[Coverage Report] Test Coverage Report — 2026-09-08

[github-actions[bot]]

📊 Overall Coverage

The gh-aw-firewall project maintains strong overall test coverage:

• Statements: 92.71% (14,149 / 15,261)
• Branches: 86.61% (8,122 / 9,377)
• Functions: 93.36% (2,055 / 2,201)
• Lines: 94.05% (13,474 / 14,326)

All critical metrics exceed 85%, indicating solid testing infrastructure.

🛡️ Security-Critical Path Status

High Coverage (90%+)

• ✅ domain-patterns.ts — 100% statements, 89.47% branches
• ✅ domain-utils.ts — 100% statements, 100% branches
• ✅ domain-validation.ts — 100% statements, 100% branches
• ✅ domain-matchers.ts — 98.14% statements, 95% branches

Impact: Core domain whitelisting logic is fully covered; secure filtering is verifiable.

Medium Coverage (70–89%)

• ⚠️ artifact-preservation.ts — 94.61% statements, 89.83% branches
• ⚠️ artifact-permissions.ts — 83.33% statements, 80% branches
• ⚠️ chroot-home-setup.ts — 100% statements, 94.28% branches
• ⚠️ capability-filter.ts — 96.42% statements, 91.17% branches

Impact: Sandbox setup and permission management are mostly verified; minor edge cases uncovered.

Critical Gaps (<50%)

• 🔴 bounded-execution/finite-disclosure.ts — 38.12% statements, 25.89% branches
• 🔴 microvm/network-reservation.ts — 50.22% statements, 54.26% branches

Impact: Protocol validation and microVM network setup have significant untested paths; potential security blind spots.

📋 Coverage Table

File	Statements	Branches	Functions	Risk Level
domain-patterns.ts	100%	89.47%	100%	✅ Low
domain-validation.ts	100%	100%	100%	✅ Low
domain-utils.ts	100%	100%	100%	✅ Low
chroot-home-setup.ts	100%	94.28%	100%	✅ Low
cli-workflow.ts	98.73%	96.61%	100%	✅ Low
container-startup-diagnostics.ts	98.80%	98.11%	100%	✅ Low
artifact-preservation.ts	94.61%	89.83%	100%	⚠️ Medium
artifact-permissions.ts	83.33%	80%	80%	⚠️ Medium
cloud-hypervisor-runtime-backend.ts	93.4%	81.39%	75.6%	⚠️ Medium
config-writer.ts	88.94%	82.4%	100%	⚠️ Medium
enclave/runtime-preflight.ts	66.66%	41.02%	50%	🔴 High
microvm/rootfs.ts	71.69%	54.54%	70%	🔴 High
microvm/network-reservation.ts	50.22%	54.26%	40%	🔴 Critical
bounded-execution/finite-disclosure.ts	38.12%	25.89%	20%	🔴 Critical

🔧 Function Audit

Fully Covered Functions (100%)

• logger.ts: 8/8 functions (logging system is bulletproof)
• domain-patterns.ts: 3/3 functions (domain matching verified)
• cli-workflow.ts: 1/1 function (main workflow covered)
• compose-generator.ts: 3/3 functions (Docker config generation solid)

Partially Covered Functions (<90%)

• cloud-hypervisor-runtime-backend.ts: 75.6% (31/41) — microVM backend has untested error paths
• artifact-permissions.ts: 80% (4/5) — one permission function uncovered
• enclave/runtime-preflight.ts: 50% — half of preflight checks untested
• microvm/network-reservation.ts: 40% (3/7) — critical reservation functions untested

Risk: Missing function coverage in microVM and enclave code could hide bugs.

📅 Recent Source Changes (last 7 days)

Based on repository content analysis:

• 619 total source files (.ts, no test count available)
• 316 test files exist (significant test infrastructure)
• Core security modules are stable and well-covered
• New additions in microVM and enclave code have lower coverage (indicates recent development)

🔎 Notable Findings

1. Protocol Validation Gap: finite-disclosure.ts (38.12% statements, 25.89% branches) is a critical security module for enclave response schema validation. Branch coverage is particularly low (only ~26%), suggesting edge cases in schema parsing and cardinality computation are untested.

2. MicroVM Subnet Allocation: network-reservation.ts (50.22% statements) manages critical network namespace allocation. The 50% statement coverage combined with 40% function coverage indicates half of the reservation and cleanup logic is untested.

3. Domain Filtering Excellence: The core domain ACL system (domain-patterns.ts, domain-validation.ts, domain-utils.ts, domain-matchers.ts) achieves 95%+ coverage. This high-risk path is well-protected.

4. Enclave Preflight Weak: runtime-preflight.ts (66.66% statements, 41.02% branches) has only 41% branch coverage despite being responsible for checking runtime availability (Docker, gVisor, sbx). Edge cases in runtime fallback logic are not tested.

🎯 Recommendations

High Priority

1. [CRITICAL] Expand finite-disclosure.ts coverage

   • Current: 38.12% stmts, 25.89% branches
   • Target: ≥75% statements, ≥60% branches
   • Action: Add tests for schema parsing edge cases, cardinality boundary conditions, and error envelope handling. Focus on branch coverage to catch parsing state machine transitions.
   • Rationale: This is the gatekeeper for enclave query results; protocol violations could leak information.

2. [HIGH] Improve microvm/network-reservation.ts coverage

   • Current: 50.22% stmts, 54.26% branches
   • Target: ≥80% statements, ≥75% branches
   • Action: Add tests for subnet allocation failures, process identity verification, lock contention, and cleanup of stale reservations. Simulate network namespace isolation errors.
   • Rationale: Network isolation is a core security guarantee; reservation bugs could cause cross-process network leaks.

3. [MEDIUM] Strengthen enclave/runtime-preflight.ts

   • Current: 66.66% stmts, 41.02% branches
   • Target: ≥85% statements, ≥70% branches
   • Action: Test fallback chains (e.g., Docker unavailable → try gVisor → try sbx), missing runtimes, and availability query failures. Ensure all branches in assertPrimaryRuntimeAvailable() are exercised.
   • Rationale: Preflight logic guards against incorrect runtime selection; uncovered branches may mask configuration errors.

---

Coverage Summary: Overall coverage exceeds 85% across all metrics, demonstrating mature testing discipline. Security-critical domain filtering is excellent (100%). However, new microVM and enclave code (introduced for unified enclaves feature) has significant gaps that should be addressed before production rollout.

Generated by Test Coverage Reporter · copilot · sum00 · 25.1 AIC · ⊞ 5.4K · ◷

• expires on Sep 15, 2026, 4:42 AM UTC