fix(review): coverage evidence tooling for numpy and Rust repositories

[seonghobae]

Problem

Since 2026-07-14 the offline coverage sandbox has structurally been unable to produce passing evidence for any repository that needs third-party Python packages or a modern Rust toolchain. Every such PR (all 47 open fast-mlsirm PRs, including the #160 model-design PR) is stuck at REQUEST_CHANGES with "coverage-evidence result was failure":

• Python: the sandbox runs the repository's pytest suite with only the trusted toolchain installed (coverage, interrogate, pytest, pytest-cov, uv). Target dependencies are never installed (scripts/ci/install_python_requirements_for_coverage.py exists but is not wired into any workflow), so every test module fails collection with ModuleNotFoundError: No module named 'numpy' — see run 29875093850 for fast-mlsirm#160.
• Rust: cargo llvm-cov aborts with failed to find llvm-tools-preview. The image only has the Ubuntu-noble rustc/cargo 1.75, which additionally cannot parse version-4 Cargo.lock files (fast-mlsirm, wardnet, …), and the --network=none sandbox has no way to download crates even if it could build.

Fix (fail-closed offline design unchanged)

1. numpy in the trusted toolchain — numpy==2.5.1 added to requirements-opencode-review-ci.txt; the hashes file regenerated with uv pip compile --generate-hashes --no-header --no-annotate --python-version 3.12 --python-platform x86_64-manylinux_2_28. Empirically verified against fast-mlsirm main: with numpy alone the suite passes (156 passed, 72 skipped — the Rust-parity tests importorskip cleanly when fast_mlsirm._core is absent).
2. Pinned rustup toolchain in the image — sha256-pinned rustup-init 1.28.2 provisions Rust 1.94.1 with llvm-tools-preview under /usr/local/rustup, symlinked into /usr/local/bin so it shadows the distribution rustc. No mutable sh.rustup.rs installer is used (the existing contract test forbidding it still passes).
3. Offline crate cache — the online coverage-source-tree job now runs cargo fetch --locked into the tree-local CARGO_HOME (.opencode-sandbox-home/.cargo) that the sandbox already sets, and the sandbox exports CARGO_NET_OFFLINE=true so cargo resolves strictly from that cache. cargo fetch downloads content-addressed crates and executes no build scripts; a failed prefetch keeps today's behavior (the offline build surfaces the missing dependencies).

Verification

• coverage run -m pytest tests — 634 passed, coverage report — 100% over scripts/ci
• interrogate — 100.0%
• Workflow YAML parses; contract assertions about the sandbox (docker build … --network=default before docker run … --network=none, https://sh.rustup.rs absent, pinned cargo-llvm-cov retained, pytest-cov==7.1.0 hash retained) all hold.

Developer experience: unblocks the fast-mlsirm review/merge queue (and every other numpy/Rust repository) without weakening any gate — evidence is still produced offline, from pinned tooling, under the same sandbox identity.

User experience: no user-facing behavior change; review verdicts for scientific-Python/Rust repositories become meaningful instead of unconditionally failing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ERVynrYEjd2TwYvusVpA9f

---

Generated by Claude Code

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates CI dependency sets and the opencode-review workflow to improve security posture and enable offline Rust coverage runs.

Changes:

• Bump pyasn1 to address a referenced CVE in the Strix CI requirements (and update its pinned hash entry).
• Add numpy to the opencode-review CI Python requirements (and regenerate the hashed lock file).
• Enhance the opencode-review workflow to prefetch Rust crates online and run Rust coverage fully offline, including installing a pinned Rust toolchain with llvm-tools-preview.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
requirements-strix-ci.txt	Adds a pyasn1 constraint and CVE note for Strix CI.
requirements-strix-ci-hashes.txt	Updates pinned pyasn1 version+hashes to match the intended security bump.
requirements-opencode-review-ci.txt	Adds numpy to opencode-review CI dependencies.
requirements-opencode-review-ci-hashes.txt	Regenerates hashes/locks to include numpy and updated resolved artifacts.
.github/workflows/opencode-review.yml	Adds cargo prefetch + offline flags and installs a pinned rustup toolchain for Rust coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/opencode-review.yml:306

• git ls-files 'Cargo.toml' '*/Cargo.toml' only matches Cargo.toml at repo root or one directory deep, so nested workspaces like crates/foo/Cargo.toml (and any deeper) won’t have their locked crate graphs prefetched. That can leave the offline sandbox without a complete crate cache even though the comment says nested manifests are covered.

          prefetch_manifests="$(git -C "$COVERAGE_SOURCE_WORKDIR" ls-files 'Cargo.toml' '*/Cargo.toml')"