[Coverage Report] Test Coverage Report — 2026-08-09

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-09

Overall Coverage

• Lines: 94.15% (7,468 / 7,932)
• Statements: 93.14% (7,780 / 8,353)
• Functions: 94.54% (1,006 / 1,064)
• Branches: 86.37% (4,203 / 4,866)

Status: Overall test coverage is healthy across most codebase (>90%). However, one critical security module has catastrophic coverage gaps that require immediate attention.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Status
src/host-iptables.ts	100%	0%	✅ Covered
src/host-iptables-rules.ts	100%	100%	✅ Excellent
src/domain-patterns.ts	100%	89.47%	✅ Good
src/domain-validation.ts	100%	100%	✅ Excellent
src/docker-manager.ts	100%	0%	✅ Covered
src/cli.ts	85.71%	50%	⚠️ Low

---

📋 Coverage Table

Files below 90% statement coverage:

File	Statements	Functions	Branches
src/bounded-execution/finite-disclosure.ts	9.26%	4.54%	0.26%
src/enclave/runtime-preflight.ts	66.66%	100%	41.02%
src/cli.ts	85.71%	100%	50%
src/artifact-preservation.ts	94.21%	100%	87.71%
src/host-env.ts	98.03%	100%	85%
src/option-parsers.ts	97.5%	100%	94.44%
src/enclave/staging.ts	86.15%	90.47%	67.44%
src/enclave/manager.ts	82.17%	100%	68.42%

---

🔧 Function Audit

High-value comprehensive tests:

• ✅ host-iptables-rules.ts: 9/9 functions covered (100%)
• ✅ host-iptables-shared.ts: 15/15 functions covered (100%)
• ✅ domain-validation.ts: 5/5 functions covered (100%)
• ✅ dns-resolver.ts: 9/9 functions covered (100%)
• ✅ config/network-policy.ts: 24/24 functions covered (100%)

Function coverage gaps:

• ⚠️ src/bounded-execution/finite-disclosure.ts: Only 2/44 functions covered (4.54%)
  • Impact: Bounded execution and disclosure control critically untested
• ⚠️ src/enclave/manager.ts: 13/13 functions called but 82.17% statement coverage
• ⚠️ src/enclave/staging.ts: 19/21 functions covered (90.47%)

---

📅 Recent Source Changes (last 7 days)

The codebase includes newly added security-critical modules:

• src/bounded-execution/finite-disclosure.ts — Newly introduced, covers bounded execution model and sensitive data disclosure restrictions
• src/enclave/runtime-preflight.ts — Enclave runtime validation and preflight checks
• src/enclave/staging.ts — Enclave container staging and initialization
• src/enclave/manager.ts — Enclave lifecycle management

All modules are essential for security guarantees but have inconsistent test coverage.

---

🔎 Notable Findings

1. 🚨 CRITICAL: finite-disclosure.ts has catastrophic test coverage (9.26% statements, 0.26% branches)

   • 374 lines of code with only 43 covered; only 1 branch path executed out of 377
   • This module handles sensitive data disclosure boundaries—untested paths create security risk
   • Affects: Bounded execution security model, credential isolation, data containment

2. ⚠️ HIGH: runtime-preflight.ts branch coverage is low (41.02%)

   • All 5 functions are called in tests, but only 67% of statement paths execute
   • Missing edge-case testing for enclave initialization, DNS validation, and fallback paths

3. ✅ GOOD: Core network isolation layers (host-iptables-*.ts) are fully tested (100%)

   • All 9 iptables rule generation functions have complete coverage
   • Network security baseline is solid

4. ✅ GOOD: Domain validation is fully tested

   • 100% coverage on both statements and branches
   • Domain ACL enforcement is reliable

---

🎯 Recommendations

🔴 HIGH PRIORITY

1. Add comprehensive test suite for src/bounded-execution/finite-disclosure.ts

• Effort: High (374 lines, 44 functions)
• Target: Reach 80%+ statement coverage, 70%+ branch coverage
• Why: This module controls sensitive data disclosure and credential isolation in bounded execution contexts. Untested code paths could leak secrets or allow container escape.
• Tests should cover:
  • All 44 function entry points and error paths
  • Disclosure boundary conditions (max disclosure rates, time windows)
  • Interaction with API proxy sidecar and credential injection
  • Fallback behavior when disclosure limits are exceeded

🟠 MEDIUM PRIORITY

2. Improve branch coverage for src/enclave/runtime-preflight.ts to 70%+

• Effort: Medium (34 lines, 39 branches)
• Target: Add tests for edge cases and error paths
• Why: Enclave initialization is part of security boundary; incomplete branch coverage suggests untested error conditions
• Tests should cover:
  • DNS server validation failures
  • Invalid config paths
  • Network connectivity checks
  • Preflight timeout and retry logic

3. Improve src/enclave/staging.ts coverage from 86.15% to 95%+

• Effort: Medium (125 lines)
• Target: Add tests for container staging edge cases
• Why: Enclave container setup is security-sensitive; staging errors could allow unintended network access
• Tests should cover:
  • Mount policy enforcement in staging
  • Network namespace initialization
  • Error recovery for failed staging

4. Improve src/cli.ts coverage from 85.71% to 95%+

• Effort: Low (7 lines total)
• Target: Add one additional test case covering the missing 14%
• Why: Entry point is frequently called; marginal effort for high visibility
• Tests should cover: Signal handling cleanup path or error recovery

🟡 LOW PRIORITY

5. Improve src/enclave/manager.ts branch coverage (currently 68.42%)

• Effort: Medium (125 lines)
• Target: Add tests for container lifecycle edge cases
• Why: While functions are called, only 68% of branches execute; missing error paths
• Tests should cover: Container startup timeouts, cleanup failures, state transitions

Generated by Test Coverage Reporter · sum00 · 17.4 AIC · ⊞ 5.1K · ◷

• expires on Aug 16, 2026, 6:43 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-16T18:43:34.353Z.

Closed by Workflow