fix: treat nested Rust coverage as peer evidence

.github/workflows/opencode-review.yml

@@ -618,6 +618,15 @@ jobs:
             fi
           }
 
+          append_nested_rust_coverage_advisory() {
+            append "### Rust test coverage"
+            append ""
+            append "- Result: PASS"
+            append "- Reason: Rust files changed, but no root Cargo.toml coverage contract was found; nested Rust coverage is not measured by this central workflow."
+            append "- Required peer evidence: keep repo-local Rust CI/build/security checks required for nested crates."
+            append ""
+          }
+
           run_rust_test_coverage() {
             ensure_rust_toolchain
             if ! command -v cargo >/dev/null 2>&1; then
@@ -632,13 +641,7 @@ jobs:
               run_and_capture "Rust coverage with missing-line report" \
                 cargo llvm-cov --workspace --all-features --fail-under-lines 100 --show-missing-lines
             else
-              append "### Rust test coverage"
-              append ""
-              append "- Result: FAIL"
-              append "- Reason: Rust files changed, but no root Cargo.toml was found."
-              append "- Fix: add or point to the Cargo workspace manifest and run cargo coverage from that workspace."
-              append ""
-              failures=$((failures + 1))
+              append_nested_rust_coverage_advisory
             fi
           }
 
@@ -776,8 +779,12 @@ jobs:
           fi
 
           if has_changed_tracked_files 'Cargo.toml' 'Cargo.lock' '*.rs'; then
-            measured_any=1
-            run_rust_test_coverage
+            if [ -f Cargo.toml ]; then
+              measured_any=1
+              run_rust_test_coverage
+            else
+              append_nested_rust_coverage_advisory
+            fi
           fi
 
           if has_changed_tracked_files 'Dockerfile' '*/Dockerfile' 'Dockerfile.*' '*/Dockerfile.*' 'docker-compose.yml' 'docker-compose.yaml' 'compose.yml' 'compose.yaml'; then

scripts/ci/test_strix_quick_gate.sh

@@ -665,6 +665,8 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
 	assert_file_contains "$workflow_file" "publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present" "opencode approval turns coverage-evidence blocker states into actionable review state"
 	assert_file_contains "$workflow_file" "needs.coverage-evidence.result == 'success'" "opencode model steps skip when coverage-evidence already failed"
 	assert_file_contains "$workflow_file" "supported repository test suites passed" "opencode coverage evidence requires supported repository test suites to pass"
+	assert_file_contains "$workflow_file" "nested Rust coverage is not measured by this central workflow" "opencode coverage evidence treats nested Rust crates as peer-CI evidence instead of failing on missing root Cargo.toml"
+	assert_file_contains "$workflow_file" "keep repo-local Rust CI/build/security checks required for nested crates" "opencode coverage evidence documents the required peer checks for nested Rust crates"
 	assert_file_contains "$workflow_file" "Python project dependencies (requirements.txt)" "opencode coverage evidence records repository Python dependency installation"
 	assert_file_contains "$workflow_file" "python3 -m pip install --disable-pip-version-check -r requirements.txt" "opencode coverage evidence installs repository Python requirements before pytest"
 	assert_file_contains "$workflow_file" "'requirements.txt' '*/requirements.txt'" "opencode coverage evidence discovers nested requirements-only Python test projects"