[Coverage Report] Test Coverage Report — 2026-08-20

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-20

Overall Coverage

Metric	Coverage	Details
Statements	92.64%	10,027/10,823 covered
Branches	85.85%	5,464/6,364 covered
Functions	93.12%	1,369/1,470 covered
Lines	93.79%	9,626/10,263 covered

Status: Project maintains strong coverage overall (>92% statements), but critical security gaps exist in new bounded-execution features.

---

🛡️ Security-Critical Path Status

Module	Statements	Branches	Functions	Status
finite-disclosure.ts	9.26% ⚠️	0.26% ⚠️	4.54% ⚠️	CRITICAL
runtime-preflight.ts	66.66%	41.02%	100%	⚠️ Low
config-assembly.ts	69.69%	20%	100%	⚠️ Low
rootfs.ts	71.69%	54.54%	100%	⚠️ Low
virtiofsd.ts	72.51%	55.35%	47.36%	⚠️ Low
domain-patterns.ts	100% ✅	89.47% ✅	100% ✅	Strong
domain-validation.ts	100% ✅	100% ✅	100% ✅	Strong
docker-manager.ts	100% ✅	100% ✅	100% ✅	Strong
squid-config.ts	100% ✅	100% ✅	100% ✅	Strong

Core firewall modules are well-tested. New bounded-execution and cloud-hypervisor paths have significant gaps.

---

📋 Coverage Table — Top 10 Lowest Coverage Files

File	Statements	Branches	Functions	Lines
bounded-execution/finite-disclosure.ts	9.26%	0.26%	4.54%	11.49%
commands/validators/config-assembly.ts	69.69%	20%	100%	69.69%
enclave/runtime-preflight.ts	66.66%	41.02%	100%	64.70%
microvm/rootfs.ts	71.69%	54.54%	100%	72%
cloud-hypervisor/virtiofsd.ts	72.51%	55.35%	47.36%	76.22%
cli.ts	85.71%	50%	100%	85.71%
host-env.ts	98.03%	85%	100%	97.95%
artifact-preservation.ts	94.21%	87.71%	100%	94.16%
config-writer.ts	90.78%	85.88%	100%	90.78%
cloud-hypervisor-runtime-backend.ts	94.49%	80%	87.80%	96.81%

---

🔧 Function Audit

Functions with 0% coverage:

• finite-disclosure.ts: 42 of 44 functions untested (95% gap in function count alone)
• virtiofsd.ts: 10 of 19 functions untested (function coverage: 47.36%)
• config-assembly.ts: Only 1 function defined; logic gaps suggest untested branches

Branch coverage gaps indicate:

• finite-disclosure.ts: 376/377 branches untested (only 1 branch exercised) — likely dead code paths
• config-assembly.ts: 8/10 branches untested (20% branch coverage) — validation paths missing
• runtime-preflight.ts: 23/39 branches untested (41% branch coverage) — error/edge cases uncovered

---

📅 Recent Source Changes (last 7 days)

Pre-computed data indicates these files were modified recently:

• src/bounded-execution/finite-disclosure.ts — new feature for bounded execution
• src/enclave/runtime-preflight.ts — new enclave validation paths
• src/cloud-hypervisor/virtiofsd.ts — cloud-hypervisor integration
• src/microvm/rootfs.ts — microVM filesystem setup

Observation: New features added without corresponding test coverage.

---

🔎 Notable Findings

1. Critical Gap: bounded-execution/finite-disclosure.ts at 9.26%

   • 464 statements with only 43 covered (421 untested)
   • Only 1 branch exercised out of 377 branches
   • Risk: This module (likely) enforces finite disclosure bounds for AI agents — untested security logic is high-risk.

2. Branch Coverage Regression in New Features

   • Five new files added (finite-disclosure, runtime-preflight, config-assembly, rootfs, virtiofsd)
   • All five have statement coverage <80%; four have branch coverage <60%
   • Enclave and cloud-hypervisor integration paths are largely untested.

3. Core Firewall Modules Remain Strong

   • All main domain ACL, docker, and config generation modules at 100% statement coverage
   • Existing network isolation and proxy configuration paths are well-tested

4. cli.ts Entry Point at 85.71%

   • Missing 1 line and 1 branch — likely an error path or shutdown signal handler
   • Recommend adding integration test for signal handling (SIGTERM, SIGINT)

---

🎯 Recommendations

🔴 HIGH PRIORITY

1. Test bounded-execution/finite-disclosure.ts to ≥80% statements
   • Impact: This module enforces agent sandbox bounds — untested code is a security liability
   • Effort: ~10–15 tests needed to cover the 421 untested statements
   • Action: Write unit tests for disclosure detection, bounds enforcement, and error paths
   • Deadline: Before merging any bounded-execution features to production

🟡 MEDIUM PRIORITY

2. Improve branch coverage in config-assembly.ts and runtime-preflight.ts

   • Impact: Validation paths and error handling are untested (branch coverage <45%)
   • Effort: ~5–8 tests per file to exercise edge cases and error conditions
   • Action: Add tests for invalid config inputs, missing fields, and runtime state transitions
   • Target: ≥75% branch coverage

3. Add signal handling tests to cli.ts

   • Impact: Missing 1 branch suggests graceful shutdown paths are untested
   • Effort: 1–2 integration tests using SIGTERM / SIGINT signals
   • Action: Test that containers are cleaned up and exit codes are propagated correctly

🟢 LOW PRIORITY

4. Monitor virtiofsd.ts and rootfs.ts as cloud-hypervisor stabilizes
   • Current: 72.51% and 71.69% statement coverage (below 80% threshold)
   • Plan: As cloud-hypervisor backend matures and is enabled in CI, these should naturally improve
   • Watch: Ensure new tests are written alongside new features; don't let coverage drift further

---

Report generated: 2026-08-20
Coverage tool: NYC (Istanbul)
Test framework: Jest

Generated by Test Coverage Reporter · sum00 · 29 AIC · ⊞ 5.4K · ◷

• expires on Aug 27, 2026, 6:45 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-27T18:45:50.146Z.

Closed by Workflow