chore: migrate coverage reporting from Codecov to Aikido

.dockerignore

@@ -9,7 +9,6 @@
 .git/
 .gitignore
 .github/
-codecov.yml
 .sourcery.yml
 .claude/
 

.github/agents/Backend_Dev.agent.md

@@ -63,8 +63,8 @@ Your priority is writing code that is clean, tested, and secure by default.
     - **Local Patch Coverage Preflight (MANDATORY)**: Run VS Code task `Test: Local Patch Report` or `bash scripts/local-patch-report.sh` before backend coverage runs.
         - Ensure artifacts exist: `test-results/local-patch-report.md` and `test-results/local-patch-report.json`.
         - Use the file-level coverage gap list to target tests before final coverage validation.
-    - **Coverage (MANDATORY)**: Run the coverage task/script explicitly and confirm Codecov Patch view is green for modified lines.
-        - **MANDATORY**: Patch coverage must cover 100% of new/modified code. This prevents CodeCov Report failing CI.
+    - **Coverage (MANDATORY)**: Run the coverage task/script explicitly and confirm modified lines are covered (`bash scripts/local-patch-report.sh`).
+        - **MANDATORY**: Patch coverage must cover 100% of new/modified code. This prevents patch-coverage regressions.
         - **VS Code Task**: Use "Test: Backend with Coverage" (recommended)
         - **Manual Script**: Execute `/projects/Charon/scripts/go-test-coverage.sh` from the root directory
         - **Minimum**: 85% coverage (configured via `CHARON_MIN_COVERAGE` or `CPM_MIN_COVERAGE`)

.github/instructions/ARCHITECTURE.instructions.md

@@ -276,7 +276,6 @@ graph TB
 ├── go.work                     # Go workspace definition
 ├── package.json                # Frontend dependencies
 ├── playwright.config.js        # E2E test configuration
-├── codecov.yml                 # Code coverage settings
 ├── README.md                   # Project overview
 ├── CONTRIBUTING.md             # Contribution guidelines
 ├── CHANGELOG.md                # Version history
@@ -1118,7 +1117,7 @@ go test ./integration/...
 2. **Test:** Go tests, Vitest, Playwright
 3. **Security:** Trivy, CodeQL, Grype, Govulncheck
 4. **Build:** Docker image build
-5. **Coverage:** Upload to Codecov (85% gate)
+5. **Coverage:** Upload to Aikido (85% gate enforced by the coverage scripts)
 6. **Supply Chain:** SBOM generation, Cosign signing
 
 ---
@@ -1399,7 +1398,7 @@ All agents (`Planning`, `Backend_Dev`, `Frontend_Dev`, `DevOps`) must reference
 **Tools:**
 
 - SonarQube: Code quality and technical debt
-- Codecov: Coverage tracking and trend analysis
+- Aikido: Security findings and code coverage reporting
 - Grafana: Runtime metrics and performance
 - GitHub Insights: Contributor activity and velocity
 

.github/instructions/copilot-instructions.md

@@ -120,7 +120,7 @@ Before proposing ANY code change or fix, you must build a mental map of the feat
 - **Sync**: React Query expects the exact JSON produced by GORM tags (snake_case). Keep API and UI field names aligned.
 - **Migrations**: When adding models, update `internal/models` AND `internal/api/routes/routes.go` (AutoMigrate).
 - **Testing**: All new code MUST include accompanying unit tests.
-- **Ignore Files**: Always check `.gitignore`, `.dockerignore`, and `.codecov.yml` when adding new file or folders.
+- **Ignore Files**: Always check `.gitignore` and `.dockerignore` when adding new file or folders.
 
 ## Documentation
 
@@ -222,7 +222,7 @@ Before marking an implementation task as complete, perform the following in orde
 
 6. **Coverage Testing** (MANDATORY - Non-negotiable):
     - **Overall Coverage**: Minimum 85% coverage is MANDATORY and will fail the PR if not met.
-    - **Patch Coverage**: Codecov's `patch` status (Codecov Patch view) is a mandatory, merge-blocking gate (`codecov.yml`, `coverage.status.patch.default`, target aligned with the project coverage target / `CHARON_MIN_COVERAGE`), not a suggestion. If patch coverage is incomplete, add targeted tests covering the uncovered changed lines before the PR can merge.
+    - **Patch Coverage**: Changed lines must be covered by tests (check locally with `bash scripts/local-patch-report.sh`); the project gate (`CHARON_MIN_COVERAGE`) is enforced by the coverage scripts, and reports go to Aikido, not a suggestion. If patch coverage is incomplete, add targeted tests covering the uncovered changed lines before the PR can merge.
     - **Backend Changes**: Run the VS Code task "Test: Backend with Coverage" or execute `scripts/go-test-coverage.sh`.
         - Minimum coverage: 85% (set via `CHARON_MIN_COVERAGE` or `CPM_MIN_COVERAGE`).
         - If coverage drops below threshold, write additional tests to restore coverage.

.github/instructions/testing.instructions.md

@@ -156,7 +156,7 @@ Before pushing code, verify E2E coverage:
    # View HTML report
    open coverage/e2e/index.html
 
-   # Check LCOV file exists for Codecov
+   # Check LCOV file exists for the coverage upload
    ls -la coverage/e2e/lcov.info
    ```
 
@@ -185,7 +185,7 @@ Before pushing code, verify E2E coverage:
 ## 3. Coverage & Completion
 * **Coverage Gate:** A task is not "Complete" until a coverage report is generated.
 * **Threshold Compliance:** You must compare the final coverage percentage against the project's threshold (Default: 85% unless specified otherwise). If coverage drops, you must identify the "uncovered lines" and add targeted tests.
-* **Patch Coverage (Mandatory Gate):** Codecov's `patch` status is a mandatory, merge-blocking gate (`codecov.yml`, `coverage.status.patch.default`, target aligned with the project coverage target / `CHARON_MIN_COVERAGE`) — not a suggestion. Every changed/added line in a PR's diff must meet the patch coverage target before the PR can merge, consistent with the rest of the Definition of Done. If patch coverage is below target, add targeted tests covering the uncovered changed lines before completing the task.
+* **Patch Coverage (Mandatory Gate):** Changed/added lines in a PR's diff must be covered by tests (check locally with `bash scripts/local-patch-report.sh`); the project coverage gate (`CHARON_MIN_COVERAGE`) is enforced in CI by the coverage scripts, and coverage reports are uploaded to Aikido for its PR checks — not a suggestion. If patch coverage is below target, add targeted tests covering the uncovered changed lines before completing the task.
 * **Review Patch Coverage:** When reviewing patch coverage reports, first attempt a real, targeted test for every uncovered line. Only treat a line as an acceptable exception (e.g., a branch proven structurally unreachable via any real caller) if you can document the specific reachability proof in a comment at that line — do not wave off uncovered lines as "acceptable" without that documented justification, and do not add contrived tests that don't reflect real reachable states just to inflate the number.
 
 ## 4. GORM Security Validation (Manual Stage)

.github/renovate.json

@@ -181,9 +181,9 @@
     },
     {
       "customType": "regex",
-      "description": "Track gotestsum version in codecov workflow",
+      "description": "Track gotestsum version in coverage workflow",
       "managerFilePatterns": [
-        "/^\\.github/workflows/codecov-upload\\.yml$/"
+        "/^\\.github/workflows/aikido-coverage\\.yml$/"
       ],
       "matchStrings": [
         "gotestsum@v(?<currentValue>[^\\s]+)"
@@ -192,6 +192,19 @@
       "datasourceTemplate": "go",
       "versioningTemplate": "semver"
     },
+    {
+      "customType": "regex",
+      "description": "Track gcov2lcov version in coverage workflow",
+      "managerFilePatterns": [
+        "/^\\.github/workflows/aikido-coverage\\.yml$/"
+      ],
+      "matchStrings": [
+        "gcov2lcov@v(?<currentValue>[^\\s]+)"
+      ],
+      "depNameTemplate": "github.com/jandelgado/gcov2lcov",
+      "datasourceTemplate": "go",
+      "versioningTemplate": "semver"
+    },
     {
       "customType": "regex",
       "description": "Track gotestsum version in quality checks workflow",