[Coverage Report] Test Coverage Report — 2026-09-03

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-03

Overall Coverage

Based on the pre-computed coverage analysis, the codebase has several files with coverage below the 80% threshold, particularly in newer security features and advanced runtime features.

Metric	Status
Security-Critical Files	⚠️ Mixed (some below 50%)
Core Infrastructure	✅ Generally good
New Features (Cloud Hypervisor, Enclaves)	🟡 Below threshold

🛡️ Security-Critical Path Status

The firewall's security-critical paths have variable coverage:

[CRITICAL] src/bounded-execution/finite-disclosure.ts: stmts=9.26% branch=0.26%
[LOW] src/microvm/network-reservation.ts: stmts=50.22% branch=54.26%
[LOW] src/enclave/runtime-preflight.ts: stmts=66.66% branch=41.02%
[LOW] src/microvm/rootfs.ts: stmts=71.69% branch=54.54%
[LOW] src/commands/validators/config-assembly.ts: stmts=73.68% branch=25%

Critical Finding: The bounded-execution/finite-disclosure.ts module (913 lines) has 9.26% statement coverage and 0.26% branch coverage. This is a security-critical feature for runtime disclosure control and needs immediate test coverage investment.

📋 Coverage Details

Files Below 80% Coverage:

File	Stmts	Branch	Type	Priority
bounded-execution/finite-disclosure.ts	9.26%	0.26%	Security-Critical	🔴 CRITICAL
microvm/network-reservation.ts	50.22%	54.26%	Infrastructure	🟡 HIGH
enclave/runtime-preflight.ts	66.66%	41.02%	Feature	🟡 MEDIUM
microvm/rootfs.ts	71.69%	54.54%	Infrastructure	🟡 MEDIUM
commands/validators/config-assembly.ts	73.68%	25%	Validation	🟡 MEDIUM

🔧 Function Audit

Test Files Available for Critical Paths:

• ✅ bounded-execution/finite-disclosure.ts has finite-disclosure-timing.test.ts (but very low coverage)
• ✅ domain-patterns.ts has domain-patterns.test.ts
• ✅ squid-config.ts has 5+ test files
• ✅ host-iptables.ts has 6+ test files
• ✅ docker-manager.ts has 5+ test files

Key Export Functions:

• domain-patterns.ts: parseDomainWithProtocol(), isWildcardPattern(), wildcardToRegex()
• Core modules (cli, host-iptables, squid-config, docker-manager): Use module re-exports pattern

📅 Recent Development Trends

Based on repository analysis, recent development has focused on:

• Cloud Hypervisor integration (src/cloud-hypervisor/)
• Unified enclaves architecture (src/enclave/)
• Microvm support (src/microvm/)
• Bounded execution features (src/bounded-execution/)

These newer subsystems show lower test coverage, suggesting they need additional test investment.

🔎 Notable Findings

1. 🔴 Critical Gap in Disclosure Control: finite-disclosure.ts has only 9.26% statement coverage and 0.26% branch coverage. This 913-line security module deserves urgent test attention despite test file existence. Disclosure control is fundamental to runtime safety guarantees.

2. 🟡 Microvm Infrastructure Under-tested: Network reservation and rootfs modules have 50-72% coverage. These are infrastructure-critical for the Cloud Hypervisor preview feature and need expanded test scenarios.

3. ⚠️ Configuration Validation Weak on Branches: config-assembly.ts has only 25% branch coverage despite 73.68% statement coverage, indicating conditional logic is not well-exercised in tests.

4. ✅ Core Paths Strong: The original security-critical files (domain patterns, squid config, host iptables, docker manager) show better coverage, indicating the foundational firewall logic is well-tested.

🎯 Recommendations

Priority 1 — HIGH (Security-Critical)

• Invest in bounded-execution/finite-disclosure.ts tests immediately
  • Target: Reach 60%+ statement coverage and 40%+ branch coverage
  • Scope: Add tests for timing attacks, disclosure decision tree, capacity management, edge cases
  • Effort: ~8-12 focused test cases for core disclosure scenarios
  • Impact: Enables bounded execution safety guarantees; reduces information leakage risk

Priority 2 — MEDIUM (Infrastructure)

• Expand microvm/network-reservation.ts and microvm/rootfs.ts tests
  • Target: Reach 80%+ statement coverage for both files
  • Scope: Network isolation scenarios, rootfs mount validation, device node handling, quota management
  • Effort: ~5-8 test cases per file
  • Impact: Ensures Cloud Hypervisor preview stability; reduces infrastructure failures

Priority 3 — MEDIUM (Validation)

• Increase branch coverage for configuration validators
  • Target: Reach 60%+ branch coverage in config-assembly.ts
  • Scope: Test all conditional branches in config validation paths, error conditions
  • Effort: ~6-10 test cases for edge conditions and branch coverage
  • Impact: Reduces configuration-related runtime errors; improves user experience

---

Report Generated: 2026-09-03 (Coverage analysis based on pre-computed metrics)

Next Steps:

• Review finite-disclosure.ts test file for gaps and expand coverage
• Prioritize adding tests for cloud-hypervisor and enclave subsystems
• Consider adding branch coverage targets to CI gates (target: 60%+ for security-critical files)
• Track coverage trends over time to identify regressions early

Generated by Test Coverage Reporter · copilot · sum00 · 21.2 AIC · ⊞ 5.4K · ◷

• expires on Sep 10, 2026, 5:35 AM UTC