[Coverage Report] Test Coverage Analysis - 2026-08-28

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-28

The project maintains strong baseline coverage (92.67% statements, 86.08% branches) with excellent security-critical path protection. However, a critical coverage gap has been identified in bounded-execution logic that requires immediate attention.

Overall Coverage

Metric	Coverage	Status
Lines	93.86% (10,758 / 11,461)	✅ Excellent
Statements	92.67% (11,254 / 12,144)	✅ Excellent
Functions	93.23% (1,571 / 1,685)	✅ Excellent
Branches	86.08% (6,218 / 7,223)	✅ Good

Assessment: Project exceeds 80% threshold across all metrics. Branch coverage could be improved (targeting 90%+).

🛡️ Security-Critical Path Status

All network isolation and domain filtering modules are fully tested:

Module	Coverage	Lines Tested	Functions	Status
host-iptables-rules.ts	100%	96 / 96	9 / 9	✅ Full
host-iptables-shared.ts	100%	90 / 90	15 / 15	✅ Full
host-iptables-validation.ts	100%	29 / 29	4 / 4 (32/32 branches)	✅ Full
host-iptables-chain.ts	100%	42 / 42	3 / 3	✅ Full
host-iptables-cleanup.ts	100%	17 / 17	2 / 2	✅ Full
host-iptables-network.ts	100%	16 / 16	1 / 1	✅ Full
domain-patterns.ts	100%	24 / 24	3 / 3 (89.47% branches)	✅ Full
docker-manager.ts (reexport)	100%	19 / 19	15 / 15	✅ Full

Key Finding: Network firewall, domain ACL, and container lifecycle logic are production-ready and fully covered.

📋 Coverage Table

All Files by Coverage Level (top 15):

File	Statements	Branches	Status
host-iptables*.ts (7 files)	100%	98%+	✅ Exemplary
api-proxy-config-domains.ts	99.03%	94.87%	✅ Excellent
api-proxy-config-validation.ts	96%	96.29%	✅ Excellent
cli.ts	85.71%	50%	⚠️ Medium (reexport barrel)
domain-patterns.ts	100%	89.47%	✅ Excellent

Coverage Gaps (< 75%):

File	Statements	Lines	Branches	Issue
bounded-execution/finite-disclosure.ts	9.26%	11.49%	0.26%	🔴 CRITICAL — 42/44 functions untested
enclave/runtime-preflight.ts	66.66%	64.7%	41.02%	🟠 Medium — New enclave infrastructure
microvm/rootfs.ts	71.69%	72%	54.54%	🟠 Medium — Cloud Hypervisor rootfs logic
commands/validators/config-assembly.ts	73.68%	73.68%	25%	🟠 Medium — Config assembly validator

🔧 Function Audit

Critical Functions Lacking Coverage (from finite-disclosure.ts):

The bounded-execution/finite-disclosure.ts module is responsible for disclosing execution context (env vars, secrets, logs) in a bounded way. Currently:

• Only 2 of 44 functions tested (~4.54% function coverage)
• 1 of 377 branches tested (0.26% branch coverage)
• Core disclosure logic (43–464 statements) almost entirely uncovered

Examples of uncovered core functions (inferred from coverage data):

• Likely: Secret pattern matching and masking functions
• Likely: Environment variable filtering and disclosure bounds checks
• Likely: Log truncation and context boundary enforcement

Risk: Any regression in secret/context disclosure could expose credentials in logs without detection.

---

Other Notable Functions:

• runtime-preflight.ts (66.66%): Enclave startup validation; 3 of 5 functions reached via integration tests
• config-assembly.ts (73.68%): Complex nested config construction; branch coverage at 25% indicates conditional paths untested
• rootfs.ts (71.69%): Cloud Hypervisor rootfs mounting; newer feature with partial coverage

📅 Recent Source Changes (last 7 days)

Recent commits indicate active development in:

1. Enclave infrastructure — New unified enclave runtime and smoke tests
2. Capability filtering — Docker capability dropping and filtering in container manager
3. MCP Gateway integration — Authorization header contract hardening for workspace credential isolation
4. Cloud Hypervisor — Split lifecycle management and backend refactoring

Coverage impact: New enclave and Cloud Hypervisor modules have lower coverage (66%–72%) as features are still being stabilized. finite-disclosure.ts coverage has not improved despite ongoing security work.

🔎 Notable Findings

1. 🔴 CRITICAL: finite-disclosure.ts remains nearly untested — A module responsible for controlled disclosure of execution context has 0.26% branch coverage and only 2/44 functions tested. This is a security-critical gap for credential isolation.

2. ✅ Network isolation fully covered — All host-iptables modules (network rules, cleanup, validation, chaining) are at 100%, with comprehensive branch coverage. Container network security is production-ready.

3. ⚠️ Branch coverage opportunity — Statements are at 92.67%, but branches lag at 86.08%. Many conditional paths in error handling and edge cases are untested. Targeting 90%+ branch coverage would catch more subtle logic errors.

4. 🆕 Enclave/microvm modules need stabilization coverage — New bounded-execution and enclave infrastructure is partially covered (66%–73%); integration tests should be expanded as these features mature.

🎯 Recommendations

Priority	Item	Action	Effort
🔴 HIGH	Cover finite-disclosure.ts (0.26% branches)	Add comprehensive tests for secret pattern matching, environment filtering, and disclosure bounds enforcement. Target 85%+ coverage and >95% branch coverage.	High
🟠 MEDIUM	Improve config-assembly.ts branch coverage (25%)	Add integration tests for all conditional paths in config merging and validation logic.	Medium
🟠 MEDIUM	Test enclave/runtime-preflight.ts error paths (41% branches)	Add tests for enclave startup failures, permission violations, and invalid configurations.	Medium
🟢 LOW	Optimize general branch coverage (86%→90%+)	Add edge-case tests for error handling, DNS fallback logic, and timeout scenarios.	Low

---

Report metadata:

• Test files: 290
• Test utilities: 26
• Baseline: 92.67% statements, 86.08% branches
• Date: 2026-08-28

Generated by Test Coverage Reporter · copilot · sum00 · 20 AIC · ⊞ 5.4K · ◷

• expires on Sep 4, 2026, 7:04 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-04T19:04:29.060Z.

Closed by Workflow