[Coverage Report] Test Coverage Report — 2026-09-25

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-25

Overall Coverage

The project maintains strong baseline test coverage across the codebase:

Metric	Coverage	Status
Statements	91.12%	✅ Excellent
Branches	84.2%	✅ Strong
Functions	89.17%	✅ Excellent
Lines	92.65%	✅ Excellent

Summary: With 91.12% statement coverage and 89.17% function coverage, the codebase demonstrates mature test maturity. However, branch coverage at 84.2% indicates some untested conditional logic paths that warrant review for security-critical modules.

---

🛡️ Security-Critical Path Status

The following files are particularly important for network isolation, domain filtering, and container orchestration:

File	Statements	Branches	Functions	Status
src/host-iptables.ts	✅ N/A (integrated)	✅ 100%	✅ 100%	✅ Well-covered
src/squid-config.ts	✅ N/A (integrated)	✅ Tested	✅ Tested	✅ Validated
src/domain-patterns.ts	✅ 100%	⚠️ 89.47%	✅ 100%	⚠️ Minor branch gaps
src/docker-manager.ts	✅ 100%	N/A	✅ 100%	✅ Well-covered
src/cli.ts	⚠️ 85.71%	🔴 50%	✅ 100%	🔴 Branch coverage low

Key Finding: src/cli.ts has only 50% branch coverage despite 85.71% statement coverage, indicating missing tests for error paths and conditional branches in the main entry point.

---

📋 Coverage Table

Critical Coverage Gaps (< 55% statement coverage):

File	Statements	Branches	Severity	Component
src/nvx/cleanup-registry.ts	42.8%	32.11%	🔴 CRITICAL	Registry cleanup (NVX)
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	🔴 CRITICAL	Bounded execution constraints
src/bounded-execution/finite-schema.ts	49.31%	42.66%	🔴 CRITICAL	Schema validation
src/microvm/network-reservation.ts	51.08%	55.07%	🟡 MEDIUM	MicroVM network allocation
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	🔴 CRITICAL	Data disclosure prevention

---

🔧 Function Audit

Key Observations:

1. NVX Registry Cleanup (cleanup-registry.ts): 42.8% statement coverage with 32% branch coverage. This module handles registry cleanup and garbage collection—critical for preventing resource leaks in the container ecosystem.

2. Bounded Execution Modules: Three modules in the bounded-execution/ family all fall below 50% statement coverage:

   • finite-schema.ts (49.31%): Validates schema constraints
   • finite-cardinality.ts (46.03%): Enforces cardinality limits
   • finite-disclosure.ts (51.78% statements but only 11.42% branches): Data disclosure prevention

3. MicroVM Network Reservation (51.08%): Handles network resource allocation for microVM backends. Branch coverage of 55% is slightly better but still below ideal.

4. Primary Entry Point (cli.ts): Only 1 of 2 branches tested (50%). While statement coverage is 85.71%, missing branch tests suggest error handling paths are not validated.

---

📅 Recent Source Changes (last 7 days)

Coverage analysis is based on the pre-computed test suite results as of 2026-09-25 21:56 UTC.

---

🔎 Notable Findings

1. Branch Coverage Gap in Entry Point: The CLI entry point (src/cli.ts) has a 35-point gap between statement coverage (85.71%) and branch coverage (50%), indicating that conditional paths—particularly error handling—are not tested.

2. Bounded-Execution Framework Undercover: Five files in the bounded-execution/ and nvx/ namespaces show severe coverage gaps (< 55%). These modules enforce resource limits and prevent data disclosure, making them security-sensitive.

3. Domain Filtering Solid: Core security-critical files like src/domain-patterns.ts and src/docker-manager.ts maintain 100% statement coverage, demonstrating good testing discipline for the primary firewall logic.

4. Branch Coverage Variance: Overall branch coverage (84.2%) is 7 percentage points lower than statement coverage (91.12%), suggesting many files have untested conditional paths even where statements are covered.

---

🎯 Recommendations

Priority	Severity	Action	Files
1	🔴 HIGH	Add integration tests for cli.ts error paths and branches. Target: branch coverage ≥ 85%	src/cli.ts
2	🔴 HIGH	Establish test suites for finite-schema.ts and finite-cardinality.ts. Focus on constraint validation edge cases. Target: ≥ 70% statement coverage	src/bounded-execution/finite-*.ts
3	🟡 MEDIUM	Expand registry cleanup tests to cover all GC scenarios in cleanup-registry.ts. Target: ≥ 70% statement coverage	src/nvx/cleanup-registry.ts
4	🟡 MEDIUM	Add branch coverage tests to domain-patterns.ts to close 10.53% gap	src/domain-patterns.ts
5	⚪ LOW	Review microvm/network-reservation.ts branch paths and add missing test cases	src/microvm/network-reservation.ts

Generated by Test Coverage Reporter · copilot · sum00 · 20.8 AIC · ⊞ 5.3K · ◷

• expires on Oct 2, 2026, 10:01 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent has passed this way. The oracle records a successful GitHub read, file check, and build rite; the browser omen remained veiled.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-02T22:01:49.700Z.

Closed by Workflow