[Coverage Report] Test Coverage Report — 2025-10-02

[github-actions[bot]]

📊 Test Coverage Report — 2025-10-02

Overall Coverage

The gh-aw-firewall project maintains strong overall test coverage:

Metric	Coverage	Details
Statements	91.29%	19,223 / 21,057 covered
Branches	84.69%	11,315 / 13,360 covered
Functions	89.34%	2,877 / 3,220 covered
Lines	92.81%	18,238 / 19,649 covered

🛡️ Security-Critical Path Status

Excellent coverage in core network-isolation modules:

Module	Coverage	Status	Notes
src/host-iptables.ts	>90%	✅	Network isolation rules well-tested
src/squid-config.ts	>90%	✅	Domain filtering ACL generation covered
src/domain-patterns.ts	>85%	✅	Pattern matching logic validated
src/cli.ts	>85%	✅	Orchestration and lifecycle covered

⚠️ Critical gaps in enclave/bounded-execution subsystems (all <50%):

Module	Statements	Branches	Risk Level	Issue
src/nvx/cleanup-registry.ts	42.8%	32.11%	🔴 CRITICAL	Registry cleanup & artifact tracking largely untested
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	🔴 CRITICAL	Cardinality enforcement (unbounded resource attack prevention) missing test cases
src/bounded-execution/finite-schema.ts	49.77%	43.11%	🔴 CRITICAL	Schema validation edge cases not covered
src/microvm/network-reservation.ts	51.5%	54.86%	🟠 HIGH	Network planning & reservation logic partially tested
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	🟠 HIGH	Very weak branch coverage — disclosure control logic missing critical path tests

📋 Coverage Table

Top 5 Lowest-Coverage Files:

#	File	Statements	Branches	Recommendation
1	src/nvx/cleanup-registry.ts	42.8%	32.11%	Add lifecycle tests: cleanup on success, partial cleanup on failure, registry validation
2	src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	Add tests for cardinality enforcement: exceeding limits, rollback, state consistency
3	src/bounded-execution/finite-schema.ts	49.77%	43.11%	Add edge case tests: malformed schema, constraint violations, type mismatches
4	src/microvm/network-reservation.ts	51.5%	54.86%	Add network conflict, exhaustion, and release tests
5	src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	Priority: Add branch tests for all error conditions and disclosure-limit enforcement

🔧 Function Audit

Total Functions: 3,220 defined / 2,877 covered (89.34%)

• Uncovered functions: ~343 (10.6%)
• Highest risk: Enclave cleanup, bounded-execution cardinality, and finite-disclosure functions
• Pattern: Most uncovered functions are error handlers and edge cases (cleanup-on-error, cardinality overflow, disclosure truncation)

📅 Recent Source Changes (last 7 days)

1. 3ff0c9a - test(cloud-hypervisor): expand host executor coverage (#9383) — Enclave executor test expansion
2. 460ee5a - [Test Coverage] src/docker-manager.ts (#9368) — Docker lifecycle coverage improvements
3. 0d10a5d - feat: implement host-side Cloud Hypervisor enclave executor (#9376) — New enclave feature (untested)
4. 52b3245 - Document AWF threat model and GitHub egress limits (#9355) — Security posture documentation
5. b1da8ea - feat(api-proxy): ordered fallback models on 5xx, timeout (#9356) — Fallback routing (test coverage unclear)

Observation: Recent changes focus on Cloud Hypervisor enclave expansion, but cleanup-registry and finite-cardinality modules remain significantly undertested.

🔎 Notable Findings

1. Enclave Cleanup Crisis (42.8% coverage) — The cleanup-registry.ts module manages artifact tracking and cleanup lifecycle. With only 42.8% statement coverage and 32% branch coverage, edge cases like partial cleanup failure, registry corruption, and cleanup-on-timeout are likely untested.

2. Cardinality Enforcement Gap (46.03% coverage) — The finite-cardinality.ts module prevents unbounded resource consumption in bounded execution. Missing 54% of statements suggests insufficient testing of:

   • Cardinality enforcement at limits
   • Rollback when limits exceeded
   • State consistency across concurrent attempts

3. Disclosure Control Branch Famine (11.42% branch coverage) — The finite-disclosure.ts module enforces information disclosure limits. With only 11.42% branch coverage despite 51.78% statement coverage, the vast majority of conditional logic (error paths, truncation, boundary conditions) is untested. This is a high-priority audit target.

4. Strong Foundation in Network Isolation — Core security modules (host-iptables, squid-config, domain-patterns) maintain >85% coverage, indicating robust confidence in network-level access control.

🎯 Recommendations

🔴 HIGH Priority — Cardinality & Cleanup Safety

Issue: finite-cardinality.ts and cleanup-registry.ts combined guard against resource exhaustion and artifact leakage — both <50% coverage.

Action:

1. Add comprehensive cardinality enforcement tests:

   • At-limit scenarios (cardinality == limit)
   • Over-limit attempts with rollback verification
   • Concurrent cardinality checks for race conditions

2. Add cleanup-registry lifecycle tests:

   • Successful cleanup (happy path) + state verification
   • Cleanup failure modes (permissions, missing files, corruption)
   • Partial cleanup recovery

Effort: ~4–6 hours | Impact: Security-critical resource-limiting mechanism fully validated

---

🟠 MEDIUM Priority — Disclosure Control Edge Cases

Issue: finite-disclosure.ts has critically weak branch coverage (11.42%), leaving >88% of conditional logic untested.

Action:

1. Audit source code for all if/else and switch statements

2. Add missing branch tests for:

   • Disclosure truncation at limits
   • Boundary conditions (empty, single item, at-limit)
   • Error conditions (invalid input, state corruption)

3. Target minimum 70% branch coverage before next release

Effort: ~3–4 hours | Impact: Disclosure-limiting security boundary fully validated

---

🟡 LOW Priority — Network Reservation Planning

Issue: network-reservation.ts (51.5% statements) lacks test coverage for network conflict and exhaustion scenarios.

Action:

1. Add network reservation conflict tests (overlapping ranges)
2. Add exhaustion tests (all IPs reserved)
3. Add release and reuse validation

Effort: ~2–3 hours | Impact: Microvm network orchestration robustness

---

Summary: Prioritize fixing CRITICAL gaps in enclave cleanup (42.8%) and cardinality (46.03%) within the next sprint to reduce risk of resource-exhaustion and artifact-leakage vulnerabilities. Medium-priority disclosure control should follow immediately after.

Generated by Test Coverage Reporter · copilot · sum00 · 19.6 AIC · ⊞ 5.3K · ◷

• expires on Oct 9, 2026, 8:02 PM UTC