ci(rust): refresh nightly coverage and track stable compiler by seonghobae · Pull Request #258 · ContextualWisdomLab/psychometrics-commons

seonghobae · 2026-08-19T12:29:56Z

Problem

Psychometrics Commons had five branch-coverage invocations tied to nightly-2026-08-01, while stable builds already used Rust 1.97.1.

Changes

move all branch-coverage installation, tool verification, generation, and diagnostics to nightly-2026-08-18
keep the stable compiler exactly pinned at 1.97.1
add weekly Dependabot rust-toolchain tracking
extend Rust CI contracts so partial nightly updates, the predecessor date, or floating stable channels fail closed
add toolchain doctoring evidence

Verification required on this exact head

PostgreSQL-backed Rust quality job
locked compile, lockfile integrity, Clippy, all-target tests, repository contracts, rustdoc
exact stable line coverage
exact nightly branch coverage
security/SAST/SBOM/provenance
qualifying independent non-author review

Compatibility and risk

No psychometric algorithms, persistence semantics, public API, migration, or dependency is changed. Exact-head repository CI has demonstrated compatibility on 14ac3219f5785efddcee1b73cfc5110b56008ec2, so the PR is review-ready rather than Draft. That evidence does not replace the independent non-author review gate, and any new head must be revalidated from scratch.

Summary by CodeRabbit

업데이트
- Rust 안정 버전을 1.97.1로 갱신했습니다.
- 브랜치 커버리지 검증에 Nightly 도구체인 2026-08-18을 사용합니다.
- Rust 도구체인 자동 업데이트를 루트 기준 주간 일정으로 설정했습니다.
문서
- 도구체인 갱신 기준과 포맷팅, 빌드, 테스트 및 커버리지 검증 절차를 안내하는 문서를 추가했습니다.
품질 개선
- 도구체인 버전과 자동 업데이트 설정이 일관되게 유지되는지 자동으로 검증합니다.

coderabbitai · 2026-08-19T12:30:08Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 858e26a7-2135-492b-9f5a-5a873b42dbbb

📥 Commits

Reviewing files that changed from the base of the PR and between 2f1c404 and 2d500c3.

📒 Files selected for processing (2)

docs/doctoring/rust-toolchain-freshness.md
tests/ci_contract.rs

🚧 Files skipped from review as they are similar to previous changes (1)

docs/doctoring/rust-toolchain-freshness.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

Rust 안정 버전을 1.97.1로 고정하고 분기 커버리지에 nightly-2026-08-18을 적용했습니다. Dependabot의 Rust toolchain 주간 업데이트와 CI 계약 테스트 및 운영 문서를 갱신했습니다.

Changes

Rust 도구체인 신선도 관리

Layer / File(s)	Summary
도구체인 정책 및 CI 갱신 `.github/dependabot.yml`, `.github/workflows/ci.yml`, `docs/doctoring/rust-toolchain-freshness.md`	Dependabot이 루트 `rust-toolchain.toml`을 매주 확인하도록 설정했습니다. 분기 커버리지 명령을 `nightly-2026-08-18`로 갱신했습니다. Rust `1.97.1`과 검증 절차를 문서화했습니다.
CI 계약 검증 `tests/ci_contract.rs`	계약 테스트가 고정된 stable 및 nightly 명령, 분기 커버리지 명령, 이전 nightly 미사용, Dependabot 설정을 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 2d500

The PR refreshes Rust coverage toolchains and adds freshness tracking, but its documentation reference is inaccurate and the CI contract does not fully verify the required stable and nightly configuration. The PR is not merge-ready until these bounded correctness and maintenance safeguards are corrected or explicitly accepted.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 nightly 커버리지 갱신과 안정 버전 컴파일러 추적이라는 주요 변경 사항을 정확하고 간결하게 요약합니다.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch agent/rust-toolchain-refresh-2026-08-19

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-19T16:36:31Z

@coderabbitai review

coderabbitai · 2026-08-19T16:36:48Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-19T19:49:08Z

@coderabbitai review

coderabbitai · 2026-08-19T19:49:14Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-20T00:36:16Z

@opencode-agent review exact current head 14ac3219f5785efddcee1b73cfc5110b56008ec2. Please evaluate the Rust toolchain refresh against current main d5443cdc1a52df8c7a34f0633a7353acfc79e008, using only same-head checks and current diff evidence. Do not transfer stale review evidence.

seonghobae · 2026-08-20T08:37:32Z

@opencode-agent

seonghobae · 2026-08-20T08:37:40Z

@cwl-noema-review

seonghobae · 2026-08-20T11:37:05Z

@coderabbitai review

coderabbitai · 2026-08-20T11:37:13Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-20T12:39:31Z

@opencode-agent Please review only exact current head 2f1c404486fc9c7ba764a6e6d46184c2c86c8398 against protected main 5544149ca5dc55d2bfc3402cc59c03c44830de5f. Runtime CI, Security Scan, SAST Semgrep, SPDX SBOM evidence, Supply chain provenance, and CodeRabbit status are all successful on this unchanged head. Do not transfer reviews or evidence from predecessor head 14ac3219f5785efddcee1b73cfc5110b56008ec2. Report only actionable findings against the current SHA, and approve only if the exact-head evidence supports it. This request is not an approval.

seonghobae · 2026-08-20T13:41:52Z

@coderabbitai review

coderabbitai · 2026-08-20T13:41:57Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Preserve the consent persistence parity patch on top of current protected main while retaining the Rust toolchain freshness changes from #258. The touched files are path-disjoint from #258; this reconciliation changes no consent behavior beyond the existing PR delta.

Preserve the #262 longitudinal observation identity guard and its focused traceability/test evidence on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing longitudinal behavior beyond the existing PR delta.

Preserve the #272 integration persistence reference-parity hardening and PostgreSQL regression contract on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing integration semantics beyond the existing PR delta.

Preserve the #273 durable result consent-reference integrity constraint and PostgreSQL regression contract on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing result semantics beyond the existing PR delta.

Preserve the #254 fail-closed HTTP/1.1 framing boundary and security regressions on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing session behavior beyond the existing PR delta.

Preserve the #220 public-release identity scanner, fail-closed inventory contract, governance update, and adversarial privacy tests on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing research-release behavior beyond the existing PR delta.

Preserve the migration-wide table-name and sequence-collision fitness contract on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing product persistence behavior.

Preserve the product-owned immutable result read HTTP boundary and its authorization/provenance contract on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing result-read semantics.

Preserve the product-owned PostgreSQL anonymous participant base, replay/corruption/concurrency/recovery evidence, and aligned as-built/traceability artifacts on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing participant persistence semantics.

Preserve the verified outbound-publish receipt handoff, fenced PostgreSQL recording contract, and aligned risk/traceability/UML evidence on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing delivery semantics beyond the existing PR delta.

Preserve the repository-wide no-cross-service-application-database fitness contract on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or weakening the accepted bounded-context boundary.

seonghobae added 4 commits August 19, 2026 05:11

ci: refresh pinned branch coverage nightly

93100f9

test: lock Rust compiler freshness contracts

8e78e1e

ci: track the pinned Rust toolchain

4436e48

docs: record Rust toolchain freshness policy

14ac321

seonghobae marked this pull request as ready for review August 19, 2026 15:31

merge(main): reconcile Rust toolchain refresh after #252

2f1c404

This comment was marked as resolved.

Sign in to view

seonghobae added 3 commits August 20, 2026 06:56

test(ci): pin each Rust toolchain command

6626510

docs(ci): cite exact Dependabot toolchain release

bc71223

style(ci): restore rustfmt trailing newline

2d500c3

devin-ai-integration Bot reviewed Aug 20, 2026

View reviewed changes

seonghobae merged commit 503a4e6 into main Aug 20, 2026
35 checks passed

seonghobae added a commit that referenced this pull request Aug 20, 2026

merge(main): reconcile scoring engine adapter after #258

177ce83

seonghobae added a commit that referenced this pull request Aug 20, 2026

merge(main): reconcile localized result reports after #258

b29cf4e

seonghobae added a commit that referenced this pull request Aug 20, 2026

merge(main): reconcile credential-bound session authority after #258

cdeaa2e

seonghobae added a commit that referenced this pull request Aug 20, 2026

merge(main): reconcile canonical narrative rule references after #258

2268754

seonghobae added a commit that referenced this pull request Aug 20, 2026

merge(main): reconcile assessment path contract after #258

c9b75e8

seonghobae added a commit that referenced this pull request Aug 20, 2026

merge(main): reconcile result export authorization after #258

956bd4e

seonghobae added a commit that referenced this pull request Aug 20, 2026

merge(main): reconcile safe API problem details after #258

fdb46d4

seonghobae added a commit that referenced this pull request Aug 20, 2026

merge(main): reconcile operator health probes after #258

df34d18

This was referenced Aug 20, 2026

fix(api): reject ambiguous HTTP request framing #254

Merged

fix(consent): enforce Rust-equivalent durable reference validation #271

Closed

seonghobae mentioned this pull request Aug 20, 2026

docs: establish current product technical gap baseline #263

Merged

Conversation

seonghobae commented Aug 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Changes

Verification required on this exact head

Compatibility and risk

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

seonghobae commented Aug 19, 2026

Uh oh!

coderabbitai Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 19, 2026

Uh oh!

coderabbitai Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

coderabbitai Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

coderabbitai Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 19, 2026 •

edited

Loading

coderabbitai Bot commented Aug 19, 2026 •

edited

Loading

coderabbitai Bot commented Aug 19, 2026 •

edited

Loading

coderabbitai Bot commented Aug 20, 2026 •

edited

Loading

coderabbitai Bot commented Aug 20, 2026 •

edited

Loading