fix(coverage): restore trusted LLVM 19 producer pin

[seonghobae]

Why this change

PR #827 extracted the LLVM 19 check into scripts/ci/ensure_rust_llvm19.sh and left .github/workflows/opencode-review-dispatch.yml identical to main. That helper is current-head source. The coverage sandbox measures untrusted PR trees, so a helper-only pin cannot bind the coverage producer.

The previously approved head 2acaa179 already had the trusted 19-line binding: llvm-19 in the coverage image, ENV + RUN test -x, docker run --env, and the ensure_rust_toolchain fail-closed guard. This PR restores that trusted path and pairs REVIEW_DISPATCH_BLOB_SHA with the updated workflow blob.

What operators should do next

Review the restored producer pin, then merge this branch instead of #827. After merge, rebuild the trusted coverage image from default-branch opencode-review-dispatch.yml before treating Rust coverage as current-head evidence.

Do not merge #827 while its head still omits the trusted 19 lines.

Verification

Focused contract tests passed locally: tests/test_opencode_rust_coverage_toolchain_contract.py, tests/test_pr_review_autofix_nvidia_nim_contract.py, and related dispatch/coverage tests (46 passed, 1 skipped when the host lacks /usr/bin/llvm-cov-19).

Trust boundary

The runtime check stays in trusted default-branch workflow source. The helper is a readable extract and override-resistant contract, not the enforcement point. Updating opencode-review-dispatch.yml updates the independent review-dispatch blob SHA pin; it does not move review-agent credentials or approval authority.

Refs #827 and #816.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d69b4520-b1e2-4bed-86d7-473f528fb8c5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale comment

Review

Head a2d4924f restores the trusted LLVM 19 producer pin and now fail-closes when that pin drifts from the independent review-dispatch identity.

What is sound

• Coverage image, docker run --env, and ensure_rust_toolchain all bind /usr/bin/llvm-cov-19 and /usr/bin/llvm-profdata-19. The helper is a readable extract, not the enforcement point.
• REVIEW_DISPATCH_BLOB_SHA=de1c4800d362bda4a90c31a0c8e39687a782afb4 matches git hash-object of .github/workflows/opencode-review-dispatch.yml.
• The follow-up commit watches tests/test_pr_review_autofix_nvidia_nim_contract.py from the LLVM quality CI and asserts the blob pin there. The hourly NVIDIA NIM quality workflow still does not watch opencode-review-dispatch.yml, so that pairing check has to live in the workflow that actually retriggers on a producer rewrite.
• Local contract: 8 passed, 1 skipped (this host has no /usr/bin/llvm-cov-19). Quality CI already passed on 7b7686d6.

Do not merge #827 while its head still omits the trusted 19 lines. This is the landing vehicle.

Next operator action

1. Merge this PR after required checks on a2d4924f complete.
2. Rebuild the trusted coverage image from default-branch opencode-review-dispatch.yml before treating DiskSage or fast-mlsirm Rust coverage as current-head evidence.
3. Close or retire #827 after this merge. Do not open a third LLVM-pin PR.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Review

Head a2d4924f is the LLVM 19 landing vehicle. Local contract evidence: 31 passed, 1 skipped on tests/test_opencode_rust_coverage_toolchain_contract.py and tests/test_pr_review_autofix_nvidia_nim_contract.py (skip is host missing /usr/bin/llvm-cov-19). git hash-object of .github/workflows/opencode-review-dispatch.yml equals REVIEW_DISPATCH_BLOB_SHA=de1c4800d362bda4a90c31a0c8e39687a782afb4.

What is sound

• Trusted coverage image installs llvm-19, binds ENV LLVM_COV=/usr/bin/llvm-cov-19 and ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19, and RUN test -x both paths.
• Isolated docker run --env passes the same literals; ensure_rust_toolchain fail-closes before cargo llvm-cov; failures != 0 exits the sandbox.
• scripts/ci/ensure_rust_llvm19.sh is a readable extract only. It is not the enforcement point.
• Quality CI watches opencode-review-dispatch.yml and the NVIDIA NIM contract so a producer rewrite cannot leave the independent review-dispatch blob stale. Hourly NIM quality still does not watch opencode-review-dispatch.yml; that split is the documented control separation.
• Review-agent credentials, model keys, and approval authority are unchanged.

Do not merge #827. That head (55a7292a) still omits the trusted 19-line producer pin in opencode-review-dispatch.yml.

Next operator action

Merge this PR after the required OpenCode, Strix, and Noema reviews complete. The next default-branch repository_dispatch rebuilds the coverage image with --no-cache; treat that successful run as the first current-head LLVM 19 evidence. Then close or leave closed #827 so a helper-only pin cannot land.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Merge loop: exact remaining blocker is queued required checks on head a2d4924f86ebace197d7477ee527490d7bc53fce — strix, noema-review, osv-scan, scorecard, dependency-review, trivy-fs, Semgrep, gitleaks, required-workflow-bootstrap. quality and exact-head-path-policy are already success. Not waiting on OpenCode/Strix/Noema.