[quality] 44 Go packages missing from coverage ratchet — pkg/api/handlers/* silently unenforced

[hivecommons-hive]

Finding

.github/go-package-coverage-ratchet.txt currently enforces per-package coverage floors for 40 packages, but the repo has ~44 additional Go packages that ship code and tests yet are absent from the ratchet. scripts/check-go-coverage-ratchet.sh only iterates entries listed in the ratchet file — unlisted packages are silently unenforced, so their coverage can drop to 0% without failing go-test.yml.

Untracked packages with existing tests (partial list)

pkg/api/handlers/ subtree — none of the 11 handler subpackages are in the ratchet, despite carrying most of the HTTP surface area:

• pkg/api/handlers/auth (4 src / 10 test files)
• pkg/api/handlers/benchmarks (3 / 8)
• pkg/api/handlers/compliance (14 / 19)
• pkg/api/handlers/feedback (16 / 26)
• pkg/api/handlers/github (8 / 17)
• pkg/api/handlers/gitops (5 / 10)
• pkg/api/handlers/mcp (13 / 24)
• pkg/api/handlers/missions (8 / 8)
• pkg/api/handlers/rewards (3 / 6)
• pkg/api/handlers/stellar (14 / 25)
• pkg/api/handlers/workloads (5 / 5)

Other untracked packages with tests: pkg/api/audit, pkg/api/middleware, pkg/api/transport, pkg/api/metrics, pkg/client, pkg/agent/config, pkg/agent/federation, pkg/agent/httputil, pkg/agent/kagent, pkg/agent/kube, pkg/agent/procutil, pkg/agent/prompts, pkg/agent/protocol, pkg/agent/providers, pkg/agent/tokentracker, pkg/agent/updater, pkg/agent/workers, pkg/apis/v1alpha1, pkg/stellar/{metrics,observer,prompts,providers,scheduler,solver,watcher}, pkg/k8s/k8stest, pkg/store/migrations, pkg/agent/federation/providers.

Why this matters

• The total-only floor (52.0% in .github/go-coverage-ratchet.txt) can be met even if a specific untracked package regresses to zero, because well-covered tracked packages mask it.
• The pkg/api/handlers/* subtree is exactly the code path Tier 1 was designed to protect. Currently only the aggregate pkg/api 60.5% is watched — but the ratchet script bucket-matches by exact package path, so pkg/api/handlers/auth statements do not count toward the pkg/api bucket (only files whose package directory == pkg/api do).
• Result: a PR that deletes tests in pkg/api/handlers/auth and drops that package from 90% → 20% will pass CI as long as the total stays ≥ 52%.

Recommendation

1. Generate a baseline: run go test -coverprofile=coverage.out -covermode=atomic ./..., then extract per-package coverage for every currently-untracked package with .go non-test files.
2. Add those packages to .github/go-package-coverage-ratchet.txt under the appropriate tier section with their current coverage as the floor (rounded down 0.5%).
3. Consider adding a lint step to check-go-coverage-ratchet.sh (or a separate script) that fails when a Go package containing non-test .go files is not listed in the ratchet file at all — closing the loop so new packages can't be added without also declaring a floor.

Priority

• Impact: high (silent regression risk on the entire HTTP handler surface)
• Effort: medium (one script run to baseline + ratchet PR; the enforcement lint is optional follow-up)

---

Filed by quality agent (ACMM L4/L6 — full mode)

— hive: agent=quality backend=copilot model=claude-opus-4.7