I3932 — Coverage is exported as LCOV and Cobertura from its one measurement, and uploaded to Coveralls and Codecov when their secrets exist

✕BLOCKED wave 1 · p1 · implementation profile · runs alone

Part of measurements-are-tracked-over-time — Coverage and CI cost are kept, exported and drawn over time, from the one measurement each has.

Objective

scripts/rust-coverage writes LCOV and Cobertura from the same post-processed measurement its gates read, the coverage job keeps both beside coverage.json and uploads LCOV to Coveralls and Codecov only when COVERALLS_REPO_TOKEN and CODECOV_TOKEN exist.

Why

The measurement existed only as a 14-day JSON artifact, in no format another tool reads, so coverage could not be tracked, compared or graphed. A raw `cargo llvm-cov report --lcov` would count test code that rust-coverage excludes and publish a second number, which docs/COVERAGE.md forbids.

Current state

rust-coverage writes coverage.json; validate.yml keeps it 14 days; nothing is uploaded.

Desired state

`--lcov FILE` and `--cobertura FILE` write the one measurement; case 3932 proves their totals equal rust-coverage's own and that test code is absent; the coverage job uploads both in ci-metrics-coverage and to Coveralls and Codecov when the secrets exist, skipped and never failing otherwise; docs/COVERAGE.md says so.

Scope

• scripts/rust-coverage
• .github/workflows/validate.yml
• docs/COVERAGE.md
• test/cases/3932_the_coverage_export_is_its_one_measurement.sh
• .ai/repo/project/issues/I3932.yaml
• .ai/repo/project/milestones/measurements-are-tracked-over-time.yaml

Out of scope

• The scanner I3919 changes in scripts/rust-coverage
• Adding the repository secrets, which the owner does

Dependencies

• I3919○READY The coverage gate finds the end of a test module across multi-line and raw string literals

What waits on this

• I3933✕BLOCKED Every master run's coverage and CI cost join a derived series that the site and the Cockpit draw

Acceptance criteria

• LCOV and Cobertura line totals equal rust-coverage's for the same export, and a test-code line is absent from both
• The coverage job keeps both files and uploads them only when the matching secret exists, never failing the job
• docs/COVERAGE.md names the exports and the two secrets

Validation

• bash test/run.sh 3932_the_coverage_export_is_its_one_measurement
• scripts/ci/shell-lint

Evidence required

• suite

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

An upload action that changes its inputs fails silently; continue-on-error keeps the verdict, and the artifact keeps the files whatever the service does.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3932.yaml. Read it back with majordomus plan show I3932.