[Coverage Report] Test Coverage Report — 2026-08-27

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-27

Overall Coverage

Metric	Value	Status
Statements	92.65%	✅ Strong
Lines	93.83%	✅ Strong
Functions	93.14%	✅ Strong
Branches	86.04%	⚠️ Good

The firewall maintains 92.65% statement coverage and 86.04% branch coverage across 240+ source files, demonstrating comprehensive test coverage for a security-critical codebase. All metrics exceed industry best practices (80%).

🛡️ Security-Critical Path Status

Core network isolation and domain filtering modules show excellent coverage:

Component	Statements	Branches	Status
host-iptables bundle	100%	100%	✅ Complete
• host-iptables-rules.ts	100%	100%	✅ Full
• host-iptables-shared.ts	100%	100%	✅ Full
• host-iptables-chain.ts	100%	100%	✅ Full
• host-iptables-cleanup.ts	100%	100%	✅ Full
• host-iptables-validation.ts	100%	100%	✅ Full
squid-config bundle	100%	100%	✅ Complete
• squid/acl-generator.ts	100%	100%	✅ Full
• squid/access-rules.ts	100%	100%	✅ Full
• squid/config-sections.ts	100%	100%	✅ Full
domain-patterns.ts	100%	89.47%	✅ Strong
domain-validation.ts	100%	100%	✅ Full
docker-manager.ts	100%	N/A	✅ Full
cli.ts	85.71%	50%	⚠️ Partial

Verdict: Network isolation (iptables) and HTTP ACL filtering (Squid) are 100% covered. Entry point has minimal but identified gaps.

📋 Coverage Table

Excellent (>98%):

• Squid ACL configuration (config-generator, acl-generator, access-rules, config-sections)
• Host iptables rules and chain management
• Domain validation and pattern matching
• Logs audit and formatting pipeline
• Config file I/O and mapping
• Container lifecycle and startup diagnostics
• API proxy environment configuration

Good (95–98%):

• Compose file generation (98.6%)
• CLI workflow (98.63%)
• Container startup diagnostics (98.85%)
• Log discovery and aggregation (97.43%)
• Config writer (88.94%)
• Upstream proxy configuration (95.89%)
• Cloud Hypervisor API client (95.06%)

Acceptable (85–94%):

• cli.ts: 85.71% statements, 50% branches
• Domain matchers: 98.14% statements, 95% branches
• Option parsers: 97.5% statements, 94.44% branches

🔧 Function Audit

Total Functions: 1,550 / 1,664 covered (93.14%)

Category	Coverage	Notes
Security enforcement	100%	iptables, Squid ACL, domain validation fully tested
Container management	96%+	Lifecycle, volumes, services all well-covered
Logging & diagnostics	97%+	Audit, stats, discovery tested
CLI & options	97%+	Argument parsing, validation robust
Credential handling	100%	All API proxy credential env vars tested
Enclave runtime	76–90%	Emerging feature, lower coverage expected

Uncovered functions (114 / 1,664):

• Mostly in:
  • src/bounded-execution/finite-disclosure.ts: 4.54% (2/44 functions)
  • Cloud Hypervisor launcher: 64.28% (9/14 functions) – emerging backend
  • Enclave manager: 90.9% — nearly complete

📅 Recent Source Changes (last 7 days)

Based on coverage snapshot timestamp (2026-08-27):

• No source files modified since snapshot (pre-computed metrics)
• Codebase stable for coverage analysis

🔎 Notable Findings

1. [CRITICAL] Bounded Execution Gap: src/bounded-execution/finite-disclosure.ts shows 9.26% statement coverage and 0.26% branch coverage — this module handles information budget limits but is nearly untested. This is a new/preview feature (not used by default).

2. [MEDIUM] Config Assembly Gaps: src/commands/validators/config-assembly.ts at 73.68% statements and 25% branches — validator logic for multi-source config merging has conditional branches that aren't exercised in tests.

3. [MEDIUM] Enclave Runtime Preflight: src/enclave/runtime-preflight.ts at 66.66% statements and 41.02% branches — enclave health checks and readiness detection have uncovered paths (feature in rollout).

4. [LOW] MicroVM Rootfs: src/microvm/rootfs.ts at 72% statements and 54.54% branches — Cloud Hypervisor backend path setup has conditional branches for different configs.

🎯 Recommendations

🔴 High Priority

1. Close Bounded Execution Coverage Gap (statements: 9.26% → target 80%)

• Action: Add unit tests for src/bounded-execution/finite-disclosure.ts
• Scope: Information budget enforcement, token counting, and disclosure tracking
• Impact: Security feature for preventing information leakage from enclaves
• Estimate: ~15–20 test cases covering budget state machine and edge cases
• Owner: Security team (bounded-execution module owner)

2. Config Assembly Validator Branches (branches: 25% → target 85%)

• Action: Expand tests for src/commands/validators/config-assembly.ts
• Scope: Multi-source config precedence (CLI args, env vars, file) and conflict resolution
• Impact: Ensures AWF config is built correctly from all input sources
• Estimate: ~8–10 parametrized test cases
• Owner: Configuration subsystem maintainer

🟡 Medium Priority

3. Enclave Runtime Preflight Paths (statements: 66.66% → target 85%)

• Action: Test src/enclave/runtime-preflight.ts gateway readiness detection
• Scope: MCP gateway backend availability, enclave executor readiness probes
• Impact: Enclave rollout stability (currently in rollout phase)
• Estimate: ~10 test cases for various gateway states
• Owner: Enclave feature team

4. CLI Entry Point Branches (branches: 50% → target 80%)

• Action: Add error path tests for src/cli.ts
• Scope: Signal handling, process exit code propagation
• Impact: Correct error reporting to callers
• Estimate: ~4–6 edge-case tests
• Owner: CLI maintainer

🟢 Low Priority

5. MicroVM Rootfs Conditional Paths (branches: 54.54% → target 80%)

• Action: Add tests for different Cloud Hypervisor configurations
• Scope: Rootfs staging for different guest OS images and mount strategies
• Impact: Microvm backend robustness (preview feature, not GA)
• Estimate: ~8 parametrized cases
• Owner: Cloud Hypervisor backend maintainer

---

Summary: Overall test coverage is excellent (92.65% statements, 86.04% branches). Security-critical paths (iptables rules and Squid ACL) are 100% covered. Main gaps are in emerging features (bounded-execution, enclaves) and edge cases in config validation. No urgent coverage debt for GA features.

Generated by Test Coverage Reporter · copilot · sum00 · 19.7 AIC · ⊞ 5.4K · ◷

• expires on Sep 3, 2026, 9:19 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-03T21:19:23.438Z.

Closed by Workflow