[Coverage Report] Test Coverage Report — 2026-09-25

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Status
Lines	92.65%	✅ Good
Statements	91.12%	✅ Good
Functions	89.17%	✅ Good
Branches	84.2%	⚠️ Attention needed

The codebase demonstrates strong overall test coverage with 92–93% line coverage across 18,283 lines of source code. However, branch coverage at 84.2% indicates significant gaps in conditional path testing, particularly in error handling and edge cases.

🛡️ Security-Critical Path Status

Component	Lines	Branches	Status	Notes
host-iptables*.ts (6 files)	100%	100%	✅ SECURE	Network isolation rules fully tested
docker-manager.ts	100%	100%	✅ SECURE	Container lifecycle management verified
domain-patterns.ts	100%	89.5%	⚠️ Minor gap	Domain whitelisting logic mostly covered
cli.ts	85.7%	50%	🔴 CRITICAL	Entry point has only 50% branch coverage

Critical Finding: src/cli.ts has only 50% branch coverage (1 of 2 branches), indicating that error or exit paths in the main entry point are not tested.

📋 Coverage Table — Top Gaps

#	Severity	File	Lines	Branches	Issue
1	🔴 CRITICAL	src/nvx/cleanup-registry.ts	42.8%	32.1%	NVX registry cleanup severely undertested
2	🔴 CRITICAL	src/bounded-execution/finite-cardinality.ts	46.0%	35.3%	Cardinality enforcement missing test paths
3	🔴 CRITICAL	src/bounded-execution/finite-schema.ts	49.3%	42.7%	Schema validation has large untested logic
4	🔴 CRITICAL	src/cli.ts	85.7%	50%	Main entry point exit paths untested
5	🟠 HIGH	src/microvm/network-reservation.ts	51.1%	55.1%	Network reservation logic incomplete
6	🟠 HIGH	src/bounded-execution/finite-disclosure.ts	51.8%	11.4%	Disclosure boundary has critical branch gap

🔧 Function Audit

Positive Coverage (100% or near):

• All 6 host-iptables-*.ts files: network isolation fully tested
• docker-manager.ts: container lifecycle management end-to-end
• domain-utils.ts, domain-validation.ts: domain whitelisting logic
• container-lifecycle.ts, container-startup-diagnostics.ts: lifecycle hooks
• dind-bootstrap.ts, dind-probe.ts: Docker-in-Docker detection
• github-env.ts, host-identity.ts: host environment introspection

Coverage Gaps:

• NVX enclave registry (src/nvx/cleanup-registry.ts): Only 42.8% lines, 32.1% branches — cleanup routines lack branch coverage
• Bounded execution policies (3 files): 46–49% lines coverage — cardinality, schema, and disclosure enforcement untested
• Network reservation (src/microvm/network-reservation.ts): 51% lines — error paths missing
• CLI entry point (src/cli.ts): 50% branches — one branch entirely untested (likely error/exit path)

📅 Recent Source Changes (last 7 days)

The presence of new low-coverage files (src/nvx/, src/bounded-execution/, src/microvm/) suggests recent feature additions for:

• NVX (network virtualization extension) support
• Bounded execution constraints (finite cardinality, schema, disclosure)
• MicroVM (Cloud Hypervisor) backend with network reservation

These features were likely added recently without comprehensive test coverage.

🔎 Notable Findings

1. NVX Feature Incompletely Tested: Three new enclave coordination files (nvx/cleanup-registry.ts, bounded-execution/finite-*.ts) are barely covered (32–49%). These appear to be new security features added within the last release cycle. Immediate testing needed for cleanup correctness and constraint enforcement.

2. CLI Entry Point Exposure: src/cli.ts shows 50% branch coverage, meaning one critical code path (likely error or signal handling) is untested. Given the firewall's security role, CLI robustness is essential.

3. Branch Coverage Gap: While line coverage is strong (92.6%), branch coverage lags at 84.2%, indicating that many conditional statements lack edge-case testing. Error paths, retry logic, and fallback handling are commonly overlooked.

4. Strong Security Foundations: Host iptables rules and container management have perfect (100%) coverage, indicating the core network isolation and lifecycle logic are well-tested.

🎯 Recommendations

Priority 1: CRITICAL — CLI Entry Point (HIGH urgency)

• Action: Add branch coverage tests for src/cli.ts to reach ≥95% branch coverage
• Impact: The main entry point currently skips one branch entirely. Test signal handling, exit codes, and error paths.
• Effort: ~2–4 hours (small file, targeted tests)

Priority 2: CRITICAL — NVX Feature Coverage (HIGH urgency)

• Action: Increase coverage for src/nvx/cleanup-registry.ts, src/bounded-execution/finite-*.ts to ≥80% lines and branches
• Impact: These new security features (NVX enclave cleanup, cardinality/schema/disclosure enforcement) lack sufficient test paths. Gaps in these areas could hide bugs in resource cleanup and constraint validation.
• Effort: ~6–8 hours (add tests for cleanup paths, constraint violations, edge cases)

Priority 3: MEDIUM — Branch Coverage Expansion

• Action: Audit remaining <80% files and add missing branch tests (error handlers, retries, edge conditions)
• Impact: Raise overall branch coverage from 84.2% → 90%+ to catch edge cases and reduce regression risk
• Files to target: src/microvm/network-reservation.ts, src/bounded-execution/finite-disclosure.ts
• Effort: ~3–5 hours (systematic branch gap identification and test addition)

---

Report Generated: 2026-09-25 22:40 UTC
Coverage Report Base: coverage/coverage-summary.json
Test Framework: Jest with Istanbul instrumentation
Baseline: All security-critical iptables and container management paths verified at 100% coverage ✅

Generated by Test Coverage Reporter · copilot · sum00 · 21.4 AIC · ⊞ 5.3K · ◷

• expires on Oct 2, 2026, 10:43 PM UTC

[github-actions[bot]]

Oracle Trace

🔮 The ancient spirits stir: the smoke test agent walked this path, found the signs favorable, and left the run in balance.

Warning

Firewall blocked 13 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• android.clients.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "android.clients.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir: this smoke-test agent passed through these halls. The omens favor GitHub reads, file I/O, and local build; only the browser vision remained veiled.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-02T22:43:18.035Z.

Closed by Workflow