[Coverage Report] Test Coverage Report — 2026-10-06

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-06

Overall Coverage

Based on coverage metrics from the latest test run:

Metric	Coverage
Statements	91.31%
Branches	84.99%
Functions	89.73%
Lines	92.87%

✅ Overall project coverage is strong at 91.31% statements, well above the 80% safety threshold for security-critical software.

🛡️ Security-Critical Path Status

Security-critical files (domain filtering, network isolation, container orchestration) all meet or exceed coverage targets:

🟢 OK - src/docker-manager.ts: excellent coverage
🟢 OK - src/host-iptables.ts: excellent coverage
🟢 OK - src/squid-config.ts: excellent coverage
🟢 OK - src/domain-patterns.ts: excellent coverage
🟢 OK - src/cli.ts: excellent coverage

All security-critical components are well-tested with strong coverage across statements, branches, and functions.

📋 Coverage Table

Files with coverage gaps (< 80% statements):

File	Stmts	Branch	Status
src/nvx/cleanup-registry.ts	42.8%	32.11%	🔴 CRITICAL
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	🔴 CRITICAL
src/microvm/network-reservation.ts	51.5%	54.86%	🟡 LOW
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	🟡 LOW
src/bounded-execution/finite-schema.ts	57.07%	56.88%	🟡 LOW

🔧 Function Audit

Coverage gap analysis by subsystem:

• nvx/ (NVX runtime backend, preview feature):

  • cleanup-registry.ts — artifact registry cleanup with only 42.8% statement coverage
  • cleanup-record.ts — individual record cleanup with low branch coverage
  • Status: High-priority for test expansion before production use

• bounded-execution/ (resource confinement module):

  • finite-cardinality.ts — cardinality bounds with 46% coverage
  • finite-disclosure.ts — disclosure bounds with 11.42% branch coverage
  • finite-schema.ts — schema validation with 57% coverage
  • Status: Moderate priority; feature is new but not security-blocking

• microvm/ (Cloud Hypervisor backend, preview):

  • network-reservation.ts — network namespace isolation with 51.5% coverage
  • Status: Acceptable for preview; should improve before GA

📅 Recent Source Changes (last 7 days)

The main branch has ongoing development in:

• Runtime backend improvements (nvx, Cloud Hypervisor preview features)
• Bounded execution and resource confinement
• Container lifecycle and startup optimization

Recommendation: Triage coverage for newly added features in these areas, as preview features are not yet production-ready.

🔎 Notable Findings

• No security-critical path gaps detected — All core firewall components (docker-manager.ts, host-iptables.ts, squid-config.ts, domain-patterns.ts, cli.ts) maintain excellent coverage.
• Preview feature coverage is secondary — The critical gaps are concentrated in new, feature-flagged subsystems (nvx, bounded-execution, microvm) that are intentionally in preview status.
• Branch coverage dips in emerging modules — finite-disclosure.ts (11.42% branch) and cleanup-registry.ts (32.11% branch) indicate edge cases and error paths need test attention.
• No regression detected — Overall project coverage remains stable at 91.31%; no previously-covered code has regressed.

🎯 Recommendations

High Priority

• Expand test cases for src/nvx/cleanup-registry.ts (42.8% → 70%+)
  • Target: artifact registry lifecycle scenarios (create, update, cleanup, error recovery)
  • Effort: ~4–6 hours of test development
  • Rationale: NVX is a preview feature; once promoted to beta, this module is critical

Medium Priority

• Improve branch coverage for src/bounded-execution/finite-disclosure.ts (11.42% → 50%+)
  • Target: edge cases in schema validation, boundary enforcement, error conditions
  • Effort: ~2–3 hours
  • Rationale: Disclosure bounds are part of resource confinement; ensure all validation paths are tested

Low Priority

• Add integration tests for src/microvm/network-reservation.ts (51.5% → 65%+)
  • Target: namespace setup, network isolation, cleanup scenarios
  • Effort: ~1–2 hours
  • Rationale: Cloud Hypervisor backend is preview; good-to-have for stability

---

Generated: 2026-10-06 | Workflow: test-coverage-reporter | Coverage Tool: Jest + istanbuljs

Generated by Test Coverage Reporter · copilot · sum00 · 18.7 AIC · ⊞ 5.4K · ◷

• expires on Oct 13, 2026, 5:42 PM UTC