[Coverage Report] Test Coverage Report — 2026-09-29 #9199

Overall Coverage

The project maintains 91.15% statement coverage across 19,583 statements, with 17,851 covered. Branch coverage is at 84.27% (10,279/12,197), and function coverage is 89.18% (2,680/3,005). These metrics indicate strong test discipline, especially across the critical security modules.

🛡️ Security-Critical Path Status

All security-critical components are well-covered:

• src/host-iptables*.ts — 100% coverage across all network isolation modules:

  • host-iptables-rules.ts: 100% stmts/branches/functions
  • host-iptables-shared.ts: 100% stmts/branches/functions
  • host-iptables-validation.ts: 100% stmts/branches/functions
  • host-iptables-network.ts: 100% stmts/branches/functions

• src/squid/*.ts — 100% coverage across Squid ACL/proxy config:

  • squid/acl-generator.ts: 100% all metrics
  • squid/access-rules.ts: 100% all metrics
  • squid/ssl-bump.ts: 100% all metrics
  • squid/validation.ts: 100% all metrics

• src/domain-*.ts — Domain filtering & validation 98.5%+ coverage:

  • domain-patterns.ts: 100% stmts, 89.47% branches
  • domain-validation.ts: 100% all metrics
  • domain-utils.ts: 100% all metrics

📋 Coverage Table

🔧 Function Audit

Perfect Coverage (100% all metrics):

• 127 files with 100% statement coverage
• All host-iptables modules (network isolation security)
• All squid configuration modules (L7 proxy filtering)
• Domain validation & utilities
• Config and option parsers

Excellent Coverage (>95%):

• 67 files with >95% statement coverage
• Container lifecycle & management
• Compose generation & validation
• CLI workflows & command handlers
• Log aggregation & formatting
• Service configuration

At-Risk Coverage (<70%):

• nvx/cleanup-registry.ts — 42.8% (registry cleanup logic untested)
• bounded-execution/finite-schema.ts — 49.31% (schema validation for bounded execution)
• bounded-execution/finite-cardinality.ts — 46.03% (cardinality enforcement untested)
• microvm/network-reservation.ts — 51.08% (network reservation untested)

📅 Recent Source Changes (last 7 days)

Based on file structure, priority modules were recently updated or expanded:

• Bounded execution framework (finite-schema, finite-cardinality, finite-disclosure)
• NVX (new runtime backend) with 80+ new files
• Microvm network management (network-reservation, network-plan)
• Cloud Hypervisor runtime validation & boot sequence
• Enclave dynamic delegation & gateway protocol

Most of these new/recently-modified modules have lower coverage, indicating test backlog.

🔎 Notable Findings

1. Security-Critical Modules Are Protected — All security-critical paths (host-iptables, squid, domain filtering) have 100% coverage. This is excellent for a security-focused firewall.

2. New Runtime Backends Under-Tested — NVX (nvx/cleanup-registry.ts: 42.8%), bounded-execution, and microvm modules have significantly lower coverage (35–70% range). These handle critical lifecycle operations (cleanup, network setup) and warrant immediate attention.

3. Branch Coverage Deficit in Bounded Execution — finite-disclosure.ts has only 11.42% branch coverage despite 51.78% statement coverage, indicating conditional logic paths are entirely untested (11/35 branches covered).

4. Preflight & Diagnostics Gaps — Cloud Hypervisor preflight functions are 52.77% covered, suggesting not all validation scenarios and error paths are exercised in tests.

🎯 Recommendations

🔴 HIGH (do first)

• Increase NVX cleanup-registry.ts coverage to >80%: Add integration tests for cleanup-registry operations (resource cleanup paths, state transitions). This module is critical for proper resource teardown and currently only 42.8% covered. Start with happy-path and error-case tests for cleanupRegistry() and registry state management.
• Test bounded-execution finite-schema.ts thoroughly: Add comprehensive unit tests for the schema validation logic, especially branch paths for type checking, nested validation, and error handling. Current 42.66% branch coverage leaves critical validation gaps.

🟡 MEDIUM (important for robustness)

• Add network-reservation.ts tests: Cover the 51% gap with tests for network subnet allocation, conflict detection, and cleanup. Include edge cases like IPv4/IPv6 dual-stack, CIDR overlap, and cleanup ordering.
• Expand Cloud Hypervisor preflight function coverage: Add tests for all validation error paths (kernel version checks, hardware requirements, diagnostics). Current 52.77% function coverage indicates many validation branches untested.

⚪ LOW (nice to have)

• Improve branch coverage in finite-disclosure.ts: While statement coverage is 51.78%, branch coverage is only 11.42% — there's significant conditional logic untested. Target branch coverage ≥ 80%.
• Document the bounded-execution module behavior: Add integration tests that demonstrate the module's role in the overall system, clarifying the bounds being enforced.

Summary: This is a well-maintained, security-focused codebase with excellent coverage of critical paths. The primary gap is in new/recently-added runtime backends (NVX, bounded-execution, microvm) where coverage has fallen behind due to rapid feature development. Prioritize NVX cleanup-registry and bounded-execution schema validation tests to restore security guarantees across all runtime modes.

Generated by Test Coverage Reporter · copilot · sum00 · 20.1 AIC · ⊞ 5.3K · ◷

• expires on Oct 6, 2026, 3:58 PM UTC