[Coverage Report] 📊 Test Coverage Report — 2026-09-16

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Count
Lines	94.18%	13,760 / 14,609
Statements	92.85%	14,456 / 15,568
Functions	93.46%	2,117 / 2,265
Branches	86.60%	8,253 / 9,529

Status: Overall coverage is healthy at 92–94% across all primary metrics. Branch coverage (86.6%) is the lowest, reflecting untested error paths and edge conditions.

---

🛡️ Security-Critical Path Status

The following files contain network isolation and domain filtering logic critical to firewall security:

File	Statements	Branches	Status
src/host-iptables.ts	100%	N/A	✅ Fully covered
src/squid-config.ts	100%	N/A	✅ Fully covered
src/docker-manager.ts	100%	N/A	✅ Fully covered
src/domain-patterns.ts	100%	89.47%	✅ High coverage (2 branches untested)
src/bounded-execution/finite-disclosure.ts	38.12%	25.89%	🔴 CRITICAL GAP
src/enclave/runtime-preflight.ts	66.66%	41.02%	🟡 Moderate gap

Key Finding: Core firewall rules (host-iptables.ts, squid-config.ts, domain-patterns.ts) are well-tested. However, bounded execution disclosure isolation (finite-disclosure.ts) has severe coverage gaps at only 38% statements and 26% branches—this is a critical security-sensitive area requiring attention.

---

📋 Coverage Table (Lowest 10 Files)

File	Statements	Branches	Lines	Functions	Risk Level
bounded-execution/finite-disclosure.ts	38.12%	25.89%	44.32%	55.31%	🔴 CRITICAL
microvm/network-reservation.ts	50.22%	54.26%	51.98%	56.81%	🟡 MEDIUM
enclave/runtime-preflight.ts	66.66%	41.02%	64.7%	100%	🟡 MEDIUM
microvm/rootfs.ts	71.69%	54.54%	72%	100%	🟡 MEDIUM
test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	66.66%	80%	⚪ LOW (test utility)
(All other files)	>75%	>75%	>75%	>90%	✅ Acceptable

---

🔧 Function Audit

Full Coverage (100%):

• src/host-iptables.ts — 3/3 functions
• src/squid-config.ts — 2/2 functions
• src/docker-manager.ts — 15/15 functions
• src/domain-patterns.ts — 3/3 functions
• src/enclave/runtime-preflight.ts — 5/5 functions
• src/microvm/rootfs.ts — 6/6 functions

Gaps:

• src/bounded-execution/finite-disclosure.ts — 26/47 functions tested (55.31%) — missing disclosure limit enforcement and repository staging paths
• src/microvm/network-reservation.ts — 25/44 functions tested (56.81%) — missing network isolation reservation logic

---

📅 Recent Source Changes (Last 7 Days)

Recent commits indicate active maintenance and feature development:

1. 7732f06 — Fix Squid log permission repair across topology restarts
2. f1eaf74 — Cloud Hypervisor version probe failure handling
3. 72d9450 — Safe-output fallback improvements
4. 4ccf85e — Stable sandbox runtime for Schema Sync
5. 14a52b6 — Redact enclave-agent session logs by default

These changes touch networking, API proxy, and enclave workflows—areas where test coverage ensures safe deployment.

---

🔎 Notable Findings

1. Bounded Execution Disclosure Isolation is Under-Tested (38% statements)

   • This file controls repository access boundaries and information leakage prevention—critical to preventing inter-job credential exposure.
   • Only 26 of 47 functions are tested; branch coverage of 26% suggests error paths, edge cases, and fallback logic are untested.
   • This is the single highest-risk coverage gap in the firewall.

2. MicroVM Network Reservation Logic Needs Test Depth (50% statements)

   • Network isolation for Cloud Hypervisor VMs relies on reservation logic that is only half-tested.
   • 19 of 44 functions untested; branch coverage 54% indicates conditional network setup paths are missing test cases.
   • Risk: Network misconfiguration in ephemeral VM sandboxes could expose workload traffic.

3. Enclave Runtime Preflight Validation is Partially Covered (67% statements, 41% branches)

   • All 5 preflight functions are implemented, but only 2/5 test paths executed; branch coverage of 41% is the lowest for any function-complete file.
   • Preflight failures (DNS, MCP gateway readiness, capability verification) are not exercised.
   • Risk: Silent deployment failures if preconditions are not met.

4. Domain Filtering Logic is Robust ✅

   • domain-patterns.ts (100% statements) and Squid config (100%) ensure domain allowlist enforcement is fully tested.
   • Only 2 edge-case branches untested in domain patterns—minor finding, not actionable.

---

🎯 Recommendations

1. 🔴 HIGH PRIORITY — Test Bounded Execution Disclosure Isolation

• Action: Add comprehensive unit tests for src/bounded-execution/finite-disclosure.ts
• Target: Achieve ≥75% statement coverage and ≥70% branch coverage
• Why: This module directly prevents credential and artifact leakage between isolated jobs. Untested error paths and fallback logic could silently fail, exposing secrets.
• Effort: Medium (add 15–20 test cases covering repository staging, disclosure limits, and cleanup paths)

2. 🟡 MEDIUM PRIORITY — Validate MicroVM Network Reservation Logic

• Action: Test src/microvm/network-reservation.ts edge cases and network isolation scenarios
• Target: Achieve ≥70% statement and branch coverage
• Why: Network misconfiguration in Cloud Hypervisor VMs could expose workload egress. Current 50% coverage leaves half the logic untested.
• Effort: Medium (add 10–15 test cases for network plan generation, address space conflicts, and cleanup)

3. 🟡 MEDIUM PRIORITY — Complete Enclave Runtime Preflight Test Coverage

• Action: Add tests for preflight failure paths in src/enclave/runtime-preflight.ts
• Target: Achieve ≥85% branch coverage (currently 41%)
• Why: Silent failures in preflight checks (DNS resolution, MCP gateway readiness, capability verification) could lead to broken deployments.
• Effort: Low (add 5–8 test cases for DNS failures, timeout scenarios, and capability drops)

---

Next Steps:

• Assign tests to the team and track as work items
• Consider adding branch coverage thresholds (currently 86.6%) to CI to prevent regressions
• Re-run coverage after each test implementation to validate improvements

Generated by Test Coverage Reporter · copilot · sum00 · 19.5 AIC · ⊞ 5.3K · ◷

• expires on Sep 23, 2026, 8:22 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has walked this hall.
The omens are clear: the path was observed and the seal remains unbroken.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

Oracle Sign

🔮 The ancient spirits stir over this discussion. The smoke test agent passed through, read the signs, and marked this thread beneath a clear sky.

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• clients2.google.com
• contentautofill.googleapis.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-23T20:22:30.994Z.

Closed by Workflow