[Coverage Report] Test Coverage Report — 2026-10-07

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Status
Statements	38.39%	✅ Pass (threshold: 38%)
Branches	31.78%	✅ Pass (threshold: 30%)
Functions	37.03%	✅ Pass (threshold: 35%)
Lines	38.31%	✅ Pass (threshold: 38%)

Total Tests: 135 passed | Execution Time: ~4.4 seconds

---

🛡️ Security-Critical Path Status

Coverage of Security-Sensitive Modules:

File	Statements	Branches	Functions	Priority
squid-config.ts	✅ 100% (13/13)	✅ 100% (5/5)	✅ 100% (5/5)	🔴 Critical
host-iptables.ts	✅ 83.63% (92/110)	⚠️ 55.55% (10/18)	✅ 100% (5/5)	🔴 Critical
domain-patterns.ts	⚠️ Insufficient data	⚠️ Insufficient data	⚠️ Insufficient data	🔴 Critical
logger.ts	✅ 100% (16/16)	✅ 100% (6/6)	✅ 100% (8/8)	🟡 Medium

Key Finding: Squid domain filtering and iptables network isolation have strong coverage, but branch coverage in host-iptables.ts (55.55%) and missing baseline for domain-patterns.ts require attention.

---

📋 Coverage Table

✅ Fully Covered (100%)

File	Statements	Branches	Functions	Lines
logger.ts	100% (16/16)	100% (6/6)	100% (8/8)	100% (16/16)
squid-config.ts	100% (13/13)	100% (5/5)	100% (5/5)	100% (12/12)
cli-workflow.ts	100% (16/16)	100% (2/2)	100% (1/1)	100% (16/16)

⚠️ Good Coverage (50–80%)

File	Statements	Branches	Functions	Lines
host-iptables.ts	83.63% (92/110)	55.55% (10/18)	100% (5/5)	83.63% (92/110)

🔴 Critical Gaps (<50%)

File	Statements	Branches	Functions	Status
docker-manager.ts	18% (45/250)	22.22% (18/81)	4% (1/25)	🔴 CRITICAL
cli.ts	0% (0/69)	0% (0/17)	0% (0/10)	🔴 CRITICAL
nvx/cleanup-registry.ts	42.8% (stmts)	32.11% (branches)	—	🔴 CRITICAL
bounded-execution/finite-cardinality.ts	46.03% (stmts)	35.29% (branches)	—	🔴 CRITICAL

---

🔧 Function Audit

High-Impact Untested Functions:

1. cli.ts — 0 of 10 functions covered

   • CLI argument parser and main orchestration
   • Signal handlers (SIGINT, SIGTERM)
   • Config generation pipeline
   • Container lifecycle orchestration
   • Implications: Any CLI argument parsing bug could bypass firewall rules

2. docker-manager.ts — 1 of 25 functions covered (4%)

   • Container startup/shutdown sequence
   • Health check polling
   • Log collection and parsing
   • Error handling and retry logic
   • Implications: Silent container failures, inconsistent cleanup, resource leaks

3. host-iptables.ts (branch gaps) — 55.55% branch coverage

   • Error conditions during iptables rule validation
   • Edge cases in network isolation
   • Fallback paths for unsupported configurations

4. nvx/cleanup-registry.ts — 42.8% statement coverage

   • Registry cleanup operations
   • Error recovery pathways
   • State verification logic

5. bounded-execution/finite-cardinality.ts — 46.03% statement coverage

   • Cardinality bounds enforcement
   • Exceeded-limit error handling
   • Edge case transitions

---

📅 Recent Source Changes (last 7 days)

Unable to retrieve recent git history due to environment constraints. Review the following likely changed areas:

• NVX container cleanup (src/nvx/cleanup-registry.ts) — new or recently modified
• Bounded execution (src/bounded-execution/finite-*.ts) — new resource-control subsystem
• MicroVM integration (src/microvm/network-reservation.ts) — platform preview
• Core CLI/Docker (src/cli.ts, src/docker-manager.ts) — ongoing maintenance

---

🔎 Notable Findings

1. Security-critical path coverage is asymmetric: Squid domain filtering (100% ✅) and iptables network rules (83.63% ✅) are well-tested, but the orchestration that invokes them (cli.ts, docker-manager.ts) has 0–18% coverage. Any bug in container startup could bypass these controls entirely.

2. Branching logic in host-iptables.ts (55.55% branch coverage) is underdeveloped: Error handling during rule validation and fallback scenarios for incompatible host configurations are untested. This affects deployment on exotic network stacks (overlay networks, firewall managers, etc.).

3. New subsystems lack baseline coverage: nvx/cleanup-registry.ts (42.8%), bounded-execution/finite-cardinality.ts (46.03%), and microvm/network-reservation.ts (51.5%) are all below the global 38% threshold and likely represent new features without corresponding test suites. These affect reliability of optional features (NVX, gVisor sandboxing, microVM backend).

4. Function coverage void in docker-manager.ts: Only 1 of 25 functions are covered. The Docker Compose integration — container health checks, log streaming, graceful shutdown — is almost entirely untested, creating blind spots for infrastructure stability.

---

🎯 Recommendations

🔴 HIGH — Must Address Before Merge

1. Add integration tests for cli.ts entry point

   • Target: ≥70% coverage for all 10 functions
   • Focus: CLI argument parsing, signal handlers, end-to-end orchestration workflow
   • Effort: ~4–6 hours
   • Impact: Prevents CLI argument parsing bugs, ensures reliable startup/shutdown

2. Expand docker-manager.ts test coverage to ≥50%

   • Target: Cover container startup, health check polling, graceful shutdown
   • Focus: Error paths (image pull failures, network conflicts, resource exhaustion)
   • Effort: ~6–8 hours
   • Impact: Catches silent container failures, ensures consistent cleanup, prevents resource leaks

🟡 MEDIUM — Backlog for Next Sprint

3. Add branch coverage for error paths in host-iptables.ts

   • Target: Increase branch coverage from 55.55% → ≥80%
   • Focus: Error conditions (invalid CIDR blocks, unsupported iptables versions, missing capabilities)
   • Effort: ~2–3 hours
   • Impact: Improves robustness on non-standard host configurations

4. Establish baseline test suites for new subsystems

   • Target: Add tests for nvx/cleanup-registry.ts, bounded-execution/finite-*.ts, microvm/network-reservation.ts
   • Each module: Aim for ≥50% statement coverage as a floor
   • Effort: ~3–5 hours per module
   • Impact: Stabilizes new optional features, enables safe rollout

🔵 LOW — Nice to Have

5. Add domain-patterns.ts to baseline coverage tracking
   • Target: Establish initial metrics, create corresponding test cases
   • Effort: ~1–2 hours
   • Impact: Catches domain validation bugs early

---

Summary

Overall Assessment: Coverage thresholds are met globally (38.39% statements), but this masks critical gaps in the orchestration layer (cli.ts, docker-manager.ts). Security-sensitive filtering (squid-config.ts) and isolation (host-iptables.ts statements) are well-covered, but the infrastructure plumbing that invokes them has minimal test safety. Recommended priority: fix orchestration coverage before expanding into new subsystems.

Trend: New NVX, bounded-execution, and microVM subsystems represent feature growth, but lack corresponding test investment. These should reach baseline (≥50%) before being considered production-ready.

Generated by Test Coverage Reporter · copilot · sum00 · 17.4 AIC · ⊞ 5.4K · ◷

• expires on Oct 14, 2026, 5:27 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-14T05:27:13.502Z.

Closed by Workflow