[Coverage Report] Test Coverage Report — 2026-08-31

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-31

Overall Coverage

Metric	Coverage	Trend
Statements	91.72%	✅ Excellent
Lines	93.09%	✅ Excellent
Functions	92.19%	✅ Excellent
Branches	85.37%	⚠️ Good but Lower

Total Lines: 13,121 covered of 13,945 | Passing threshold: 80% (✅ Exceeded)

---

🛡️ Security-Critical Path Status

All security-critical firewall modules maintain excellent coverage above 89%:

File	Coverage	Status	Notes
src/host-iptables.ts	100%	✅ Perfect	Core network isolation rules
src/host-iptables-shared.ts	100%	✅ Perfect	Shared iptables utilities
src/host-iptables-rules.ts	100%	✅ Perfect	Dynamic rule generation
src/domain-patterns.ts	100% (89.5% branches)	✅ Good	Domain ACL matching
src/domain-matchers.ts	98.14%	✅ Excellent	Domain pattern logic
src/squid-config.ts	100%	✅ Perfect	Proxy config generation
src/cli.ts	85.71% (50% branches)	⚠️ Acceptable	Main entry point — 1 branch uncovered

---

📋 Coverage Table

Files Under 80% Coverage (Critical Gaps):

File	Statements	Branches	Status	Severity
src/bounded-execution/finite-disclosure.ts	9.26%	0.26%	🔴 Critical	CRITICAL — Only init path tested
src/microvm/network-reservation.ts	50.22%	54.26%	🔴 Critical	HIGH — Network reservation logic
src/enclave/runtime-preflight.ts	66.66%	41.02%	🟡 Medium	MEDIUM — Enclave validation
src/microvm/rootfs.ts	71.69%	54.54%	🟡 Medium	MEDIUM — Sparse rootfs staging
src/commands/validators/config-assembly.ts	73.68%	25%	🟡 Medium	MEDIUM — Configuration validation

Files at Risk (70–80%):

File	Coverage
src/cloud-hypervisor/artifact-manifest.ts	79.36%
src/enclave/github-gateway.ts	76.92% (73.95% stmts)
src/cloud-hypervisor/confinement-verifier.ts	82.87%
src/cloud-hypervisor/diagnostics.ts	87.73%

---

🔧 Function Audit

Uncovered Critical Functions:

1. finite-disclosure.ts — 44 functions, only 2 covered (4.54%)

   • Disclosure management, rate limiting, and bounded execution core logic
   • All advanced error paths untested
   • Impact: Runtime behavior undefined for multi-turn sessions

2. network-reservation.ts — 44 functions, only 25 covered (56.81%)

   • Network IP/port allocation algorithms
   • Cleanup and rollback on failure untested
   • Impact: Network exhaustion, allocation conflicts possible

3. runtime-preflight.ts — 5 functions all covered but low branch coverage (41%)

   • Enclave validation branches incomplete
   • Error conditions missing

4. config-assembly.ts — Full coverage but only 3 of 12 branches (25%)

   • Configuration error paths barely tested

---

📅 Recent Source Changes (last 7 days)

New Features Added (Coverage Implications):

1. Cloud Hypervisor VMM Identity Isolation (7920, 7896)

   • src/cloud-hypervisor/vmm-identity.ts — 95.29% coverage ✅
   • Per-run identity validation well-tested

2. Sparse RootFS Staging (7920)

   • src/microvm/rootfs.ts — 71.69% coverage ⚠️
   • Incomplete branch coverage (54.54%)

3. Network Resource Reservation (7893)

   • src/microvm/network-reservation.ts — 50.22% coverage 🔴
   • NEW MODULE — Minimally tested

4. Cloud Hypervisor Confinement Verification (7889)

   • src/cloud-hypervisor/confinement-verifier.ts — 82.87% coverage ⚠️
   • Security validation ~83% covered

5. API Proxy TLS Support (7816)

   • Related modules at 96%+ coverage ✅

6. Network Conflict Reclamation (7817)

   • src/compose-network-conflicts.ts — 95.38% coverage ✅

---

🔎 Notable Findings

1. 🔴 CRITICAL: finite-disclosure.ts at 9.26%

   • This is a NEW module for bounded execution and disclosure control
   • Only initialization path is covered
   • All rate limiting, multi-turn, and overflow handling is untested
   • Recommendation: Entire feature needs integration test coverage before production use

2. 🔴 HIGH: network-reservation.ts at 50.22%

   • BRAND NEW for microVM network isolation
   • Core allocation algorithm has coverage gaps (54.26% branches)
   • Recovery paths untested
   • Risk: Silent failures in network resource allocation

3. ⚠️ MEDIUM: Branch coverage lagging statements by 5–15%

   • Even well-covered files have incomplete branch paths
   • Example: domain-patterns.ts is 100% statements but only 89.47% branches
   • Suggests tests cover happy paths but not error conditions

4. ✅ Excellent: Legacy core modules remain stable

   • host-iptables (100%), squid-config (100%), domain-matchers (98%)
   • No regressions in security-critical paths

---

🎯 Recommendations

1. 🔴 HIGH PRIORITY: finite-disclosure.ts Integration Tests

• File: src/bounded-execution/finite-disclosure.ts
• Current: 9.26% statements, 0.26% branches
• Action: Write integration tests for all disclosure control paths (rate limiting, budget enforcement, overflow handling)
• Effort: 6–8 hours
• Target: ≥80% statements, ≥70% branches
• Acceptance: Multi-turn session with disclosure overflow returns correct error

2. 🔴 HIGH PRIORITY: network-reservation.ts Coverage

• File: src/microvm/network-reservation.ts
• Current: 50.22% statements, 54.26% branches
• Action: Add unit tests for allocation algorithm, collision detection, and cleanup paths
• Effort: 4–6 hours
• Target: ≥85% statements, ≥80% branches
• Acceptance: All allocation edge cases validated (exhaustion, retry, rollback)

3. 🟡 MEDIUM PRIORITY: runtime-preflight.ts Branch Coverage

• File: src/enclave/runtime-preflight.ts
• Current: 66.66% statements, 41.02% branches
• Action: Add tests for validation error branches; focus on enclave environment failures
• Effort: 2–3 hours
• Target: ≥85% statements, ≥75% branches
• Acceptance: All validation failures generate correct diagnostics

Generated by Test Coverage Reporter · copilot · sum00 · 24.6 AIC · ⊞ 5.4K · ◷

• expires on Sep 7, 2026, 7:22 PM UTC