffe820524640c84f904d93900a735cd21e61375.

• Python: 561 collected, 486 passed, 75 skipped, 100% line coverage.
• Python docstrings: 100%.
• Rust: failed before test execution because the trusted coverage image installed Ubuntu Cargo 1.75.0 and could not parse edition = "2024".
• Exact failure: feature edition2024 is required and Cargo 1.75.0.

The target crate builds and passes its Rust tests with the current stable toolchain. This is a central evidence-toolchain compatibility defect, not an application test failure.

Scope

• Replace the stale distro Cargo/rustc pair in the trusted offline coverage image with a digest-pinned official Rust stable amd64 image.
• Keep all PR-controlled execution under the existing --network=none, tokenless, capability-restricted sandbox.
• Preserve the hash-pinned cargo-llvm-cov and Python requirements contracts.
• Add static regression assertions for the pinned Rust image, removal of distro Cargo/rustc, and current toolchain version evidence.

Acceptance criteria

• The central test suite, Ruff, workflow syntax, and git diff --check pass.
• A new current-head repository_dispatch run for ContextualWisdomLab/codec-carver#250 reaches Rust coverage rather than failing manifest parsing.
• Any subsequent Rust coverage gap is reported with exact missing-line evidence.
• The exact current-head OpenCode review is regenerated only after coverage evidence passes.

Agent: Codex
Recorded: 2026-07-19T15:58:00+09:00
Phase: Ops

Unblocks: ContextualWisdomLab/codec-carver#250

[seonghobae]

PR #592 is at current head 137ff8b.

Current evidence:

• Strix current-head run 29683525528: success.
• Required OpenCode repository_dispatch run 29683750497: coverage-evidence succeeded; the real-model review pool is still in progress.
• Local full suite: 634 passed.
• Official Python coverage contract: 5,527 statements, 0 missed, 100%.
• Interrogate: 514/514, 100%.
• Targeted OpenCode contract/model-pool tests: 54 passed.
• Ruff, Bash syntax, Actionlint expression/syntax checks, and git diff validation passed.

The PR now pins the official Rust 1.97.1 linux/amd64 image by exact manifest digest, seals rustup/cargo paths, installs llvm-tools-preview during the trusted networked image build, and preserves the existing tokenless network-disabled PR sandbox. It also caps central review-process candidates at 15 minutes with a one-hour pool budget so an unavailable provider cannot starve every fallback.

Acceptance remains open until PR #592 merges and a new exact-head review of codec-carver#250 reaches real Rust coverage.

[seonghobae]

Current-head retry 29683750497 reached successful coverage-evidence, then exhausted the real-model pool after about 183 minutes. Publish OpenCode review outcome failed with MODEL_OUTPUT_UNAVAILABLE; no review or comment was posted for head 137ff8b. Deterministic evidence correctly did not create an approval.

This is systemic rather than PR-local: among completed repository_dispatch OpenCode runs created after 2026-07-19T10:00:00Z, there were no successful runs; every completed run was failure or cancelled.

Live governance state:

• Ruleset 17921150 requires 2 approvals and last-push approval.
• bypass_actors is empty and current_user_can_bypass is never.
• The only repository collaborator is the PR author, so a human same-head approval is unavailable.
• No alternate default-branch manual workflow accepts a trusted review verdict or model/timeout override.

PR #592 remains fully validated locally and blocked only on external real-model reviewer availability. The safe next action requires provider recovery or explicit authority for a temporary governance change; neither is being assumed.

[seonghobae]

Current protected-main operational acceptance still reproduces this central coverage-toolchain defect.

• Central workflow revision: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
• Consumer evidence: OpenCode dispatch run 31576614667 for ContextualWisdomLab/disksage#181@ea192535bd467dc1a0121ca2886fcdecd04da502.
• Exact first failing boundary: coverage-evidence job 94050254880; metadata validation, bootstrap, and source-tree materialization all succeeded first.
• Immediate error: cargo-llvm-cov could not find llvm-tools-preview, so the coverage sandbox failed before it could produce qualifying Rust coverage evidence.
• This is central infrastructure/toolchain evidence, not a semantic source finding against disksage.

PR #592 carried the intended pinned Rust/llvm-tools-preview repair but closed unmerged on 2026-08-03. The recurrence on the current protected head proves the issue is not resolved. Acceptance remains: port the bounded offline Rust toolchain repair onto the then-current protected base, rerun this exact coverage boundary successfully, and obtain a current-head consumer dispatch proving the installed LLVM tools are usable without network access.

[seonghobae]

Fresh protected-main consumer reproduction from ContextualWisdomLab/OriginWeave#37 at exact leaf head fe324f71ccd154f7759f009d8c34fb6247c7d070 and protected OriginWeave main 0c376acf059be9ddddddfbde1d0189e4f39ef014.

Central OpenCode workflow revision is the same affected protected .github revision already recorded here: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.

Exact central evidence:

• OpenCode run 31916575003, workflow_dispatch, completed failure.
• First failing job: coverage-evidence job 95089261092.
• Job steps reached checkout and trusted astral-sh/setup-uv; the named Enforce real coverage step then failed.
• Check annotations report Coverage sandbox reported failing test, build, or coverage evidence (exit 1) and process exit 1.
• OpenCode consequently submitted exact-leaf-head CHANGES_REQUESTED for absent coverage proof.

Independent leaf evidence on the unchanged same OriginWeave head contradicts a leaf coverage-gap diagnosis: current OriginWeave CI run 31913805978 completed successfully, including its exact 100% production coverage job, and current SAST/Security/MV3 evidence is also green. The leaf branch is mergeable against the same protected main and does not need a source mutation merely to retrigger central coverage.

The central job log body is not currently retrievable through the available connector, so this reproduction does not invent whether the immediate stderr was specifically missing llvm-tools-preview. However, it is the same central revision and same Rust coverage-evidence boundary as the already-proven DiskSage recurrence in this issue. Please include OriginWeave#37 in #591 acceptance/reproduction coverage and preserve the existing requirement: repair the central offline Rust coverage toolchain, then rerun the exact unchanged leaf head and regenerate the formal OpenCode verdict. A leaf workaround, weakened threshold, stale-review dismissal, or source churn is not justified by the evidence.

[seonghobae]

Additional same-class OriginWeave reproductions on unchanged direct-main heads, with independent leaf coverage green:

• OriginWeave#45 exact head 6e615ecb9b946943f2e360a4ba4fe3ed8003ce6b: native CI 31683160261 succeeded, including Production coverage job 94393052343; central OpenCode run 31695895087 at .github@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba had coverage-source-tree success, then coverage-evidence job 94448811048 failed specifically in Measure test and docstring evidence, producing exact-head formal CHANGES_REQUESTED.
• OriginWeave#46 exact head 2132617a7eaa2d36b061c61841b34c744df63a50: native CI/SAST/Security are green; current exact-head formal OpenCode reviews report coverage-evidence failure in central runs 31793734494 and 31799176620. Fresh fetch of 31799176620 confirms the same central source revision .github@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.

These join the already-routed OriginWeave#37@fe324f71ccd154f7759f009d8c34fb6247c7d070 reproduction. Please treat #37/#45/#46 as protected-main consumer acceptance cases for the same central Rust coverage-evidence owner path: repair centrally, rerun the unchanged exact leaf heads, and regenerate formal OpenCode verdicts. Do not require leaf source churn, lower coverage thresholds, or dismissal of current-head reviews as a substitute for fixing the control plane.