[Coverage Report] Test Coverage Report — 2026-08-23

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-23

Overall Test Status: ✅ All 4,966 tests passed (315 suites) in 51.5s

Overall Coverage

Metric	Coverage	Status
Statements	92.56%	✅ Excellent
Branches	85.78%	✅ Good
Functions	92.88%	✅ Excellent
Lines	93.71%	✅ Excellent

Source Code Coverage (src/ directory):

• Statements: 97.48% | Branches: 92.55% | Functions: 97.64% | Lines: 97.83%

---

🛡️ Security-Critical Path Status

Good News: Core security functions are well-covered:

Module	Statements	Branches	Status
host-iptables.ts	100%	100%	✅ Fully Covered
squid-config.ts	100%	100%	✅ Fully Covered
domain-patterns.ts	100%	89.47%	✅ Well Covered
squid/ (all modules)	100%	100%	✅ Fully Covered
host-iptables-* (all variants)	100%	100%	✅ Fully Covered

Critical Gap Identified:

Module	Statements	Branches	Status
bounded-execution/finite-disclosure.ts	9.26%	0.26%	🚨 CRITICAL

The finite-disclosure.ts module (bounded execution framework) is almost entirely untested. This is concerning for security-sensitive code. Uncovered lines: 123–131, 201–390, 408–422, 443–459, 476–522, 540–546, 556–599, 613–640, 653–791, 800–805, 830–870, 878, 895–899.

---

📋 Coverage Table – Security-Sensitive & Borderline Files

File	Stmts	Branch	Funcs	Lines	Priority
bounded-execution/finite-disclosure.ts	9.26%	0.26%	4.54%	11.49%	🔴 CRITICAL
enclave/runtime-preflight.ts	66.66%	41.02%	100%	64.7%	🟠 HIGH
microvm/rootfs.ts	71.69%	54.54%	100%	72%	🟠 HIGH
cloud-hypervisor/virtiofsd.ts	72.51%	55.35%	100%	71.96%	🟠 MEDIUM
commands/validators/config-assembly.ts	73.68%	25%	100%	73.68%	🟠 MEDIUM
enclave/staging.ts	86.15%	67.44%	90.47%	87.2%	🟡 LOW
enclave/manager.ts	84.44%	75.29%	100%	85.49%	🟡 LOW
microvm/workspace.ts	89.05%	72.99%	97.05%	90.28%	🟡 LOW

---

🔧 Function Audit – High-Risk Uncovered Functions

1. finite-disclosure.ts (9.26% stmts)

• Risk: Bounded execution disclosure prevention — controls sensitive output filtering
• Uncovered: ~98% of code paths, including primary logic blocks (201–390, 653–791)
• Impact: Confidentiality risk; potential information leakage not validated

2. runtime-preflight.ts (66.66% stmts, 41% branch)

• Risk: Enclave runtime validation — verifies execution environment safety
• Uncovered: Lines 37, 46–57, 68–73, 79
• Impact: Edge case validation gaps; some environment checks may not be triggered

3. rootfs.ts (71.69% stmts, 54.5% branch)

• Risk: Microvm filesystem root setup — critical for container isolation
• Uncovered: Lines 33, 37, 52, 72–88, 101
• Impact: Edge cases in mount operations and error paths untested

4. virtiofsd.ts (72.51% stmts, 55.3% branch)

• Risk: Virtio filesystem daemon — inter-VM communication security
• Uncovered: Significant branch coverage gap (44.7% untested)
• Impact: Some traffic patterns or error scenarios not validated

---

📅 Recent Source Changes (last 7 days)

The workflow is executing in an isolated sandbox environment with restricted Git access. Recent commits cannot be enumerated from this context, but the test suite was executed against the current state of the repository at 2026-08-23T04:42:36Z.

Note: If recent changes were made to bounded-execution/, enclave/, or microvm/ modules, test coverage should be immediately reviewed and expanded.

---

🔎 Notable Findings

1. Excellent Core Security Coverage: host-iptables.ts and squid-config.ts (L7 HTTP filtering and network isolation) are fully covered at 100% statements and 100% branches. Domain pattern matching also has strong coverage (100% stmts, 89.47% branch).

2. Critical Gap in Bounded Execution: The finite-disclosure.ts module is nearly untested (9.26% statements, 0.26% branches). This code is responsible for preventing sensitive information disclosure in bounded execution contexts and requires immediate attention.

3. Enclave and MicroVM Coverage Lag: Modules in enclave/ and microvm/ (runtime-preflight, rootfs, virtiofsd) show moderate statement coverage (66–72%) but significantly lower branch coverage (41–55%), indicating edge cases and error paths are under-tested.

4. API Proxy Credentialing: Credential isolation modules (services/credentials/) are fully covered (100%), demonstrating strong test discipline for sensitive API key handling.

---

🎯 Recommendations

🔴 High Priority (Address within 1 sprint)

1. Expand bounded-execution/finite-disclosure.ts test coverage
   • Current: 9.26% statements, 0.26% branches
   • Target: ≥ 80% statements, ≥ 70% branches
   • Action: Add unit tests for disclosure prevention logic (lines 201–390, 653–791), error handling paths, and edge cases in output filtering. This code is security-critical for preventing credential leakage.
   • Effort: High (~3–4 days); involves mocking bounded execution environment and output channels.

🟠 Medium Priority (Address within 2 sprints)

2. Improve branch coverage in enclave/runtime-preflight.ts and microvm/rootfs.ts

   • Current: 41% and 54.5% branch coverage respectively
   • Target: ≥ 75% branches for both
   • Action: Add tests for conditional branches (environment validation, mount failure scenarios, race conditions). Prioritize error paths and edge cases.
   • Effort: Medium (~2 days per file)

3. Validate config-assembly.ts branch paths (25% branch coverage)

   • Current: 73.68% statements, 25% branches
   • Target: ≥ 90% statements, ≥ 70% branches
   • Action: Add tests for validation logic branches (lines 82–83, 86–90, 101–105). Review conditional paths in configuration assembly.
   • Effort: Medium (~1.5 days)

🟡 Low Priority (Backlog for continuous improvement)

4. Raise enclave and microvm workspace coverage toward 95%
   • Modules like staging.ts, manager.ts, and workspace.ts are already >84% statements; focus on branch coverage improvements for error handling and edge cases.

---

Summary

Test coverage is strong overall (92.56% statements, 93.71% lines). Security-critical network isolation and Squid filtering code is fully covered. However, a critical gap exists in bounded execution disclosure prevention (finite-disclosure.ts at 9.26%), which requires immediate investigation and test expansion. Enclave and microvm modules also show room for improvement in branch coverage (edge case handling).

No action needed if this report is for archival purposes. Immediate action recommended if active development continues on bounded execution or enclave features.

Generated by Test Coverage Reporter · sum00 · 19.5 AIC · ⊞ 5.4K · ◷

• expires on Aug 30, 2026, 4:45 AM UTC