[Coverage Report] Test Coverage Report — 2026-09-15

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-15

Overall Coverage

Metric	Coverage	Trend
Lines	94.13% (13,702 / 14,556)	✅ Excellent
Statements	92.8% (14,397 / 15,514)	✅ Excellent
Functions	93.44% (2,109 / 2,257)	✅ Excellent
Branches	86.61% (8,217 / 9,487)	⚠️ Good (monitoring)

Summary: Overall test coverage is strong across all metrics, with >92% line and statement coverage. Branch coverage is slightly lower at 86.61%, indicating some conditional paths need better coverage.

🛡️ Security-Critical Path Status

The following files are essential for network security and deserve special attention:

File	Lines	Stmts	Branches	Status
src/host-iptables-rules.ts	100%	100%	100%	✅ Fully Covered
src/host-iptables-shared.ts	100%	100%	100%	✅ Fully Covered
src/domain-patterns.ts	100%	100%	89.47%	✅ Covered
src/domain-validation.ts	100%	100%	100%	✅ Fully Covered
src/domain-matchers.ts	98.14%	98.14%	95%	✅ Covered
src/docker-manager.ts	100%	100%	100%	✅ Fully Covered
src/cli.ts	85.71%	85.71%	50%	⚠️ Needs Review

Key Finding: Critical network isolation files (host-iptables-*, domain-*) have excellent coverage. However, src/cli.ts (main entry point) has gaps at 85.71% lines and only 50% branch coverage that should be addressed.

📋 Coverage Table

High-Risk Files (Statements <80%):

#	File	Statements	Branches	Size (LOC)	Priority
1	src/bounded-execution/finite-disclosure.ts	🔴 38.12%	🔴 25.89%	~38	CRITICAL
2	src/microvm/network-reservation.ts	🟡 50.22%	🟡 54.26%	~80	HIGH
3	src/enclave/runtime-preflight.ts	🟡 66.66%	🟡 41.02%	~30	HIGH
4	src/microvm/rootfs.ts	🟡 71.69%	🟡 54.54%	~65	MEDIUM
5	src/commands/validators/config-assembly.ts	🟡 73.68%	🔴 25%	~60	HIGH
6	src/artifact-permissions.ts	🟡 83.33%	🟡 80%	~66	MEDIUM
7	src/cli.ts	🟡 85.71%	🔴 50%	~7	MEDIUM
8	src/config-writer.ts	🟡 88.99%	🟡 82.4%	~209	MEDIUM
9	src/host-env.ts	🟡 96.61%	🟡 85.71%	~59	LOW

🔧 Function Audit

Functions with Incomplete Coverage:

• finite-disclosure.ts (~6 functions, 38% coverage): Contains bounded execution timeout logic; low branch coverage (25.89%) suggests conditional path testing is insufficient
• network-reservation.ts (~8 functions, 50% coverage): Network namespace and resource setup code; critical for isolation layer
• runtime-preflight.ts (~3 functions, 66% coverage): Pre-flight validation for sandboxed runtimes
• config-assembly.ts (~5 functions, 73% coverage): Config validation and assembly; 25% branch coverage is concerning

📅 Recent Source Changes (last 7 days)

To identify if recent changes introduced coverage regressions:

• Check if finite-disclosure.ts, network-reservation.ts, or config-assembly.ts were recently modified
• If modified, prioritize adding tests for new code paths
• Review bounded-execution and microvm modules in particular

🔎 Notable Findings

1. Critical Gap in Bounded Execution (finite-disclosure.ts): At 38.12% statement coverage and 25.89% branch coverage, this module is significantly under-tested. This is especially concerning given its role in timeout enforcement and execution control.

2. Strong Coverage of Core Network Isolation: The foundational network security modules (host-iptables-*.ts, domain-*.ts) achieve 98-100% coverage, indicating excellent quality for the core firewall logic.

3. Branch Coverage Lags Behind Line Coverage: While line coverage is 94.13%, branch coverage is 86.61% (7.52% gap). This suggests conditional logic and error paths are not consistently tested across the codebase.

4. CLI Entry Point Needs Refinement: src/cli.ts has only 50% branch coverage despite 85.71% line coverage, indicating edge cases and error handling paths need additional test scenarios.

🎯 Recommendations

HIGH PRIORITY

1. Increase finite-disclosure.ts test coverage to ≥80%: This file has the lowest coverage in the codebase at 38.12%. Focus on:

   • Timeout enforcement scenarios
   • Edge cases in bounded execution logic
   • Error handling branches
   • Estimated effort: 3–4 hours for comprehensive test suite

2. Improve branch coverage in config-assembly.ts: Statements are at 73.68% but branches are critically low at 25%. Add tests for:

   • All validation failure modes
   • Conditional config merging paths
   • Missing and invalid input scenarios
   • Estimated effort: 2–3 hours

MEDIUM PRIORITY
3. Expand cli.ts branch coverage (50% → ≥80%): The main entry point needs better error path and edge case coverage:

• Signal handling (SIGTERM, SIGINT)
• Initialization failures
• Cleanup logic
• Multiple execution paths
• Estimated effort: 2 hours

LOW PRIORITY
4. Incrementally address remaining gaps: network-reservation.ts (50%), runtime-preflight.ts (66%), and rootfs.ts (71%) should be brought to ≥85% over the next sprint, focusing on gap areas identified in coverage reports.

---

Baseline maintained: All critical security-path files remain at or above desired thresholds. The overall 94.13% line coverage reflects a mature, well-tested codebase. Focus areas should be the identified high-risk modules with external dependencies or complex conditional logic.

Generated by Test Coverage Reporter · copilot · sum00 · 19.3 AIC · ⊞ 5.3K · ◷

• expires on Sep 22, 2026, 1:24 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-22T01:24:31.257Z.

Closed by Workflow