[Coverage Report] Test Coverage Report — 2026-09-25

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-25

Overall Coverage

Metric	Covered	Total	Percentage
Lines	16,890	18,230	92.64%
Statements	17,753	19,482	91.12%
Functions	2,662	2,987	89.11%
Branches	10,219	12,131	84.23%

Status: ✅ Overall coverage remains strong at 91-93% across key metrics. Branch coverage is the lowest metric at 84.23%, indicating edge cases and conditional logic paths need additional testing.

---

🛡️ Security-Critical Path Status

Security-critical modules show excellent coverage:

File	Lines	Functions	Branches
host-iptables.ts	100%	100%	100%
domain-patterns.ts	100%	100%	89.47%
squid-config.ts	100%	100%	100%
docker-manager.ts	100%	100%	100%
host-iptables-rules.ts	100%	100%	100%
host-iptables-shared.ts	100%	100%	100%

✅ Core security paths are fully covered. Network isolation (iptables), domain filtering (squid-config), and container orchestration (docker-manager) all meet 100% line coverage.

---

📋 Coverage Table

Lowest 25 Files by Line Coverage (excluding test utilities):

#	File	Lines %	Branches %	Status
1	nvx/cleanup-registry.ts	41.32%	32.11%	🔴 CRITICAL
2	bounded-execution/finite-cardinality.ts	52.83%	35.29%	🔴 CRITICAL
3	bounded-execution/finite-schema.ts	52.84%	42.66%	🔴 CRITICAL
4	microvm/network-reservation.ts	52.83%	55.07%	🟠 HIGH
5	bounded-execution/finite-disclosure.ts	54.16%	11.42%	🟡 MEDIUM
6	microvm/rootfs.ts	72.00%	54.54%	🟡 MEDIUM
7	enclave/runtime-preflight.ts	66.66%	43.90%	🟡 MEDIUM
8	nvx/preflight.ts	72.03%	73.33%	🟡 MEDIUM
9	nvx/manager.ts	79.67%	65.00%	🟡 MEDIUM
10	commands/build-config.ts	79.41%	75.83%	🟡 MEDIUM
11	nvx/one-shot-adapter.ts	82.88%	67.24%	🟡 MEDIUM
12	cloud-hypervisor/virtiofsd.ts	80.60%	63.15%	🟡 MEDIUM
13	nvx/cleanup-store.ts	70.58%	55.10%	🟡 MEDIUM
14	enclave/github-gateway.ts	82.56%	74.13%	🟡 MEDIUM
15	nvx/cleanup-record.ts	84.11%	79.13%	⚪ LOW

---

🔧 Function Audit

Function Coverage Gaps (functions < 80% coverage):

File	Functions Covered	Notes
nvx/cleanup-registry.ts	54.23% (32/59)	Critical: Many registry cleanup paths untested
cloud-hypervisor/launcher.ts	63.15% (12/19)	Only 63% of launcher functions tested
nvx/index.ts	3.22% (2/62)	Type/export file; minimal function coverage expected
nvx/manager.ts	57.89% (22/38)	NVX manager functions lack test coverage
bounded-execution/finite-disclosure.ts	37.50% (3/8)	Disclosure limiting functions undertested
nvx/runtime-backend.ts	63.63% (14/22)	Runtime backend functions partially tested
cloud-hypervisor/preflight.ts	52.77% (19/36)	Preflight check functions need more tests
nvx/preflight.ts	54.54% (6/11)	NVX preflight validation gaps

---

📅 Recent Source Changes (last 7 days)

Based on git history:

• 47907b3: "fix: get the NVX Copilot smoke test to genuinely pass on real KVM hardware (fix: get the NVX Copilot smoke test to genuinely pass on real KVM hardware #9010)"
  • Affected: src/nvx/ (multiple files related to NVX KVM testing)
  • Coverage Impact: NVX cleanup and runtime modules show low coverage
• b769da1: "Upgrade gh-aw and recompile workflows (Upgrade gh-aw and recompile workflows #9002)"
• efd5d63: "docs: correct task-level routing status in awf-config-spec.md ([docs] auth: auth: correct stale task-level routing wiring status in awf-config-spec.md #8993)"

Key observation: Recent NVX smoke test fixes suggest testing infrastructure changes but coverage gaps in nvx/cleanup-registry.ts (41%) and nvx/preflight.ts (72%) indicate incomplete test harness coverage.

---

🔎 Notable Findings

1. 🔴 NVX Cleanup Registry (41% coverage): The nvx/cleanup-registry.ts module—responsible for cleaning up NVX microVM artifacts—has the lowest coverage in the codebase. This is critical for resource cleanup and could lead to orphaned resources if paths aren't tested.

2. 🔴 Bounded Execution Schema Validation (49-53% coverage): The bounded-execution/finite-*.ts modules (cardinality, schema, disclosure) have 50% coverage with extremely low branch coverage (11-42%). These enforce constraints on agent output and error disclosure—security-critical functions that need comprehensive testing.

3. ✅ Security Core is Solid: All primary security modules (host-iptables-*, squid-config, domain-patterns) maintain 100% line coverage and 89-100% branch coverage, indicating strong test discipline for network/filtering layers.

4. 🟡 Branch Coverage Lag: While line coverage is 92.64%, branch coverage is only 84.23%—an 8.4 percentage point gap. This suggests many conditional/error paths are not exercised by tests, particularly in NVX and bounded-execution modules.

---

🎯 Recommendations

HIGH PRIORITY

• Fix nvx/cleanup-registry.ts (41% → 80%+)

  • Action: Add comprehensive tests for registry cleanup functions covering all 59 functions
  • Rationale: This module handles critical resource cleanup; low coverage risks orphaned infrastructure
  • Estimated Impact: High (fixes ~60 untested functions, improves resource cleanup reliability)

• Improve bounded-execution/finite-schema.ts (52.84% → 80%+)

  • Action: Expand test suite for schema validation, especially branch coverage (42.66% → 80%+)
  • Rationale: Enforces output schema constraints; incomplete tests could allow unexpected agent output
  • Estimated Impact: High (security-critical, ~108 untested statements)

MEDIUM PRIORITY

• Increase Branch Coverage Across All Modules (84.23% → 90%+)
  • Action: Audit conditional logic in high-value modules (NVX, cloud-hypervisor, enclave); add error-path tests
  • Rationale: 8.4 percentage point gap between line and branch coverage indicates missing edge cases
  • Estimated Impact: Medium (1,900+ untested branches; improves reliability of error handling)

LOW PRIORITY

• Microvm Network Reservation Coverage (52.83% → 75%+)
  • Action: Add tests for IP range allocation and network plan edge cases
  • Rationale: Non-critical path but important for microVM networking reliability
  • Estimated Impact: Low (infrastructure test completeness)

---

📌 Next Steps

1. This week: Address HIGH priority items (nvx/cleanup-registry.ts, bounded-execution/finite-schema.ts)
2. Next sprint: Increase branch coverage systematically across NVX and cloud-hypervisor modules
3. Ongoing: Maintain 100% coverage for all security-critical paths (currently on track)

---

Report Generated: 2026-09-25 21:07:37 UTC
Coverage Suite: Jest with istanbul coverage reporter
Thresholds: Lines ≥92%, Branches ≥84% (current baselines)

Generated by Test Coverage Reporter · copilot · sum00 · 24 AIC · ⊞ 5.3K · ◷

• expires on Oct 2, 2026, 9:09 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-02T21:09:44.431Z.

Closed by Workflow