[Coverage Report] Test Coverage Report — 2026-10-07

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-07

Overall Coverage

Metric	Coverage	Trend
Statements	91.43%	✅ Excellent
Branches	85.08%	✅ Strong
Functions	90.08%	✅ Excellent
Lines	92.96%	✅ Excellent

The project maintains strong overall test coverage across all metrics. Statement and line coverage exceed 91%, with branch coverage at a healthy 85.08%. This indicates comprehensive unit testing and good path coverage for most code paths.

---

🛡️ Security-Critical Path Status

Core firewall and network isolation components show excellent coverage:

File	Lines	Statements	Functions	Status
src/docker-manager.ts	100%	100%	100%	✅ Fully Tested
src/squid-config.ts	100%	100%	100%	✅ Fully Tested
src/domain-patterns.ts	100%	100%	100%	✅ Fully Tested
src/host-iptables-chain.ts	100%	100%	100%	✅ Fully Tested
src/host-iptables-cleanup.ts	100%	100%	100%	✅ Fully Tested
src/host-iptables-network.ts	100%	100%	100%	✅ Fully Tested
src/cli.ts	85.71%	85.71%	100%	⚠️ Minor Gap (1 line)

Key Finding: All security-critical network isolation and firewall configuration modules have 100% coverage, which is exceptional for a security-focused project. The only minor gap is in src/cli.ts (the entry point), which has 1 uncovered line (likely an error handling or edge case).

---

📋 Coverage Table

Files with Coverage < 80% (Requires Attention):

File	Statements	Branches	Functions	Priority
src/nvx/cleanup-registry.ts	42.8%	32.11%	—	🔴 CRITICAL
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	—	🔴 CRITICAL
src/microvm/network-reservation.ts	51.5%	54.86%	—	🟠 HIGH
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	—	🟠 HIGH
src/bounded-execution/finite-schema.ts	57.07%	56.88%	—	🟠 HIGH
src/artifact-permissions.ts	82.08%	80%	80%	🟡 MEDIUM
src/config-writer.ts	89.17%	83.21%	94.11%	🟡 MEDIUM
src/cli.ts	85.71%	50%	100%	🟡 MEDIUM

---

🔧 Function Audit

High-Value Functions in Critical Gaps:

1. src/nvx/cleanup-registry.ts (42.8% coverage)

   • Purpose: NVX (Network Virtualization eXtension) registry cleanup
   • Risk: Low coverage on registry state management and cleanup path
   • Impact: Potential resource leaks if cleanup paths aren't exercised

2. src/bounded-execution/finite-cardinality.ts (46.03% coverage)

   • Purpose: Enforce bounded cardinality constraints (prevent unlimited resource allocation)
   • Risk: Low coverage on constraint validation logic
   • Impact: Missing tests could allow unbounded resource requests to bypass limits

3. src/bounded-execution/finite-disclosure.ts (51.78%, branch coverage 11.42% ⚠️)

   • Purpose: Bound information disclosure during execution
   • Risk: Extremely low branch coverage indicates most conditional paths untested
   • Impact: Security risk; disclosure constraints may not be enforced

---

📅 Recent Source Changes (last 7 days)

7 commits to src/ in the last week:

1. b3f1fa1 — feat: distinguish enclave mount capture failure hypotheses (feat: distinguish enclave mount capture failure hypotheses #9525)
2. a375a8f — Reject unsupported reasoning efforts before proxying (Reject unsupported reasoning efforts before proxying #9520)
3. b9f235a — Add granular Cloud Hypervisor artifact snapshot diagnostics (Add granular Cloud Hypervisor artifact snapshot diagnostics #9521)
4. 4b1a19e — Clarify max-turns guidance in LLM invocation-cap errors (Clarify max-turns guidance in LLM invocation-cap errors #9512)
5. 4790477 — fix: build before running tests (fix: build before running tests #9517)

Modified files include:

• src/domain-patterns.ts (security-critical, 100% coverage ✅)
• src/host-env.ts, src/runner-tool-cache.ts (infrastructure)
• Multiple src/services/agent-volumes/* (sandbox setup)
• src/api-proxy-config-*.ts (API proxy routing)

Positive Signal: Recent changes to security-critical files like domain-patterns.ts show strong test coverage.

---

🔎 Notable Findings

1. 🟢 Security-Critical Code is Highly Tested

   • Firewall rules (squid-config.ts), network isolation (host-iptables-*.ts), and domain matching (domain-patterns.ts) all have 100% statement coverage
   • Docker orchestration (docker-manager.ts) is also fully tested
   • This is a strong defensive posture for the core mission

2. 🟠 Bounded-Execution Module Lacks Coverage

   • Three files in src/bounded-execution/ have significantly lower coverage (42–58%)
   • finite-disclosure.ts has critically low 11.42% branch coverage, suggesting entire conditional branches are never executed during tests
   • These appear to be newer features (Cloud Hypervisor, enclaves) with incomplete test harnesses

3. 🟡 Entry Point (cli.ts) Has Minor Gap

   • 1 uncovered line in src/cli.ts (likely error handling or signal cleanup)
   • Not a critical security gap, but worth investigating for completeness

4. ✅ Branch Coverage is Healthy

   • Overall branch coverage at 85.08% is strong; most decision points are tested
   • Exception: finite-disclosure.ts with 11.42% branch coverage needs urgent attention

---

🎯 Recommendations

High Priority (Address Immediately)

1. Fix src/bounded-execution/finite-disclosure.ts (🔴 CRITICAL)

• Why: 11.42% branch coverage is dangerously low for security boundary enforcement
• Action: Review disclosure boundary logic; identify and exercise all conditional paths (likely paths for different constraint types or violation scenarios)
• Effort: 2–4 hours (add ~20–30 test cases for constraint branches)
• Security Impact: High — tests ensure disclosure limits are actually enforced

2. Add Coverage for src/bounded-execution/finite-cardinality.ts (🔴 CRITICAL)

• Why: 46.03% coverage on resource cardinality constraints leaves gaps in limit enforcement
• Action: Expand test cases to cover all cardinality constraint types and edge cases (zero, negative, max-int, overflow scenarios)
• Effort: 3–5 hours
• Security Impact: High — prevents unbounded resource consumption attacks

Medium Priority (Improve in Next Sprint)

3. Increase Coverage for src/nvx/cleanup-registry.ts (🟠 HIGH)

• Why: 42.8% coverage on cleanup logic risks resource leaks in network virtualization
• Action: Add tests for registry state transitions, cleanup error handling, and partial-cleanup recovery
• Effort: 2–3 hours
• Operational Impact: Medium — affects container/network cleanup reliability

4. Refactor/Extend Tests for src/config-writer.ts (🟡 MEDIUM)

• Why: 83.21% branch coverage; identify and test remaining edge cases in configuration generation
• Action: Review branch miss report; focus on error handling paths and edge case configurations
• Effort: 1–2 hours

Low Priority (Polish)

5. Add 1 Test Case for src/cli.ts (🟡 MEDIUM)

• Why: 1 uncovered line likely represents error handling or cleanup edge case
• Action: Identify and test the missing line (e.g., signal handler, cleanup path)
• Effort: 15–30 minutes
• Impact: Marginal, but brings coverage to 100%

---

Summary

Verdict: The project has excellent coverage for security-critical paths (firewall, network isolation, domain filtering all at 100%). However, bounded-execution and NVX modules need urgent attention, particularly finite-disclosure.ts with its critically low branch coverage. The overall coverage trend is positive, and recent commits show good test discipline.

Next Steps:

1. Open issues for the three critical/high-priority items
2. Assign to backend team for bounded-execution improvements
3. Re-run coverage report after fixes to validate improvement

Generated by Test Coverage Reporter · copilot · sum00 · 23.8 AIC · ⊞ 5.4K · ◷

• expires on Oct 14, 2026, 1:48 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-14T01:48:30.041Z.

Closed by Workflow