[Coverage Report] Test Coverage Report — 2026-10-02

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-02

Overall Coverage

The gh-aw-firewall test suite demonstrates strong overall coverage metrics:

Metric	Coverage
Lines	92.76% (17,875 / 19,270)
Statements	91.28% (18,844 / 20,643)
Functions	89.37% (2,834 / 3,171)
Branches	84.63% (11,037 / 13,041)

Status: ✅ High confidence in critical execution paths

---

🛡️ Security-Critical Path Status

The following security-critical modules were analyzed for coverage:

Component	Purpose	Status
host-iptables.ts	L3/L4 network isolation rules	✅ High coverage
squid-config.ts	L7 HTTP/HTTPS domain ACL filtering	✅ High coverage
docker-manager.ts	Container lifecycle & orchestration	✅ High coverage
domain-patterns.ts	Domain pattern matching & validation	✅ High coverage
cli.ts	Main entry point & command routing	✅ High coverage

Aggregate Assessment: All critical security paths meet or exceed 85% branch coverage.

---

📋 Coverage Table

Critical Files (Lowest Coverage)

Severity	File	Statements	Branches	Status
🔴 CRITICAL	src/nvx/cleanup-registry.ts	42.8%	32.1%	⚠️ Requires urgent attention
🔴 CRITICAL	src/bounded-execution/finite-cardinality.ts	46.0%	35.3%	⚠️ Requires urgent attention
🔴 CRITICAL	src/bounded-execution/finite-schema.ts	49.3%	42.7%	⚠️ Requires urgent attention
🟡 MEDIUM	src/microvm/network-reservation.ts	51.5%	54.9%	⚠️ Needs improvement
🟡 MEDIUM	src/bounded-execution/finite-disclosure.ts	51.8%	11.4%	⚠️ Branch coverage critically low

High-Confidence Files (>95% Coverage)

• src/api-proxy-config-warnings.ts — 100%
• src/api-proxy-config-domains.ts — 98.5%
• src/api-proxy-config-validation.ts — 96%
• Most authentication and validation logic

---

🔧 Function Audit

Total Functions: 3,171
Tested Functions: 2,834
Untested Functions: 337 (10.6%)

The 10.6% of untested functions are concentrated in:

1. NVX runtime backends (cleanup-registry, lifecycle management)
2. Bounded execution modules (finite-cardinality, finite-schema, finite-disclosure)
3. Cloud Hypervisor enclaves (newer feature, ramping up coverage)
4. MicroVM network isolation (newer feature, initialization paths)

These gaps are primarily in newer, feature-specific code paths that need targeted test expansion.

---

📅 Recent Source Changes (last 7 days)

Recent commits prioritize:

• Cloud Hypervisor enclave resource limits and networking
• API proxy model routing and fallback logic
• Copilot model catalog and routing enhancements
• Integration tests for end-to-end smoke testing

Impact on Coverage: New features in cloud-hypervisor/, nvx/, and bounded-execution/ modules are not yet fully tested, explaining the coverage gaps in these areas.

---

🔎 Notable Findings

1. Branch Coverage Dip — Branch coverage (84.63%) is 6–7 points lower than statement coverage (91.28%), indicating error paths, conditional guards, and edge cases need more test expansion.

2. NVX/Enclave Feature Gap — The src/nvx/cleanup-registry.ts module (42.8% statements) handles critical artifact cleanup in enclave execution; this is a security-relevant module that needs urgent test coverage.

3. Bounded Execution Logic — finite-cardinality.ts, finite-schema.ts, and finite-disclosure.ts implement resource bounds and constraint validation for sandbox execution. Their low coverage (42–49%) indicates insufficient testing of boundary conditions.

4. Discrepancy in finite-disclosure.ts — Statements at 51.8% but branches at 11.4% suggests heavy consolidation; branch-level tests would catch subtle logic bugs in conditional branches and error handling.

---

🎯 Recommendations

1. 🔴 HIGH — Expand NVX Cleanup Registry Tests

• File: src/nvx/cleanup-registry.ts (42.8% statements, 32.1% branches)
• Action: Add tests for artifact cleanup on error, partial cleanup scenarios, and registry state transitions
• Effort: ~3–4 hours
• Impact: Prevents data exfiltration in enclave cleanup paths

2. 🔴 HIGH — Implement Bounded Execution Constraint Tests

• Files: src/bounded-execution/finite-cardinality.ts, finite-schema.ts
• Action: Add test cases for cardinality limits (duplicate detection), schema validation edge cases, and constraint violations
• Effort: ~4–5 hours
• Impact: Ensures sandbox resource bounds cannot be bypassed

3. 🟡 MEDIUM — Improve Branch Coverage in Disclosure Module

• File: src/bounded-execution/finite-disclosure.ts (51.8% statements, 11.4% branches)
• Action: Add branch-level tests for conditional error paths, empty/null inputs, and exception handling
• Effort: ~2–3 hours
• Impact: Catches logic errors in information disclosure filtering

---

Report Generated: 2026-10-02 14:46 UTC
Test Suite: Jest with Istanbul coverage instrumentation
Confidence Level: High (pre-computed metrics, no estimation)

Generated by Test Coverage Reporter · copilot · sum00 · 20.7 AIC · ⊞ 5.3K · ◷

• expires on Oct 9, 2026, 2:49 PM UTC