test: lift coverage 41% → 76% (+1068 tests across 36 files)

Service-level tests now exercise provider, permissions, project, journal,
messaging, work_session, metrics, kanban, extraction, learning, notification,
dashboard, llm_routing, a2a, task, repository_base, audit, db_seed,
branch_name, indexed_document, query_helpers, agent. API route tests cover
provider, journal, project, sessions, dashboard, work_session, tasks, a2a,
groups, notifications, agents, channels, messages, kanban, api_resources.
Pure-function helpers covered: handlers, deps_helpers, middleware,
middleware_docs, transcription, pr templates, agents_config, errors,
logging, journal/notification/channel/a2a access, task_lifecycle,
streaming, converters, crypto, schemas (common + websocket), events,
permissions extras.

pyproject ruff per-file-ignores extended for tests so PLR2004 (status code
magic values), PLC0415 (lazy imports), PLR0913 (fixture params), ARG001
(unused fixture deps), SIM105, and E501 don't fight test idioms.

tests/unit/services/test_extraction.py

@@ -129,14 +129,10 @@ async def test_extract_splits_on_double_newlines(
 @pytest.mark.asyncio
 async def test_extract_keeps_code_blocks_intact(svc: ExtractionService) -> None:
     content = (
-        "Some explanation.\n\n"
-        "```\nline1\nline2\nline3\n```\n\n"
-        "Some more explanation."
+        "Some explanation.\n\n```\nline1\nline2\nline3\n```\n\nSome more explanation."
     )
     result = await svc.extract(_ctx(content))
-    code_segments = [
-        m for m in result.messages if m.content.startswith("```")
-    ]
+    code_segments = [m for m in result.messages if m.content.startswith("```")]
     assert len(code_segments) >= 1
 
 

tests/unit/services/test_learning.py

@@ -43,9 +43,7 @@ class _StubOptimal:
         )
         return self.results
 
-    async def search_learnings(
-        self, *, query: str, top_k: int
-    ) -> list[SearchResult]:
+    async def search_learnings(self, *, query: str, top_k: int) -> list[SearchResult]:
         self.search_learnings_calls.append({"query": query, "top_k": top_k})
         return self.results
 
@@ -146,6 +144,7 @@ async def test_get_learnings_for_agent_returns_filtered_results(
 ) -> None:
     aid = uuid4()
     other_id = uuid4()
+
     def _r(metadata: dict, score: float = 0.7) -> SearchResult:
         return SearchResult(
             content="x",
@@ -171,7 +170,13 @@ async def test_get_learnings_for_agent_returns_filtered_results(
     team_other_role = _r({"scope": "team", "agent_role": "qa"})
     org_visible = _r({"scope": "org", "agent_role": "qa"}, score=0.5)
     stub = _StubOptimal(
-        results=[own_personal, other_personal, team_visible, team_other_role, org_visible]
+        results=[
+            own_personal,
+            other_personal,
+            team_visible,
+            team_other_role,
+            org_visible,
+        ]
     )
     await svc.initialize(stub)
     out = await svc.get_learnings_for_agent(aid, "developer")

tests/unit/services/test_permissions.py

@@ -310,12 +310,31 @@ def test_can_communicate_dev_to_qa_different_cells(
 
 def test_can_agent_write_channel_known(svc: PermissionService) -> None:
     """be-pm should be able to write to backend-cell."""
-    assert isinstance(
-        svc.can_agent_write_channel("be-pm", "backend-cell"), bool
-    )
+    assert isinstance(svc.can_agent_write_channel("be-pm", "backend-cell"), bool)
 
 
 def test_can_agent_write_channel_unknown_slug(svc: PermissionService) -> None:
     assert svc.can_agent_write_channel("ghost-agent", "any") is False
 
 
+def test_can_read_channel_for_main_pm_unknown_bypasses(
+    svc: PermissionService,
+) -> None:
+    """Main PM has bypass — unknown channel returns True (no DB lookup)."""
+    main_pm = _ctx(AgentRole.MAIN_PM)
+    assert svc.can_read_channel(main_pm, "ghost-channel") is True
+
+
+def test_can_write_channel_for_ceo_unknown_bypasses(
+    svc: PermissionService,
+) -> None:
+    """CEO has bypass — unknown channel returns True."""
+    ceo = _ctx(AgentRole.CEO)
+    assert svc.can_write_channel(ceo, "ghost-channel") is True
+
+
+def test_can_agent_write_channel_unknown_channel(
+    svc: PermissionService,
+) -> None:
+    """Unknown channel slug → False (no panic)."""
+    assert svc.can_agent_write_channel("be-dev-1", "ghost-channel") is False