fix(ci): restore Pingora raw evidence failure coverage

[seonghobae]

Root cause

A clean detached worktree at actual main 2917179b861b7bb09e575f42156c27db1a716435, with pytest executed from that worktree under GITHUB_ACTIONS=true, reproduces the coverage failure: 3466 tests pass, but statement/branch coverage is 99.97%. The four uncovered statements and two partial branches are in scripts/ci/pingora_edge_policy.py at the raw transport error handler and content validation.

The large-blob repair in #2396 added the raw transport path (062a9ea6c3) and an upstream encoding allowlist (f03239b2f9). After allowing only none/base64 and rejecting inline none, the old downstream non-base64 guard is unreachable. Transport failures and a non-string base64 content field also lacked regressions. The same failure surfaced on #2358's main integration; it is reproduced independently on main.

Repair

• Remove the two unreachable lines while preserving the upstream encoding rejection.
• Exercise HTTP, URL and timeout failures through the production raw transport; assert fail-closed error propagation and the original cause.
• Add a non-string content rejection to the existing adversarial metadata cases.

Two files, 14 added and 2 removed lines. No coverage exclusions, policy exemptions, workflow permissions, retry or timeout changes.

Verification

Exact head 02a4b031bcc20e975812de8e46a223c42a2aabe5:

• Full CI-environment gate: 3470 passed, 5 skipped, 40 subtests; 100% statement and branch coverage, process exit0, 296.85 seconds.
• Pingora regression file: 100 passed, process exit0.
• Diff-check passed. The global docstring check separately fails99.8% on inherited Rust vendor helpers; docs(ci): complete trusted Cargo vendor helper docstrings #2443 repairs those two missing docstrings.

The full local result binds this head and parent 2917179b; current main has since advanced to f6a50f6a. Its separate declared-artifact security delta is preserved by normal merging; the #2358 integration of that main and this repair is being tested separately. Matching-head hosted checks, independent Noema/OpenCode approval and protected merge remain required.

Related: #712, #2358, #2396. This PR repairs a prerequisite; it does not close #712 or claim organization-wide queue acceptance.

Docstring evidence correction

The earlier docstring-success statement came from a combined shell command whose final status belonged to another successful command. A dedicated interrogate run reproduces99.8% on clean main, with the two inherited nested Rust helpers missing docstrings. #2443 corrects them and verifies100% with its own terminal process. This correction does not change the exact-head3470-pass/100% statement and branch coverage proof above.

[coderabbitai]

Warning

Review limit reached

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f85a056f-60fd-4066-aa6b-dbcd2050b462

📥 Commits

Reviewing files that changed from the base of the PR and between f6a50f6 and 02a4b03.

📒 Files selected for processing (2)

• scripts/ci/pingora_edge_policy.py
• tests/test_pingora_edge_policy.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head admission correction — 02a4b031bcc20e975812de8e46a223c42a2aabe5

Ready is review admission only. Fresh audit against base f6a50f6a59a0d3a4a5bdbd9e574684c71bd6fbbf found:

• latest terminal workflow blockers: CodeQL PR 36320701738=failure

This PR is moved to Draft/Proposed until the causal owner repair is present on a successor exact head and re-audited. Queued/pending work is neither an additional blocker nor passing evidence. No Close, force push, destructive rebase, manual rerun, synthetic status/approval, merge, auto-merge, or bypass was performed.