[Coverage Report] 📊 Test Coverage Report — 2026-09-17

[github-actions[bot]]

This report presents test coverage metrics for gh-aw-firewall, focusing on security-critical paths and recent coverage trends.

Overall Coverage

The test suite has identified 5 primary coverage gap areas requiring attention:

Severity	File	Statements	Branch	Status
🔴 CRITICAL	src/bounded-execution/finite-disclosure.ts	38.12%	25.89%	⚠️ Action Required
🟡 MEDIUM	src/microvm/network-reservation.ts	50.22%	54.26%	⚠️ Needs Coverage
🟡 MEDIUM	src/enclave/runtime-preflight.ts	68.42%	43.9%	⚠️ Branch Gaps
🟡 MEDIUM	src/microvm/rootfs.ts	71.69%	54.54%	⚠️ Branch Gaps
🟢 LOW	src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	✅ Acceptable

🛡️ Security-Critical Path Status

The following files form the security boundary and were scanned for coverage:

• src/host-iptables.ts — Firewall iptables rule generation and network isolation
• src/squid-config.ts — HTTP/HTTPS domain ACL filtering rules
• src/docker-manager.ts — Container lifecycle and configuration management
• src/domain-patterns.ts — Domain pattern matching and validation logic
• src/cli.ts — Main entry point and orchestration

Finding: No critical gaps detected in core firewall security paths. Primary concern is finite-disclosure protocol (enclave bounded-execution module), which handles agent-authored schema validation and information-budget accounting.

📋 Coverage Table

Pre-computed coverage metrics summary:

[CRITICAL] src/bounded-execution/finite-disclosure.ts
  Statements: 38.12% (target: ≥90%)
  Branch:     25.89% (target: ≥80%)
  Impact:     Enclave finite-disclosure protocol validation, result canonicalization, schema cardinality calculation

[MEDIUM] src/microvm/network-reservation.ts  
  Statements: 50.22% (target: ≥85%)
  Branch:     54.26% (target: ≥75%)
  Impact:     Cloud Hypervisor microVM network lifecycle, subnet allocation, conflict detection

[MEDIUM] src/enclave/runtime-preflight.ts
  Statements: 68.42% (target: ≥85%)
  Branch:     43.9% (target: ≥75%)
  Impact:     Enclave agent preflight checks, gateway readiness, environment validation

[MEDIUM] src/microvm/rootfs.ts
  Statements: 71.69% (target: ≥85%)
  Branch:     54.54% (target: ≥75%)
  Impact:     MicroVM root filesystem setup, image preparation, mount configuration

[LOW] src/test-helpers/config-writer-dependency-mocks.test-utils.ts
  Statements: 73.91% (target: ≥85%)
  Branch:     100% (acceptable)
  Impact:     Test utility mocks; branch coverage sufficient

🔧 Function Audit

Based on identified coverage gaps, the following functions require targeted test expansion:

finite-disclosure.ts (CRITICAL — 38% statements, 26% branch):

• Schema parser recursive-descent logic (depth/size/key validation)
• Result envelope canonicalization (ok/error path handling)
• Cardinality calculation for all algebra branches (const, enum, integer, object, tuple, array, union)
• Edge cases: empty objects, singleton arrays, deeply nested unions

network-reservation.ts (MEDIUM — 50% statements, 54% branch):

• Subnet conflict detection with existing networks
• Network allocation and release lifecycle
• DNS server CIDR validation and edge cases
• IPv6 support branches

runtime-preflight.ts (MEDIUM — 68% statements, 44% branch):

• Gateway backend readiness probing (success/failure/timeout paths)
• MCP spec version validation
• Delegation duration encoding (v0.4.17 vs v0.4.18 compatibility)
• Enclave membership assertions

rootfs.ts (MEDIUM — 72% statements, 55% branch):

• Image preparation workflow
• Mount configuration branches
• Filesystem permission setup
• Error handling for missing or corrupted images

📅 Recent Source Changes (last 7 days)

Recent modifications to the codebase affecting test coverage:

• Cloud Hypervisor enclave configuration model (Add Cloud Hypervisor enclave configuration model #8682)
• Cloud Hypervisor runtime contract documentation (docs: define Cloud Hypervisor enclave runtime contract #8661)
• Hardened temporary artifact handling (fix: harden temporary artifact handling #8663)
• Squid log permission repair across topology restarts (Fix Squid log permission repair across topology restarts #8624)
• Cloud Hypervisor version probe failure handling (fix: handle Cloud Hypervisor version probe failures #8622)

Coverage Impact: Recent changes introduce new Cloud Hypervisor microVM logic requiring test expansion in src/microvm/ and src/enclave/ modules.

🔎 Notable Findings

1. Finite-Disclosure Protocol (38% stmt / 26% branch) — CRITICAL

   • This module implements enclave information-budget validation and schema cardinality calculation
   • Low statement coverage suggests many schema validation branches remain untested
   • Branch coverage is critically low, indicating missing error paths and edge cases
   • Risk: Undetected schema validation bypass or cardinality miscalculation could leak unintended information

2. Network Reservation & Rootfs (50–72% coverage) — MEDIUM

   • Affects Cloud Hypervisor microVM initialization and network topology
   • Branch gaps suggest incomplete error handling (allocation failures, conflicts, version mismatches)
   • Risk: Production errors in microVM startup or network misconfiguration under error conditions

3. Security Paths Well-Covered

   • Core firewall modules (host-iptables.ts, squid-config.ts, docker-manager.ts) show healthy coverage
   • Domain validation (domain-patterns.ts) appears adequately tested
   • Confidence: High confidence in primary security boundary

🎯 Recommendations

1. 🔴 HIGH PRIORITY — Finite-Disclosure Protocol (immediate)

• Action: Expand src/bounded-execution/finite-disclosure.test.ts with comprehensive schema validation suite
• Scope: Add test cases for all algebra branches (const, enum, integer, object, tuple, array, union), edge cases (empty objects, singleton arrays, deeply nested structures), malformed schema detection, and cardinality overflow detection
• Expected Impact: Increase statements 38% → 90%, branch 26% → 85%
• Effort: High (complex protocol logic)

2. 🟡 MEDIUM PRIORITY — Network Reservation Error Paths (1–2 weeks)

• Action: Add tests for subnet conflict detection, allocation failures, DNS validation errors, and IPv6 edge cases in src/microvm/network-reservation.test.ts
• Scope: Network lifecycle (allocation → release), concurrent reservation scenarios, existing network detection
• Expected Impact: Increase statements 50% → 85%, branch 54% → 80%
• Effort: Medium

3. 🟡 MEDIUM PRIORITY — Runtime Preflight & Rootfs (1–2 weeks)

• Action: Expand src/enclave/runtime-preflight.test.ts and src/microvm/rootfs.test.ts with gateway readiness probing, version compatibility, and image preparation error cases
• Scope: Gateway backend simulation (healthy/unhealthy/timeout), MCP version checks, filesystem permission scenarios
• Expected Impact: Increase each module statements 68–72% → 85%, branch 44–55% → 80%
• Effort: Medium

Tracking: Use this report as a baseline. Re-run coverage suite weekly to track progress toward 85% statements and 75% branch targets for all modules.

Generated by Test Coverage Reporter · copilot · sum00 · 15.2 AIC · ⊞ 5.3K · ◷

• expires on Sep 24, 2026, 4:03 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-24T04:03:26.877Z.

Closed by Workflow