From 6682455e13ff97b3fb10d5f4c397ee4cc7391624 Mon Sep 17 00:00:00 2001
From: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Date: Tue, 20 Jan 2026 14:57:17 -0800
Subject: [PATCH 1/8] refactor(coverage): Replace per-package thresholds with
 GitHub Actions workflow

- Remove per-package coverage thresholds from vitest.config.ts to eliminate merge conflicts
- Add 'json-summary' reporter for coverage reporting
- Delete reset-coverage-thresholds.sh script and pretest hook
- Create coverage.yml workflow that:
  - Runs tests with coverage on PR and base branches in parallel
  - Uploads coverage as artifacts (7-day retention)
  - Posts PR comments with coverage totals and deltas using vitest-coverage-report-action
- No coverage data stored in repo, preventing conflicts while enabling trend tracking

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/coverage.yml       |  90 ++++++++++++++++++
 package.json                         |   3 +-
 scripts/reset-coverage-thresholds.sh |  19 ----
 vitest.config.ts                     | 131 +--------------------------
 4 files changed, 92 insertions(+), 151 deletions(-)
 create mode 100644 .github/workflows/coverage.yml
 delete mode 100755 scripts/reset-coverage-thresholds.sh

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 000000000..a2b0d247f
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,90 @@
+name: Coverage Report
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: coverage-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Runs on both push to main and PRs
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup environment
+        uses: MetaMask/action-checkout-and-setup@v2
+        with:
+          is-high-risk-environment: false
+          node-version: 24.x
+        env:
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+
+      - name: Build
+        run: yarn build
+
+      - name: Run tests with coverage
+        run: yarn vitest run --coverage
+
+      # On push to main, upload as the baseline for future PRs
+      - name: Upload baseline coverage
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v6
+        with:
+          name: coverage-baseline
+          path: coverage/
+          retention-days: 90
+
+      # On PRs, upload as PR coverage for the report job
+      - name: Upload PR coverage
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v6
+        with:
+          name: coverage-pr
+          path: coverage/
+          retention-days: 7
+
+  # Only runs on PRs to generate the comparison report
+  report:
+    name: Report
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    needs: coverage
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Download PR coverage
+        uses: actions/download-artifact@v7
+        with:
+          name: coverage-pr
+          path: coverage/
+
+      - name: Download baseline coverage from main
+        uses: actions/download-artifact@v7
+        with:
+          branch: main
+          name: coverage-baseline
+          path: coverage-base/
+          workflow_conclusion: success
+          if_no_artifact_found: warn
+
+      - name: Post coverage report
+        uses: davelosert/vitest-coverage-report-action@5b6122e3a819a3be7b27fc961b7faafb3bf00e4d
+        with:
+          json-summary-path: coverage/coverage-summary.json
+          json-final-path: coverage/coverage-final.json
+          json-summary-compare-path: coverage-base/coverage-summary.json
+          file-coverage-mode: changes
diff --git a/package.json b/package.json
index 76d1acaa7..432aa6f19 100644
--- a/package.json
+++ b/package.json
@@ -27,9 +27,8 @@
     "lint:misc": "prettier --no-error-on-unmatched-pattern '**/*.json' '**/*.md' '**/*.html'  '**/*.yml' '!**/CHANGELOG.old.md' '!.yarnrc.yml' '!CLAUDE.md' '!merged-packages/**' --ignore-path .gitignore  --log-level error",
     "postinstall": "simple-git-hooks && yarn rebuild:native",
     "prepack": "./scripts/prepack.sh",
-    "pretest": "bash scripts/reset-coverage-thresholds.sh",
     "rebuild:native": "./scripts/rebuild-native.sh",
-    "test": "yarn pretest && vitest run",
+    "test": "vitest run",
     "test:ci": "vitest run --coverage false",
     "test:dev": "turbo run test:dev",
     "test:dev:quiet": "turbo run test:dev:quiet --output-logs=errors-only",
diff --git a/scripts/reset-coverage-thresholds.sh b/scripts/reset-coverage-thresholds.sh
deleted file mode 100755
index 76306ff4f..000000000
--- a/scripts/reset-coverage-thresholds.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash
-
-# Find the vitest.config.ts file
-CONFIG_FILE="vitest.config.ts"
-
-# Create a temporary file
-TMP_FILE=$(mktemp)
-
-# Process the file
-awk '
-  /statements:/ { sub(/statements: [0-9.]+,/, "statements: 0,") }
-  /functions:/ { sub(/functions: [0-9.]+,/, "functions: 0,") }
-  /branches:/ { sub(/branches: [0-9.]+,/, "branches: 0,") }
-  /lines:/ { sub(/lines: [0-9.]+,/, "lines: 0,") }
-  { print }
-' "$CONFIG_FILE" > "$TMP_FILE"
-
-# Replace original file with modified content
-mv "$TMP_FILE" "$CONFIG_FILE"
diff --git a/vitest.config.ts b/vitest.config.ts
index 740a0991b..fe602d389 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -49,7 +49,7 @@ export default defineConfig({
     coverage: {
       enabled: true,
       provider: 'v8',
-      reporter: ['text', 'json', 'html'],
+      reporter: ['text', 'json', 'json-summary', 'html'],
       reportsDirectory: './coverage',
       include: ['**/src/**/*.{ts,tsx}'],
       exclude: [
@@ -60,135 +60,6 @@ export default defineConfig({
         '**/*.{test,spec}.{ts,tsx,js,jsx}',
         path.join(import.meta.dirname, './packages/brow-2-brow/**'),
       ],
-      thresholds: {
-        autoUpdate: true,
-        'packages/cli/**': {
-          statements: 52.32,
-          functions: 53.57,
-          branches: 68.88,
-          lines: 52.63,
-        },
-        'packages/create-package/**': {
-          statements: 100,
-          functions: 100,
-          branches: 100,
-          lines: 100,
-        },
-        'packages/extension/**': {
-          statements: 1.42,
-          functions: 0,
-          branches: 0,
-          lines: 1.44,
-        },
-        'packages/kernel-agents/**': {
-          statements: 92.34,
-          functions: 90.84,
-          branches: 85.08,
-          lines: 92.48,
-        },
-        'packages/kernel-browser-runtime/**': {
-          statements: 85.88,
-          functions: 78.88,
-          branches: 81.92,
-          lines: 86.15,
-        },
-        'packages/kernel-errors/**': {
-          statements: 99.24,
-          functions: 97.29,
-          branches: 96,
-          lines: 99.21,
-        },
-        'packages/kernel-language-model-service/**': {
-          statements: 99,
-          functions: 100,
-          branches: 94.11,
-          lines: 98.97,
-        },
-        'packages/kernel-platforms/**': {
-          statements: 99.28,
-          functions: 100,
-          branches: 91.89,
-          lines: 99.26,
-        },
-        'packages/kernel-rpc-methods/**': {
-          statements: 100,
-          functions: 100,
-          branches: 100,
-          lines: 100,
-        },
-        'packages/kernel-shims/**': {
-          statements: 0,
-          functions: 0,
-          branches: 0,
-          lines: 0,
-        },
-        'packages/kernel-store/**': {
-          statements: 98.37,
-          functions: 100,
-          branches: 91.42,
-          lines: 98.36,
-        },
-        'packages/kernel-ui/**': {
-          statements: 95.03,
-          functions: 95.83,
-          branches: 87.53,
-          lines: 95.11,
-        },
-        'packages/kernel-utils/**': {
-          statements: 100,
-          functions: 100,
-          branches: 100,
-          lines: 100,
-        },
-        'packages/logger/**': {
-          statements: 98.66,
-          functions: 96.66,
-          branches: 97.36,
-          lines: 100,
-        },
-        'packages/nodejs/**': {
-          statements: 88.98,
-          functions: 87.5,
-          branches: 90.9,
-          lines: 89.74,
-        },
-        'packages/nodejs-test-workers/**': {
-          statements: 23.52,
-          functions: 25,
-          branches: 25,
-          lines: 25,
-        },
-        'packages/ocap-kernel/**': {
-          statements: 95.12,
-          functions: 97.69,
-          branches: 86.95,
-          lines: 95.1,
-        },
-        'packages/omnium-gatherum/**': {
-          statements: 5.26,
-          functions: 5.55,
-          branches: 0,
-          lines: 5.35,
-        },
-        'packages/remote-iterables/**': {
-          statements: 100,
-          functions: 100,
-          branches: 100,
-          lines: 100,
-        },
-        'packages/streams/**': {
-          statements: 100,
-          functions: 100,
-          branches: 100,
-          lines: 100,
-        },
-        'packages/template-package/**': {
-          statements: 100,
-          functions: 100,
-          branches: 100,
-          lines: 100,
-        },
-      },
     },
   },
 });

From d38ee66327d92d8066cd41dd05b7dd761b56ac60 Mon Sep 17 00:00:00 2001
From: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Date: Tue, 20 Jan 2026 15:33:59 -0800
Subject: [PATCH 2/8] feat(coverage): Add GitHub Pages deployment for HTML
 coverage report

- Deploy HTML coverage report to GitHub Pages on push to main
- Add PR comment with link to main branch coverage report
- Fix action versions (use v4 for checkout/artifact actions)
- Use dawidd6/action-download-artifact for cross-workflow artifact download

Coverage report will be available at:
https://metamask.github.io/ocap-kernel/coverage/

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/coverage.yml | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index a2b0d247f..877733a57 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -16,7 +16,7 @@ jobs:
     name: Coverage
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -38,16 +38,25 @@ jobs:
       # On push to main, upload as the baseline for future PRs
       - name: Upload baseline coverage
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: coverage-baseline
           path: coverage/
           retention-days: 90
 
+      # On push to main, deploy HTML coverage report to GitHub Pages
+      - name: Deploy coverage to GitHub Pages
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./coverage
+          destination_dir: coverage
+
       # On PRs, upload as PR coverage for the report job
       - name: Upload PR coverage
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: coverage-pr
           path: coverage/
@@ -67,7 +76,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Download PR coverage
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
         with:
           name: coverage-pr
           path: coverage/
@@ -88,3 +97,14 @@ jobs:
           json-final-path: coverage/coverage-final.json
           json-summary-compare-path: coverage-base/coverage-summary.json
           file-coverage-mode: changes
+
+      - name: Post coverage report link
+        uses: actions/github-script@v8
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '📊 [View full HTML coverage report for `main`](https://metamask.github.io/ocap-kernel/coverage/)'
+            })

From f941bd48e8c809e5d3e20dda4f9268c18426b0e4 Mon Sep 17 00:00:00 2001
From: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Date: Tue, 20 Jan 2026 15:44:39 -0800
Subject: [PATCH 3/8] fix: Fix action tags in coverage workflow

---
 .github/workflows/coverage.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 877733a57..4670fd853 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -38,7 +38,7 @@ jobs:
       # On push to main, upload as the baseline for future PRs
       - name: Upload baseline coverage
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: coverage-baseline
           path: coverage/
@@ -47,7 +47,7 @@ jobs:
       # On push to main, deploy HTML coverage report to GitHub Pages
       - name: Deploy coverage to GitHub Pages
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./coverage
@@ -56,7 +56,7 @@ jobs:
       # On PRs, upload as PR coverage for the report job
       - name: Upload PR coverage
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: coverage-pr
           path: coverage/
@@ -76,7 +76,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Download PR coverage
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: coverage-pr
           path: coverage/

From 7929d75a893713e79e6a8aa5a4734dc584448c6f Mon Sep 17 00:00:00 2001
From: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Date: Tue, 20 Jan 2026 15:54:39 -0800
Subject: [PATCH 4/8] refactor(coverage): Integrate coverage into main CI and
 create reusable report workflow

- Add coverage job to lint-build-test.yml to collect coverage artifacts
- Create coverage-report.yml as reusable workflow for PR comments and GitHub Pages
- Call coverage-report from main.yml after lint-build-test
- Remove standalone coverage.yml (duplicate functionality)
- Coverage now collected as part of main CI instead of running tests twice

Coverage report will be available at:
https://metamask.github.io/ocap-kernel/coverage/

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../{coverage.yml => coverage-report.yml}     | 74 ++++---------------
 .github/workflows/lint-build-test.yml         | 28 +++++++
 .github/workflows/main.yml                    |  9 +++
 3 files changed, 50 insertions(+), 61 deletions(-)
 rename .github/workflows/{coverage.yml => coverage-report.yml} (52%)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage-report.yml
similarity index 52%
rename from .github/workflows/coverage.yml
rename to .github/workflows/coverage-report.yml
index 4670fd853..0166b7160 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage-report.yml
@@ -1,96 +1,47 @@
 name: Coverage Report
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-concurrency:
-  group: coverage-${{ github.ref }}
-  cancel-in-progress: true
+  workflow_call:
 
 jobs:
-  # Runs on both push to main and PRs
-  coverage:
-    name: Coverage
+  report:
+    name: Report
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Setup environment
-        uses: MetaMask/action-checkout-and-setup@v2
-        with:
-          is-high-risk-environment: false
-          node-version: 24.x
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-
-      - name: Build
-        run: yarn build
-
-      - name: Run tests with coverage
-        run: yarn vitest run --coverage
-
-      # On push to main, upload as the baseline for future PRs
-      - name: Upload baseline coverage
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v6
+      - name: Download coverage artifact
+        uses: actions/download-artifact@v7
         with:
-          name: coverage-baseline
+          name: coverage
           path: coverage/
-          retention-days: 90
 
       # On push to main, deploy HTML coverage report to GitHub Pages
       - name: Deploy coverage to GitHub Pages
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
+        uses: peaceiris/actions-gh-pages@v4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./coverage
           destination_dir: coverage
 
-      # On PRs, upload as PR coverage for the report job
-      - name: Upload PR coverage
-        if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v6
-        with:
-          name: coverage-pr
-          path: coverage/
-          retention-days: 7
-
-  # Only runs on PRs to generate the comparison report
-  report:
-    name: Report
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    needs: coverage
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Download PR coverage
-        uses: actions/download-artifact@v7
-        with:
-          name: coverage-pr
-          path: coverage/
-
+      # On PRs, download baseline and post comparison report
       - name: Download baseline coverage from main
+        if: github.event_name == 'pull_request'
         uses: actions/download-artifact@v7
         with:
           branch: main
-          name: coverage-baseline
+          name: coverage
           path: coverage-base/
           workflow_conclusion: success
           if_no_artifact_found: warn
 
       - name: Post coverage report
+        if: github.event_name == 'pull_request'
         uses: davelosert/vitest-coverage-report-action@5b6122e3a819a3be7b27fc961b7faafb3bf00e4d
         with:
           json-summary-path: coverage/coverage-summary.json
@@ -99,6 +50,7 @@ jobs:
           file-coverage-mode: changes
 
       - name: Post coverage report link
+        if: github.event_name == 'pull_request'
         uses: actions/github-script@v8
         with:
           script: |
diff --git a/.github/workflows/lint-build-test.yml b/.github/workflows/lint-build-test.yml
index 3a6224dce..f6c252190 100644
--- a/.github/workflows/lint-build-test.yml
+++ b/.github/workflows/lint-build-test.yml
@@ -142,6 +142,34 @@ jobs:
             exit 1
           fi
 
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    needs: prepare
+    steps:
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v2
+        with:
+          is-high-risk-environment: false
+          node-version: 24.x
+        env:
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+      - run: yarn build
+      - run: yarn vitest run --coverage
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: coverage
+          path: coverage/
+          retention-days: 90
+      - name: Require clean working directory
+        shell: bash
+        run: |
+          if ! git diff --exit-code; then
+            echo "Working tree dirty at end of job"
+            exit 1
+          fi
+
   e2e:
     name: E2E Tests
     runs-on: ubuntu-latest
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 0759a9864..cc4089d2a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -58,6 +58,15 @@ jobs:
     needs: check-workflows
     uses: ./.github/workflows/lint-build-test.yml
 
+  coverage-report:
+    name: Coverage report
+    needs: lint-build-test
+    if: github.event_name != 'merge_group'
+    uses: ./.github/workflows/coverage-report.yml
+    permissions:
+      contents: write
+      pull-requests: write
+
   is-release:
     name: Determine whether this is a release merge commit
     needs: lint-build-test

From d8d4e03a03a3fa170c8a06ab6d6fe310be220a9d Mon Sep 17 00:00:00 2001
From: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Date: Tue, 20 Jan 2026 16:54:51 -0800
Subject: [PATCH 5/8] refactor(coverage): Fetch baseline from GitHub Pages
 instead of cache

- Remove cache save/restore steps from workflows
- Fetch baseline coverage-summary.json from gh-pages URL on PRs
- Reduce artifact retention to 7 days (only needed within workflow run)
- Simplifies to only official GitHub actions, no third-party dependencies
- Gracefully handles first run when baseline doesn't exist yet

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/coverage-report.yml | 15 ++++++---------
 .github/workflows/lint-build-test.yml |  2 +-
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/coverage-report.yml b/.github/workflows/coverage-report.yml
index 0166b7160..b5163d917 100644
--- a/.github/workflows/coverage-report.yml
+++ b/.github/workflows/coverage-report.yml
@@ -29,16 +29,13 @@ jobs:
           publish_dir: ./coverage
           destination_dir: coverage
 
-      # On PRs, download baseline and post comparison report
-      - name: Download baseline coverage from main
+      # On PRs, fetch baseline coverage from GitHub Pages
+      - name: Fetch baseline coverage from GitHub Pages
         if: github.event_name == 'pull_request'
-        uses: actions/download-artifact@v7
-        with:
-          branch: main
-          name: coverage
-          path: coverage-base/
-          workflow_conclusion: success
-          if_no_artifact_found: warn
+        run: |
+          mkdir -p coverage-base
+          curl -fsSL https://metamask.github.io/ocap-kernel/coverage/coverage-summary.json \
+            -o coverage-base/coverage-summary.json || echo "No baseline coverage found" && exit 1
 
       - name: Post coverage report
         if: github.event_name == 'pull_request'
diff --git a/.github/workflows/lint-build-test.yml b/.github/workflows/lint-build-test.yml
index f6c252190..5e764db57 100644
--- a/.github/workflows/lint-build-test.yml
+++ b/.github/workflows/lint-build-test.yml
@@ -161,7 +161,7 @@ jobs:
         with:
           name: coverage
           path: coverage/
-          retention-days: 90
+          retention-days: 7
       - name: Require clean working directory
         shell: bash
         run: |

From 64e9d10c930761f85d376d0b13c614dbcdb019ea Mon Sep 17 00:00:00 2001
From: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Date: Tue, 20 Jan 2026 17:00:15 -0800
Subject: [PATCH 6/8] fix: Update peaceiris action release tag

---
 .github/workflows/coverage-report.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverage-report.yml b/.github/workflows/coverage-report.yml
index b5163d917..9391d5a5e 100644
--- a/.github/workflows/coverage-report.yml
+++ b/.github/workflows/coverage-report.yml
@@ -23,7 +23,7 @@ jobs:
       # On push to main, deploy HTML coverage report to GitHub Pages
       - name: Deploy coverage to GitHub Pages
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: peaceiris/actions-gh-pages@v4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./coverage

From 206b77acb340556b3b0d8a4061ced5df3e838c84 Mon Sep 17 00:00:00 2001
From: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Date: Tue, 20 Jan 2026 17:14:29 -0800
Subject: [PATCH 7/8] refactor: Collect coverage in test job

---
 .github/workflows/lint-build-test.yml | 37 ++++++---------------------
 package.json                          |  1 -
 2 files changed, 8 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/lint-build-test.yml b/.github/workflows/lint-build-test.yml
index 5e764db57..a284413a3 100644
--- a/.github/workflows/lint-build-test.yml
+++ b/.github/workflows/lint-build-test.yml
@@ -108,7 +108,14 @@ jobs:
         env:
           PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
       - run: yarn build
-      - run: yarn test:ci
+      - run: "yarn test --coverage=${{ matrix.node-version == '24.x' && 'true' || 'false' }}"
+      - name: Upload coverage artifact
+        if: ${{ matrix.node-version == '24.x' }}
+        uses: actions/upload-artifact@v6
+        with:
+          name: coverage
+          path: coverage/
+          retention-days: 7
       - name: Require clean working directory
         shell: bash
         run: |
@@ -142,34 +149,6 @@ jobs:
             exit 1
           fi
 
-  coverage:
-    name: Coverage
-    runs-on: ubuntu-latest
-    needs: prepare
-    steps:
-      - name: Checkout and setup environment
-        uses: MetaMask/action-checkout-and-setup@v2
-        with:
-          is-high-risk-environment: false
-          node-version: 24.x
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-      - run: yarn build
-      - run: yarn vitest run --coverage
-      - name: Upload coverage artifact
-        uses: actions/upload-artifact@v6
-        with:
-          name: coverage
-          path: coverage/
-          retention-days: 7
-      - name: Require clean working directory
-        shell: bash
-        run: |
-          if ! git diff --exit-code; then
-            echo "Working tree dirty at end of job"
-            exit 1
-          fi
-
   e2e:
     name: E2E Tests
     runs-on: ubuntu-latest
diff --git a/package.json b/package.json
index f59004eba..54051f466 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,6 @@
     "prepack": "./scripts/prepack.sh",
     "rebuild:native": "./scripts/rebuild-native.sh",
     "test": "vitest run",
-    "test:ci": "vitest run --coverage false",
     "test:dev": "turbo run test:dev",
     "test:dev:quiet": "turbo run test:dev:quiet --output-logs=errors-only",
     "test:e2e": "yarn workspaces foreach --all run test:e2e",

From 3f9517a777dd2337edc6b6631870c116c060a0d1 Mon Sep 17 00:00:00 2001
From: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Date: Tue, 20 Jan 2026 17:31:31 -0800
Subject: [PATCH 8/8] refactor: Address review feedback

---
 .github/workflows/coverage-report.yml | 28 +++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/coverage-report.yml b/.github/workflows/coverage-report.yml
index 9391d5a5e..4b8073f79 100644
--- a/.github/workflows/coverage-report.yml
+++ b/.github/workflows/coverage-report.yml
@@ -35,7 +35,7 @@ jobs:
         run: |
           mkdir -p coverage-base
           curl -fsSL https://metamask.github.io/ocap-kernel/coverage/coverage-summary.json \
-            -o coverage-base/coverage-summary.json || echo "No baseline coverage found" && exit 1
+            -o coverage-base/coverage-summary.json || { echo "No baseline coverage found"; exit 1; }
 
       - name: Post coverage report
         if: github.event_name == 'pull_request'
@@ -51,9 +51,29 @@ jobs:
         uses: actions/github-script@v8
         with:
           script: |
-            github.rest.issues.createComment({
+            const marker = '<!-- coverage-report-link -->';
+            const body = `${marker}\n📊 [View full HTML coverage report for \`main\`](https://metamask.github.io/ocap-kernel/coverage/)`;
+
+            const { data: comments } = await github.rest.issues.listComments({
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: '📊 [View full HTML coverage report for `main`](https://metamask.github.io/ocap-kernel/coverage/)'
-            })
+            });
+
+            const existing = comments.find(c => c.body?.includes(marker));
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                comment_id: existing.id,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body,
+              });
+            }