From ba1a0d042b2af214b4e88e133e05a8480b381c68 Mon Sep 17 00:00:00 2001
From: david <58231312+davseby@users.noreply.github.com>
Date: Sat, 22 Aug 2026 18:59:01 +0300
Subject: [PATCH] add min coverage check for server core

---
 .github/workflows/qa-server-core.yml |  2 +-
 server/core/CLAUDE.md                |  9 +++++----
 server/core/Makefile                 | 11 +++++++++++
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/qa-server-core.yml b/.github/workflows/qa-server-core.yml
index 7546e0ba..6877df5e 100644
--- a/.github/workflows/qa-server-core.yml
+++ b/.github/workflows/qa-server-core.yml
@@ -59,5 +59,5 @@ jobs:
         working-directory: server/core
 
       - name: Run unit tests
-        run: go test -race ./...
+        run: make check-coverage
         working-directory: server/core
diff --git a/server/core/CLAUDE.md b/server/core/CLAUDE.md
index 81ec0b73..cbbe6efc 100644
--- a/server/core/CLAUDE.md
+++ b/server/core/CLAUDE.md
@@ -39,10 +39,11 @@ of the convention.
 ## Commands & QA gates
 
 ```sh
-make build       # goreleaser snapshot build -> bin/ + ghcr.io/oxynote/core:dev image
-make test        # go test -race ./...
-make lint        # golangci-lint run --fix (applies automatic fixes)
-make check-lint  # golangci-lint run (verification only)
+make build          # goreleaser snapshot build -> bin/ + ghcr.io/oxynote/core:dev image
+make test           # go test -race ./...
+make check-coverage # go test -race with coverage; fails below COVERAGE_MIN
+make lint           # golangci-lint run --fix (applies automatic fixes)
+make check-lint     # golangci-lint run (verification only)
 ```
 
 ## Repository layout
diff --git a/server/core/Makefile b/server/core/Makefile
index 801cf97b..be6cc36d 100644
--- a/server/core/Makefile
+++ b/server/core/Makefile
@@ -1,3 +1,7 @@
+# Minimum total statement coverage. Set from the measured baseline and
+# ratcheted up as suites grow — never lowered.
+COVERAGE_MIN = 93.1
+
 # Build the Docker image
 # dockers_v2 snapshot builds load into the local daemon with an arch suffix;
 # retag so the dev compose stack can reference a stable :dev tag.
@@ -11,6 +15,13 @@ build:
 test:
 	@go test -race ./...
 
+# Run all tests with coverage and fail below the minimum.
+.PHONY: check-coverage
+check-coverage:
+	@go test -race -coverprofile=coverage.out ./...
+	@go tool cover -func=coverage.out | tail -n 1 | awk -v min=$(COVERAGE_MIN) \
+		'{ print; if ($$3 + 0 < min) { printf "total coverage is below the %s%% minimum\n", min; exit 1 } }'
+
 # Run the linters and apply automatic fixes.
 .PHONY: lint
 lint: