[Coverage Report] Test Coverage Report — 2026-08-28

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-28

Overall Coverage

The firewall codebase maintains strong test coverage across all dimensions:

Metric	Coverage	Trend
Lines	93.85% (10,684/11,384)	✅ Excellent
Statements	92.67% (11,177/12,061)	✅ Excellent
Functions	93.19% (1,562/1,676)	✅ Excellent
Branches	86.07% (6,170/7,168)	⚠️ Good, room for improvement

Key Observation: Branch coverage (86.07%) is the weakest link. This indicates that while most code paths execute, some conditional branches remain untested—particularly error handling paths and edge cases.

🛡️ Security-Critical Path Status

All primary security-critical files have 100% coverage:

File	Lines	Statements	Branches	Status
host-iptables.ts	100%	100%	100%	✅ Complete
host-iptables-rules.ts	100%	100%	100%	✅ Complete
host-iptables-chain.ts	100%	100%	100%	✅ Complete
host-iptables-validation.ts	100%	100%	100%	✅ Complete
squid-config.ts	100%	100%	100%	✅ Complete
domain-patterns.ts	100%	100%	89.47%	✅ Strong

Verdict: Primary network firewall logic (iptables, Squid ACLs, domain matching) is fully tested and secure.

📋 Coverage Table

High Coverage (>90%)

• Container lifecycle management: 96.62% lines
• Squid config generation: 100%
• Host iptables setup: 100% (all variants)
• Domain pattern matching: 100% statements, 89.47% branches
• CLI workflow: 98.63% lines
• Container diagnostics: 98.8% lines
• Compose sanitizer: 97.05% lines

Medium Coverage (80-90%)

• Config writer: 88.94% lines, 82.4% branches
• Artifact preservation: 94.15% lines, 93.05% branches
• API proxy config: 96-100% across variants
• Cloud Hypervisor backend: 93.41% statements, 80.73% branches
• Capability filter: 94.73% statements, 91.17% branches

Coverage Gaps (<80%)

• 🔴 CRITICAL: src/bounded-execution/finite-disclosure.ts: 9.26% statements, 0.26% branches (374 lines, only 43 covered)
• 🟡 HIGH: src/enclave/runtime-preflight.ts: 66.66% statements, 41.02% branches
• 🟡 HIGH: src/commands/validators/config-assembly.ts: 73.68% statements, 25% branches
• 🟡 MEDIUM: src/microvm/rootfs.ts: 71.69% statements, 54.54% branches
• 🟡 MEDIUM: src/artifact-permissions.ts: 83.33% lines, 80% branches

🔧 Function Audit

• Total functions: 1,676
• Covered: 1,562 (93.19%)
• Uncovered: 114 functions

Uncovered function patterns:

1. Error handlers in optional features (enclaves, Cloud Hypervisor) that are exercised only in specific CI environments
2. Config validators for edge cases (malformed domain patterns, invalid microVM configs)
3. Preflight checks for enclave MCP gateway handoff (requires gateway service; not always running locally)

📅 Recent Source Changes (last 7 days)

1. Split Cloud Hypervisor manager lifecycle (Split Cloud Hypervisor manager lifecycle into focused modules #7796, refactor: split Cloud Hypervisor backend helpers #7797) — modularized manager into focused helpers; new modules inherited lower initial coverage
2. Add protected enclave entry diagnostics (Add protected enclave entry diagnostics #7772) — new diagnostic code for enclave startup
3. Add read-only GitHub CLI access (feat: add read-only GitHub CLI access to agent enclaves #7714) — enclave feature expansion
4. Fix enclave transcript bounds harness (test: fix enclave transcript bounds harness #7778) — test harness fix; transcript modules still emerging
5. Upgrade gh-aw prerelease workflows (chore: upgrade gh-aw prerelease workflows #7784) — CI/CD changes; no source coverage impact expected

Coverage Impact: Recent refactoring of Cloud Hypervisor and enclave modules introduced new code paths that are partially covered in integration tests but not fully exercised in unit tests.

🔎 Notable Findings

1. finite-disclosure.ts is untested (CRITICAL): 374-line module with 0.26% branch coverage. This module likely handles sensitive agent output filtering for bounded execution. Recommend prioritizing unit test coverage immediately.

2. Branch coverage lag: Despite 93% line coverage, only 86% of branches are covered. This gap suggests many conditional paths (error cases, fallbacks, edge conditions) are not explicitly tested.

3. Enclave modules emerging: Newer enclave and Cloud Hypervisor features added in the last 30 commits still need dedicated unit test harnesses. Currently relying on integration-level coverage.

4. Security-critical paths are solid: All primary network isolation logic (iptables, Squid, domain matching) maintains 100% coverage, which is the correct priority for this security-sensitive project.

🎯 Recommendations

High Priority ⚠️

1. Add unit tests for src/bounded-execution/finite-disclosure.ts (9.26% → target 80%+)

   • This module appears to handle sensitive output filtering and warrants dedicated test coverage
   • Add tests for filtering logic, edge cases (empty input, max disclosure, various content types)
   • Effort: Medium | Risk: CRITICAL if untested

2. Improve branch coverage for config validators (target 85% → 95%)

   • src/commands/validators/config-assembly.ts: 25% branches → add tests for malformed configs, missing fields, type mismatches
   • src/microvm/rootfs.ts: 54% branches → add tests for rootfs build failures, missing mount points
   • Effort: Medium | Risk: Medium (prevents bad configs from reaching production)

Medium Priority ⏱️

3. Add integration test harnesses for enclave modules
   • src/enclave/runtime-preflight.ts: Add preflight checks for MCP gateway availability, enclave executor fallback scenarios
   • Effort: Medium | Risk: Low (features are functional; coverage is the gap)
   • Note: Consider adding CI env vars to enable/disable enclave tests

Low Priority 📋

4. Target 90%+ branch coverage globally
   • Current 86.07% is good, but reaching 90% will catch additional error paths and edge cases
   • Focus on conditional branches in error handlers and fallback logic
   • Effort: Low | Risk: None

---

Last Updated: 2026-08-28 | Coverage Epoch: Local test run | Workflow: test-coverage-reporter

Generated by Test Coverage Reporter · copilot · sum00 · 18.7 AIC · ⊞ 5.4K · ◷

• expires on Sep 4, 2026, 4:18 AM UTC