fix(ci): keep external coverage reporting nonblocking

Author: JuliaEdom

.github/workflows/ci.yml

@@ -316,7 +316,10 @@ jobs:
         with:
           files: coverage.xml
           use_oidc: true
-          fail_ci_if_error: true
+          # Coverage floors are enforced locally above. Codecov is reporting
+          # only and must not mask a green test job when the repo is not yet
+          # enabled in the external service.
+          fail_ci_if_error: false
 
   test-integration:
     runs-on: ubuntu-latest

docs/PROJECT_CLOSURE.md

@@ -87,6 +87,10 @@ Push, PR mutations and release actions require explicit owner authorization.
 - Per owner allocation, Codex performed the dependency remediation,
   documentation, Mac verification, and Git closeout; Grok/Grokw remained
   paused to preserve its remaining weekly quota.
+- Repository-owned coverage gates are green and remain blocking. Codecov OIDC
+  currently returns `Repository not found`; its upload is non-blocking
+  reporting until the one-time external activation in
+  [operations/codecov-setup.md](operations/codecov-setup.md) is completed.
 - Production status remains `candidate`; none of this closes the live Iceberg,
   restore/replay, fresh soak/rollback, external pen-test, or npm approval gates.
 

docs/STATUS.md

@@ -35,6 +35,10 @@ findings; see
 [security-runtime-image-trivy-2026-07-30.md](security-runtime-image-trivy-2026-07-30.md).
 The dependency failure, resolution, and clean Mac verification are recorded in
 [dependency-compatibility-2026-07-30.md](dependency-compatibility-2026-07-30.md).
+All repository-owned coverage floors remain blocking; Codecov upload is
+non-blocking reporting until the repository is enabled in that external
+service, as recorded in
+[operations/codecov-setup.md](operations/codecov-setup.md).
 The exact post-remediation GitHub SHA must still complete all required checks
 before the external closure gate is claimed.
 

docs/operations/codecov-setup.md

@@ -6,12 +6,25 @@ run.
 
 ## How uploads work today
 
-- `ci.yml` calls `codecov/codecov-action@v4` with `use_oidc: true` during
-  the `test-unit` job.
+- `ci.yml` calls pinned `codecov/codecov-action` v7.0.0 with
+  `use_oidc: true` during the `test-unit` job.
 - OIDC uploads do not require a long-lived `CODECOV_TOKEN`; the action
   exchanges the GitHub OIDC token for a short-lived Codecov credential.
 - `fail_ci_if_error: false` keeps CI green even if Codecov is temporarily
-  unreachable.
+  unreachable or the repository has not yet been enabled there.
+- Coverage still fails closed inside CI: the full suite enforces a 60%
+  line/branch floor, `diff-cover` enforces 80% on changed code, and
+  security-critical modules have separate 90% gates.
+
+## Current external status
+
+On 2026-07-30, CI run
+[`30575838038`](https://github.com/brownjuly2003-code/agentflow/actions/runs/30575838038)
+completed every test and local coverage gate successfully. Codecov OIDC token
+exchange and upload queueing also succeeded, but Codecov returned
+`Repository not found` while processing the report. This is an external
+repository-activation gap, not a test or coverage failure. Complete the
+one-time setup below before treating the Codecov dashboard or badge as current.
 
 ## One-time setup
 
@@ -40,7 +53,8 @@ Expected response: `Valid!`.
 ## Verify the pipeline
 
 1. Push a commit to `main` or open a pull request.
-2. Confirm the `Upload coverage` step in `test-unit` succeeds.
+2. After the repository is enabled in Codecov, confirm the `Upload coverage`
+   step reports a successful external upload.
 3. Open the Codecov dashboard and confirm a new report appears for the
    commit SHA.
 4. Reload `README.md` on GitHub — the `codecov` badge should resolve to
@@ -57,3 +71,8 @@ Expected response: `Valid!`.
 - Coverage for `tests/`, `scripts/`, `examples/`, `sdk-ts/`, and
   `notebooks/` is ignored because those directories are not part of the
   production surface.
+
+These Codecov policies are additional reporting/status checks once the
+external repository is enabled. The blocking repository-owned coverage floors
+remain the `pytest-cov`, `diff-cover`, and module-specific commands in
+`.github/workflows/ci.yml`.

docs/release-readiness.md

@@ -81,7 +81,10 @@ The required `lint` job now contains strict MkDocs and claims validation. The
 required `test-unit` job contains the 80% changed-code coverage gate and depends
 on the 3.11/3.12/3.13 `python-compat` matrix, so a failed compatibility lane
 cannot be bypassed merely because its job name is not a separate protected
-context.
+context. The same job enforces a 60% full-suite line/branch floor and separate
+90% floors for security-critical modules. Codecov upload is non-blocking
+reporting until the repository is enabled in that external service; see
+[operations/codecov-setup.md](operations/codecov-setup.md).
 
 The 2026-07-30 closing remediation additionally covers two clean-install
 boundaries: the core-only API imports and serves health/entity/query without

tests/unit/test_audit_quality_gates.py

@@ -19,10 +19,12 @@ def test_required_ci_quality_gates_are_local_and_fail_closed() -> None:
     )
 
     assert checkout["with"]["fetch-depth"] == 0
+    assert "--cov-fail-under=60" in workflow
     assert "diff-cover coverage.xml --compare-branch=origin/main --fail-under=80" in workflow
+    assert "--fail-under=90" in workflow
     assert "mkdocs build --strict" in workflow
     assert "python scripts/validate_project_claims.py" in workflow
-    assert "fail_ci_if_error: true" in workflow
+    assert "fail_ci_if_error: false" in workflow
 
 
 def test_dev_profile_pins_quality_gate_tool_families() -> None: