test(quality): enforce Python branch coverage

[seonghobae]

Quality outcome

BandScope's Python quickcheck now measures branch coverage as well as statement coverage. Enabling coverage.py branch measurement exposed reachable branch gaps that the former statement-only gate could not see; this PR repairs them with bounded regression tests or removes one logically unreachable branch. No coverage omission, pragma, threshold reduction, or ignored module is used.

Exact current scope

• Exact head: 6afbc9fff585a5a7c2bf0454b0673c3f71f1b0e1.
• Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
• Exactly three files differ from protected develop:
  • services/analysis-engine/pyproject.toml: sets [tool.coverage.run] branch = true;
  • services/analysis-engine/src/bandscope_analysis/roles/activity.py: removes the redundant deact_role in handoffs branch because every deactivating role is constructed from current_roles, whose keys initialize handoffs;
  • services/analysis-engine/tests/test_branch_coverage_contract.py: adds focused regressions for branch arcs that statement-only measurement previously hid.
• No dependency, lockfile, persistent workflow, model, database, network, filesystem, IPC, or application-permission authority change.
• The temporary one-shot formatter workflow self-deleted and is absent from the current diff.

Verification-driven RED → GREEN history

1. Exact head 4ec36a6c0e03104127b197dd18361956accaccff failed ci run 31919361371 and release at the repository Ruff formatter. The affected Python files were formatted with the repository's pinned toolchain through a self-cleaning one-shot workflow; that workflow is absent from the current tree.
2. Human-authored verification head fcf7e52ac441c92a8950075f1b292c3b3dfc0ff7 then reached the substantive RED state: release job 95097924193 reported 3020 statements with zero misses and 986 branches with one partial arc, sections/segmenter.py 150->153, for 99.98% total coverage.
3. Exact-code inspection proved the arc reachable for a full-size flat/silent self-similarity matrix whose novelty peak is zero. Current head adds a deterministic 6×6 zero-SSM / kernel-size-4 regression asserting the novelty curve remains all-zero and finite.
4. Exact current-head release run 31920094986, job 95098490420, is terminal-success. Its fallback-path report proves 3020/3020 statements and 986/986 branches at 100%, including sections/segmenter.py at 195 statements and 74 branches with zero misses/partial branches. Public docstrings (D100–D107), Ruff check/format, Bandit, mypy, desktop/shared-types 100% statement/branch/function/line coverage, Python 671 passed / 24 skipped, and frontend production build also pass. Skipped native-parity cases in this fallback job are not counted as parity success.
5. Exact current-head ci run 31920094933, job 95098490111, builds and installs the Rust numeric extension before quickcheck and is terminal-success. It executes all 23/23 test_numeric_parity.py cases, reports 694 passed / 1 skipped overall, and independently proves 3020 statements / 986 branches / 0 misses / 0 partial branches = 100%. gate / ci / rust-check job 95098490180 is also terminal-success.
6. Exact current-head build-baseline run 31920094977 is now terminal-success. macOS amd64/arm64 and Windows amd64/arm64 builds all succeed; both platform gates succeed. The workflow-intentional Windows arm64 Python-sync skip and release-publish skip are not substituted for test/security evidence.

Exact-head security and supply-chain state

Terminal-success exact-head repository gates now include ci, build-baseline, release, sbom, SAST Semgrep, bandit, and secret-scan-gate.

The two failed exact-head security gates were inspected at job/annotation/log level before classification:

• security-audit run 31920095039, job 95098490621, fails at npm audit --workspaces --audit-level=high on the protected-base JavaScript set: nanoid <3.3.18, pdfjs-dist >=5.6.83 <6.2.108, and undici 7.0.0-7.28.0. Python/Rust audit steps are skipped because npm exits first; skipped stages are not success.
• aggregate Security Scan run 31920094950 has terminal-success OSV base-vs-head comparison, dependency review, and Scorecard. Its only failed job is trivy-fs job 95098490404: scan and SARIF upload succeed, then the finding gate reports one HIGH CVE-2026-16633 for protected-base pdfjs-dist at package-lock.json:6370 and directs remediation to the shared base.

This branch has no JavaScript dependency/root-lock delta and exact-head OSV PR-introduced comparison is clean. These whole-tree failures are inherited protected-base evidence owned by canonical dependency-security baseline #783; they are not suppressed, duplicated, or counted as success here.

Review state

Current inline review inspection has no unresolved actionable product thread; the former Scorecard thread referred only to the deleted one-shot formatter workflow and is resolved/outdated. There is no qualifying independent non-author approval for this exact head.

Central owned-coverage/OpenCode evidence remains gated on ContextualWisdomLab/.github#1020 reaching protected central main. #1020 explicitly supersedes closed-unmerged #1008; no predecessor check/review/approval evidence transfers. Do not redispatch unchanged reviewer-agent work merely to reproduce that known prerequisite failure.

Security Notes

No runtime trust boundary changes. Coverage.py branch measurement is enabled at the analysis-engine package boundary while --cov-fail-under=100 remains unchanged. Exact current-head native and fallback runs prove statement and branch coverage at 100%, while native CI separately proves all 23 Rust↔NumPy numeric-parity cases execute and pass. No dependency, lockfile, user-data, or PII handling change is introduced.

Merge gate

Keep Draft until all of the following are true on the then-current exact head/base:

• Python owned production statement and branch coverage is measured at 100%; public docstrings, Ruff, mypy, Bandit, desktop/shared-types measured coverage, native numeric parity, release preflight, repository CI, and the full build-baseline platform matrix are terminal-success.
• fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 reaches protected develop and this branch is refreshed/revalidated so repository security/audit gates are terminal-success rather than inherited-base failures.
• .github#1020 reaches protected central main and exact-current-head central coverage/review evidence is terminal-success.
• Zero unresolved actionable current-head inline review threads at latest inspection.
• A qualifying independent non-author exact-head last-push approval exists.
• Branch protection permits merge without bypass.

Queued, in-progress, skipped-required, failed inherited-base, predecessor-head, protected-base, author/self, or administrative-bypass evidence is not success.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 67d6af09-1d69-4c4b-86e5-ffa3f300cfbb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Review only exact current head 6afbc9fff585a5a7c2bf0454b0673c3f71f1b0e1 against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9. Refetch both before review and abort if either moves.

The old central trusted-uv prerequisite named in the PR body is stale; protected central .github/main now contains the replacement materializer and version-verifier repairs. Reacquire central evidence rather than transferring predecessor failure.

Verify the three-file diff only: branch coverage is actually enabled in services/analysis-engine/pyproject.toml; the removed deact_role in handoffs branch is logically redundant under the function's construction invariant; test_branch_coverage_contract.py reaches the previously hidden arcs without coverage exclusions/pragma/threshold weakening; exact repository CI 31920094933 and release 31920094986 prove 3020/3020 statements and 986/986 branches at 100% plus native Rust↔NumPy parity. Treat the two repository security failures as #783-owned only after confirming this branch has no JavaScript dependency/root-lock delta and the failures are the protected-base set.

Inspect current exact-head reviews and unresolved threads. Submit formal APPROVE only if the unchanged head has the required source-backed evidence and no valid product finding; otherwise REQUEST_CHANGES with the first causal boundary and narrowest test-first remediation. Do not edit, merge, weaken protection, rerun unrelated workflows, or duplicate #783.