Bundle: ci-pipeline-cleanup, Phase 2 / frozen decision 0.3.
Move 9 hardcoded coverage thresholds from inline bash to a YAML
manifest at .github/coverage-thresholds.yml. The load-bearing
per-package context (Bundle reference, HEAD measurement, gap
rationale) survives in the YAML's `why:` field instead of in
inline bash comments.
Adding a new gated package: one YAML entry instead of ~30 lines
of bash + 50 lines of comment.
Coverage check logic extracted to scripts/check-coverage-thresholds.sh
so the operator can run the same check locally:
bash scripts/check-coverage-thresholds.sh
ci.yml dropped 557 → 417 lines (-140, total Phase 1+2: -1071,
-72% from baseline 1488).
Same 9 floors, same fail-on-miss semantics — pure relocation:
internal/service: 70 (was: 70)
internal/api/handler: 75 (was: 75)
internal/domain: 40 (was: 40)
internal/api/middleware: 30 (was: 30)
internal/crypto: 88 (was: 88)
internal/connector/issuer/local: 86 (was: 86)
internal/connector/issuer/acme: 80 (was: 80)
internal/connector/issuer/stepca: 80 (was: 80)
internal/mcp: 85 (was: 85)
Sandbox verification:
- ci.yml YAML-parses cleanly
- coverage-thresholds.yml YAML-parses cleanly with all 9 entries
- scripts/check-coverage-thresholds.sh extracts the (pkg, floor)
table correctly from the YAML
shankar0123