[Coverage Report] Test Coverage Report — 2026-09-25

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-25

Overall Coverage

The project maintains strong test coverage across the codebase:

Metric	Coverage	Statements	Status
Lines	92.64%	16,888 / 18,228	✅ Excellent
Statements	91.12%	17,751 / 19,480	✅ Excellent
Functions	89.11%	2,662 / 2,987	✅ Very Good
Branches	84.22%	10,217 / 12,130	⚠️ Good

Overall Assessment: The project achieves 90%+ coverage on statements and lines, indicating comprehensive test coverage.

🛡️ Security-Critical Path Status

Core security-critical files maintain excellent coverage:

File	Statements	Branches	Functions	Status
src/squid-config.ts	100% ✅	100% ✅	100% ✅	Fully Tested
src/docker-manager.ts	100% ✅	100% ✅	100% ✅	Fully Tested
src/domain-patterns.ts	100% ✅	89.47% ✅	100% ✅	Well Covered
src/cli.ts	85.71% ✅	—	—	Good Coverage

Finding: The primary firewall and network isolation logic is well-tested. Domain validation and CLI orchestration logic have solid coverage.

📋 Coverage Table

Directory-Level Coverage

Directory	Statements	Branches	Functions	Risk Level
src/	97.46%	92.89%	98.59%	✅ LOW
src/bounded-execution/	55.45%	41.98%	71.92%	🔴 CRITICAL
src/cloud-hypervisor/	92.14%	85.08%	88.97%	✅ LOW
src/commands/	96.9%	90.9%	94.19%	✅ LOW
src/config/	99.18%	98.75%	100%	✅ LOW
src/enclave/	91.43%	83.97%	94.19%	✅ LOW
src/logs/	98.65%	91.73%	100%	✅ LOW
src/microvm/	86.59%	82.97%	88.93%	✅ ACCEPTABLE
src/nvx/	79.79%	68.4%	72.64%	🟡 MEDIUM
src/parsers/	99.06%	98.45%	100%	✅ LOW
src/routing/	79.22%	66.9%	83.33%	🟡 MEDIUM
src/services/	98.05%	—	—	✅ LOW

🔧 Function Audit

⚠️ CRITICAL GAPS (< 50% Coverage)

File	Statements	Branches	Functions	Lines	Issue
src/bounded-execution/finite-schema.ts	49.31% 🔴	42.66% 🔴	69.56%	52.84%	Schema validation logic under-tested; complex branching logic needs more edge cases
src/bounded-execution/finite-cardinality.ts	46.03% 🔴	35.29% 🔴	66.66%	52.83%	Cardinality bounds checking has gaps; 22 statements untested
src/nvx/cleanup-registry.ts	42.8% 🔴	32.11% 🔴	54.23%	41.32%	Cleanup logic for NVX executor state is under-tested; 146+ lines untested

🟡 MEDIUM CONCERNS (50–79% Coverage)

File	Statements	Branches	Key Gap
src/microvm/network-reservation.ts	51.08%	55.07%	Network allocation and conflict detection missing test paths
src/bounded-execution/finite-disclosure.ts	51.78%	11.42% 🔴	Only 11% branch coverage—disclosure limits control flow is mostly untested
src/nvx/ (directory)	79.79%	68.4%	Several executor lifecycle functions lack full branch coverage
src/routing/ (directory)	79.22%	66.9%	Gateway fallback and dynamic delegation logic incomplete

📅 Recent Source Changes (last 7 days)

Unable to retrieve recent commit history due to system constraints. Last coverage measurement taken on 2026-09-25 at 04:53 UTC.

🔎 Notable Findings

1. Bounded-Execution Module Systematically Under-tested: All three files (finite-schema.ts, finite-cardinality.ts, finite-disclosure.ts) show <50% statement coverage. These modules implement critical cardinality bounds and disclosure controls for agent confinement, and they deserve dedicated test expansion.

2. NVX Cleanup Registry Missing Error Path Coverage: src/nvx/cleanup-registry.ts at 42.8% statements suggests cleanup error handling, rollback scenarios, and edge cases in executor state removal are largely untested.

3. Finite-Disclosure Branch Coverage Critically Low: At 11.42%, this indicates the disclosure-limiting conditional logic is almost entirely untested. Given the security sensitivity of info disclosure in agent sandboxing, this is a priority gap.

4. Core Firewall & CLI: Excellent Coverage: The primary egress filtering (squid-config.ts, domain-patterns.ts) and orchestration (cli.ts, docker-manager.ts) achieve 100% or near-100% coverage, validating the main security-critical paths.

🎯 Recommendations

🔴 HIGH PRIORITY

• Expand src/bounded-execution/ test suite (~3–5 new test files recommended)

  • Add edge cases for cardinality boundary conditions (finite-cardinality.ts)
  • Test schema validation error paths and complex nested structures (finite-schema.ts)
  • Add full branch coverage for disclosure control conditions (finite-disclosure.ts)
  • Impact: Covers 532 total statements, 393 branch conditions across the module
  • Effort: Medium (2–3 hours of test authoring)

• Add error and recovery path tests for src/nvx/cleanup-registry.ts

  • Test cleanup failure scenarios, partial state cleanup, and idempotency
  • Add negative test cases for registry mutation and rollback
  • Impact: Increases from 42.8% to target 75%+ coverage
  • Effort: Medium (1.5–2 hours)

🟡 MEDIUM PRIORITY

• Improve src/microvm/network-reservation.ts test coverage to 75%+

  • Add tests for IP allocation conflicts and boundary conditions
  • Test subnet exhaustion and fragmentation scenarios
  • Effort: Low–Medium (1–1.5 hours)

• Strengthen routing module tests (src/routing/) to 85%+

  • Gateway fallback and dynamic delegation logic incomplete
  • Add conditional branch tests
  • Effort: Low (1 hour)

⚪ LOW PRIORITY

• Domain pattern branch gap (89.47%→100%):
  • Identify the 2 uncovered edge cases and add minimal tests
  • Effort: <30 minutes

---

Summary: Firewall security paths are well-protected; focus expansion efforts on bounded-execution isolation logic and NVX cleanup resilience. Aiming for 85%+ branch coverage across critical modules within the next sprint.

Generated by Test Coverage Reporter · copilot · sum00 · 28.7 AIC · ⊞ 5.3K · ◷

• expires on Oct 2, 2026, 4:58 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-02T04:58:46.219Z.

Closed by Workflow