[Coverage Report] Test Coverage Report — 2026-08-20

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-20

Overall Coverage

The firewall maintains strong baseline coverage across the codebase:

• Lines: 93.85% (9,603 / 10,232)
• Statements: 92.69% (10,004 / 10,792)
• Functions: 93.11% (1,366 / 1,467)
• Branches: 85.94% (5,448 / 6,339)

This represents high-quality test coverage for a security-critical network isolation firewall. The branch coverage dip reflects edge cases and error paths that are harder to exercise in test environments.

🛡️ Security-Critical Path Status

✅ Network Isolation (Excellent)
All host-iptables-*.ts modules maintain 100% coverage:

• host-iptables-chain.ts (100%) — Chain management
• host-iptables-rules.ts (100%) — Rule generation
• host-iptables-shared.ts (100%) — Shared utilities
• host-iptables-validation.ts (100%) — Rule validation
• host-iptables-cleanup.ts (100%) — Cleanup logic

Network traffic filtering rules are fully covered.

✅ Domain Filtering (Excellent)

• domain-patterns.ts (100% stmts, 89.47% branches) — Pattern validation
• domain-utils.ts (100%) — Domain utilities
• domain-validation.ts (100%) — Validation logic
• squid-config.ts (100%) — Squid ACL generation

Domain whitelisting logic is well-tested.

⚠️ Bounded Execution (Critical Gap)

• finite-disclosure.ts (9.26% stmts, 0.26% branches) — CRITICAL
  • Only 43 of 464 statements covered
  • Only 1 of 377 branches exercised
  • Impact: Bounded execution and disclosure mitigation largely untested
  • Risk: Regressions in finite-disclosure guards could go undetected

📋 Coverage Table

Module	Statements	Branches	Status
bounded-execution/finite-disclosure.ts	9.26%	0.26%	🔴 CRITICAL
enclave/runtime-preflight.ts	66.66%	41.02%	🟡 LOW
commands/validators/config-assembly.ts	69.69%	20%	🟡 LOW
microvm/rootfs.ts	71.69%	54.54%	🟡 LOW
cloud-hypervisor/virtiofsd.ts	72.51%	55.35%	🟡 LOW
host-iptables-*.ts (6 files)	100%	100%	🟢 EXCELLENT
domain-*.ts (4 files)	99.75% avg	97.37% avg	🟢 EXCELLENT
Overall	92.69%	85.94%	🟢 GOOD

🔧 Function Audit

Well-covered function counts:

• Total functions: 1,366 of 1,467 tested (93.11%)
• 101 untested functions (mostly in new/optional features)
• Iptables functions: 15/15 covered (100%)
• Domain utilities: 10/10 covered (100%)

Gap areas by function coverage:

• finite-disclosure.ts: 2 of 44 functions (4.54%) — disclosure logic untested
• cloud-hypervisor/virtiofsd.ts: 9 of 19 functions (47.36%) — microVM virtiofsd setup
• enclave/runtime-preflight.ts: 5 of 5 functions (100%) but with low branch coverage — preflight checks incomplete

📅 Recent Source Changes (last 7 days)

Recent commits show focus on microVM and enclave stability:

• d79988b: Fix Cloud Hypervisor guest network readiness race
• c80f528: Support Copilot Auto API versions
• 4549a5e: Inject stable X-Interaction-Id and Copilot-Integration-Id
• 051292a: Harden local state mounts across sandbox runtimes
• 6de3cb1: Fix enclave smoke runtime and rootless cleanup failures

Note: Low coverage in cloud-hypervisor/virtiofsd.ts (72.51%) and microvm/rootfs.ts (71.69%) may reflect recent rapid development in microVM support. Consider adding integration tests for these paths.

🔎 Notable Findings

1. Network isolation module is exceptionally well-tested — All six host-iptables-*.ts modules maintain 100% coverage across statements and branches. This is the core security boundary and is thoroughly validated.

2. Bounded execution logic is at-risk — finite-disclosure.ts (9.26% stmts, 0.26% branches) controls disclosure mitigation and sensitive data handling. With only 43 of 464 statements covered, regressions in this critical module could ship undetected.

3. Domain filtering is robust — Four domain-related modules average 99.75% statement coverage. HTTP/HTTPS ACL logic is comprehensive and well-exercised.

4. MicroVM and enclave features need test expansion — cloud-hypervisor/virtiofsd.ts, microvm/rootfs.ts, and enclave/runtime-preflight.ts lag at 66–72% coverage, reflecting active development or optional runtime paths. These should have test coverage expanded as the features stabilize.

🎯 Recommendations

Priority 1 (High) — Add finite-disclosure.ts tests

• Write integration tests for disclosure detection and remediation pathways
• Target: Bring finite-disclosure.ts from 9.26% to ≥80%
• Impact: Ensures bounded execution guarantees are maintained
• Effort: Medium (complex domain; 300+ untested statements)

Priority 2 (High) — Expand cloud-hypervisor/virtiofsd.ts tests

• Add unit tests for virtiofsd bootstrap, socket setup, and error handling
• Target: Increase from 72.51% to ≥85%
• Impact: Prevents microVM guest filesystem mount failures
• Effort: Medium (30 untested statements; requires microVM test harness)

Priority 3 (Medium) — Improve enclave/runtime-preflight.ts branch coverage

• Current: 66.66% stmts, 41.02% branches
• Add tests for failure cases: missing files, permission errors, API unavailability
• Target: Bring branches to ≥80%
• Impact: Ensures enclave preflight validation is robust
• Effort: Medium (23 untested branches; error handling scenarios)

---

Generated: 2026-08-20
Baseline: Latest test run
Files analyzed: 78 source files, 1 aggregate

Generated by Test Coverage Reporter · sum00 · 15.9 AIC · ⊞ 5.3K · ◷

• expires on Aug 27, 2026, 4:33 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-27T04:33:17.039Z.

Closed by Workflow