[Quality gate] Make JaCoCo fail closed when production class selection is empty

[seonghobae]

Buyer / acquisition risk

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 has a durable-job JaCoCo control that can analyze zero production classes and still report every zero-missed coverage check as satisfied. A vacuous bundle is not 100% owned-production coverage and cannot support acquisition/release claims.

Protected-baseline reproduction

The defect has been reproduced on multiple direct-develop PR integration trees. Representative CI logs include:

--- jacoco:0.8.15:report (report-durable-job-coverage) @ etl-service ---
Analyzed bundle 'etl-service' with 0 classes

--- jacoco:0.8.15:check (check-durable-job-coverage) @ etl-service ---
All coverage checks have been met.

Real ETL tests execute before this output, so the defect is the shared coverage selector/control rather than an empty test suite.

Root cause

Protected etl-service/pom.xml historically reused dotted class-name patterns at plugin level:

<includes>
    <include>com.xtrmetl.etl.job.*</include>
    <include>com.xtrmetl.etl.controller.EtlJobController*</include>
</includes>

JaCoCo prepare-agent accepts class-name expressions, while Maven report/check filter compiled class files. Reusing one selector across those goals can leave report/check with an empty class-file set. The control then had no non-empty bundle invariant, so an empty selection satisfied every MISSEDCOUNT <= 0 rule vacuously.

Selected remedy

PR #164 (fix/nonvacuous-jacoco-coverage) is the active direct-develop remediation. Exact current source head:

bae782c0406bec4258ceadb04251f385980cb99f

It:

• removes the incompatible shared plugin-level selector;
• uses class-file filters on report-durable-job-coverage and check-durable-job-coverage;
• preserves exact zero-missed INSTRUCTION, LINE, METHOD, and BRANCH limits; and
• adds a BUNDLE CLASS / TOTALCOUNT / minimum 1 invariant so an empty selected production set fails closed.

Current GREEN evidence — integration tree, not literal source

CI run 31327458876, job 93279988858, checked out GitHub PR synthetic merge 32c6b234731dde8f7d91ddb577ffb947becf0666 for #164. The full Maven reactor reached the repaired JaCoCo boundary. Both report and check logged:

Analyzed bundle 'etl-service' with 8 classes

The selected eight production classes then reported 100.0% instruction, line, branch, method, and class coverage, and the BUNDLE non-empty invariant passed. This is direct A/B evidence that #164 changes the causal quality-gate boundary from a zero-class false green to a real selected production bundle without weakening zero-missed thresholds.

The same job proves the current hosted PR workflow source identity is synthetic merge (refs/pull/164/merge), not literal source head. Therefore this GREEN is merged-tree compatibility/coverage evidence, not accepted literal-source evidence under mightyETL's exact-source governance.

Remaining acceptance

Keep this issue open and PR #164 Draft. Close only after the integrated protected quality control proves all of the following on accepted source identity:

1. the selected production class set is non-empty before percentage/zero-missed thresholds are considered;
2. the intended class-file filters select real compiled production classes;
3. exact zero missed instruction, line, method, and branch counters hold for that selected set;
4. full supported-host Maven tests succeed;
5. Dependency Review, SBOM, SAST and hard Security Scan succeed on the unchanged accepted revision;
6. canonical docs/TEST_STRATEGY.md, traceability, doctoring and CHANGELOG state that Analyzed bundle with 0 classes is a control failure, not 100% coverage;
7. valid review findings are resolved and qualifying independent non-author approval exists where governance requires it; and
8. protected acceptance distinguishes literal source evidence from GitHub synthetic PR merge evidence.

Do not close this issue merely because #164's POM or synthetic merged tree looks correct. The protected baseline remains a known_gap until #164 or an equivalent repair integrates and protected acceptance is regenerated.

Primary JaCoCo references

JaCoCo. (2026). jacoco:prepare-agent. https://www.jacoco.org/jacoco/trunk/doc/prepare-agent-mojo.html

JaCoCo. (2026). jacoco:report. https://www.jacoco.org/jacoco/trunk/doc/report-mojo.html

JaCoCo. (2026). jacoco:check. https://www.jacoco.org/jacoco/trunk/doc/check-mojo.html

JaCoCo. (2026). CoverageTransformer.java. https://www.jacoco.org/jacoco/trunk/coverage/org.jacoco.agent.rt/org.jacoco.agent.rt.internal/CoverageTransformer.java.html

JaCoCo. (2026). ReportSupport.java. https://www.jacoco.org/jacoco/trunk/coverage/jacoco-maven-plugin/org.jacoco.maven/ReportSupport.java.html

JaCoCo. (2026). FileFilter.java. https://www.jacoco.org/jacoco/trunk/coverage/jacoco-maven-plugin/org.jacoco.maven/FileFilter.java.html

[seonghobae]

Execution update (2026-08-09): the stale coverage-policy test identified by the prior RCA has now been repaired on PR #164 without weakening the gate. The live #164 head is 6110eaa724d8172c0114918f2bbcab7c4bd340f5 over unchanged develop@622e5e6c3d534f230c390f10e3832efadfc01825. The new commit updates EtlJobCoveragePolicyTest to require the separated class-file selectors (com/xtrmetl/etl/job/*.class, com/xtrmetl/etl/controller/EtlJobController*.class), explicitly reject the obsolete dotted selectors, require BUNDLE + CLASS/TOTALCOUNT >= 1, and retain zero-missed INSTRUCTION/LINE/METHOD/BRANCH assertions. Publication used an exact-parent Git Data commit and non-forced ref update from e9cec632d0b2336040a3e86363dc0348e0cab059, so the source change is an auditable fast-forward rather than a force rewrite.

Fresh workflow state on 6110eaa...: Dependency Review 31317196408 is success; CI 31317196423 is in progress; Security Scan 31317196433, CycloneDX SBOM 31317196410, and SAST Semgrep 31317196432 remain queued and therefore are not passing. Acceptance still requires the hosted JaCoCo report/check to actually run, report a non-zero analyzed production bundle, satisfy the non-empty class invariant and zero missed counters, plus the remaining exact-current-head security/SBOM/review gates. No queued or synthetic-only result is being promoted to success.

[seonghobae]

Execution update (2026-08-09): superseding the prior transient-head note, PR #164 has advanced again to live exact source head f8fa8504f0cceb2f072befda09eef3d13169b5b4 on unchanged develop@622e5e6c3d534f230c390f10e3832efadfc01825. The stale EtlJobCoveragePolicyTest mismatch is now resolved: on current CI run 31317634945, all 278 ETL tests pass, JaCoCoCoverageConfigurationTest is 3/3, and EtlJobCoveragePolicyTest is 1/1.

The non-vacuity repair now reaches the actual JaCoCo boundary and proves that the replacement selectors are real: macOS job 93255339808 reports Analyzed bundle 'etl-service' with 8 classes. The gate then fails closed on genuine residual coverage debt rather than configuration vacuity: 7 missed instructions, 2 missed lines, and 2 missed branches exceed the configured zero-missed maxima; no missed-method violation is reported. Dependency Review 31317634939, CycloneDX SBOM 31317634927, SAST Semgrep 31317634934, and Security Scan 31317634952 are green on this source head, while CI is correctly red on all three hosted OS jobs.

Therefore the issue's current first failing boundary is no longer the stale policy test described in the body. The next safe source remedy is to locate the exact uncovered branches/lines from JaCoCo report evidence and add realistic production-boundary tests; weakening selectors, exclusions, or thresholds is rejected. Current PR CI still executes synthetic merge e47a02b739f866836ee2f27b3962e109ebdd9980 (f8fa8504... into 622e5e6...), so even a later green run remains merged-tree evidence until literal-source checkout controls integrate. Do not close #162 until the integrated protected source has a nonzero analyzed bundle, zero missed owned-production counters, and accepted source-identity/review evidence.

[seonghobae]

Fresh dated acceptance evidence for the live #164 remediation supersedes the issue body's earlier e9cec632... snapshot.

At live #164 source head f8fa8504f0cceb2f072befda09eef3d13169b5b4 over unchanged develop@622e5e6c3d534f230c390f10e3832efadfc01825, CI run 31317634945 reaches the JaCoCo report/check boundary successfully. macOS job 93255339808 runs 278 etl-service tests with 0 failures / 0 errors / 0 skips, then reports Analyzed bundle 'etl-service' with 8 classes for both report and check. The stale EtlJobCoveragePolicyTest mismatch described in the issue body has therefore been corrected, and the zero-class false-green mechanism is no longer the active failure on this candidate.

The next gate is a real owned-production coverage deficit: JaCoCo fails the strict BUNDLE rule with 7 missed instructions, 2 missed lines, and 2 missed branches; the method counter does not fail. Dependency Review 31317634939, CycloneDX SBOM 31317634927, SAST Semgrep 31317634934, and Security Scan 31317634952 are green, but CI is correctly failed. This is materially stronger evidence than the predecessor run because it proves the non-vacuity repair works and now exposes the real test obligation instead of manufacturing 100% from an empty bundle.

Acceptance remains unchanged: identify the exact uncovered production lines/branches, add realistic tests that reach those boundaries (or remove only code proven dead/unreachable), rerun the same 8-class selection, and require zero missed instruction/line/method/branch counters. Lowering thresholds, shrinking the intended selection, adding exclusions, or restoring a vacuous filter is rejected. #164 is under another active writer in this invocation, so this loop will not race its source ref.

[seonghobae]

Fresh exact-head RCA update for PR #164 (supersedes the earlier e9cec632... failure description; issue remains active_pr).

• Current source head: f8fa8504f0cceb2f072befda09eef3d13169b5b4 over live develop@622e5e6c3d534f230c390f10e3832efadfc01825; PR remains Draft and mergeable.
• Hosted CI run 31317634945 is failed on macOS, Ubuntu, and Windows. This is not a transient runner/provider failure and should not be rerun unchanged.
• macOS job 93255339808 ran the full reactor on synthetic PR merge e47a02b739f866836ee2f27b3962e109ebdd9980; all 278 tests passed.
• The stale EtlJobCoveragePolicyTest mismatch is now fixed: the policy test passes and the build reaches the actual JaCoCo boundary.
• jacoco:report and jacoco:check now analyze a real selected bundle with 8 classes. The non-vacuity repair therefore works.
• The strict gate correctly fails on genuine remaining coverage debt: 7 missed instructions, 2 missed lines, 2 missed branches (0-miss thresholds remain intact). This is the first failing deterministic boundary now.
• Exact-head non-CI gates are green: Dependency Review 31317634939, SBOM 31317634927, SAST 31317634934, Security Scan 31317634952.

RCA: the original systemic control failure (0 selected classes satisfying zero-miss limits) is repaired; the now-visible failure is real test inadequacy in the intended owned durable-job/controller slice, not JaCoCo configuration. Smallest acceptable remedy is to locate the exact uncovered production lines/branches and add realistic boundary-reaching tests (or remove demonstrably dead product code under review), then rerun the unchanged strict gate. Reject threshold reduction, exclusions, reverting to dotted selectors, or retrying unchanged CI.

This loop is keeping #164 source/ref writes frozen for this invocation because the branch moved under another writer earlier; the next source fix belongs to that branch owner. Acceptance still requires nonzero selection and 0 missed instruction/line/method/branch counters on the exact head, then the remaining governance/review/protected-source controls.

[seonghobae]

Fresh execution evidence (2026-08-09 UTC): PR #164 is now at exact source head bae782c0406bec4258ceadb04251f385980cb99f on unchanged develop@622e5e6c3d534f230c390f10e3832efadfc01825. The active branch has advanced beyond the older e9cec632... evidence recorded above.

Current hosted workflow aggregates for this source head are all green: CI 31327458876, Dependency Review 31327458885, SBOM 31327458871, SAST 31327458860, and Security Scan 31327458880.

Most importantly, CI now reaches the non-vacuous JaCoCo boundary instead of stopping at a stale policy assertion. Ubuntu job 93279988825 ran 281 ETL-service tests with 0 failures/errors/skips, and both report-durable-job-coverage and check-durable-job-coverage report Analyzed bundle 'etl-service' with 8 classes; the check then reports All coverage checks have been met. The focused defensive parser branch tests also execute successfully. The same CI matrix is green on Ubuntu, macOS, and Windows.

This closes the specific vacuous zero-class defect at the current candidate tree without weakening the zero-missed instruction/line/method/branch thresholds. It does not by itself close #162 or make #164 mergeable: the ordinary pull_request CI checkout shown in job 93279988825 is still synthetic merge 32c6b234731dde8f7d91ddb577ffb947becf0666 (Merge bae782c... into 622e5e6...), not literal source head execution, and there is currently no formal independent non-author approval. Keep those governance/source-identity prerequisites separate from the now-proven non-vacuity result.

[seonghobae]

Fresh acceptance evidence after the active #164 writer advanced the branch:

• live fix(coverage): make JaCoCo production gate non-vacuous #164 source head: bae782c0406bec4258ceadb04251f385980cb99f; protected base remains develop@622e5e6c3d534f230c390f10e3832efadfc01825; PR remains Draft;
• CI run 31327458876 is successful across Ubuntu/macOS/Windows. Ubuntu job 93279988825 ran 281 ETL tests with 0 failures/errors/skips;
• report-durable-job-coverage and check-durable-job-coverage both report Analyzed bundle 'etl-service' with 8 classes, and the JaCoCo check reports all configured coverage checks met. This is the first hosted evidence in this remediation line that the intended bundle is non-empty rather than vacuously zero-class;
• current fix(coverage): make JaCoCo production gate non-vacuous #164 Dependency Review 31327458885, CycloneDX SBOM 31327458871, SAST Semgrep 31327458860, and Security Scan 31327458880 are also successful; CodeRabbit commit status is success;
• current formal review list is still empty, and no qualifying independent non-author approval is present.

Source-identity caveat remains material: the Ubuntu checkout was GitHub's synthetic PR merge 32c6b234731dde8f7d91ddb577ffb947becf0666 (Merge bae782c... into 622e5e6...), not literal source head bae782c.... Therefore this proves the non-vacuity correction and zero-missed gate on the current merged tree, but it is not literal-head/protected-release evidence and does not satisfy the #121 source-identity control by itself.

Classification: the original #162 configuration defect is now structurally remediated on the active PR and has non-vacuous hosted merged-tree proof, but #162 must remain open until that correction integrates on protected history under accepted exact-source controls. Do not close or treat #164 as merge-ready solely from this run; it remains Draft, has no formal independent approval, and its source branch moved under another active writer during this invocation.