vulkro-sf coverage-attest and vulkro-sf coverage-risk

Two commands that read the Apex coverage report your test run already produced. coverage-attest checks it against a coverage bar; coverage-risk ranks the gaps by business criticality. Vulkro does not run the tests.

sf apex run test --code-coverage --json > coverage.json
vulkro-sf coverage-attest coverage.json
vulkro-sf coverage-risk coverage.json

coverage-attest

Checks that org-wide and per-class coverage meet the AgentExchange (formerly AppExchange) Security Review bar of 75%, and names every under-covered class.

Argument or flag	What it does
<COVERAGE>	The Apex coverage JSON report.
--min <pct>	Required coverage percentage. Default 75.
--format <table|json>	Output format. Default table.

Exit codes: 0 coverage meets the bar, 1 below the bar, 2 error (unreadable file, not a coverage report, unknown --format).

coverage-risk

Ranks each under-covered class by coverage gap times process criticality, so a gap on a payment class outranks the same gap on a logger. An under-covered class on a high-criticality process raises SF-COVERAGE-RISK-001.

The criticality map lives at .vulkro-sf/business-processes.yaml:

coverage_target: 75          # optional, default 75
processes:
  - name: Payment authorization
    criticality: 10          # 1 to 10, higher is more critical
    patterns: [Payment, Billing, Invoice]   # matched against class names
  - name: Internal tooling
    criticality: 2
    patterns: [Logger]

Argument or flag	What it does
<COVERAGE>	The Apex coverage JSON report.
--processes <file>	The criticality map. Default .vulkro-sf/business-processes.yaml.
--format <table|json>	Output format. Default table.

Exit codes: 0 no high-risk gap, 1 at least one SF-COVERAGE-RISK-001, 2 error (unreadable file, bad map, unknown --format).