Add a real-server integration test lane and a coverage gate

[morcen]

Problem

Coverage reporting is configured in phpunit.xml.dist but CI runs with coverage: none in every workflow (run-tests.yml, test-matrix.yml, security-audit.yml), so there is no coverage signal or gate.

Every test, including the "integration" suite, fakes the HTTP layer... Resolved by #233: tests/Feature/PassageRealServerIntegrationTest.php now proxies through a real PHP built-in web server (tests/Fixtures/real-server-router.php) covering body types, header forwarding, query forwarding, streaming, and the allowed-hosts guard — exactly the real-transport gap this issue originally raised. tests/Feature/PassageIntegrationTest.php remains Http::fake-based, which is fine now that the real-transport lane exists alongside it.

Location

• CI workflows (run-tests.yml, test-matrix.yml, security-audit.yml all still run with coverage: none)

Fix

Enable a coverage driver (pcov or xdebug) and a coverage job with a modest floor (start at 80%). The real-server test lane portion of this issue is done; only the coverage gate remains.

Sizing

Priority 18 (Impact 3, Risk 3, Effort 3). Originally estimated 1-2 days; remaining scope (coverage gate only) is smaller.

From the tech debt audit dated 2026-07-05.

[morcen]

Checked against current main (72a81a0). Nothing merged addresses the core ask: .github/workflows/run-tests.yml still runs with coverage: none, and there is no real-server test lane — tests/Feature/PassageIntegrationTest.php is still 100% Http::fake-based.

If anything the specific detail cited in the body is now understated: at filing time (baseline commit 6c183fa) the file had 8 Http::fake calls; a series of correctness fixes since then (e.g. 260057b, 2adece3, 6d5046d, 9c46e44, 1582b72) added more fake-based test cases, bringing the count to 14. That's the opposite direction from what this issue asks for, so I've corrected the count in the body from 8 to 14. The ask (real-server lane + coverage gate) is unchanged and still fully open.

---

Generated by Claude Code

[morcen]

Routine audit (2026-08-11): still nothing merged toward the core ask — run-tests.yml remains coverage: none, and PassageIntegrationTest.php is still fully Http::fake-based, no real-server lane exists. The Http::fake count cited in the body has drifted further since the last correction: 3f14f7d (#195, "default retry only on connection errors and 5xx responses") added 2 more fake-based test cases, bringing the total from 14 to 16. Updated the count; the ask itself is unchanged and still fully open.

---

Generated by Claude Code

[morcen]

The real-server integration test lane half of this is done via #233 (merged), which also fixed a multipart boundary bug that lane surfaced.

Still open: enabling a coverage driver (pcov/xdebug) in run-tests.yml and gating on the 80% floor. Leaving this issue open to track that.

---

Generated by Claude Code

[morcen]

Routine audit (2026-09-13): updated the issue body to reflect current main. The real-server integration test lane (previously noted as done via #233 in the comment above) is now reflected in the body's Problem/Location/Fix sections — that half of the original ask is resolved. Remaining scope is narrowed to just enabling a coverage driver and gating CI on it; nothing has merged toward that yet (coverage: none still in all three workflows).

---

Generated by Claude Code