[Coverage Report] Test Coverage Report — 2026-08-27

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-27

Overall Coverage

Metric	Value	Status
Statements	92.6% (11,065 / 11,948)	✅ Excellent
Branches	85.99% (6,136 / 7,135)	✅ Good
Functions	93.16% (1,526 / 1,638)	✅ Excellent
Lines	93.76% (10,594 / 11,299)	✅ Excellent

The codebase maintains strong overall coverage across all metrics, exceeding the 80% security threshold. The most conservative metric is branch coverage at 85.99%, indicating most conditional logic paths have test coverage.

---

🛡️ Security-Critical Path Status

The following security-critical modules directly control network isolation, domain filtering, and container orchestration:

File	Statements	Branches	Functions	Status
src/host-iptables.ts	100%	100%	100%	✅ Complete
src/squid-config.ts	100%	100%	100%	✅ Complete
src/docker-manager.ts	100%	100%	100%	✅ Complete
src/domain-patterns.ts	100%	89.47%	100%	⚠️ Minor gap
src/cli.ts	85.71%	50%	100%	⚠️ Moderate gap

Assessment: Three critical firewall modules (host-iptables, squid-config, docker-manager) have 100% coverage—ideal for security-critical code. Two modules show moderate coverage gaps:

• domain-patterns.ts: 89.47% branch coverage indicates a few edge cases in domain matching logic are untested
• cli.ts: 50% branch coverage suggests error handling or fallback paths lack test coverage (only 7 lines, small file)

---

📋 Coverage Table

Security-Critical & Core Modules

• ✅ host-iptables.ts — Network isolation rules: 100%
• ✅ squid-config.ts — HTTP/HTTPS domain filtering: 100%
• ✅ docker-manager.ts — Container lifecycle management: 100%
• ⚠️ domain-patterns.ts — Domain regex matching: 89.47% branches
• ⚠️ cli.ts — Main entry point: 50% branches

New/Emerging Modules with Low Coverage

• 🔴 src/bounded-execution/finite-disclosure.ts — Enclave protocol (CRITICAL): 9.26% stmts, 0.26% branches
• 🟡 src/enclave/runtime-preflight.ts — Enclave validation: 66.66% stmts
• 🟡 src/microvm/rootfs.ts — Cloud Hypervisor rootfs: 71.69% stmts
• 🟡 src/commands/validators/config-assembly.ts — Config validation: 73.68% stmts

Baseline Coverage

• src/ (aggregate): 97.46% statements, 92.69% branches
• Full codebase: 92.6% statements, 85.99% branches

---

🔧 Function Audit

Across 1,638 functions in the codebase, 1,526 are covered (93.16%).

Uncovered functions (112 total):

• Most are in new/experimental modules (bounded-execution/, enclave/, microvm/, cloud-hypervisor/)
• Fallback/error handling paths in main modules
• Test utilities and mock factories (intentionally lower coverage)

Key observation: All critical production functions in host-iptables.ts, squid-config.ts, and docker-manager.ts are covered. Uncovered functions are predominantly in new features (enclaves, microVM) or utilities.

---

📅 Recent Source Changes (last 7 days)

• 9cf8160 (most recent): docs: document run-id forwarding to api-proxy sidecar (#7570)
  • Documentation update, no core changes detected to security-critical modules
  • No coverage regressions expected

Note: No breaking changes detected in security-critical modules in the last 7 days.

---

🔎 Notable Findings

1. 🔴 CRITICAL GAP: finite-disclosure.ts — 9.26% statement coverage

   • This enclave protocol module implements critical request/response validation with no test coverage
   • Despite low coverage, the module includes built-in parsing safeguards (no JSON.parse, bounded recursion)
   • Risk: Protocol bugs could affect enclave security
   • Recommendation: Add dedicated test suite for schema parsing, validation, and cardinality calculation

2. ⚠️ NEW FEATURE GAPS: Enclave & Cloud Hypervisor modules

   • runtime-preflight.ts (66.66%), rootfs.ts (71.69%), config-assembly.ts (73.68%)
   • These are recent additions for enclaves and cloud-hypervisor backend
   • Coverage is below 80% but above the critical 50% threshold
   • These modules are not yet in full production (preview/experimental status)

3. ✅ FIREWALL CORE IS SOLID

   • All three foundational security modules (host-iptables, squid-config, docker-manager) achieve 100% coverage
   • This is exceptional for security-critical code
   • No regression detected since last release

4. i️ BRANCH COVERAGE VARIANCE

   • Overall branch coverage (85.99%) is 6.6 percentage points lower than statement coverage (92.6%)
   • This is normal and indicates some complex conditional logic (if/switch/ternary operators) has incomplete path testing
   • domain-patterns.ts exhibits this pattern (100% statements, 89.47% branches)

---

🎯 Recommendations

🔴 HIGH Priority (Security-Critical)

1. Add test suite for bounded-execution/finite-disclosure.ts

   • Why: 9.26% coverage is critically low for a security-critical protocol handler
   • Action: Create src/bounded-execution/finite-disclosure.test.ts with tests for:
     • Schema parsing (const, boolean, enum, integer, object, tuple, array, union)
     • Cardinality calculation (confirm BigInt never overflows)
     • Result envelope validation ({"status":"ok"/"error", "result":...})
     • Error handling for oversized/deeply nested schemas
     • Vector testing against matching containers/bounded-execution/finite-disclosure.js
   • Effort: High (complex protocol, requires deep understanding)
   • Impact: Eliminates critical gap; enables safe enclave feature rollout

2. Increase domain-patterns.ts branch coverage from 89.47% to 100%

   • Why: Domain filtering is security-critical; 2 branches untested is unacceptable
   • Action: Identify and test the missing branch paths (likely regex edge cases or fallback logic)
   • Effort: Low (add 2–3 test cases)
   • Impact: Complete coverage of domain matching logic

🟡 MEDIUM Priority (Feature Stability)

3. Lift enclave/microVM module coverage above 80%
   • Why: These new features (enclaves, cloud-hypervisor) are moving toward general availability
   • Action: Prioritize tests for:
     • src/enclave/runtime-preflight.ts (from 66.66% → 80%+)
     • src/microvm/rootfs.ts (from 71.69% → 80%+)
     • src/commands/validators/config-assembly.ts (from 73.68% → 80%+)
   • Effort: Medium (new code, requires integration test infrastructure)
   • Impact: Prevents regressions as enclave feature stabilizes; enables confident beta release

🟢 LOW Priority (Maintainability)

4. Document untested code paths in CLI branch coverage
   • Why: cli.ts has 50% branch coverage (1/2 branches), likely a minor fallback path
   • Action: Review the uncovered branch in cli.ts and add a test or document why it's not covered
   • Effort: Low (2–3 lines of code)
   • Impact: Improves code clarity; may reveal edge case bugs

---

📌 Conclusion

Overall Status: HEALTHY ✅

The gh-aw-firewall codebase maintains strong baseline coverage with all three core security modules at 100% coverage. The primary gap is finite-disclosure.ts (the enclave protocol module), which requires urgent attention before enclave features reach production. Emerging modules (enclave validation, cloud-hypervisor) need coverage lift before general availability but are acceptable for current preview status. No regression detected; coverage remains stable and well-above industry baseline (80%).

Generated by Test Coverage Reporter · copilot · sum00 · 24.9 AIC · ⊞ 5.4K · ◷

• expires on Sep 3, 2026, 6:57 PM UTC