[Coverage Report] Test Coverage Report — 2026-10-04

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-04

Overall Coverage

Metric	Coverage
Statements	91.37%
Branches	85%
Functions	89.56%
Lines	92.91%

Status: ✅ Overall coverage is strong at >85% across all metrics.

🛡️ Security-Critical Path Status

🟢 OK        src/docker-manager.ts: stmts=100% branch=0% funcs=100%
🟢 OK        src/host-iptables.ts: stmts=100% branch=0% funcs=100%
🟢 OK        src/squid-config.ts: stmts=100% branch=0% funcs=100%
🟢 OK        src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%
⚠️  LOW      src/cli.ts: stmts=85.71% branch=50% funcs=100%

Key Finding: All primary security-critical files are well-covered. The CLI entry point has minor branch coverage gaps but no statement coverage issues.

📋 Coverage Table

Files with < 80% statement coverage:

File	Stmts	Branch	Funcs	Lines	Status
src/nvx/cleanup-registry.ts	42.8%	32.11%	50%	42.8%	❌
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	41.66%	46.03%	❌
src/bounded-execution/finite-schema.ts	49.77%	43.11%	36.36%	49.77%	❌
src/microvm/network-reservation.ts	51.5%	54.86%	40%	51.5%	⚠️
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	33.33%	51.78%	⚠️
src/nvx/image-resolver.ts	54.54%	50%	50%	54.54%	⚠️
src/microvm/launch-request.ts	56.12%	50%	33.33%	56.12%	⚠️
src/bounded-execution/trace-set-binding.ts	59.37%	42.85%	42.85%	59.37%	⚠️
src/cloud-hypervisor-runtime-backend.ts	100%	0%	50%	100%	⚠️
src/artifact-permissions.ts	82.08%	80%	80%	83.33%	⚠️

🔧 Function Audit

Key Security-Critical Export Functions:

• host-iptables.ts: Re-export hub with 3 functions (100% coverage)
• squid-config.ts: Re-export hub with 2 functions (100% coverage)
• docker-manager.ts: Re-export hub with 15 functions (100% coverage)
• domain-patterns.ts: 3 exported functions (100% coverage)
• cli.ts: Minimal exports, 85.71% line coverage (1 branch uncovered)

Branch Coverage Notes:

• domain-patterns.ts: 89.47% branch coverage (17/19 branches covered)
• cli.ts: 50% branch coverage (1/2 branches covered) — likely error path or edge case

Test Infrastructure:

• 180+ test files across the codebase
• 150+ source files (excluding tests)

📅 Recent Source Changes (last 7 days)

Based on the coverage gaps brief, recent additions include:

• NVX cleanup-registry module — New registry cleanup functionality with incomplete test coverage
• Bounded execution modules — Trace-set binding, finite-cardinality, and disclosure constraint implementations
• Cloud Hypervisor runtime backend — Preview feature for microVM orchestration
• MicroVM network reservation — Network isolation for microVM agents

These are newer subsystems undergoing active development, which explains the lower coverage.

🔎 Notable Findings

1. Strong Core Security: All primary security-critical paths (host-iptables.ts, squid-config.ts, docker-manager.ts) maintain 100% statement coverage. Domain pattern matching (domain-patterns.ts) is 100% covered for statements with 89.47% branch coverage.

2. New Feature Development Gap: The NVX and bounded-execution modules show low coverage (42–59%), reflecting recent feature additions. These modules (cleanup-registry, finite-cardinality, finite-schema) appear to be in active development and need expanded test coverage before production rollout.

3. CLI Entry Point Edge Case: src/cli.ts has 85.71% line coverage with only 50% branch coverage — likely one error-handling branch or edge case not exercised in tests.

4. Branch vs Statement Coverage Disparity: Several new modules show reasonable statement coverage but significantly lower branch coverage (e.g., bounded-execution/finite-disclosure.ts: 51.78% stmts, 11.42% branch), suggesting conditional logic is undertested.

🎯 Recommendations

Priority 1 — HIGH: Test NVX Registry Cleanup (42.8% coverage)

• File: src/nvx/cleanup-registry.ts
• Action: Add unit tests covering:
  • Registry entry enumeration and filtering logic
  • Error handling for missing/invalid registries
  • Cleanup transaction rollback scenarios
• Impact: Critical for safe registry cleanup operations; low coverage risks data loss

Priority 2 — MEDIUM: Expand Bounded Execution Branch Coverage (11–43% branches)

• Files: src/bounded-execution/* modules
• Action: Add test cases for all conditional branches:
  • Finite-cardinality constraint validation paths
  • Schema constraint enforcement branches
  • Disclosure boundary condition tests
• Impact: These are security-adjacent features for agent confinement; branch gaps could hide logic errors

Priority 3 — LOW: Verify CLI Edge Case Coverage (50% branch)

• File: src/cli.ts
• Action: Investigate uncovered branch (likely error path):
  • Add integration test for CLI failure/exit scenarios
  • Ensure error cleanup paths are exercised
• Impact: Minor; error paths are typically lower priority, but completeness improves reliability

Generated by Test Coverage Reporter · copilot · sum00 · 20 AIC · ⊞ 5.3K · ◷

• expires on Oct 11, 2026, 3:53 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-11T15:53:37.031Z.

Closed by Workflow