[Coverage Report] Test Coverage Report — 2026-10-02

[github-actions[bot]]

Overall Coverage

• Lines: 92.08% (18,093 / 19,649)
• Statements: 90.54% (19,067 / 21,057)
• Functions: 88.88% (2,862 / 3,220)
• Branches: 83.54% (11,161 / 13,360)

Overall test coverage is strong across all metrics, with statements and line coverage both exceeding 90%. Branch coverage at 83.54% indicates good decision-path testing, though some edge cases remain uncovered.

---

🛡️ Security-Critical Path Status

Five files with CRITICAL coverage gaps requiring immediate attention:

File	Statements	Branches	Status
src/nvx/cleanup-registry.ts	42.80%	32.11%	🔴 CRITICAL
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	🔴 CRITICAL
src/bounded-execution/finite-schema.ts	49.77%	43.11%	🔴 CRITICAL
src/microvm/network-reservation.ts	51.50%	54.86%	🟡 LOW
src/cloud-hypervisor/host-enclave-executor.ts	51.67%	34.48%	🟡 LOW

Primary Concern: The three files in src/nvx/ and src/bounded-execution/ represent critical infrastructure for network isolation and resource bounding in microVM and enclave execution. Coverage gaps here directly impact security guarantees.

---

📋 Coverage Table

Top-Performing Files (Security-critical paths):

• src/host-iptables.ts: High coverage for iptables rule generation
• src/squid-config.ts: Strong coverage for domain ACL filtering
• src/docker-manager.ts: Comprehensive coverage for container lifecycle management
• src/cli.ts: Well-tested main entry point
• src/domain-patterns.ts: Pattern matching validation thoroughly tested

Lowest Coverage Files (Requiring attention):

1. src/nvx/cleanup-registry.ts — 42.80% statements
2. src/bounded-execution/finite-cardinality.ts — 46.03% statements
3. src/bounded-execution/finite-schema.ts — 49.77% statements
4. src/microvm/network-reservation.ts — 51.50% statements
5. src/cloud-hypervisor/host-enclave-executor.ts — 51.67% statements

---

🔧 Function Audit

The audit reveals:

• 3,220 total functions across the codebase
• 2,862 functions tested (88.88% coverage)
• 358 untested functions primarily in microVM and bounded-execution subsystems

The untested functions are concentrated in:

1. Enclave execution paths (src/nvx/, src/cloud-hypervisor/)
2. Resource-bounding logic (src/bounded-execution/)
3. Network reservation and microVM lifecycle (src/microvm/)

These represent newer infrastructure features added for unified enclaves and Cloud Hypervisor support, suggesting incomplete test harness buildout for these subsystems.

---

📅 Recent Source Changes (last 7 days)

Recent changes focused on:

• Enclave infrastructure hardening and MCP gateway integration
• Bounded execution framework for resource isolation
• Cloud Hypervisor microVM backend refinement
• Network reservation and cleanup registry improvements

Several of the low-coverage files were modified recently to support:

• Dynamic repository delegation for enclaves
• Resource limits for sandbox isolation
• Multi-VM coordination

---

🔎 Notable Findings

1. Core firewall security modules remain well-tested: Host iptables rules, Squid configuration, and domain pattern matching all have strong coverage, protecting the primary security boundary.

2. Enclave/microVM subsystem is undertested: The three CRITICAL gaps in src/nvx/, src/bounded-execution/, and related files indicate that newer infrastructure for private repository enclaves and Cloud Hypervisor support needs significantly more test coverage before production hardening.

3. Branch coverage gap: While statements are at 90.54%, branches lag at 83.54%, indicating edge cases and error handling paths are less thoroughly tested. This is especially concerning in security-critical code.

4. Potential resource exhaustion risk: The src/bounded-execution/finite-*.ts files handle cardinality and schema validation for resource limits—undertested paths here could allow resource exhaustion attacks or bypass sandbox limits.

---

🎯 Recommendations

HIGH PRIORITY 🔴

1. Expand enclave subsystem tests — Focus on src/nvx/cleanup-registry.ts (42.80%), src/bounded-execution/finite-cardinality.ts (46.03%), and src/bounded-execution/finite-schema.ts (49.77%). These files control critical sandbox resource isolation; test coverage must reach ≥80% before MCP gateway integration rollout. Target: Add tests for cleanup workflows, cardinality enforcement, and schema validation error paths.

MEDIUM PRIORITY 🟡

2. Improve branch coverage for error handling — Branches lag statements by 7 percentage points (83.54% vs 90.54%). Prioritize error paths in host-iptables.ts, squid-config.ts, and docker-manager.ts. Add tests for: DNS resolution failures, Squid startup timeouts, Docker network conflicts, and capability drop edge cases.

LOW PRIORITY ⚪

3. Stabilize Cloud Hypervisor backend tests — src/cloud-hypervisor/host-enclave-executor.ts (51.67%) and src/microvm/network-reservation.ts (51.50%) need foundational test harness buildout. Not blocking the core firewall, but essential for preview-feature stability. Defer until enclave subsystem reaches 80%.

Generated by Test Coverage Reporter · copilot · sum00 · 13.2 AIC · ⊞ 5.3K · ◷

• expires on Oct 9, 2026, 5:50 PM UTC