test: statement coverage is 34% (Python) and unmeasurable (JS) — OpenSSF silver blocker

[cdeust]

Blocks the OpenSSF Best Practices silver criterion test_statement_coverage80 ("at least 80% statement coverage if there is at least one FLOSS tool that can measure this in the selected language"). Answered Unmet in .bestpractices.json.

Measured 2026-07-28 (commit f563f72)

Python:

python -m pytest --cov=cortex_viz --cov-report=term -q
431 passed, 1 skipped
TOTAL   11625 statements   7706 missed   34%

The gap is concentrated in the HTTP server layer, which is the largest and most exposed surface:

Module	Coverage
server/http_server.py	0%
server/visualize_bootstrap.py	0%
server/layout_authority_lod.py	0%
server/trace_impact.py	4%
server/http_standalone_sse.py	11%
server/http_standalone_routes.py	13%
server/http_standalone_activity.py	16%
server/http_standalone.py / http_standalone_static.py	18%

JavaScript: not measurable by the current harness.

npx vitest run --coverage
All files | 0 | 0 | 0 | 0

This 0% is an artifact, not a result. tests/js/helpers/load-globals.mjs loads UI files with new Function(code) so a browser IIFE runs at jsdom global scope, and v8 cannot attribute the executed lines back to the source file. 175 tests genuinely pass against that code; the coverage provider simply cannot see it.

Also found

npx vitest run --coverage fails, independently of the coverage number: the trigram scale benchmark asserts a 500ms wall-clock bound and measures 939ms under v8 instrumentation.

FAIL tests/js/trigram.test.mjs > scans a 300k-label corpus within the regression bound
AssertionError: expected 939.8624159999999 to be less than 500

So npm run test:coverage cannot currently be run at all. A wall-clock assertion should be measured against a control rather than an absolute bound, or excluded from instrumented runs.

Acceptance criteria

• Python statement coverage >= 80%, or a written, per-module justification for each area deliberately left uncovered
• JS coverage produces a real number: either export seams the tests can import, or configure a provider that can attribute new Function execution
• npm run test:coverage exits 0
• The trigram benchmark no longer asserts an absolute wall-clock bound under instrumentation
• .bestpractices.json test_statement_coverage80_status flips to Met with the measurement quoted