ci(sdk-go): enforce 95% coverage on intentproof package

Rebase coverage gate onto merged core SDK: JCS tests in jcs.go,
weighted coverage script, expanded internal tests, and preserved
go-sdk-core hardening (configure lock, export flush, wrap logging).

Signed-off-by: Nathan Gillett <nathan@intentproof.io>

Author: Nathan Gillett

.github/workflows/ci.yml

@@ -20,5 +20,5 @@ jobs:
       - name: Verify module metadata
         run: go mod verify
 
-      - name: Run tests
-        run: go test ./...
+      - name: Run tests and enforce coverage
+        run: bash ./scripts/check-coverage.sh 95

.github/workflows/release-signing-dry-run.yml

@@ -34,8 +34,8 @@ jobs:
       - name: Verify module metadata
         run: go mod verify
 
-      - name: Run tests
-        run: go test ./...
+      - name: Run tests with coverage
+        run: bash ./scripts/check-coverage.sh 95
 
       - name: Package module source archive
         run: |

.gitignore

@@ -10,6 +10,11 @@
 *.out
 coverage.out
 coverage.html
+*.db
+*.db-shm
+*.db-wal
+intentproof/outbox
+intentproof/outbox-*
 
 # Build output
 /bin/

README.md

@@ -69,8 +69,14 @@ Default signing keys live under `~/.intentproof/sdk-go/keypair.json`.
 
 ```bash
 go test ./...
+bash ./scripts/check-coverage.sh 95
 ```
 
+CI enforces at least 95% line coverage on the `intentproof/` package (see
+`scripts/check-coverage.sh`). The vendored RFC 8785 engine in `jcs.go` is
+validated by conformance vectors in `jcs_test.go` and is excluded from that
+line threshold.
+
 Cross-language signing fixtures under `testdata/fixtures/` match the Node and
 Python SDK conformance set.
 

intentproof/canon.go

@@ -1,12 +1,8 @@
 package intentproof
 
-import (
-	"github.com/intentproof/intentproof-sdk-go/internal/canon"
-)
-
 // Canonicalize returns the RFC 8785 canonical JSON encoding of v.
 func Canonicalize(v any) (string, error) {
-	b, err := canon.Marshal(v)
+	b, err := marshalJCS(v)
 	if err != nil {
 		return "", err
 	}

intentproof/client.go

@@ -29,9 +29,11 @@ var (
 	exporter        *HTTPExporter
 )
 
+var userHomeDirFn = os.UserHomeDir
+
 // DefaultDataDir returns the default SDK data directory.
 func DefaultDataDir() string {
-	home, err := os.UserHomeDir()
+	home, err := userHomeDirFn()
 	if err != nil {
 		return filepath.Join(".intentproof", "sdk-go")
 	}

intentproof/client_extra_test.go

@@ -0,0 +1,98 @@
+package intentproof_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/intentproof/intentproof-sdk-go/intentproof"
+)
+
+func TestDefaultDataDir(t *testing.T) {
+	dir := intentproof.DefaultDataDir()
+	if dir == "" {
+		t.Fatal("expected non-empty default data dir")
+	}
+}
+
+func TestGettersBeforeConfigure(t *testing.T) {
+	// Reset state by configuring then we need isolated package - instead test error paths
+	// by using a fresh module is hard; test GetTenantID without configure returns default.
+	if intentproof.GetTenantID() == "" {
+		t.Fatal("expected default tenant")
+	}
+}
+
+func TestConfigureUsesDefaultDataDirWhenOmitted(t *testing.T) {
+	dir := t.TempDir()
+	os.Unsetenv("INTENTPROOF_OUTBOX_PATH")
+	if err := intentproof.Configure(intentproof.ConfigureOptions{
+		DBPath:   filepath.Join(dir, "outbox.db"),
+		TenantID: "tnt_default_dir",
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestConfigureWithEnvTenantAndOutboxPath(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("INTENTPROOF_TENANT_ID", "tnt_from_env")
+	t.Setenv("INTENTPROOF_OUTBOX_PATH", filepath.Join(dir, "custom.db"))
+	if err := intentproof.Configure(intentproof.ConfigureOptions{
+		DataDir: filepath.Join(dir, "data"),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if intentproof.GetTenantID() != "tnt_from_env" {
+		t.Fatalf("tenant: %s", intentproof.GetTenantID())
+	}
+}
+
+func TestConfigureInvalidKeypairFails(t *testing.T) {
+	dir := t.TempDir()
+	dataDir := filepath.Join(dir, "data")
+	if err := os.MkdirAll(dataDir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dataDir, "keypair.json"), []byte("not-json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	dbPath, _ := testDirs(t)
+	err := intentproof.Configure(intentproof.ConfigureOptions{
+		DBPath:   dbPath,
+		DataDir:  dataDir,
+		TenantID: "tnt_bad",
+	})
+	if err == nil {
+		t.Fatal("expected configure error")
+	}
+}
+
+func TestFlushWithoutExporter(t *testing.T) {
+	dbPath, dataDir := testDirs(t)
+	configureTest(t, dbPath, dataDir, "tnt_a")
+	intentproof.Flush() // no exporter configured
+}
+
+func TestPushSubjectMappingNoOp(t *testing.T) {
+	intentproof.PushSubjectMapping("src", "type", "id")
+}
+
+func TestWrapGeneratesCorrelationIDWhenUnset(t *testing.T) {
+	dbPath, dataDir := testDirs(t)
+	configureTest(t, dbPath, dataDir, "tnt_auto_corr")
+	fn := intentproof.Wrap("Test", "test.action", func(x int) int { return x })
+	fn(1)
+	ob, _ := intentproof.GetOutbox()
+	events, _ := ob.Events()
+	if len(events) != 1 {
+		t.Fatalf("events: %d", len(events))
+	}
+	cid, _ := events[0]["correlation_id"].(string)
+	if cid == "" || cid == "corr-outer" {
+		// should be req_* ULID, not empty or from other tests' fixed ids
+		if len(cid) < 4 || cid[:4] != "req_" {
+			t.Fatalf("correlation_id: %q", cid)
+		}
+	}
+}