fix(ci): serialize Runtime coverage without renaming checks

[seonghobae]

RCA

Fresh protected main is 70c9344a022c602062b7d6a43cfde7adc9d476cc. Across current open PR heads, Runtime CI plus the independent Security/SAST/SBOM/provenance workflows are repeatedly remaining queued before repository steps execute. Runtime CI already has per-PR cancel-in-progress, so stale same-PR runs are not the root cause. The first failing operational boundary remains GitHub-hosted runner allocation.

An earlier experiment on this branch combined coverage jobs, but doing so renamed the long-lived Production line coverage and Production branch coverage check identities. The active organization ruleset is authoritative and the repository connector cannot prove that no policy consumer still binds those identities. Replacing them would therefore introduce avoidable governance risk.

The current smallest root-cause-changing remedy preserves all three Runtime check identities and serializes branch-coverage behind line-coverage. Runtime CI requests at most two hosted runners concurrently (Format, lint, test, and rustdoc plus one coverage job) rather than all three at once. Total Runtime CI allocations remain three. branch-coverage uses needs: line-coverage with if: ${{ always() && !cancelled() }}, so a failed line-coverage job still hands off to branch coverage while cancellation does not force another runner to start.

TDD / reconciliation lineage

• bf5d8cb4031cfa817cb24a338c3aa833a073b3fb — RED executable contract requiring preserved coverage check identities and serialized scheduling.
• 946f54dc8a4ecd9d0e5ce901c2c866b8302a57a6 — RED refinement requiring failed-line handoff without cancellation hang.
• 34210dab2abeecd07fc74f9580821ffa2a0f1ceb — restore separate named coverage jobs and serialize branch coverage after line coverage.
• c156b9019163900c704673af2c74789d3fc68ffa — reconcile the broader CI contract with three exact-head jobs, independent PostgreSQL services, and the pinned nightly branch-coverage toolchain.
• 0aeedcd4f3f1464550d6077bf734189c8fd691a3 — historical changelog alignment; the final reconciliation intentionally restores the current protected-main CHANGELOG so active-PR wording cannot become shipped truth.
• 0be7c7e28cbca012b964e48be34268af8a43e4e1 — restore docs/TRACEABILITY.md byte-for-byte to protected-main content so obsolete combined-runner evidence cannot masquerade as current architecture truth.
• d2c1b768d0ebc2ecbfdcd79ebbe31a7b2356fe5f — earlier non-destructive main reconciliation.
• f4653cfea708d45d9c91cc034767c0f1c9ab191c — current non-destructive two-parent reconciliation with protected main@70c9344a022c602062b7d6a43cfde7adc9d476cc. The final tree is exactly current main plus the three intended Runtime-CI contract files.

Earlier combined-runner commits remain historical exploration only and are not acceptance evidence for the final tree.

Evidence preserved

• Long-lived Runtime check identities remain Format, lint, test, and rustdoc, Production line coverage, and Production branch coverage.
• Every Runtime job checks out the exact PR head and uses persist-credentials: false.
• Every PostgreSQL service remains digest-pinned, connects directly on localhost, and uses per-run ephemeral credentials.
• Stable 1.97.1 line coverage and pinned nightly-2026-08-18 branch coverage remain separate exact 100% gates.
• Line and branch generation failures retain explicit operator diagnostics, while true coverage-gate failures retain scoped missing-line/branch diagnostics.
• No repository permission, secret, package publication, attestation, psychometric/scoring behavior, database schema, scientific threshold, security gate, or known check identity is weakened.

Final diff boundary

Against protected main@70c9344a022c602062b7d6a43cfde7adc9d476cc, exact head f4653cfea708d45d9c91cc034767c0f1c9ab191c is ahead with zero commits behind and changes only:

• .github/workflows/ci.yml
• tests/ci_contract.rs
• tests/ci_serial_coverage_contract.rs

CHANGELOG.md is intentionally identical to protected main in the final tree.

Supersession

This remains the sole Runtime allocation landing vehicle. #286 is historical predecessor evidence. #347 is closed without merge after reconciliation showed that its single-job design removed the three long-lived check identities and introduced a diagnostic-scoping defect. Do not revive either as a competing writer lane.

Current exact-head state

Exact current head is f4653cfea708d45d9c91cc034767c0f1c9ab191c. Runtime CI, Security, SAST, SPDX SBOM, and supply-chain provenance for this head are currently queued; predecessor success is not acceptance evidence. The branch was reconciled without force-push, and protected main is its merge base.

Acceptance

Do not merge until the unchanged exact current head itself passes Runtime CI, Security, SAST, SPDX SBOM, provenance, every live required gate, has zero valid unresolved findings, and satisfies qualifying independent non-author review where repository or organization policy requires it. Queued, pending, skipped, cancelled, stale, predecessor, synthetic, or model-only evidence is not passing. Never self-approve or bypass the ruleset.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 771dfd58-a0c4-43ad-8f36-9f327ef37604

📝 Walkthrough

Walkthrough

라인 및 브랜치 커버리지를 단일 coverage 작업으로 통합했습니다. 고정 툴체인과 두 게이트를 검증하도록 CI 계약 테스트를 갱신했습니다. 변경 기록과 추적성 문서에 Runtime CI 상태를 추가했습니다.

Changes

커버리지 CI 통합

Layer / File(s)	Summary
통합 커버리지 작업 구성 .github/workflows/ci.yml	작업 이름과 제한 시간을 변경했습니다. 안정 버전과 고정 nightly 툴체인을 설치하고, 라인 및 브랜치 커버리지 게이트와 조건부 실패 진단을 실행합니다.
CI 계약 및 변경 기록 검증 tests/ci_contract.rs, tests/ci_serial_coverage_contract.rs, CHANGELOG.md, docs/TRACEABILITY.md	CI 작업 수, PostgreSQL 설정, 커버리지 게이트, cargo-llvm-cov 설치를 검증하도록 테스트를 갱신했습니다. 브랜치 커버리지 실행 순서와 Runtime CI 추적성 기록을 추가했습니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to 4c044

The combined coverage workflow can skip branch coverage when line coverage fails, leaving the branch coverage gate unrun on that path. Update the workflow so branch coverage still generates and is gated independently before merging.

Suggested reviewers: cursoragent

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 2 files. (3 skipped: 3…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Runtime coverage를 직렬화하고 기존 체크 이름을 유지하는 핵심 변경을 정확하게 요약합니다. CI 워크플로 변경 및 PR 목표와 일치합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 2 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/runtime-coverage-single-runner-main-20260821

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Validation update for exact head 6970bc93e064acca56965b69d38569686c93caa0 (base 4499d9c0889c082487ddbd7fd8d0d5d18257995d):

• Added the required active-PR traceability and changelog entries for the Runtime CI allocation/recovery change; protected-main and release evidence remain explicitly unclaimed.
• cargo test --test documentation_architecture_contract -- --nocapture: 10/10 passed.
• cargo test --test traceability_active_pr_contract -- --nocapture: 1/1 passed.
• git diff --check: passed.
• Existing Devin review reports no issues; no inline review threads are unresolved.

The workflow change itself remains unmerged pending fresh exact-head Runtime CI, Security, SAST, SPDX SBOM, provenance, all live required gates, and qualifying independent review.