---

name: coverage-gate description: Check endpoint_map.md coverage at Phase 1→2 transition. Blocks Phase 2 if below 80%. Matches "coverage check", "endpoint coverage", "Phase 2 gate" user-invocable: true argument-hint: <target-dir> allowed-tools: [Read, Bash, Grep, Glob]

Endpoint Coverage Gate

CRITICAL RULES (NEVER VIOLATE)

1. FAIL → Phase 2 is BLOCKED — no Phase 2 spawn without coverage gate pass
2. No premature "analysis complete" declarations — must verify numbers against endpoint_map.md

Checks endpoint_map.md coverage at Phase 1→2 transition. Lesson: NAMUHX had 40% coverage at Phase 2 entry; the real IDOR was in the untested 60%.

Input

• $ARGUMENTS: target directory (e.g., targets/keeper)

Procedure

Step 1: Run bb_preflight.py coverage-check

!python3 /home/rootk1m/01_CYAI_Lab/01_Projects/Terminator/tools/bb_preflight.py coverage-check "$ARGUMENTS" 2>&1

Step 2: Parse Result

| Result | Condition | Action | |--------|-----------|--------| | PASS | coverage >= 80% | Phase 2 proceed | | FAIL | coverage < 80% | Phase 2 BLOCKED. Output UNTESTED endpoint list | | ERROR | endpoint_map.md missing | Scout must generate it. Phase 2 blocked |

Step 3: On FAIL — List UNTESTED Endpoints

!grep -i "UNTESTED" "$ARGUMENTS/endpoint_map.md" 2>/dev/null || echo "endpoint_map.md not found"

Step 4: Small Target Exception

• Total endpoints < 10 → 100% coverage required (not 80%)
• Reason: 1-2 untested endpoints on small targets = critical attack surface gap

Step 5: Output

[COVERAGE-GATE] Target: <target>
[COVERAGE-GATE] Total endpoints: N
[COVERAGE-GATE] Tested: N (VULN=X, SAFE=Y, TESTED=Z)
[COVERAGE-GATE] Untested: N
[COVERAGE-GATE] Coverage: XX.X%
[COVERAGE-GATE] Threshold: 80% (or 100% for <10 endpoints)
[COVERAGE-GATE] Result: PASS / FAIL
[COVERAGE-GATE] Action: <"Phase 2 proceed" or "Additional analyst/exploiter round needed — UNTESTED list attached">

REMINDER: FAIL = Phase 2 blocked. Spawn additional analyst/exploiter rounds targeting UNTESTED endpoints.