What agents do with coverage output
An agent that receives free-form shell output will invent next steps. coverctl returns bounded JSON: passed, summary, domain rows, and on rejection a stable error_code plus remediation.
That boundary does two jobs:
- Actionability — the agent knows whether to write tests, lower ambition, or stop.
- Safety — dangerous runner flags (
--rootdir,--require, …) are rejected before they reach a toolchain.
Read the contract: Rejection schema and Threat model.