[Coverage Report] Test Coverage Report — 2026-10-12

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-12

Overall Coverage

Metric	Coverage
Statements	91.68%
Branches	85.44%
Functions	90.35%
Lines	93.13%

🛡️ Security-Critical Path Status

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=85.71% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 Coverage Table

File	Stmts	Branch	Funcs	Lines	Status
src/nvx/cleanup-registry.ts	42.8%	32.11%	54.23%	41.32%	❌
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%	52.83%	❌
src/microvm/network-reservation.ts	51.5%	54.86%	58.33%	53.27%	⚠️
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.5%	54.16%	⚠️
src/bounded-execution/finite-schema.ts	57.07%	56.88%	73.91%	59.58%	⚠️
src/nvx/cleanup-store.ts	65.59%	55.1%	71.42%	70.58%	⚠️
src/bounded-execution/strict-json-parser.ts	67.53%	65.04%	100%	83.49%	⚠️
src/nvx/preflight.ts	70.83%	73.33%	54.54%	72.03%	⚠️
src/microvm/rootfs.ts	71.69%	54.54%	100%	72%	⚠️
src/enclave/runtime-preflight.ts	72.72%	48.88%	100%	70.73%	⚠️
src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	80%	66.66%	⚠️
src/cloud-hypervisor/cleanup-vmm-identity.ts	75.86%	70.76%	100%	79.24%	⚠️
src/cloud-hypervisor/virtiofsd.ts	79.38%	66.66%	64.28%	80.76%	⚠️
src/nvx/one-shot-adapter.ts	79.63%	67.3%	89.65%	82.3%	⚠️
src/enclave/github-gateway.ts	79.8%	74.13%	83.87%	82.56%	⚠️
src/routing/bootstrap.ts	79.8%	68.27%	83.33%	85.26%	⚠️
src/nvx/runtime-lifecycle.ts	79.88%	63.59%	92.98%	84.56%	⚠️
src/cli.ts	85.71%	50%	100%	85.71%	✅
src/microvm/vsock-client.ts	93.07%	90.6%	91.3%	97.07%	✅
src/enclave/delegation-control-client.ts	94.92%	94.73%	92%	94.53%	✅
TOTAL	91.68%	85.44%	90.35%	93.13%

🔧 Function Audit

=== host-iptables.ts ===
=== squid-config.ts ===
=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 394 / Source files: 386

📅 Recent Source Changes (last 7 days)

src/agent-entrypoint-output.test.ts
src/agent-helper-staging.test.ts
src/agent-runtime-start.test.ts
src/agent-runtime-start.ts
src/api-proxy-config-domains.test.ts
src/api-proxy-config-domains.ts
src/api-proxy-config-validation.test.ts
src/api-proxy-config-validation.ts
src/api-proxy-config-warnings.test.ts
src/api-proxy-config-warnings.ts
+export function isCloudHypervisorScriptAcceptanceWorkflow(
+export function resolveAgentRuntimeStartFile(workDir: string, proxyLogsDir?: string): string {
+export function readAgentRuntimeStartTimeMs(workDir: string, proxyLogsDir?: string): number | undefined {
+export function ensureAgentRuntimeStartMarker(workDir: string, proxyLogsDir?: string): number | undefined {
+export function assertCloudHypervisorEnclaveExportsIsolated(
+export function validateEnclavesStructure(
+export function resolveRunSandboxBackend(primaryRuntime?: string): RunSandboxBackend {
+export function validateRunSandboxBackend(
+export async function captureEnclaveStartupDiagnostics(
+export async function planNvxLiveMounts(

🔎 Notable Findings

• 🛡️ All five security-critical files meet the 80% bar; host-iptables.ts, squid-config.ts, and docker-manager.ts are at 100% across all metrics.
• ⚠️ src/cli.ts has 100% function coverage but only 50% branch coverage, so orchestration error paths are largely untested.
• ❌ Two files are critically low: src/nvx/cleanup-registry.ts (42.8% statements, 32.11% branches) and src/bounded-execution/finite-cardinality.ts (46.03% statements, 35.29% branches).
• 📉 src/bounded-execution/finite-disclosure.ts has 11.42% branch coverage, the lowest branch figure in the report.

🎯 Recommendations

1. High — Raise branch coverage in src/cli.ts (50%). Add tests for error and validation branches in the command orchestration path.
2. Medium — Add tests for src/nvx/cleanup-registry.ts and src/bounded-execution/finite-cardinality.ts, which are both below 50% statement coverage. Start with the untested branches listed in the coverage-gaps brief.
3. Low — Improve src/bounded-execution/finite-disclosure.ts branch coverage (11.42%) and src/microvm/network-reservation.ts (51.5% statements), then bring the remaining ⚠️ files above 80%.

---

Generated by test-coverage-reporter workflow. Trigger: push

Generated by Test Coverage Reporter · copilot · sum00 · 0.764 AIC · ⊞ 7.2K · ◷

• expires on Oct 19, 2026, 11:38 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent was here.

The omens were read, the circuits consulted, and this discussion now bears the mark of the oracle.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[manamansor]

مرحباً فريق GitHub Action, شكراً لكم على التحديث. لقد قمت بإضافة الوسم 'ready-for-aw' إلى التشغيل كما هو مطلوب لبدء الاختبار مرة أخرى. مع أطيب التحيات، [اسمك] بتاريخ ١٣ أكتوبر ٢٠٢٦ ٢:٥٨:٤١ ص GMT+03:00، "github-actions[bot]" ***@***.***> الرسالة:

…

🔮 The ancient spirits stir, and the smoke-test agent was here. The omens were read, the circuits consulted, and this discussion now bears the mark of the oracle. > 🔮 *The oracle has spoken through [Smoke Codex](https://github.com/github/gh-aw-firewall/actions/runs/38323851066)* > _{Add label <em>ready-for-aw</em> to run again} <!-- gh-aw-agentic-workflow: Smoke Codex, engine: codex, model: gpt-5.4, id: 38323851066, workflow_id: smoke-codex, run: https://github.com/github/gh-aw-firewall/actions/runs/38323851066 --> <!-- gh-aw-workflow-call-id: github/gh-aw-firewall/smoke-codex --> -- Reply to this email directly or view it on GitHub: #9887 (comment) You are receiving this because you are subscribed to this thread. Message ID: ***@***.***>