feat(sova): observability foundation (logging, CI coverage, healthz, secrets scan)

[xsovad06]

Objective

Establish baseline observability: structured logging across critical paths, CI coverage reporting, a real healthz endpoint, and secrets scanning in pre-push/CI.

Findings

[P2] Only 14 logger calls across 277 source files

• Location: Entire sova/ package
• Issue: 0.05 log statements per file. LLM provider, adapters, and supervisor have zero logging. Production issues would be invisible.
• Recommendation: Add structured logging to LLM provider calls, adapter API calls, supervisor gate decisions, and agent lifecycle events. Target 100+ log statements.

[P2] No coverage reporting in CI pull requests

• Location: .github/workflows/ci.yml
• Issue: pytest tests/ -v runs without --cov. No coverage data, no gates, no trend tracking.
• Recommendation: Add --cov=sova --cov-report=term-missing --cov-report=xml. Upload XML to SonarCloud.

[P2] Healthz endpoint is a stub

• Location: sova/dashboard/app.py (/healthz)
• Issue: Returns {"status": "ok"} unconditionally without checking DB, disk, or scheduler.
• Recommendation: Add DB ping, disk free check, optional scheduler PID check. Return 503 on failure.

[P3] No secrets scanning in pre-push or CI

• Location: .githooks/pre-push, .github/workflows/ci.yml
• Issue: No scanning for accidentally committed secrets.
• Recommendation: Add gitleaks to pre-push hook and CI.

Files to Modify

• sova/llm/providers/claude_code.py
• sova/adapters/github.py
• sova/supervisor/progression.py
• sova/dashboard/app.py
• .github/workflows/ci.yml
• .githooks/pre-push

Estimated Effort

6 hours

Dependencies

None

---

Source: docs/HEALTH-AUDIT.md -- Health Audit 2026-08-12

Triage Assessment

Title: feat(sova): observability foundation (logging, CI coverage, healthz, secrets scan)
Has description: yes
Suitability: ready
Confidence: 85%
Complexity: complex
Missing context: none
Labels: type: infra, area: sova

Issue has structured sections indicating clear scope; ready for research.