fix(coverage): measure safeHash in operational core

[seonghobae]

Purpose

Advance #84 with the next bounded Region A coverage-truthfulness slice on protected main 26de1c3ab69106900410f6ceb18420109bfd9f8f. This lane measures only private safeHash, immediately after #333 made the adjacent trace helpers measurable. It does not touch the credential/OIDC/GitHub App Region B or claim #84 complete.

Test-first RED

Exact RED head: 36684096751774e77417c9176bceea5e047347ed.

The RED changes only test/coverage-ignore-operational-helpers.test.ts, extending the existing deterministic source contract to require safeHash to be outside any broad v8 ignore region. Protected source currently places safeHash immediately inside Region A, so the new assertion is intentionally RED until production coverage instrumentation is narrowed.

Existing realistic test/worker.test.ts already exercises safeHash through the public Worker boundary: an overlong untrusted client identifier is reduced to a bounded client key and the resulting rate-limit client_hash is checked against an independent FNV-1a test implementation. The GREEN change must therefore remove only the coverage exclusion around this already-observed behavior, not add a no-op direct export or weaken the 100% gate.

Safety / evidence boundary

• base is exact protected main at construction;
• stale docs(api): inventory and document non-conflicting TypeScript API #86 remains unchanged at 1d8b9a3fafc07f0df6e79a286f141d21e22bc1f9; this slice changes only private coverage instrumentation and the existing source-contract test;
• canonical docs: establish canonical product and trust-boundary documentation #71 remains a separate diverged documentation/architecture lane; this slice does not alter its docs or credential-core behavior;
• no force update, destructive rebase, workflow mutation, gate weakening, reviewer/secret invention, release, deployment, persistence, or outbound-license decision.

Keep Draft. RED failure is evidence, not merge authority. After the smallest GREEN, require fresh unchanged-head application ci, reviewer-ci, protected-base central Security Scan, configured exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending/queued/skipped/absent/neutral/failed/cancelled/stale/predecessor/status-only/model-only/rate-limited evidence remains non-passing.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 208280db-76df-48ce-ad75-2bdc122ec7b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}