[Coverage Report] Test Coverage Report — 2026-09-02

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-02

Overall Coverage

Metric	Coverage	Raw
Statements	91.72%	12996/14169
Branches	85.32%	7391/8662
Functions	92.08%	1861/2021
Lines	93.12%	12404/13320

The codebase maintains strong statement and line coverage (>91%), but branch coverage lags at 85.32%, indicating untested conditional paths and error handling scenarios.

---

🛡️ Security-Critical Path Status

CRITICAL GAPS DETECTED:

File	Category	Statements	Branches	Risk Level
src/bounded-execution/finite-disclosure.ts	Enclave Protocol	9.26%	0.26%	CRITICAL
src/microvm/network-reservation.ts	Cloud Hypervisor	50.22%	54.26%	HIGH
src/enclave/runtime-preflight.ts	Enclave Validation	66.66%	41.02%	HIGH
src/microvm/rootfs.ts	Cloud Hypervisor	71.69%	54.54%	MEDIUM
src/commands/validators/config-assembly.ts	Config Validation	73.68%	25%	MEDIUM

Key Finding: finite-disclosure.ts (913 LOC) is the wire protocol parser for enclave requests and results — a security-critical component handling untrusted schema and result parsing. At 9.26% statement coverage and 0.26% branch coverage, this module lacks testing for:

• Schema cardinality validation
• Protocol version checks
• Finite-disclosure envelope parsing and validation
• Error path handling for malformed inputs

---

📋 Coverage Table

Security & Network Layer:

• ✅ src/host-iptables.ts — Network isolation (comprehensive coverage via 15+ test files)
• ✅ src/squid-config.ts — Domain ACL enforcement (covered via 10+ test files)
• ✅ src/domain-patterns.ts — Domain matching logic (solid coverage)
• ✅ src/docker-manager.ts — Container lifecycle (well-tested with 20+ test files)

New High-Risk Modules (Preview Features):

• ❌ src/bounded-execution/finite-disclosure.ts — 9.26% (Wire protocol parsing for enclaves)
• ⚠️ src/microvm/network-reservation.ts — 50.22% (Cloud Hypervisor network setup)
• ⚠️ src/enclave/runtime-preflight.ts — 66.66% (Enclave pre-flight validation)
• ⚠️ src/microvm/rootfs.ts — 71.69% (Root filesystem setup for microVMs)

Configuration & Validation:

• ⚠️ src/commands/validators/config-assembly.ts — 73.68% (Branch coverage only 25%)

---

🔧 Function Audit

High-Priority Untested Functions:

1. finite-disclosure.ts (9.26% coverage)

   • parseSchema() — Recursive-descent parser for finite-disclosure schemas
   • validateResult() — Protocol envelope validation (ok/error distinction)
   • computeCardinality() — BigInt cardinality calculation (prevents overflow)
   • Error handling paths for schema size/depth/nesting violations

2. network-reservation.ts (50.22% coverage)

   • Network namespace setup for Cloud Hypervisor backends
   • IP allocation and reservation logic

3. runtime-preflight.ts (66.66% coverage)

   • Pre-flight checks for enclave runtime readiness
   • Backend availability detection

4. config-assembly.ts (73.68% statements, 25% branches)

   • Config struct building and assembly
   • Conditional validation logic (strong branch gap)

---

📅 Recent Source Changes

Recent development includes new modules for Cloud Hypervisor microVM support (microvm/) and enclave runtime (enclave/), indicating active feature development for preview functionality. These modules show low coverage scores (50–71%), suggesting the test suite has not yet caught up with recent source additions.

---

🔎 Notable Findings

1. Enclave Finite-Disclosure Protocol (CRITICAL): finite-disclosure.ts at 9.26% coverage is a new cryptographic/information-theoretic module defining the wire protocol for enclave requests/results. Its hand-written recursive-descent parsers must validate untrusted schema and output — the 0.26% branch coverage means nearly all error paths are untested.

2. Branch Coverage Bottleneck: Overall branch coverage (85.32%) is 6.4 percentage points below statement coverage (91.72%), indicating systematic under-testing of error handling, conditional logic, and edge cases across the codebase.

3. Cloud Hypervisor Backend (Partial Coverage): Three new modules (microvm/, enclave/) implement the preview Cloud Hypervisor feature. Combined coverage is low (50–71%), suggesting the feature is incomplete or the test suite hasn't caught up.

4. Configuration Validation Gaps: config-assembly.ts has only 25% branch coverage despite 73.68% statement coverage, meaning complex assembly logic and error branches remain untested.

---

🎯 Recommendations

High Priority (Security-Critical):

1. Add comprehensive unit tests for finite-disclosure.ts (9.26% → target 90%+)

   • Test parseSchema() with valid and invalid schemas (size/depth limits, duplicate keys)
   • Test validateResult() with both ok and error envelopes
   • Test cardinality calculation for all schema types (object, tuple, array, union, enum)
   • Add fuzzing or property-based tests for parser robustness
   • Effort: High | Timeline: 1–2 sprints | Blocker: Enclaves feature

2. Increase branch coverage from 85.32% to 90%+ (Target: 8662 → ~9200+ branches)

   • Focus on error paths and conditional logic in:
     • src/config-assembly.ts (25% → 90%+)
     • src/microvm/network-reservation.ts (54% → 75%+)
     • src/enclave/runtime-preflight.ts (41% → 75%+)
   • Use branch coverage reports (npm run test:coverage) to identify missing paths
   • Effort: Medium | Timeline: 1 sprint

Medium Priority (New Feature Coverage):
3. Complete test coverage for Cloud Hypervisor modules (target 80%+ across microvm/ and enclave/)

• Add integration tests for microVM network reservation and rootfs setup
• Test enclave runtime pre-flight checks with mocked backend responses
• Add negative tests for failure scenarios (network conflicts, missing kernel features)
• Effort: Medium | Timeline: 1–2 sprints

Generated by Test Coverage Reporter · copilot · sum00 · 15.9 AIC · ⊞ 5.4K · ◷

• expires on Sep 9, 2026, 10:01 PM UTC