feat(enrichment): add changed-line coverage-delta analyzer

Adds a coverageDelta REES analyzer that flags added lines a PR introduces
which the repo's own latest successful CI coverage report records as
executed zero times, parsed from the head commit's GitHub Actions coverage
artifact (lcov / Istanbul coverage-final.json / Cobertura XML) and
intersected with the patch's added lines. Additive and fail-safe: any
missing token, absent artifact, unparseable report, or fetch error yields
no finding rather than a false one. Self-contained in review-enrichment/.

Closes #1516

Author: e11734937-beep

.env.example

@@ -70,6 +70,7 @@ GITTENSORY_REVIEW_ENRICHMENT=false
 # pendingReviewRequests,testRatio,migrationSafety,looseRange,terminology,todoMarker,magicNumber
 # conflictMarker,debugLeftover,sizeSmell,floatingPromise,deepNesting,errorSwallow,unsafeAny,a11y
 # i18n,unusedExport,exhaustiveness,flakyTest,commitLint,apiBreak,deprecatedDep,revertRecurrence
+# coverageDelta
 #
 # Profile defaults:
 # fast: dependency,dependencyDiff,lockfileDrift,secret,license,installScript,heavyDependency
@@ -84,14 +85,15 @@ GITTENSORY_REVIEW_ENRICHMENT=false
 # commitHygiene,pendingReviewRequests,testRatio,migrationSafety,looseRange,terminology
 # todoMarker,magicNumber,conflictMarker,debugLeftover,sizeSmell,floatingPromise,deepNesting
 # errorSwallow,unsafeAny,a11y,i18n,unusedExport,exhaustiveness,flakyTest,commitLint,apiBreak
-# deprecatedDep,revertRecurrence
+# deprecatedDep,revertRecurrence,coverageDelta
 # deep: dependency,dependencyDiff,lockfileDrift,secret,license,installScript,heavyDependency
 # hardcodedUrl,actionPin,eol,redos,provenance,codeowners,secretLog,assetWeight,typosquat
 # commitSignature,iacMisconfig,nativeBuild,history,docCommentDrift,duplication,churnHotspot
 # blameLink,approvalIntegrity,ciCheckSignals,undocumentedExport,staleBranch,commitHygiene
 # pendingReviewRequests,testRatio,migrationSafety,looseRange,terminology,todoMarker,magicNumber
 # conflictMarker,debugLeftover,sizeSmell,floatingPromise,deepNesting,errorSwallow,unsafeAny,a11y
 # i18n,unusedExport,exhaustiveness,flakyTest,commitLint,apiBreak,deprecatedDep,revertRecurrence
+# coverageDelta
 # END GENERATED REES ANALYZERS
 
 # Submitter-reputation spend control (internal-only): downgrades new/burst/low-rep

apps/gittensory-ui/src/lib/rees-analyzers.ts

@@ -1295,6 +1295,32 @@ export const REES_ANALYZERS = [
         "Conservative: only a message-confirmed revert commit whose removed range overlaps an added range is reported (one finding per file); line-range overlap is a heuristic across history, and lockfiles/generated/binary paths are skipped. Fail-safe on missing token/invalid slug/fetch error or an aborted signal.",
     },
   },
+  {
+    name: "coverageDelta",
+    title: "Coverage gaps on changed lines",
+    category: "quality",
+    cost: "github-heavy",
+    defaultEnabled: true,
+    profiles: ["balanced", "deep"],
+    requires: ["files", "github-token", "head-sha"],
+    limits: {
+      maxRunsProbed: 5,
+      maxFilesReported: 15,
+      maxLinesPerFile: 20,
+    },
+    docs: {
+      summary:
+        "Flags added lines in a PR that the project's own latest successful CI coverage report records as never executed — measured test gaps on exactly the touched lines, not a guess about whether tests look present.",
+      looksAt:
+        "The PR's added new-file line numbers, intersected with the zero-hit lines parsed from the coverage artifact (lcov, Istanbul coverage-final.json, or Cobertura XML) of the head commit's most recent successful workflow run.",
+      reports:
+        "Each changed file and the specific added line numbers with no test coverage — never file contents.",
+      network:
+        "Calls the GitHub Actions runs and artifacts APIs and downloads one coverage artifact zip, each bounded by fixed fanout and byte caps. Requires GitHub token forwarding.",
+      notes:
+        "Conservative and fail-safe: only an added line the report explicitly marks zero-hit is flagged, so a missing token, absent artifact, unparseable report, or fetch error yields no finding rather than a false one. Bounded by run, file, and line caps.",
+    },
+  },
 ] as const satisfies readonly ReesAnalyzerDoc[];
 
 export const REES_ANALYZER_NAMES = REES_ANALYZERS.map((analyzer) => analyzer.name);

review-enrichment/analyzer-metadata.json

@@ -1455,6 +1455,34 @@
         "network": "Calls the GitHub commits API per probed file and the single-commit API per revert commit, both bounded by fixed fanout caps. Requires GitHub token forwarding for private repos.",
         "notes": "Conservative: only a message-confirmed revert commit whose removed range overlaps an added range is reported (one finding per file); line-range overlap is a heuristic across history, and lockfiles/generated/binary paths are skipped. Fail-safe on missing token/invalid slug/fetch error or an aborted signal."
       }
+    },
+    {
+      "name": "coverageDelta",
+      "title": "Coverage gaps on changed lines",
+      "category": "quality",
+      "cost": "github-heavy",
+      "defaultEnabled": true,
+      "profiles": [
+        "balanced",
+        "deep"
+      ],
+      "requires": [
+        "files",
+        "github-token",
+        "head-sha"
+      ],
+      "limits": {
+        "maxRunsProbed": 5,
+        "maxFilesReported": 15,
+        "maxLinesPerFile": 20
+      },
+      "docs": {
+        "summary": "Flags added lines in a PR that the project's own latest successful CI coverage report records as never executed — measured test gaps on exactly the touched lines, not a guess about whether tests look present.",
+        "looksAt": "The PR's added new-file line numbers, intersected with the zero-hit lines parsed from the coverage artifact (lcov, Istanbul coverage-final.json, or Cobertura XML) of the head commit's most recent successful workflow run.",
+        "reports": "Each changed file and the specific added line numbers with no test coverage — never file contents.",
+        "network": "Calls the GitHub Actions runs and artifacts APIs and downloads one coverage artifact zip, each bounded by fixed fanout and byte caps. Requires GitHub token forwarding.",
+        "notes": "Conservative and fail-safe: only an added line the report explicitly marks zero-hit is flagged, so a missing token, absent artifact, unparseable report, or fetch error yields no finding rather than a false one. Bounded by run, file, and line caps."
+      }
     }
   ]
 }