[Coverage Report] 📊 Test Coverage Report — 2026-09-10

[github-actions[bot]]

Overall Coverage

Current Project-Wide Coverage Metrics:

• Statements: 92.76% (14,290 / 15,405)
• Branches: 86.61% (8,191 / 9,457)
• Functions: 93.48% (2,080 / 2,225)
• Lines: 94.09% (13,600 / 14,453)

Overall coverage is healthy across all metrics. Branch coverage (86.61%) is the lowest area and represents the primary improvement opportunity.

---

🛡️ Security-Critical Path Status

The security-critical firewall paths have excellent coverage:

File	Purpose	Statements	Branches
src/host-iptables.ts	Network isolation rules (L3/L4)	✅ High	✅ High
src/squid-config.ts	Domain ACL filtering (L7)	✅ High	✅ High
src/docker-manager.ts	Container lifecycle management	✅ High	✅ High
src/domain-patterns.ts	Domain pattern validation	✅ High	✅ High
src/cli.ts	CLI orchestration entry point	⚠️ 85.71%	⚠️ 50%

⚠️ Alert: src/cli.ts has 50% branch coverage — a split code path in the CLI wrapper is not exercised by the test suite. This should be addressed.

---

📋 Coverage Table — Critical Gaps

Severity	File	Statements	Branches	Issue
🔴 CRITICAL	src/bounded-execution/finite-disclosure.ts	38.12%	25.89%	Disclosure bounds logic untested; security boundary at risk
🟠 HIGH	src/microvm/network-reservation.ts	50.22%	54.26%	microVM network isolation only half-tested
🟡 MEDIUM	src/enclave/runtime-preflight.ts	66.66%	41.02%	Enclave startup validation lacks branch coverage
🟡 MEDIUM	src/microvm/rootfs.ts	71.69%	54.54%	Filesystem setup logic branch coverage below 60%
🟡 MEDIUM	src/commands/validators/config-assembly.ts	73.68%	25%	Config validation branching severely under-tested

Recommendation: Focus first on finite-disclosure.ts (CRITICAL) as it governs output bounds. microVM network reservation is also high-priority for sandbox isolation.

---

🔧 Function Audit

Key low-coverage functions require investigation:

src/bounded-execution/finite-disclosure.ts (38.12% statements)

• Controls output truncation and disclosure limits
• Only 3-in-8 code paths covered
• Mitigation: Add test cases for boundary conditions (max output, truncation points)

src/microvm/network-reservation.ts (50.22% statements)

• Allocates private network ranges for microVM sandbox
• Network isolation logic is partially untested
• Mitigation: Test IP allocation across all pool configurations

src/cli.ts (50% branch coverage)

• The CLI entry point has a missing conditional branch
• Likely a signal-handling or error-path edge case
• Mitigation: Add test for the uncovered branch (check error handling flow)

---

📅 Recent Source Changes (last 7 days)

Recent commits touching the firewall codebase:

• 407226f — Add --network-subnet to relocate awf-net off colliding host/cluster subnets (Add --network-subnet to relocate awf-net off colliding host/cluster subnets #8398)
• a8ce656 — Support Codex apply_patch through Copilot Responses API (Support Codex apply_patch through Copilot Responses API #8359)
• 9e89cca — Refactor provider adapter registration (Refactor provider adapter registration #8335)
• f895fca — Refactor: centralize agent sandbox path policy (refactor: centralize agent sandbox path policy #8334)
• e015efd — Test: add end-to-end security coverage for dynamic repository enclaves (test: add end-to-end security coverage for dynamic repository enclaves #8307)

Key observation: Recent changes are mostly refactoring and configuration. The --network-subnet change should be covered by existing network tests.

---

🔎 Notable Findings

1. Security boundary exposure: finite-disclosure.ts (38.12%) is a CRITICAL gap — output bounds enforcement is the last line of defense against data exfiltration. This must be addressed.

2. microVM isolation risk: network-reservation.ts at 50.22% means half of the network isolation code is untested. Given microVM is a preview feature, this should be remediated before GA.

3. CLI edge cases: The 50% branch coverage in src/cli.ts suggests signal handling or error conditions are missing test cases — these are often security-relevant paths.

4. Overall health: Project-wide coverage is strong (92.76% statements, 94.09% lines), but branch coverage (86.61%) lags — this indicates missing conditional paths in happy-path tests.

---

🎯 Recommendations

Priority 1 (CRITICAL):

• File: src/bounded-execution/finite-disclosure.ts
• Action: Increase statement coverage from 38% to ≥80% by writing tests for all disclosure limit boundaries and truncation paths
• Rationale: This controls output sanitization; security boundary violation if untested

Priority 2 (HIGH):

• File: src/microvm/network-reservation.ts
• Action: Test network pool exhaustion, IP reuse, and edge cases; aim for ≥75% statement coverage
• Rationale: Network isolation is core to sandbox security

Priority 3 (MEDIUM):

• File: src/cli.ts
• Action: Identify the uncovered branch (likely signal handling) and add integration test for that code path
• Rationale: Error handling paths in the CLI orchestrator are security-relevant

Generated by Test Coverage Reporter · copilot · sum00 · 20.2 AIC · ⊞ 5.3K · ◷

• expires on Sep 17, 2026, 8:06 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-17T20:06:29.289Z.

Closed by Workflow

[github-actions[bot]]

🔮 The ancient spirits stir. A smoke-test envoy passed through this chamber, and the omens held true.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}