[Coverage Report] Test Coverage Report — 2026-09-17

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-17

Overall Coverage

Metric	Coverage	Status
Lines	94.19%	✅ Excellent
Statements	92.86%	✅ Excellent
Functions	93.47%	✅ Excellent
Branches	86.64%	✅ Good

Summary: The codebase maintains strong overall coverage at 92.86% statement coverage. All security-critical firewall components are well-tested.

---

🛡️ Security-Critical Path Status

Component	Coverage	Status	Notes
host-iptables.ts	100%	✅ Full	Network isolation rules fully tested
squid-config.ts	100%	✅ Full	Domain ACL filtering fully tested
domain-patterns.ts	100%	✅ Full	Domain matching logic fully tested
domain-validation.ts	100%	✅ Full	Domain validation fully tested
host-iptables-rules.ts	100%	✅ Full	All iptables rule generation covered
host-iptables-shared.ts	100%	✅ Full	Shared iptables utilities covered
cli.ts	85.71%	⚠️ Partial	1 uncovered line; branch coverage at 50%

Key Finding: All core network security components (host-iptables, squid-config, domain-validation) have 100% coverage. The one weakness is cli.ts (85.71%), which handles orchestration but is not security-critical to firewall rules.

---

📋 Coverage Table

Files with < 80% Coverage (by severity)

File	Statements	Branches	Issue
src/bounded-execution/finite-disclosure.ts	38.12%	25.89%	🔴 CRITICAL: 307 uncovered statements
src/microvm/network-reservation.ts	50.22%	54.26%	🟠 HIGH: 110 uncovered statements
src/enclave/runtime-preflight.ts	66.66%	41.02%	🟡 MEDIUM: 12 uncovered statements
src/microvm/rootfs.ts	71.69%	54.54%	🟡 MEDIUM: 15 uncovered statements
src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	🟡 MEDIUM: Test helper coverage (non-critical)
src/cloud-hypervisor/virtiofsd.ts	79.09%	63.15%	🟡 MEDIUM: virtiofsd integration (optional feature)
src/cloud-hypervisor/confinement-verifier.ts	81.57%	64.94%	🟡 MEDIUM: VM confinement verification
src/cloud-hypervisor/cleanup-vmm-identity.ts	75.86%	70.76%	🟡 MEDIUM: Cloud hypervisor cleanup

Files with 80–90% Coverage

Good coverage with minor gaps:

• src/artifact-permissions.ts (82.08%)
• src/config-writer.ts (89.2%)
• src/host-env.ts (95.23%) — Near perfect
• Several Cloud Hypervisor backend modules (80–90%)

---

🔧 Function Audit

Top Issues by Category

1. Bounded Execution Module (CRITICAL)

• File: src/bounded-execution/finite-disclosure.ts
• Issue: 38.12% statement coverage, 25.89% branch coverage
• Impact: Disclosure limitation logic for bounded execution not adequately tested
• Affected Functions: 21 of 47 functions untested (55.31% coverage)

2. MicroVM Network Reservation (HIGH)

• File: src/microvm/network-reservation.ts
• Issue: 50.22% statement coverage, 54.26% branch coverage
• Impact: IP/subnet reservation logic for microVM guests partially untested
• Affected Functions: 19 of 44 functions untested (56.81% coverage)

3. Enclave Runtime Preflight (MEDIUM)

• File: src/enclave/runtime-preflight.ts
• Issue: 66.66% statement coverage, 41.02% branch coverage
• Impact: Pre-flight checks for enclave execution have significant branch gaps
• Risk: Uncommon error paths not validated

4. MicroVM RootFS (MEDIUM)

• File: src/microvm/rootfs.ts
• Issue: 71.69% statement coverage, 54.54% branch coverage
• Impact: 14 statements + 10 branches untested in root filesystem mounting

---

📅 Recent Source Changes (last 7 days)

Analysis is based on current coverage snapshot dated 2026-09-17. Key observations:

1. No regressions detected in core security components
2. Cloud Hypervisor backend shows expected lower coverage (new/optional feature)
3. Bounded execution module remains the lowest-covered component
4. All critical firewall rules modules maintain 100% coverage

---

🔎 Notable Findings

• ✅ Security Excellence: All L7 HTTP/HTTPS filtering (squid-config.ts, domain-*.ts) and L3/L4 isolation (host-iptables-*.ts) achieve 100% coverage — the core security guarantee is robust.
• ⚠️ Bounded Execution Gap: The bounded-execution module (finite-disclosure.ts) at 38% coverage is a quality concern, though this component handles agentic workflow control rather than firewall enforcement.
• 🔵 Optional Features Partial: Cloud Hypervisor and enclave components show 60–85% coverage, appropriate for preview/beta features (not yet GA).
• ✅ Main CLI Stable: Despite 85.71% line coverage, cli.ts is thin wrapper around well-tested orchestration components.

---

🎯 Recommendations

1. Increase Bounded Execution Coverage (🔴 HIGH PRIORITY)

• Target: Raise src/bounded-execution/finite-disclosure.ts from 38% → 70%+
• Effort: ~2–3 days
• Rationale: Controls disclosure limits in agentic workflows; currently 21 functions are untested
• Action: Add unit tests for disclosure policy enforcement, budget calculation, and error handling paths

2. Harden MicroVM Network Tests (🟠 MEDIUM PRIORITY)

• Target: Raise src/microvm/network-reservation.ts from 50% → 75%+
• Effort: ~1–2 days
• Rationale: IP allocation/release for guest network setup; 19 functions untested
• Action: Test IPAM state machine, subnet exhaustion, lease renewal, and cleanup edge cases

3. Document Enclave Preflight Gaps (🟡 LOW PRIORITY)

• Target: Document branch coverage gaps in src/enclave/runtime-preflight.ts (41% branches)
• Effort: ~4 hours
• Rationale: Clarify which error paths are intentionally not tested (e.g., rare/host-dependent conditions)
• Action: Add comment annotations for untested branches; prioritize tests for recoverable failures

---

Report Generated: 2026-09-17
Coverage Baseline: 92.86% statements, 86.64% branches
Status: ✅ HEALTHY — No coverage regression detected. Security-critical components at 100%.

Generated by Test Coverage Reporter · copilot · sum00 · 28.3 AIC · ⊞ 5.3K · ◷

• expires on Sep 24, 2026, 2:24 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-24T02:24:26.391Z.

Closed by Workflow