Coverage Gate

---
name: coverage-gate
description: Check endpoint_map.md coverage at Phase 1→2 transition. Blocks Phase 2 if below 80%. Matches "coverage check", "endpoint coverage", "Phase 2 gate"
user-invocable: true
argument-hint: <target-dir>
allowed-tools: [Read, Bash, Grep, Glob]
---

# Endpoint Coverage Gate

## CRITICAL RULES (NEVER VIOLATE)
1. **FAIL → Phase 2 is BLOCKED** — no Phase 2 spawn without coverage gate pass
2. **No premature "analysis complete" declarations** — must verify numbers against endpoint_map.md

Checks endpoint_map.md coverage at Phase 1→2 transition.
Lesson: NAMUHX had 40% coverage at Phase 2 entry; the real IDOR was in the untested 60%.

## Input
- `$ARGUMENTS`: target directory (e.g., `targets/keeper`)

## Procedure

### Step 1: Run bb_preflight.py coverage-check
!`python3 /home/rootk1m/01_CYAI_Lab/01_Projects/Terminator/tools/bb_preflight.py coverage-check "$ARGUMENTS" 2>&1`

### Step 2: Parse Result

| Result | Condition | Action |
|--------|-----------|--------|
| **PASS** | coverage >= 80% | Phase 2 proceed |
| **FAIL** | coverage < 80% | Phase 2 **BLOCKED**. Output UNTESTED endpoint list |
| **ERROR** | endpoint_map.md missing | Scout must generate it. Phase 2 blocked |

### Step 3: On FAIL — List UNTESTED Endpoints
!`grep -i "UNTESTED" "$ARGUMENTS/endpoint_map.md" 2>/dev/null || echo "endpoint_map.md not found"`

### Step 4: Small Target Exception
- Total endpoints < 10 → **100% coverage required** (not 80%)
- Reason: 1-2 untested endpoints on small targets = critical attack surface gap

### Step 5: Output
```
[COVERAGE-GATE] Target: <target>
[COVERAGE-GATE] Total endpoints: N
[COVERAGE-GATE] Tested: N (VULN=X, SAFE=Y, TESTED=Z)
[COVERAGE-GATE] Untested: N
[COVERAGE-GATE] Coverage: XX.X%
[COVERAGE-GATE] Threshold: 80% (or 100% for <10 endpoints)
[COVERAGE-GATE] Result: PASS / FAIL
[COVERAGE-GATE] Action: <"Phase 2 proceed" or "Additional analyst/exploiter round needed — UNTESTED list attached">
```

> **REMINDER**: FAIL = Phase 2 blocked. Spawn additional analyst/exploiter rounds targeting UNTESTED endpoints.