[Coverage Report] Test Coverage Report — 2026-09-25

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-25

Overall Coverage

Metric	Coverage
Statements	91.12% (17,752 / 19,481)
Lines	92.64% (16,889 / 18,229)
Functions	89.11% (2,662 / 2,987)
Branches	84.22% (10,217 / 12,130)

Summary: The codebase maintains strong test coverage above the 80% threshold across most metrics, with all categories exceeding baseline standards. Branch coverage (84.22%) represents the lowest metric, indicating some complex conditional logic remains untested.

---

🛡️ Security-Critical Path Status

Three security-critical components show CRITICAL coverage gaps:

File	Statements	Branches	Risk Level
src/nvx/cleanup-registry.ts	42.8% ⚠️	32.11% ⚠️	CRITICAL
src/bounded-execution/finite-cardinality.ts	46.03% ⚠️	35.29% ⚠️	CRITICAL
src/bounded-execution/finite-schema.ts	49.31% ⚠️	42.66% ⚠️	CRITICAL

These files are responsible for:

• cleanup-registry.ts: NVX artifact registry cleanup (prevents resource leaks)
• finite-cardinality.ts: Bounded execution resource cardinality constraints (security isolation)
• finite-schema.ts: Schema validation for bounded execution (prevents injection attacks)

All three files have statement coverage below 50% and branch coverage below 45%, indicating many code paths remain untested.

---

📋 Coverage Table — Low Coverage Files (<70%)

#	File	Statements	Branches	Type	Status
1	src/nvx/cleanup-registry.ts	42.8% 🔴	32.11% 🔴	Security	CRITICAL
2	src/bounded-execution/finite-cardinality.ts	46.03% 🔴	35.29% 🔴	Security	CRITICAL
3	src/bounded-execution/finite-schema.ts	49.31% 🔴	42.66% 🔴	Security	CRITICAL
4	src/microvm/network-reservation.ts	51.08% 🟠	55.07% 🟡	Networking	HIGH
5	src/bounded-execution/finite-disclosure.ts	51.78% 🟠	11.42% 🔴	Security	HIGH
6	src/nvx/cleanup-store.ts	65.59% 🟡	55.1% 🟡	Storage	MEDIUM
7	src/nvx/preflight.ts	70.83% 🟡	73.33% 🟡	Validation	MEDIUM
8	src/microvm/rootfs.ts	71.69% 🟡	54.54% 🟡	Filesystem	MEDIUM

---

🔧 Function Audit

Functions with 0% coverage or stub-only implementation:

File	Function	Impact
src/nvx/index.ts	61/62 functions	Export index stubs (functions exported but not called in tests)
src/nvx/cleanup-registry.ts	27/59 functions (45.7% uncovered)	Registry cleanup and state management
src/nvx/confinement.ts	4/30 functions (13.3% uncovered)	Sandbox confinement rules
src/bounded-execution/finite-schema.ts	7/23 functions (30.4% uncovered)	Schema validation logic
src/microvm/rootfs.ts	0/6 functions (0% uncovered, but 28.3% line coverage gap)	Root filesystem assembly

High-coverage success examples:

• src/microvm/guest-protocol.ts: 100% coverage (security-critical IPC protocol)
• src/microvm/infrastructure.ts: 100% coverage (network and resource setup)
• src/nvx/runtime-validation.ts: 98.78% coverage (runtime constraint validation)
• src/nvx/filesystem-write-policy.ts: 96.84% coverage (write permission enforcement)

---

📅 Recent Source Changes (last 7 days)

Recent commits affecting major source areas:

• 2026-09-25: Upgrade gh-aw and recompile workflows (Upgrade gh-aw and recompile workflows #9002)
• 2026-09-24: Wire task-level model routing into host workflow (Wire task-level model routing into the host workflow #8985)
• 2026-09-23: Reach Cloud Hypervisor parity for NVX microVM backend (Reach Cloud Hypervisor parity for the NVX microVM backend #8983)
• 2026-09-23: Extract dynamic enclave launch test fixture (Extract dynamic enclave launch test fixture #8987)
• 2026-09-22: Add GitHub REST and GraphQL API point budgets (Add GitHub REST and GraphQL API point budgets #8978)

Impact on coverage: Recent NVX microVM backend changes (commit #8983) likely increased complexity in src/nvx/*.ts and src/microvm/*.ts files. Task-level routing (#8985) may have introduced new code paths in bounded execution modules.

---

🔎 Notable Findings

1. Branch coverage debt concentrated in 3 files: The critical 42.8%, 46.03%, and 49.31% statement-level coverage files all show severe branch coverage gaps (32%, 35%, 42% respectively). These are complex control-flow modules that require comprehensive branch testing.

2. Bounded execution module is partially tested: finite-disclosure.ts has only 11.42% branch coverage despite 51.78% statement coverage, suggesting its conditional logic is largely unexercised. This module is critical for resource disclosure control.

3. NVX artifact registry cleanup is largely untested: cleanup-registry.ts has only 100/242 lines covered, affecting 59 functions. This cleanup logic is essential for preventing resource leaks in artifact staging and microVM lifecycle management.

4. High-quality security modules exist as reference: Modules like runtime-validation.ts (98.78%), filesystem-write-policy.ts (96.84%), and guest-protocol.ts (100%) demonstrate that robust test coverage is achievable and should serve as benchmarks for missing test coverage in sister modules.

---

🎯 Recommendations

🔴 HIGH — Stabilize Security-Critical Path

Priority: Immediate (Sprint Current)

• Action: Expand test suite for src/nvx/cleanup-registry.ts to reach 80%+ statement and branch coverage

  • Focus: Registry state transitions, garbage collection logic, edge cases in artifact removal
  • Expected impact: Eliminates CRITICAL risk for artifact staging resource leaks
  • Estimated effort: 16-20 test cases covering 100+ untested statements

• Action: Add comprehensive branch tests for src/bounded-execution/finite-disclosure.ts (currently 11.42% branch coverage)

  • Focus: Timing side-channel disclosure detection, threshold enforcement, edge cases
  • Expected impact: Reduces CRITICAL vulnerability surface for information disclosure
  • Estimated effort: 8-12 complex branch scenarios

🟠 MEDIUM — Close Known Coverage Gaps

Priority: Next Sprint

• Action: Improve src/bounded-execution/finite-cardinality.ts and finite-schema.ts to 70%+ coverage

  • Pair: Add integration tests for schema validation + cardinality enforcement interaction
  • Focus areas: Schema type mismatch handling, cardinality overflow scenarios, recovery paths
  • Estimated effort: 24-32 additional test cases across both files

• Action: Increase src/microvm/network-reservation.ts branch coverage from 55% to 75%+

  • Focus: Network conflict detection, fallback allocation, reservation expiry logic
  • Estimated effort: 10-14 additional branch tests

🟡 LOW — Establish Test Quality Baseline

Priority: Backlog (Future Sprints)

• Action: Document test coverage strategy and minimum thresholds (recommend: 80% statements, 75% branches)

  • Create CI check: Fail builds if statement coverage drops below threshold for critical files
  • Estimated effort: 2-4 hours

• Action: Use src/microvm/guest-protocol.ts (100%) as reference implementation for writing new tests

  • Pattern: Comprehensive state-machine testing with edge-case branches
  • Estimated effort: Documentation only

---

Next Review: Post-implementation of HIGH-priority fixes. Target coverage after remediation: 85%+ statements, 78%+ branches across all critical files.

Generated by Test Coverage Reporter · copilot · sum00 · 22.2 AIC · ⊞ 5.3K · ◷

• expires on Oct 2, 2026, 3:51 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-02T15:51:42.958Z.

Closed by Workflow