[Coverage Report] 📊 Test Coverage Report — 2026-09-17

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Details
Statements	92.87%	14,496 / 15,608 covered
Branches	86.70%	8,316 / 9,591 covered
Functions	93.48%	2,125 / 2,273 covered
Lines	94.20%	13,800 / 14,649 covered

Assessment: Strong overall coverage with all metrics above 86%. Most of the codebase has excellent test support. ✅

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts	100%	100%	100%	✅ Excellent
src/host-iptables-shared.ts	100%	100%	100%	✅ Excellent
src/host-iptables-rules.ts	100%	100%	100%	✅ Excellent
src/host-iptables-chain.ts	100%	100%	100%	✅ Excellent
src/host-iptables-cleanup.ts	100%	100%	100%	✅ Excellent
src/host-iptables-validation.ts	100%	100%	100%	✅ Excellent
src/host-iptables-network.ts	100%	88.88%	100%	✅ Good
src/domain-patterns.ts	100%	89.47%	100%	✅ Good
src/docker-manager.ts	100%	100%	100%	✅ Excellent
src/squid-config.ts	100%	100%	100%	✅ Excellent
src/cli.ts	85.71%	50%	100%	⚠️ Attention needed

Key Finding: Core network isolation (host-iptables-*) and domain filtering (squid-config, domain-patterns) are fully covered. This is excellent for security-critical code. The main entry point (cli.ts) has gaps, but it's largely a wrapper around well-tested modules.

---

📋 Coverage Table

Top Coverage (95-100%)

Component	Count
Files at 100%	78
Files at 95%+	12
Total Strong Coverage	90

Moderate Coverage (80-95%)

Component	Count
Files at 80-95%	8

Low Coverage (<80%)

Component	Statements	Branches	File
CRITICAL	38.12%	25.89%	src/bounded-execution/finite-disclosure.ts
Low	50.22%	54.26%	src/microvm/network-reservation.ts
Low	68.42%	43.90%	src/enclave/runtime-preflight.ts
Low	71.69%	54.54%	src/microvm/rootfs.ts
Low	73.91%	100%	src/test-helpers/config-writer-dependency-mocks.test-utils.ts

---

🔧 Function Audit

Fully Tested Functions

• setupIptablesChain() — 100% coverage, critical for network namespace setup
• generateSquidConfig() — 100% coverage, generates ACL rules
• getDockerComposePath() — 100% coverage, container orchestration
• validateDomainPattern() — 100% coverage, domain whitelisting
• calculateCapabilities() — 100% coverage, capability filtering

Partially Tested Functions

• cli.ts entry point — 85.71% statements, 50% branches
  • Some branch paths in signal handling not exercised
  • Recovery/error paths not fully tested
  • Recommend adding error injection tests

---

📅 Recent Source Changes (last 7 days)

Recent commits suggest focus on:

• Cloud Hypervisor v53.0 microVM support
• Enclave security hardening (redacted logs, new preflight checks)
• Bug fixes: temporary artifact handling, Squid log permissions, network race conditions

Observation: New features in src/cloud-hypervisor/ and src/enclave/ added complexity, with coverage still ramping. This is expected for newer modules.

---

🔎 Notable Findings

1. 🛡️ Network Isolation is Rock-Solid

   • All host-iptables-*.ts files at 100% coverage
   • Domain filtering (squid-config.ts, domain-patterns.ts) fully tested
   • Firewall's core security promise is well-validated

2. ⚠️ New Modules Have Lower Coverage

   • src/bounded-execution/finite-disclosure.ts at 38.12% (CRITICAL)
   • src/microvm/rootfs.ts at 71.69%
   • src/enclave/runtime-preflight.ts at 68.42%
   • These are new features; coverage should improve as features stabilize

3. 🎯 Entry Point Gaps

   • cli.ts has 50% branch coverage — some error/recovery paths untested
   • This is common in thin CLI wrappers but worth monitoring

4. 📊 No Regression

   • 86.7% branch coverage is above typical production targets (80%)
   • No security-critical gaps in firewall's core logic

---

🎯 Recommendations

High Priority

• Add integration tests for src/bounded-execution/finite-disclosure.ts (currently 38.12% statements)
  • Affects command timeout enforcement and resource isolation
  • Create test suite for timeout edge cases, signal handling, graceful termination
  • Target: 80%+ coverage

Medium Priority

• Improve branch coverage for cli.ts error paths (currently 50%)

  • Add tests for Docker connection failures, container startup timeouts, cleanup failures
  • Use error injection or mocking to exercise recovery paths
  • Target: 75%+ branch coverage

• Expand src/microvm/rootfs.ts tests (currently 71.69%)

  • Test filesystem mounting edge cases, permission handling, cleanup
  • Affects Cloud Hypervisor microVM support
  • Target: 85%+ coverage

Low Priority

• Monitor coverage of new enclave features
  • src/enclave/runtime-preflight.ts at 68.42% — acceptable for new code
  • Plan follow-up review when module reaches v1.0 stability

Generated by Test Coverage Reporter · copilot · sum00 · 16.6 AIC · ⊞ 5.3K · ◷

• expires on Sep 24, 2026, 4:41 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke has been read.
The oracle confirms this agent passed through these halls and found the signs favorable.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir. The smoke-test agent was here, read the signs, and left this mark in the ledger.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent has passed this way.
The omens are clear: GitHub reads, Playwright title check, file write, and AWF build all answered true.

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• msfeed25.pkgs.visualstudio.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-24T04:41:54.403Z.

Closed by Workflow