ci: enforce workflow coverage gate

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
           cache: pip
@@ -54,8 +54,19 @@ jobs:
       - name: Install Python dependencies
         run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
 
-      - name: Run Python tests
-        run: python -m pytest
+      - name: Run Python tests with workflow coverage
+        run: >-
+          python -m pytest -q --cov=core.workflow
+          --cov-report=term-missing
+          --cov-report=xml:coverage-workflow.xml
+          --cov-fail-under=75
+
+      - name: Upload workflow coverage report
+        uses: actions/upload-artifact@v4
+        with:
+          name: workflow-coverage
+          path: coverage-workflow.xml
+          if-no-files-found: error
 
       - name: Run Ruff
         run: python -m ruff check __init__.py core

docs/architecture.md

@@ -76,7 +76,13 @@ The workflow uses the tracked `package-lock.json` with `npm ci`, has read-only
 repository permissions, and does not require secrets. Its two jobs run:
 
 1. `npm test` and `npm run lint` for the frontend.
-2. `pytest`, Ruff, and `compileall` for the backend.
+2. The Python suite with branch coverage for `core.workflow`, Ruff, and
+   `compileall` for the backend.
+
+The backend job requires at least 75% coverage for `core.workflow` and uploads
+the XML report as the `workflow-coverage` artifact. The threshold is scoped to
+the refactored workflow package while the remaining legacy backends are being
+covered incrementally.
 
 The workflow uses `pull_request`, not `pull_request_target`, so code from an
 external fork is tested with the restricted pull-request token context.