test: lift coverage 41% → 76% (+1068 tests across 36 files)

Service-level tests now exercise provider, permissions, project, journal,
messaging, work_session, metrics, kanban, extraction, learning, notification,
dashboard, llm_routing, a2a, task, repository_base, audit, db_seed,
branch_name, indexed_document, query_helpers, agent. API route tests cover
provider, journal, project, sessions, dashboard, work_session, tasks, a2a,
groups, notifications, agents, channels, messages, kanban, api_resources.
Pure-function helpers covered: handlers, deps_helpers, middleware,
middleware_docs, transcription, pr templates, agents_config, errors,
logging, journal/notification/channel/a2a access, task_lifecycle,
streaming, converters, crypto, schemas (common + websocket), events,
permissions extras.

pyproject ruff per-file-ignores extended for tests so PLR2004 (status code
magic values), PLC0415 (lazy imports), PLR0913 (fixture params), ARG001
(unused fixture deps), SIM105, and E501 don't fight test idioms.

tests/unit/test_logging.py

@@ -0,0 +1,73 @@
+"""logging.py coverage — secret redaction + processors."""
+
+from __future__ import annotations
+
+from roboco.logging import (
+    _redact_secrets,
+    add_app_context,
+    redact_event_dict,
+)
+
+
+def test_redact_secrets_passes_through_non_strings() -> None:
+    assert _redact_secrets(42) == 42
+    assert _redact_secrets(None) is None
+    assert _redact_secrets([1, 2]) == [1, 2]
+
+
+def test_redact_secrets_redacts_classic_pat() -> None:
+    out = _redact_secrets("token=ghp_abcdefghijklmnopqrstuvwxyz12345")
+    assert "ghp_" not in out
+    assert "<REDACTED>" in out
+
+
+def test_redact_secrets_redacts_fine_grained_pat() -> None:
+    out = _redact_secrets("token=github_pat_abcdefghijklmnopqrstuvwxyz12345")
+    assert "github_pat_" not in out
+    assert "<REDACTED>" in out
+
+
+def test_redact_secrets_redacts_server_token() -> None:
+    out = _redact_secrets("token=ghs_abcdefghijklmnopqrstuvwxyz12345")
+    assert "ghs_" not in out
+
+
+def test_redact_secrets_redacts_bearer_token() -> None:
+    out = _redact_secrets("Authorization: bearer abcdef123456789012345")
+    assert "<REDACTED>" in out
+
+
+def test_redact_secrets_redacts_user_pass_url() -> None:
+    out = _redact_secrets("https://user:supersecretpassword@github.com/x/y")
+    assert "supersecretpassword" not in out
+
+
+def test_redact_secrets_no_change_for_clean_string() -> None:
+    out = _redact_secrets("just a normal log message")
+    assert out == "just a normal log message"
+
+
+def test_add_app_context_injects_app_name() -> None:
+    event = {"event": "test"}
+    out = add_app_context(None, "info", event)
+    assert out["app"] == "roboco"
+    assert "version" in out
+    assert "environment" in out
+
+
+def test_redact_event_dict_redacts_values() -> None:
+    event = {
+        "event": "test",
+        "token": "ghp_abcdefghijklmnopqrstuvwxyz12345",
+        "safe": "ok",
+    }
+    out = redact_event_dict(None, "info", event)
+    assert "ghp_" not in out["token"]
+    assert out["safe"] == "ok"
+
+
+def test_redact_event_dict_preserves_non_string_values() -> None:
+    event = {"event": "test", "count": 42, "items": [1, 2, 3]}
+    out = redact_event_dict(None, "info", event)
+    assert out["count"] == 42
+    assert out["items"] == [1, 2, 3]