[Coverage Report] Test Coverage Report — 2026-09-04

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-04

Overall Coverage

Metric	Coverage	Status
Statements	91.79%	✅ Excellent
Branches	85.34%	✅ Strong
Functions	92.29%	✅ Excellent
Lines	93.18%	✅ Excellent
Total Tests	5,496 passed, 5 failed	⚠️ Minor failures
Test Suites	343 passed, 2 failed	⚠️ Minor failures

Summary: The overall test coverage is excellent at 91.79% statement coverage and 85.34% branch coverage, well above the 80% threshold. However, 2 test suites are currently failing, requiring investigation.

---

🛡️ Security-Critical Path Status

File	Lines	Branches	Functions	Status
src/host-iptables.ts	100%	100%	100%	✅ Perfect
src/squid-config.ts	100%	100%	100%	✅ Perfect
src/docker-manager.ts	100%	100%	100%	✅ Perfect
src/domain-patterns.ts	100%	89.47%	100%	✅ Good
src/cli.ts	85.71%	50%	100%	⚠️ Gaps

🔒 Secure: All critical security components (host-iptables, squid-config, docker-manager) have perfect coverage. Domain patterns and CLI entry point have minor branch coverage gaps, but core functionality is covered.

---

📋 Coverage Table

Highest Coverage Files (Selection)

• src/api-proxy-config-domains.ts: 99.03% stmts | 94.87% branch
• src/cli-workflow.ts: 98.63% stmts | 96.36% branch
• src/compose-generator.ts: 100% stmts | 95.34% branch
• src/config-file.ts: 100% stmts | 100% branch
• src/container-lifecycle.ts: 96.27% stmts | 90% branch

Lowest Coverage Files (Below 80%)

1. src/bounded-execution/finite-disclosure.ts ⚠️ CRITICAL

   • Statements: 9.26% ❌
   • Branch: 0.26% ❌
   • Functions: 4.54% ❌
   • Impact: Finite disclosure/bounded execution logic for agent isolation is nearly untested

2. src/microvm/network-reservation.ts

   • Statements: 50.22%
   • Branch: 54.26%
   • Impact: Network reservation for microVM sandboxing needs test expansion

3. src/enclave/runtime-preflight.ts

   • Statements: 66.66%
   • Branch: 41.02%
   • Impact: Enclave startup validation missing branch coverage

4. src/microvm/rootfs.ts

   • Statements: 71.69%
   • Branch: 54.54%
   • Impact: Filesystem setup for microVM execution needs better branch testing

5. src/commands/validators/config-assembly.ts

   • Statements: 73.68%
   • Branch: 25% ⚠️
   • Impact: Configuration validation has extremely low branch coverage (only 25%)

---

🔧 Function Audit

Functions with Coverage Gaps (Top Issues)

Module	Gap	Function	Issue
finite-disclosure.ts	91%	Multiple disclosure functions	Entire finite disclosure protocol untested
config-assembly.ts	75%	assembleConfig() variants	Branch coverage only 25%; missing validation paths
runtime-preflight.ts	59%	Preflight checks	Missing error cases and fallback paths
network-reservation.ts	50%	Network allocation functions	~half of logic untested
rootfs.ts	28%	Root filesystem operations	Most branches uncovered

Note: The finite-disclosure.ts module shows extremely low coverage despite high statement coverage in other components, suggesting it is either new code or intentionally isolated. This warrants investigation.

---

📅 Recent Source Changes (last 7 days)

The test run includes recent commits. Key files modified recently include:

• Cloud hypervisor components (runtime-backend, manager, preflight)
• Enclave runtime components (gateway, preflight, staging)
• Configuration assembly and validation logic
• Microvm network and filesystem modules

Given the size of the codebase (5,496 tests), coverage metrics are stable with only minor fluctuations in new/modified components.

---

🔎 Notable Findings

1. Security-Critical Components Fully Covered ✅
   All L7 filtering (squid-config.ts), L3/L4 rules (host-iptables.ts), and lifecycle management (docker-manager.ts) have perfect 100% coverage. Network isolation is well-tested.

2. Finite Disclosure Module is a Coverage Outlier ⚠️
   src/bounded-execution/finite-disclosure.ts has only 9.26% statement coverage. This is likely a recently added security feature for bounded execution in enclaves. Requires urgent test expansion to ensure bounded-execution safety guarantees.

3. Branch Coverage Gaps in Configuration Validators ⚠️
   src/commands/validators/config-assembly.ts has 25% branch coverage despite 73.68% statement coverage. Missing branches likely represent error paths and edge-case validations that should be explicitly tested.

4. Test Failures in Enclave Components ⚠️
   2 test suites are failing (5 tests total), both in enclave-related code:

   • src/enclave/agent-entrypoint-diagnostics.test.ts (4 failures)
   • src/services/api-proxy-env-config.test.ts (1 failure)

   These failures suggest recent changes to enclave diagnostics and API proxy configuration need stabilization.

---

🎯 Recommendations

🔴 HIGH PRIORITY

1. Add Tests for finite-disclosure.ts (9.26% coverage)
   • Add test cases for all bounded-execution protocols (lines 136–912)
   • Test disclosure thresholds, credential scrubbing, and output filtering
   • Verify finite result channel behavior and deadline handling
   • Effort: High | Impact: Critical (affects agent isolation guarantees)

🟡 MEDIUM PRIORITY

2. Expand Branch Coverage in Config Assembly (config-assembly.ts: 25% branch)

   • Add tests for validation error paths (lines 82–90, 101–105)
   • Test config assembly edge cases and merging scenarios
   • Verify error handling and diagnostics
   • Effort: Medium | Impact: High (configuration correctness is security-sensitive)

3. Stabilize Enclave Diagnostic Tests

   • Fix failing agent-entrypoint-diagnostics.test.ts tests
   • Review API proxy env config test failures
   • Ensure enclave startup diagnostics capture correct exception types
   • Effort: Medium | Impact: High (enclave isolation depends on accurate diagnostics)

🟢 LOW PRIORITY

4. Improve MicroVM Component Coverage
   • Expand tests for network-reservation.ts (50%) and rootfs.ts (72%)
   • Test fallback paths and edge cases in network allocation
   • Add filesystem permission and mount validation tests
   • Effort: Low | Impact: Medium (microVM backend is newer feature; good-to-have)

---

Report Generated: 2026-09-04
Baseline: All files at 91.79% statement, 85.34% branch coverage
Next Review: Monitor coverage trends; re-run after implementing HIGH priority recommendations

Generated by Test Coverage Reporter · copilot · sum00 · 24.9 AIC · ⊞ 5.4K · ◷

• expires on Sep 11, 2026, 4:45 AM UTC