feat(coverage): add noise tolerance to the coverage gates

.agentic-toolkit.lock.yaml

@@ -5,7 +5,7 @@ sources:
   sha: 3a19c994319dd8a0d16db16629d19df46cd7e920
 - url: github.com/pedromvgomes/agentic-toolkit.git
   ref: main
-  sha: 0fa843ca38a50e3d1d070cb8efe381d2239afceb
+  sha: 13fbcd81632de892d516a451b64fa07197a93893
 - url: github.com/anthropics/skills.git
   ref: main
   sha: 9d2f1ae187231d8199c64b5b762e1bdf2244733d

.serena/.gitignore

@@ -0,0 +1,2 @@
+/cache
+/project.local.yml

.serena/project.yml

@@ -0,0 +1,168 @@
+# the name by which the project can be referenced within Serena
+project_name: "vulture-inselberg"
+
+
+# list of languages for which language servers are started; choose from:
+#   al                  angular             ansible             bash                clojure
+#   cpp                 cpp_ccls            crystal             csharp              csharp_omnisharp
+#   dart                elixir              elm                 erlang              fortran
+#   fsharp              go                  groovy              haskell             haxe
+#   hlsl                html                java                json                julia
+#   kotlin              lean4               lua                 luau                markdown
+#   matlab              msl                 nix                 ocaml               pascal
+#   perl                php                 php_phpactor        powershell          python
+#   python_jedi         python_ty           r                   rego                ruby
+#   ruby_solargraph     rust                scala               scss                solidity
+#   svelte              swift               systemverilog       terraform           toml
+#   typescript          typescript_vts      vue                 yaml                zig
+#   (This list may be outdated. For the current list, see values of Language enum here:
+#   https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py
+#   For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
+# Note:
+#   - For C, use cpp
+#   - For JavaScript, use typescript
+#   - For Angular projects, use angular (subsumes typescript+html; requires `npm install` in the project root)
+#   - For Svelte projects, use svelte (subsumes typescript/javascript for .svelte projects; requires npm)
+#   - For SCSS / Sass / plain CSS, use scss (some-sass-language-server handles all three)
+#   - For Free Pascal/Lazarus, use pascal
+# Special requirements:
+#   Some languages require additional setup/installations.
+#   See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
+# When using multiple languages, the first language server that supports a given file will be used for that file.
+# The first language is the default language and the respective language server will be used as a fallback.
+# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
+languages:
+- go
+
+# the encoding used by text files in the project
+# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
+encoding: "utf-8"
+
+# optional shell command to run before the language backend (LSP or JetBrains) is initialised.
+# the command runs in the project root directory and is only executed if the project is trusted
+# (see trusted_project_path_patterns in the global configuration).
+# serena waits for the command to exit: a non-zero exit code is logged as an error but does not
+# abort activation. a per-project timeout (activation_command_timeout, default 180s) is the safety
+# backstop for non-terminating commands; on expiry the process is killed and activation continues.
+# example: activation_command: "npx nx run-many -t build"
+activation_command:
+
+# maximum time in seconds to wait for activation_command to complete before killing it (default 180s).
+# must be a positive number.
+activation_command_timeout: 180
+
+# line ending convention to use when writing source files.
+# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
+# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
+line_ending:
+
+# The language backend to use for this project.
+# If not set, the global setting from serena_config.yml is used.
+# Valid values: LSP, JetBrains
+# Note: the backend is fixed at startup. If a project with a different backend
+# is activated post-init, an error will be returned.
+language_backend:
+
+# whether to use project's .gitignore files to ignore files
+ignore_all_files_in_gitignore: true
+
+# advanced configuration option allowing to configure language server-specific options.
+# Maps the language key to the options.
+# Have a look at the docstring of the constructors of the LS implementations within solidlsp (e.g., for C# or PHP) to see which options are available.
+# No documentation on options means no options are available.
+ls_specific_settings: {}
+
+# list of workspace folder paths (LSP backend only).
+# These folders will be used to build up Serena's symbol index.
+# Paths must be within the project root and should thus be relative to the project root.
+# Furthermore, the paths should not be filtered by ignore settings.
+# Default setting: The entire project root folder (".") is considered.
+# In (large) monorepos, this can be used to index only subfolders of the project root, e.g.
+#   ls_workspace_folders:
+#     - "./subproject1"
+#     - "./subproject2"
+ls_workspace_folders: ["."]
+
+# list of additional workspace folder paths for cross-package reference support.
+# Paths can be absolute or relative to the project root.
+# Each folder is registered as an LSP workspace folder, enabling language servers to discover
+# symbols and references across package boundaries, but these folders are not indexed by Serena,
+# i.e. the respective symbols will not be found using Serena's symbol search tools.
+# Example:
+#   additional_workspace_folders:
+#     - ../sibling-package
+#     - ../shared-lib
+ls_additional_workspace_folders: []
+
+# list of additional paths to ignore in this project.
+# Same syntax as gitignore, so you can use * and **.
+# Note: global ignored_paths from serena_config.yml are also applied additively.
+ignored_paths: []
+
+# whether the project is in read-only mode
+# If set to true, all editing tools will be disabled and attempts to use them will result in an error
+# Added on 2025-04-18
+read_only: false
+
+# list of tool names to exclude.
+# This extends the existing exclusions (e.g. from the global configuration)
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+excluded_tools: []
+
+# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
+# This extends the existing inclusions (e.g. from the global configuration).
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+included_optional_tools: []
+
+# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
+# This cannot be combined with non-empty excluded_tools or included_optional_tools.
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+fixed_tools: []
+
+# list of mode names that are to be activated by default, overriding the setting in the global configuration.
+# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
+# If the setting is undefined/empty, the default_modes from the global configuration (serena_config.yml) apply.
+# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
+# Therefore, you can set this to [] if you do not want the default modes defined in the global config to apply
+# for this project.
+# This setting can, in turn, be overridden by CLI parameters (--mode).
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
+default_modes:
+
+# list of mode names to be activated additionally for this project, e.g. ["query-projects"]
+# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
+added_modes:
+
+# initial prompt for the project. It will always be given to the LLM upon activating the project
+# (contrary to the memories, which are loaded on demand).
+initial_prompt: ""
+
+# time budget (seconds) per tool call for the retrieval of additional symbol information
+# such as docstrings or parameter information.
+# This overrides the corresponding setting in the global configuration; see the documentation there.
+# If null or missing, use the setting from the global configuration.
+symbol_info_budget:
+
+# list of regex patterns which, when matched, mark a memory entry as read‑only.
+# Extends the list from the global configuration, merging the two lists.
+read_only_memory_patterns: []
+
+# list of regex patterns for memories to completely ignore.
+# Matching memories will not appear in list_memories or activate_project output
+# and cannot be accessed via read_memory or write_memory.
+# To access ignored memory files, use the read_file tool on the raw file path.
+# Extends the list from the global configuration, merging the two lists.
+# Example: ["_archive/.*", "_episodes/.*"]
+ignored_memory_patterns: []
+
+# list of additional workspace folder paths for cross-package reference support (e.g. in monorepos).
+# Paths can be absolute or relative to the project root.
+# Each folder is registered as an LSP workspace folder, enabling language servers to discover
+# symbols and references across package boundaries.
+# Currently supported for: TypeScript.
+# Example:
+#   additional_workspace_folders:
+#     - ../sibling-package
+#     - ../shared-lib
+additional_workspace_folders: []

AGENTS.md

@@ -76,8 +76,8 @@ exact `1.26.5`. If `go.mod`'s `toolchain` line is ever bumped, update every `go-
 ## Configuration
 
 `.bulwark.yml` at the scan root is optional and purely **opt-out** — its job is narrowing what
-bulwark's zero-config default already does (scan everything detected, every check enabled), not
-tuning severity or suppressing individual findings (that's what a fix-up pass + inline
+bulwark's zero-config default already does (scan everything detected, every check enabled), plus
+one numeric knob (`coverage.tolerance`), not tuning severity or suppressing individual findings (that's what a fix-up pass + inline
 `#nosec`/`nosemgrep` annotations in the scanned repo are for). See `internal/config/config.go` for
 the full schema; shape:
 
@@ -96,6 +96,15 @@ go:
 semgrep:
   enabled: true
   config: auto           # override to a custom registry ref/path if needed
+coverage:
+  tolerance: 0.1         # pp a language's aggregate coverage may dip below its baseline before
+                          # the gate fails; absorbs sub-tenth measurement noise ("86.1% vs
+                          # baseline 86.1%, regressed 0.0%"). Compared at display precision
+                          # (tenths); 0 = fail any dip the report can show. Must be finite and
+                          # non-negative — Load rejects anything else.
+  patch:
+    tolerance: 0.1       # the patch gate's own dip allowance — deliberately independent, so
+                          # loosening the aggregate knob never weakens the untested-new-code check
 ```
 
 Omitting the file, or omitting a section/key within it, keeps that value at its default — see
@@ -187,7 +196,12 @@ generated cache data, not source, needs no PR/review and never pollutes main's h
   `warnUnmeasured` names every detected-but-unmeasured ecosystem on stderr rather than dropping it in
   silence. If a language is missing from the gate, bulwark now says so.
 - A language with no prior baseline entry (new) is reported but doesn't fail the check on its own;
-  a language whose current coverage is below its baseline does. A language the baseline has but the
+  a language whose current coverage dipped below its baseline by more than `coverage.tolerance`
+  (default 0.1pp, compared at the report's tenth-of-a-point display precision) does. To keep
+  tolerated dips from compounding — each merge lowering the baseline the next PR gates against —
+  the baseline writers restore any within-tolerance dip to the prior (high-water) value when
+  recording; only a beyond-tolerance drop, which was FAIL-visible on the PR that introduced it,
+  resets the baseline. A language the baseline has but the
   current run doesn't splits on detection: still detected in the tree means its coverage step just
   didn't run this time (path-filtered CI job, missing tooling) and it's reported as `[UNMEASURED]`;
   no longer detected means the source actually left the tree and it's reported as `[DROPPED]`
@@ -244,7 +258,9 @@ bounds the other, so `bulwark coverage` computes and gates on both, not either/o
 is a second, independent check alongside `diffReport`'s existing aggregate gate, not a replacement.
 
 Patch coverage has **no baseline or threshold of its own** — it always gates against that same
-language's aggregate baseline already read from `bulwark-state` (`patch% >= baseline%`). A language
+language's aggregate baseline already read from `bulwark-state` (`patch% >= baseline% -
+coverage.patch.tolerance` — its own knob, deliberately independent of `coverage.tolerance`, so
+loosening the noisy aggregate gate never silently weakens this one). A language
 with no aggregate baseline yet is reported informationally (`[NEW]`), not failed, mirroring
 aggregate's own handling of a first-time-seen language. It's opt-out, not opt-in, per language, via
 `.bulwark.yml`:

README.md

@@ -84,6 +84,8 @@ go:
 semgrep:
   enabled: true
   config: auto
+coverage:
+  tolerance: 0.1  # pp the aggregate gate tolerates below baseline (patch gate: coverage.patch.tolerance)
 ```
 
 See [AGENTS.md](AGENTS.md#configuration) for the full schema and merge semantics.