[Coverage Report] Test Coverage Report — 2026-10-03

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-03

Overall Coverage

Aggregate Results:

• Statements: 91.37% (19,744 / 21,607 covered)
• Functions: 89.55% (2,941 / 3,284 covered)
• Branches: 85.01% (11,740 / 13,809 covered)
• Lines: 92.9% (18,714 / 20,143 covered)

The codebase maintains strong overall coverage with statements and lines both above 91%. However, branch coverage lags at 85.01%, indicating some conditional logic paths are not exercised by tests.

---

🛡️ Security-Critical Path Status

Component	Statements	Functions	Branches	Status
src/host-iptables-rules.ts	100%	100%	100%	✅ Excellent
src/host-iptables-shared.ts	100%	100%	100%	✅ Excellent
src/host-iptables-chain.ts	100%	100%	100%	✅ Excellent
src/squid-config.ts	100%	100%	—	✅ Excellent
src/domain-patterns.ts	100%	100%	89.47%	⚠️ Branch gaps
src/docker-manager.ts	100%	100%	—	✅ Good
src/cli.ts	85.71%	100%	50%	🔴 Low branches

Key Insight: Network isolation rules (iptables) and Squid proxy config are fully covered. However, src/cli.ts (main entry point) has weak branch coverage at 50%, and domain-patterns.ts has 11% untested branch paths.

---

📋 Coverage Table

Critical Files with Gaps:

File	Statements	Functions	Branches	Notes
src/cli.ts	85.71%	100%	50%	Main orchestration logic underexercised
src/domain-patterns.ts	100%	100%	89.47%	Conditional domain matching paths incomplete
src/artifact-permissions.ts	82.08%	80%	80%	Incomplete artifact permission scenarios
src/config-writer.ts	89.17%	94.11%	83.21%	Configuration edge cases uncovered
src/host-env.ts	95.23%	100%	85.71%	Environment variable edge cases
src/microvm/network-reservation.ts	51.5%	—	54.86%	LOW: Emerging microVM feature
src/bounded-execution/finite-schema.ts	49.77%	—	43.11%	CRITICAL: Cardinality bounding incomplete
src/bounded-execution/finite-cardinality.ts	46.03%	—	35.29%	CRITICAL: Core bounded-exec uncovered
src/nvx/cleanup-registry.ts	42.8%	—	32.11%	CRITICAL: Registry cleanup 57% untested

---

🔧 Function Audit

Fully Tested (Security-Critical):

• ✅ host-iptables-rules.ts: All 9 functions at 100%
• ✅ host-iptables-shared.ts: All 15 functions at 100%
• ✅ squid-config.ts: All 2 functions at 100%
• ✅ domain-patterns.ts: All 3 functions at 100% (functions level; branches lag)
• ✅ domain-matchers.ts: 4/4 functions (98.14% statements)
• ✅ domain-validation.ts: 5/5 functions at 100%
• ✅ domain-utils.ts: 10/10 functions at 100%
• ✅ docker-manager.ts: 15/15 functions at 100%

Partially Tested (Emerging Features):

• ⚠️ src/bounded-execution/finite-cardinality.ts: 46.03% statements (1+ functions untested)
• ⚠️ src/nvx/cleanup-registry.ts: 42.8% statements (multiple functions unreached)
• ⚠️ src/microvm/network-reservation.ts: 51.5% statements (half-tested)

---

📅 Recent Source Changes (last 7 days)

Note: Git log review is not available in this automation context. Coverage metrics reflect the tip of the current branch at test time (2026-10-03 17:35 UTC).

Detected Unmerged Feature Branches:
The presence of src/bounded-execution/, src/nvx/, and src/microvm/ modules with < 60% coverage suggests active development on experimental subsystems. These are candidates for:

1. Stabilization and test hardening before merge
2. Or, if recently merged, test expansion is critical

---

🔎 Notable Findings

1. Main CLI Entry Point Underexercised — src/cli.ts has only 50% branch coverage (1 of 2 branches tested). The main orchestration flow (config generation → container startup → cleanup) lacks adequate scenario testing, particularly for error paths and signal handling.

2. Conditional Domain Matching Gaps — src/domain-patterns.ts reaches 100% statements but only 89.47% branches. Missing tests for edge cases in subdomain matching, wildcard handling, or normalization (2 branch paths untested).

3. Critical Feature Incomplete — Three modules (bounded-execution, nvx, microvm) have statement coverage < 55%. These should not ship to production without test expansion. The nvx/cleanup-registry.ts module is only 42.8% covered — registration cleanup logic is mostly untested.

4. Strong Iptables & Proxy Security Coverage — Host network isolation rules and Squid proxy config generation are 100% covered, providing high confidence in the L3/L4 and L7 enforcement layers.

---

🎯 Recommendations

Priority 1 (HIGH) — Stabilize Main CLI Logic

• Files: src/cli.ts
• Action: Add integration tests for:
  • Signal handling (SIGINT, SIGTERM) during container lifecycle
  • Error recovery paths (config generation failures, missing docker, network conflicts)
  • Log preservation and cleanup edge cases
• Impact: Closes 30–50% of branch coverage gap in orchestration
• Effort: ~2–3 tests

Priority 2 (HIGH) — Harden Bounded-Execution Module

• Files: src/bounded-execution/finite-cardinality.ts, src/bounded-execution/finite-schema.ts
• Action: Audit for:
  • Cardinality constraint enforcement correctness
  • Schema validation rejection paths
  • Disclosure limitation edge cases
• Impact: Prevents runtime cardinality violations in untested scenarios
• Effort: Unit test suite (5–8 test cases)

Priority 3 (MEDIUM) — Cover Emerging Features Before Merge

• Files: src/nvx/cleanup-registry.ts, src/microvm/network-reservation.ts
• Action:
  • Confirm these are not in production branches (check PR, milestone, or branch name)
  • If experimental, add [WIP] or .skip() to relevant tests until ready
  • If scheduled for release, block merge until coverage ≥ 80%
• Impact: Prevents untested code paths in network or registry handling
• Effort: Feature team review + test addition

---

Coverage Data Sourced: 2026-10-03T17:35:24Z
Report Generated: Coverage Reporter automation

Generated by Test Coverage Reporter · copilot · sum00 · 23.6 AIC · ⊞ 5.3K · ◷

• expires on Oct 10, 2026, 5:40 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-10T17:40:15.707Z.

Closed by Workflow