fix(QUAL-009): bring app.py into the coverage gate

.github/workflows/quality-and-security.yml

@@ -49,7 +49,7 @@ jobs:
           # The floor sits ~two points under the measured 89% (QUAL-005) so
           # routine PRs don't fight the gate, while a large untested addition
           # still fails.
-          python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
+          python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
 
       - name: Compile importable Python files
         run: python -m compileall -q app.py backend screeners ui tests

AGENTS.md

@@ -126,7 +126,7 @@ Reproduce it locally — these are the exact commands; **all must pass**:
 python -m pip install -r requirements.txt -r requirements-dev.txt -c constraints.txt
 
 python -m pre_commit validate-config .pre-commit-config.yaml
-python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
+python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
 python -m compileall -q app.py backend screeners ui tests
 python -m ruff check app.py backend screeners ui Dependencies tests
 python -m mypy
@@ -142,6 +142,10 @@ docker compose down --volumes --remove-orphans
 
 Coverage floor is **89%** (measured ~89.7%). Headroom is deliberately thin, so a
 sizeable untested addition fails the gate rather than quietly eroding the suite.
+The measured set includes `app.py` (QUAL-009); it sits at ~76%, which is the main
+reason the headroom is as tight as it is. `Dependencies/` and `migrations/` remain
+unmeasured on purpose - the first is an interactive credential helper, the second
+is hand-written migrations that the Alembic drift guard covers instead.
 `pre-commit` hooks are **non-rewriting**
 (check-only, no `--fix`) so commits stay author-reviewed.
 

README.md

@@ -1197,7 +1197,7 @@ pip install -r requirements-dev.txt -c constraints.txt
 Run the full local verification set before publishing changes:
 
 ```bash
-python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
+python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
 python -m compileall -q app.py backend screeners ui tests
 python -m ruff check app.py backend screeners ui Dependencies tests
 python -m bandit -r app.py backend screeners ui Dependencies -q

docs/adding-a-screener.md

@@ -155,7 +155,7 @@ python -m pytest -q                                                      # alway
 
 ```bash
 python -m pre_commit validate-config .pre-commit-config.yaml
-python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
+python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
 python -m compileall -q app.py backend screeners ui tests
 python -m ruff check app.py backend screeners ui Dependencies tests
 python -m mypy

docs/operations.md

@@ -1022,7 +1022,7 @@ The "Quality and security" workflow runs the same gates you can run locally:
 
 ```bash
 python -m pre_commit validate-config .pre-commit-config.yaml
-python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
+python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89
 python -m compileall -q app.py backend screeners ui tests
 python -m ruff check app.py backend screeners ui Dependencies tests
 python -m mypy

tests/test_supply_chain_policy.py

@@ -52,7 +52,7 @@
 )
 CI_COMMANDS = (
     "python -m pre_commit validate-config .pre-commit-config.yaml",
-    "python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89",
+    "python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89",
     "python -m compileall -q app.py backend screeners ui tests",
     "python -m ruff check app.py backend screeners ui Dependencies tests",
     "python -m mypy",
@@ -124,7 +124,7 @@ def test_ci_workflow_runs_quality_and_dependency_security_checks():
     assert 'python-version: ["3.11", "3.12"]' in text
     assert "python -m pre_commit validate-config .pre-commit-config.yaml" in text
     assert (
-        "python -m pytest -q --cov=backend --cov=screeners --cov=ui "
+        "python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui "
         "--cov-fail-under=89"
         in text
     )
@@ -253,7 +253,7 @@ def test_readme_documents_local_quality_and_security_commands():
     assert "pip install -r requirements.txt -c constraints.txt" in text
     assert "pip install -r requirements-dev.txt -c constraints.txt" in text
     assert (
-        "python -m pytest -q --cov=backend --cov=screeners --cov=ui "
+        "python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui "
         "--cov-fail-under=89"
         in text
     )