mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 22:31:36 +00:00
shankar0123
879ed17879
Closes the 2026-04-27 coverage audit. Full closure pipeline executed across Bundles I (QA-doc cleanup), J (ACME failure modes), K (MCP per- tool), L (cmd/server + StepCA + repo + CI raise #1), M / M.Cloud (connector failure modes), N partial (issuer round-out), O (test hygiene + FSM coverage), P (QA-doc strengthening), Q (property-based pilot + hygiene), and R (final closeout + CI raise #3). Final acquisition- readiness score: 4.3 / 5 (passing tech DD clean). R.5 — CI threshold raise checkpoint #3 ====================================== Existential-cluster floors lifted in .github/workflows/ci.yml against post-Bundle-Q HEAD measurements: internal/crypto/ 85 -> 88 (HEAD 88.2%) internal/connector/issuer/local/ 85 -> 86 (HEAD 86.7%) internal/pkcs7/ 100% locked (informational gate retained — global-run measurement artifact; package-scoped 100% via Bundle 7 fuzz) The prescribed +7pp jumps from coverage-bundle-R-prompt.md (crypto 85->92, local 85->92) are NOT applied because the actual post-Q measurements don't support them. Remaining gap is platform-failure branches (rand.Reader / aes.NewCipher fail paths) that need interface seams the production code doesn't expose. Tracked as R-CI-extended (~200-400 LoC of crypto/rand interface plumbing). Out of session budget. Workspace doc updates ====================================== - cowork/CLAUDE.md::Active Focus: 2026-04-27 audit status flipped to CLOSED with operator-measurement gates explicitly tracked; v2.1.0 gate language untouched - coverage-audit-closure-plan.md: ticks Bundle R [x] with per-item breakdown - coverage-audit-2026-04-27/coverage-report.md: STATUS: CLOSED archive marker at top, all-bundles enumeration - coverage-audit-2026-04-27/acquisition-readiness.md: closure-status header with final score 4.3/5 and path-to-5.0 documentation - coverage-audit-2026-04-27/coverage-matrix.md: Post-Closure Summary appended (20-row per-cluster table covering Existential / High / Medium / Low / Frontend / Mutation / Race / Repo-integration with pre vs post-Q values + acquisition target + met/partial/ operator-only status) Operator-only measurements (NOT run; tracked as gates to 5.0) ====================================== 1. go test -race -count=10 -timeout=45m ./... 2. go-mutesting --debug ./internal/{crypto,pkcs7,connector/issuer/ local,connector/issuer/acme}/... (avito-tech fork) 3. go test -tags integration ./internal/repository/postgres/... 4. cd web && npx vitest run --coverage Each requires a workstation + Docker + ≥10GB free disk + ~30-45min runtime; agent sandbox can't run any of them. Once operator runs return clean, acquisition-readiness lifts 4.3 -> 4.7-4.8. No git tag from agent ====================================== Operator pushes the tag (typically v2.0.60 or v2.1.0) once the four workstation measurements confirm green and they decide on the version cut. Bundle R does NOT auto-tag. Verification ====================================== - python3 yaml.safe_load on ci.yml: OK - All Existential cluster coverage measurements run in-sandbox confirm new floors met with margin (crypto 88.2 vs 88; local 86.7 vs 86; pkcs7 100 informational) - git diff --stat: 6 files changed (2 in repo, 4 in audit folder) Audit closed: 33/33 findings (with 4 operator-only measurements tracked as residual gates to acquisition-readiness 5.0). Future audits start a new dated folder; coverage-audit-2026-04-27/ preserved as historical record. Bundle: R (Final Closure + CI raise checkpoint #3)