feat(ci): report CRAP from measured test coverage (report-only)

.fallowrc.json

@@ -627,6 +627,9 @@
     "deadCodeBaseline": "fallow-baselines/dead-code.json",
     "healthBaseline": "fallow-baselines/health.json"
   },
+  // CRAP needs measured coverage: estimated from imports it disagrees with measured scores on most
+  // findings. fallow-crap.json re-enables it for the CI Coverage job, which supplies the coverage map.
+  "health": { "maxCrap": 0 },
   "includeEntryExports": true,
   "ignoreExportsUsedInFile": {
     "type": true,

.github/workflows/ci.yml

@@ -298,6 +298,10 @@ jobs:
         uses: ./.github/actions/run-gate
         with: { gate: coverage-model }
 
+      - name: Test coverage-based CRAP report
+        uses: ./.github/actions/run-gate
+        with: { gate: coverage-crap-model }
+
       - name: Run coverage
         id: run-coverage
         env:
@@ -331,6 +335,29 @@ jobs:
             --base
             ${{ github.event.pull_request.base.sha }}
 
+      # Report-only: scores the functions this PR touches with the coverage map the coverage step
+      # wrote (fallow-crap.json), as a job summary and warning annotations. It never fails the job:
+      # a tooling error marks only this step. `!cancelled()` keeps it running after a failed
+      # changed-line gate.
+      - name: Report coverage-based CRAP
+        if: ${{ !cancelled() && steps.run-coverage.outcome == 'success' && github.event_name == 'pull_request' }}
+        continue-on-error: true
+        uses: ./.github/actions/run-gate
+        with:
+          gate: coverage-crap
+          args: |
+            --base
+            ${{ github.event.pull_request.base.sha }}
+
+      # On main, the same report covers every function: the backlog of untested complex code.
+      - name: Report coverage-based CRAP for the whole repository
+        if: ${{ !cancelled() && steps.run-coverage.outcome == 'success' && github.event_name == 'push' }}
+        continue-on-error: true
+        uses: ./.github/actions/run-gate
+        with:
+          gate: coverage-crap
+          args: --all
+
   integration:
     name: Integration Tests
     runs-on: ubuntu-latest

CONTRIBUTING.md

@@ -201,6 +201,9 @@ Useful direct entry points:
 - `pnpm test:integration` — Node and provider-backed integration suites
 - `pnpm perf --platform ios` or `pnpm perf --platform android` — device performance harness
 - `pnpm check:fallow --base origin/main` — changed-code quality gate
+- `pnpm check:coverage-crap --base origin/main` — CRAP from measured coverage for the functions a
+  change touches (run `pnpm test:coverage` first; `--all` scans every function). Both report scores
+  at or above 30. `check:fallow` leaves CRAP off because it has no coverage.
 - `pnpm fallow:all` — full-tree audit, including grandfathered baseline findings
 - `pnpm fallow:baseline` — intentionally regenerate both reviewed Fallow baselines