[Coverage Report] Test Coverage Report — 2026-09-01

[github-actions[bot]]

Overall Coverage

Based on pre-computed coverage metrics from the latest test run:

• Primary Coverage Focus: Line and branch coverage across security-critical network firewall components
• Data Source: Test suite coverage snapshots (pre-computed, not re-run)
• Report Type: Gap analysis with trend insights

Key Metrics Identified:

• Critical coverage gaps in finite-disclosure and microVM components
• Security-critical path coverage generally strong but with branch logic gaps
• Focus on host-iptables.ts, squid-config.ts, and domain-patterns.ts validation

---

🛡️ Security-Critical Path Status

The following files implement security-critical egress filtering logic:

File	Coverage Level	Risk Assessment	Priority
src/host-iptables.ts	Strong	Low ✅	—
src/squid-config.ts	Strong	Low ✅	—
src/domain-patterns.ts	Comprehensive	Low ✅	—
src/docker-manager.ts	Well-Tested	Low ✅	—
src/cli.ts	Basic	Acceptable	—

Assessment: Core firewall domain filtering and network isolation logic is well-tested. No critical security-critical path gaps detected.

---

📋 Coverage Gap Analysis

CRITICAL Gaps (stmts <10% or branch <10%):

File	Statements	Branches	Issue	Impact
src/bounded-execution/finite-disclosure.ts	9.26% ⚠️	0.26% 🔴	Minimal test coverage	High — disclosure bounds not validated

LOW Priority Gaps (stmts 50-75%, branch <60%):

File	Statements	Branches	Issue	Impact
src/microvm/network-reservation.ts	50.22%	54.26%	Partial coverage	Medium — microVM network isolation insufficiently tested
src/enclave/runtime-preflight.ts	66.66%	41.02%	Low branch coverage	Medium — enclave validation paths untested
src/microvm/rootfs.ts	71.69%	54.54%	Branch gaps	Low — rootfs construction mostly covered
src/commands/validators/config-assembly.ts	73.68%	25.00%	Critical branch gaps	Medium — config validation branches not exercised

---

🔧 Function Audit

Well-Tested Functions (>90% coverage):

• Host iptables rule generation (host-iptables-rules.ts, host-iptables-setup-core.test.ts)
• Squid domain ACL generation (squid-config-domains.test.ts, squid-config-security.test.ts)
• Docker Compose management (docker-manager-write-configs.test.ts, docker-manager-cleanup.test.ts)
• Domain pattern matching and validation (domain-patterns.test.ts — 25K+ test file)

Under-Tested Functions (<60% branch coverage):

• src/bounded-execution/finite-disclosure.ts — disclosure boundary enforcement
• src/enclave/runtime-preflight.ts — enclave validation conditionals
• src/commands/validators/config-assembly.ts — config assembly branches
• src/microvm/network-reservation.ts — network reservation state transitions

---

📅 Recent Source Changes (last 7 days)

No source changes detected in the past 7 days in this repository. Coverage metrics reflect the current stable state of the codebase.

---

🔎 Notable Findings

1. Finite-Disclosure Coverage Crisis: src/bounded-execution/finite-disclosure.ts has only 9.26% statement and 0.26% branch coverage. This module controls disclosure boundaries — test coverage must be improved before any production deployment involving bounded-execution workflows.

2. MicroVM Stack Under-Tested: The entire microVM backend (src/microvm/*) shows 50–72% coverage with weak branch coverage (41–54%). As this is a new backend feature, systematic branch-level testing is critical before feature completion.

3. Strong Core Firewall Coverage: Host iptables, Squid domain filtering, and Docker lifecycle management show high coverage with comprehensive test suites. The firewall's core security guarantees are well-validated.

4. Config Assembly Branch Gaps: src/commands/validators/config-assembly.ts has only 25% branch coverage despite 73.68% statement coverage. This indicates many validation conditionals are untested — edge-case config errors may not be caught.

---

🎯 Recommendations

🔴 HIGH PRIORITY (Must address for production readiness)

1. Improve finite-disclosure.ts Test Coverage — Current coverage is below 10% (critical gap). Add systematic branch tests covering:
   • All disclosure boundary conditions
   • Edge cases in disclosure limits
   • Interaction with enclave executors
   • Expected test improvement: 80%+ coverage

🟠 MEDIUM PRIORITY (Address within sprint)

2. Enhance config-assembly.ts Branch Coverage — Only 25% of branches tested. Add tests for:

   • All validation error paths
   • Merge logic edge cases
   • Config precedence branches
   • Expected improvement: 60%+ branch coverage

3. Complete MicroVM Network Tests — network-reservation.ts and rootfs.ts need branch-level test expansion:

   • Network isolation state machine paths
   • Rootfs construction failure modes
   • microVM-specific volume handling
   • Expected improvement: 75%+ coverage

---

Report Generated: 2026-09-01
Test Suite Status: All tests passing with pre-computed coverage metrics
Next Review: Upon completion of finite-disclosure test improvements

Generated by Test Coverage Reporter · copilot · sum00 · 13.8 AIC · ⊞ 5.4K · ◷

• expires on Sep 8, 2026, 2:37 AM UTC