refactor(health,observability): adopt style guide rules for pub/module visibility

[chet]

This adopts the new style guide rules around pub and module visibility introduced in #4522, applying the correct visibility throughout Health and its supporting observability crates.

Primary callouts are:

• Replace unrestricted pub across health, nras, logfmt, sqlx-query-tracing, secrets, log-parser, and dpu-otel-agent with private, pub(super), pub(crate), or path-scoped visibility based on actual callers.
• Keep downstream library interfaces and cross-module Health seams available while narrowing NVUE, gNMI, OTLP, and test-support internals to the modules that use them.
• Move the NRAS integration helpers under tests/common/ so Cargo no longer builds them as standalone zero-test binaries, then scope their fixtures and mocks to the integration test crate.
• Remove the unused JWKS crv field and stale dead-code allowances whose Health callers are already in place.
• Leave generated Health protobufs, HTTP/OTLP behavior, serialized responses, and other runtime behavior unchanged.

Tests updated!

Related issues

This supports #4556.

This supports the updated Rust visibility scoping guidelines in STYLE_GUIDE.md, established in #4522.

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

All 517 targeted unit and integration tests passed. I also ran:

cargo test --locked -p carbide-health -p nras -p logfmt -p sqlx-query-tracing -p carbide-secrets -p carbide-log-parser -p carbide-dpu-otel-agent --all-features
cargo clippy --locked -p carbide-health -p nras -p logfmt -p sqlx-query-tracing -p carbide-secrets -p carbide-log-parser -p carbide-dpu-otel-agent --all-targets --all-features -- --force-warn unreachable-pub
cargo make format-nightly
cargo make clippy
cargo make carbide-lints
git diff --check

Additional Notes

The initial visibility lint identified 86 overbroad declarations across 17 hand-authored files. The final 24-file diff also includes the adjacent field and module boundaries exposed during review, the NRAS test-helper move, and the dead-code audit. No hand-authored visibility finding remains in the seven scoped crates.

The remaining strict-lint findings are unchanged from the baseline: 65 generated Health protobuf declarations and seven declarations in dependency crates owned by other campaign tasks. Generated Health protobufs remain untouched for #4547, and lint enforcement remains with #4558.

Local CodeRabbit returned no findings. The read-only Claude review completed over the full diff, and its applicable internal SSE, field, and module scoping suggestions are incorporated.

Closes #4556

[chet]

@coderabbitai full_review, thanks!

[coderabbitai]

@chet: I will perform a complete review of #4665.

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 25bec1a6-4041-400c-a60b-13a3b3b918dd

📥 Commits

Reviewing files that changed from the base of the PR and between 4f0e11f and 93b8dff.

📒 Files selected for processing (24)

• crates/dpu-otel-agent/src/main_loop.rs
• crates/health/src/collectors/mod.rs
• crates/health/src/collectors/nvue/gnmi/client.rs
• crates/health/src/collectors/nvue/gnmi/mod.rs
• crates/health/src/collectors/nvue/mod.rs
• crates/health/src/collectors/nvue/rest/client.rs
• crates/health/src/collectors/nvue/tls.rs
• crates/health/src/collectors/runtime.rs
• crates/health/src/endpoint/mod.rs
• crates/health/src/otlp/drain.rs
• crates/health/src/otlp/metrics_drain.rs
• crates/health/src/sink/dedup_queue.rs
• crates/health/src/sink/event_mapper.rs
• crates/log-parser/src/carbide_reporting.rs
• crates/logfmt/src/lib.rs
• crates/nras/src/keystore.rs
• crates/nras/tests/common/fixtures.rs
• crates/nras/tests/common/mock_keystore.rs
• crates/nras/tests/common/mock_server.rs
• crates/nras/tests/common/mod.rs
• crates/nras/tests/fixtures.rs
• crates/nras/tests/integration.rs
• crates/secrets/src/forge_vault.rs
• crates/sqlx-query-tracing/src/lib.rs

💤 Files with no reviewable changes (3)

• crates/nras/src/keystore.rs
• crates/health/src/sink/event_mapper.rs
• crates/nras/tests/fixtures.rs

---

Summary by CodeRabbit

• Refactor

  • Restricted internal APIs and modules to narrower visibility without changing runtime behavior.
  • Reduced exposure of health monitoring, telemetry, logging, networking, and security internals.
  • Removed unused code and annotations.

• Tests

  • Consolidated NRAS integration-test fixtures and mock utilities into shared test modules.
  • Added valid and malformed authentication response fixtures for broader test coverage.

Walkthrough

The change narrows Rust visibility across health, observability, and NRAS crates. It also centralizes NRAS integration-test fixtures and mocks. Runtime behavior remains unchanged.

Changes

Visibility Scope Tightening

Layer / File(s)	Summary
Health NVUE encapsulation crates/health/src/collectors/...	NVUE modules, gNMI APIs, REST clients, response types, TLS helpers, and runtime stream APIs now use narrower visibility.
Health internal service APIs crates/health/src/endpoint/mod.rs, crates/health/src/otlp/..., crates/health/src/sink/...	Health endpoint helpers, OTLP drain methods, queue methods, and event mapper declarations now use crate or parent-module visibility.
Observability crate visibility crates/dpu-otel-agent/src/main_loop.rs, crates/log-parser/src/carbide_reporting.rs, crates/logfmt/src/lib.rs, crates/secrets/src/forge_vault.rs, crates/sqlx-query-tracing/src/lib.rs, crates/nras/src/keystore.rs	Internal APIs and test helpers use narrower visibility. The unused Jwk::crv field and related dead-code allowance were removed.
NRAS shared test support crates/nras/tests/common/*, crates/nras/tests/integration.rs	Fixtures and mocks moved into shared test modules. Integration tests now import the shared modules.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/infra-controller#4660: Applies the same visibility narrowing to setup_and_run.
• NVIDIA/infra-controller#4664: Narrows visibility for internal Rust APIs and test helpers.
• NVIDIA/infra-controller#4522: Introduces related visibility-scoping guidelines.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the visibility refactor across Health and observability crates.
Description check	✅ Passed	The description directly explains the visibility changes, test-helper move, dead-code cleanup, and validation performed.
Linked Issues check	✅ Passed	The changes address issue #4556 by narrowing visibility across the listed crates while preserving generated modules and runtime behavior.
Out of Scope Changes check	✅ Passed	The test-helper move and dead-code cleanup are explicitly included in the pull request objectives, and no unrelated changes are shown.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}