[Coverage Report] Test Coverage Report — 2026-08-21

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-21

Overall Coverage

Metric	Coverage
Statements	92.50%
Branches	85.73%
Functions	92.77%
Lines	93.65%

Summary: Overall coverage is excellent across all metrics. The project has strong test infrastructure with 10,297 of 11,131 statements covered.

---

🛡️ Security-Critical Path Status

The following critical security modules show excellent coverage:

• 🟢 host-iptables.ts (100%) - All network isolation rules covered
• 🟢 squid-config.ts (100%) - Domain ACL filtering fully tested
• 🟢 domain-patterns.ts (100%) - Domain validation logic complete
• 🟢 docker-manager.ts (100%) - Container orchestration tested
• 🟢 cli.ts (85.71%) - Main entry point well covered

Key Finding: All primary security-critical modules have 100% statement coverage, demonstrating mature test practices for network isolation and domain filtering.

---

📋 Coverage Table

Files below 80% coverage (security-critical or newly identified gaps):

File	Statements	Branches	Functions	Lines	Status
src/bounded-execution/finite-disclosure.ts	9.26%	0.26%	4.54%	11.49%	🔴 CRITICAL
src/enclave/runtime-preflight.ts	66.66%	41.02%	N/A	N/A	🟡 LOW
src/commands/validators/config-assembly.ts	69.69%	20%	N/A	N/A	🟡 LOW
src/microvm/rootfs.ts	71.69%	54.54%	N/A	N/A	🟡 LOW
src/cloud-hypervisor/virtiofsd.ts	72.51%	55.35%	47.36%	76.22%	🟡 LOW

---

🔧 Function Audit

Security-Critical Functions:

host-iptables modules (all 100% covered):

• host-iptables.ts → 3/3 functions covered
• host-iptables-rules.ts → 9/9 functions covered (97 statements, 36 branches)
• host-iptables-shared.ts → 15/15 functions covered (91 statements, 20 branches)
• host-iptables-validation.ts → 4/4 functions covered
• host-iptables-chain.ts → 3/3 functions covered
• host-iptables-cleanup.ts → 2/2 functions covered
• host-iptables-network.ts → 1/1 functions covered

squid-config module (100% covered):

• squid-config.ts → 2/2 functions covered

domain-patterns module (100% covered):

• domain-patterns.ts → 3/3 functions covered
• domain-matchers.ts → 4/4 functions covered (98.14% lines)
• domain-utils.ts → 10/10 functions covered (100%)
• domain-validation.ts → 5/5 functions covered (100%)

Test infrastructure: 40+ test files providing comprehensive coverage across all subsystems.

---

📅 Recent Source Changes (last 7 days)

The repository shows active development in core networking and container orchestration areas:

• Network isolation (host-iptables-*.ts) - fully covered and maintained
• Squid configuration generation - 100% coverage
• Domain filtering logic - comprehensive test coverage
• New enclave runtime preflight checks - initial coverage at 66.66%
• Cloud Hypervisor backend integration - 94.24% statement coverage

---

🔎 Notable Findings

1. Exceptional Core Security Coverage: All primary security-critical modules (host-iptables-*.ts, squid-config.ts, domain-*.ts) achieve 100% statement coverage, indicating a mature testing culture for network isolation and domain filtering logic.

2. Critical Gap: bounded-execution/finite-disclosure.ts: This module has only 9.26% statement coverage and 0.26% branch coverage. With 464 total statements and just 43 covered, this represents a significant testing gap in disclosure boundary enforcement logic.

3. Emerging Features Under-Tested: New modules for enclave runtime preflight (66.66%), root filesystem configuration (71.69%), and virtiofsd daemon (72.51%) show moderate-to-low coverage, typical for recently-introduced features awaiting broader test suite maturity.

4. Branch Coverage Asymmetry: While statement coverage is strong across the board (92.5% overall), branch coverage shows weaker performance in newer modules (0.26–55.35%), suggesting conditional logic in these areas needs additional edge-case testing.

---

🎯 Recommendations

High Priority

1. Implement tests for bounded-execution/finite-disclosure.ts (currently 9.26%)
   • This module appears to handle sensitive disclosure boundary logic
   • Target: Achieve ≥70% statement coverage within one sprint
   • Focus: Test all conditional branches related to disclosure filtering and rate limiting
   • Why: Critical for security posture; low coverage suggests incomplete test harness

Medium Priority

2. Expand branch coverage for cloud-hypervisor/virtiofsd.ts and enclave modules
   • Current statement coverage (66–72%) is acceptable, but branch coverage (0–55%) lags
   • Target: Achieve ≥80% branch coverage for virtiofsd (131 statements, 56 branches)
   • Why: Microvisors and enclaves involve complex conditional logic; branch gaps indicate untested error paths and edge cases
   • Action: Add tests for daemon initialization failures, I/O errors, and protocol edge cases

Low Priority

3. Document and maintain security-critical module coverage at 100%
   • Current: All core modules (host-iptables, squid-config, domain-*) at 100%
   • Target: Keep this invariant across refactors via pre-commit hooks or CI gate
   • Why: Network isolation and filtering are attack surfaces; regression prevention is crucial
   • Action: Add a CI check that fails if any host-iptables-*.ts or squid-config*.ts coverage drops below 100%

---

Report Generated: 2026-08-21
Coverage Threshold Status: ✅ All thresholds passing (Statements: 92.5% ≥ 38%, Branches: 85.73% ≥ 30%, Functions: 92.77% ≥ 35%, Lines: 93.65% ≥ 38%)

Generated by Test Coverage Reporter · sum00 · 20.4 AIC · ⊞ 5.4K · ◷

• expires on Aug 28, 2026, 10:46 PM UTC