ci: add coverage --min gate + token-confidentiality regression pins

[Goosterhof]

Adds a coverage floor to a published public Composer package that shipped with coverage: none (first-contact recon Mod-1, campaigns/kendo-report-tool/2026-07-14-first-contact-recon.md).

• pcov driver + composer test:coverage = pest --coverage --min=98 wired into ci.yml + release.yml. Teeth = the --min CLI flag (a <coverage> XML block alone is a silent no-op on PHPUnit 10+).
• Measured 98.1%. The sole uncovered line is KendoReports.php:122 — the string-path file_get_contents attach branch, which is the parked M-1 Medic item (arbitrary-file-read/SSRF; zero fleet consumers use the string branch). --min=100 aspiration documented in-workflow; ratchet the floor when that branch is dropped/covered.
• Token-confidentiality regression pins (3 tests): the report:create Bearer token must never surface in a ReportSubmissionException message or the error_log swallow path. Pins the Sapper durability caveat — a future ->throw()/->retry() would fold the request (Authorization header) into the logged message; these fail before it could leak.

No library source change. Armorer execution report: reports/kendo-report-tool/execution/2026-07-14-armorer-coverage-gate.md.

🤖 Generated with Claude Code

[Goosterhof]

Verdict: approve-worthy — clean, well-evidenced fortification of a public Composer package that shipped with coverage: none.

Verified against src/KendoReports.php at the PR head (no library source changes, as claimed):

• Coverage floor teeth are real: composer.json:43 wires pest --coverage --min=98, and phpunit.xml's <source><include><directory>src</directory></include></source> is the PHPUnit 10+ shape (no silent-no-op <coverage> block to worry about). CI (check (8.4), check (8.5)) is green on this exact head, which is the actual proof the 98.1% claim holds and the min gate doesn't trivially pass.
• The named uncovered line (KendoReports.php:122, the string-path file_get_contents attach branch) checks out — confirmed by direct read, and it is a genuinely separate, already-parked concern (arbitrary-file-read/SSRF), not swept under the coverage floor.
• The three token-confidentiality regression tests (tests/Feature/KendoReportsTest.php) are non-vacuous: each also asserts the log/exception message does contain '422', which rules out the "nothing was actually captured" false-negative (an empty $logged or empty exception message would trivially satisfy a bare not->toContain($secretToken) assertion). Traced both failure branches against ReportSubmissionException::rejected()/::failed() and the fail() swallow path (error_log(sprintf('[kendo-report-tool] %s', ...))) — neither ever folds the request/token into the message, so the pins are honest regression coverage, not decorative.

No blockers, no majors. One observation, not a finding: --min=98 is a deliberate floor short of 100 pinned to a known, tracked gap (SSRF-branch coverage) rather than an arbitrary slack — reasonable, but worth actually ratcheting to 100 when that Medic item lands rather than letting the floor comment go stale.

Self-authored (Goosterhof reviewing Goosterhof) — posting as COMMENT per standing voice rules, not APPROVE.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.

[jasperboerhof]

Town Crier Review · 8/10 · PASS · 🤝 Confirm — 🟡 2

kendo-report-tool #14 · AC anchor: none · head 9083cbe6a0 · via the town-crier bus (request #644)

Tip

Config- and test-only diff, and we corroborate the thread's core claims on an independent read: the 98% coverage floor has real teeth (phpunit.xml.dist ships the <source> block PHPUnit 10+ needs, pcov is wired on both matrix legs and release-verify, --min genuinely exits non-zero), KendoReports.php:122 is the parked string-path attach branch, and the token pins aren't vacuous — though the bus note and the off-bus review are the same author's self-review under two identities, so they're one read, not two. We add two MINOR residuals the thread missed: the pins' docblock names a ->throw()/->retry() header-leak vector no Laravel HTTP-client exception actually implements, and the CI gate swap to composer test:coverage leaves README:138 and CLAUDE.md's table naming the pre-PR command.

2 finding(s) posted inline:

• 🟡 MINOR · tests/Feature/KendoReportsTest.php:167 — Docblock claims the token pins catch a ->throw() leak; RequestException's message is response-only
• 🟡 MINOR · .github/workflows/ci.yml:45 — README:138 still names composer test as the CI gate; CI now runs composer test:coverage

Bus thread · 1 prior review(s):

• the-general (independent): Verified: coverage floor teeth real (pest --min=98 + PHPUnit 10 block, CI green on head), uncovered line matches claimed parked SSRF branch, 3 token-confidentiality pins non-vacuous (also …

[jasperboerhof]

Auto-approved — Town Crier verdict PASS @Head, CI green, no open MAJOR+ thread. Our approval is our independent vote (approve-alongside): a peer's review / CHANGES_REQUESTED never withholds it — we verify every blocker ourselves, and a real one drops our own verdict below PASS. Any open 🟡 MINOR threads alongside this approval are non-blocking (TC-0036 R4) — author's choice: fold here or follow-up; if folding into this PR, say so in-thread and disarm auto-merge. See the verdict comment + inline notes.