[Coverage Report] Test Coverage Analysis — 2026-09-22

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-22

Overall Coverage

Metric	Coverage	Threshold	Status
Statements	38.39%	38%	✅ Pass
Branches	31.78%	30%	✅ Pass
Functions	37.03%	35%	✅ Pass
Lines	38.31%	38%	✅ Pass

Total: 182 of 474 statements covered. The test suite passes all thresholds but operates at the minimum margin (statements at 38.39% vs. 38% threshold = 0.39% buffer).

---

🛡️ Security-Critical Path Status

✅ Well-Protected (>80%)

• squid-config.ts — 100% coverage | HTTP/HTTPS domain ACL enforcement
• host-iptables.ts — 83.63% coverage | Network isolation and port filtering

🔴 High-Risk Coverage Gaps (<50%)

• docker-manager.ts — 18% coverage (45/250 statements) | Container lifecycle, health checks, cleanup

  • Only 4% function coverage (1/25 functions)
  • Only 22.22% branch coverage — error paths largely untested

• cli.ts — 0% coverage (0/69 statements) | Main entry point, signal handling, orchestration

  • Zero function coverage (0/10 functions)
  • Zero branch coverage (0/17 branches)
  • No tests for CLI argument parsing, error handling, or lifecycle events

⚠️ Emerging Modules (<50%)

• src/nvx/index.ts — 0% coverage (136 lines, re-export module)
• src/bounded-execution/finite-disclosure.ts — 38.12% coverage (950 lines, finite-disclosure protocol)
• src/nvx/cleanup-registry.ts — 42.8% coverage (631 lines, NVX cleanup)
• src/microvm/network-reservation.ts — 51.08% coverage (539 lines, microVM network reservation)

---

📋 Coverage Table

Fully Tested (100%)

File	Statements	Branches	Functions	Lines	Test Count
logger.ts	100% (16/16)	100% (6/6)	100% (8/8)	100% (16/16)	33
squid-config.ts	100% (13/13)	100% (5/5)	100% (5/5)	100% (12/12)	41
cli-workflow.ts	100% (16/16)	100% (2/2)	100% (1/1)	100% (16/16)	2

Acceptable Coverage (50–80%)

File	Statements	Branches	Functions	Lines
host-iptables.ts	83.63% (92/110)	55.55% (10/18)	100% (5/5)	83.63% (92/110)

Insufficient Coverage (<50%)

File	Statements	Branches	Functions	Lines	Issue
docker-manager.ts	18% (45/250)	22.22% (18/81)	4% (1/25)	17.15% (41/239)	Critical
cli.ts	0% (0/69)	0% (0/17)	0% (0/10)	0% (0/69)	Critical
finite-disclosure.ts	38.12%	25.89%	?	?	High
cleanup-registry.ts	42.8%	32.11%	?	?	High

---

🔧 Function Audit

Untested Entry Points

• cli.ts — All 10 functions untested
  • main() and signal handler registration
  • Config generation flow (writeConfigs())
  • Container lifecycle management
  • Error handling for all CLI scenarios

Partially Tested Functions

• docker-manager.ts — 1 of 25 functions tested (4%)
  • 81 branches, only 18 covered (22%)
  • Container health checks not exercised
  • Cleanup and error recovery paths missing

Well-Tested Functions

• squid-config.ts — 5/5 functions (100%)
• host-iptables.ts — 5/5 functions (100%)

---

📅 Recent Source Changes (last 7 days)

The repository contains 331 source files. Recent activity includes:

• Integration of NVX (nix virtual execution) module
• Addition of bounded-execution (finite-disclosure protocol)
• Expansion of microVM support (network reservation, Cloud Hypervisor)
• Ongoing enclave architecture refinement

These new modules have minimal test coverage, requiring targeted test development as they mature.

---

🔎 Notable Findings

1. Entry Point Blind Spot: cli.ts (0% coverage) is the primary orchestrator for network isolation, signal handling, and container lifecycle. Without tests, regressions in CLI argument parsing, graceful shutdown, or error propagation go undetected.

2. Container Lifecycle Risk: docker-manager.ts (18% coverage) controls Docker Compose operations, health checks, and cleanup. Only 1 of 25 functions is tested; error paths and rollback scenarios are not validated.

3. Protocol Validation Gaps: bounded-execution/finite-disclosure.ts (38.12% coverage) enforces information-budgeting and request/result validation for secure enclaves — a protocol-level security boundary. The 61.88% untested code may hide validation bypasses.

4. Passing Margin Razor-Thin: Overall statement coverage is 38.39% against a 38% threshold — only 0.39 percentage points above failure. Any regression in tested modules drops the project below the CI gate.

---

🎯 Recommendations

🔴 High Priority

1. Establish cli.ts test coverage (0% → target 60%+)

   • Impact: Entry point testing catches regressions in signal handling, config generation, and orchestration.
   • Effort: Moderate (mock Docker manager, test arg parsing, error cases)
   • Security Risk: Signal handling and error exit codes are untested; graceful shutdown may fail under load.
   • Recommended tests: Argument parsing, signal SIGINT/SIGTERM handling, config generation flow, cleanup on error.

2. Expand docker-manager.ts test coverage (18% → target 50%+)

   • Impact: Container lifecycle is the core of the sandbox — untested error paths risk container leaks or hung processes.
   • Effort: High (mock Docker CLI, test health checks, error recovery)
   • Security Risk: Cleanup failures may leave containers with leaked credentials or open ports.
   • Recommended tests: Failed health checks, cleanup on SIGTERM, log parsing, error propagation.

3. Validate bounded-execution/finite-disclosure.ts (38.12% → target 75%+)

   • Impact: Finite-disclosure protocol is a security boundary; incomplete validation could allow schema bypasses or information leakage.
   • Effort: High (complex protocol state machine, edge cases in cardinality calculation)
   • Security Risk: Protocol violations may silently exceed information budget or allow unauthorized result schemas.
   • Recommended tests: Schema validation (const, enum, object, union), cardinality calculation, error envelope handling, timing-bucket assignment.

🟡 Medium Priority

4. Close gap in host-iptables.ts (83.63% → target 90%+)

   • Impact: The remaining 16.37% likely includes error cases, edge conditions, or cleanup scenarios.
   • Effort: Low (isolated function, existing test suite structure)
   • Recommended tests: Review uncovered lines in iptables rule generation, DNS allowlist edge cases.

5. Stabilize coverage threshold (current 38% → recommended 45%+)

   • Rationale: Current 0.39-point buffer leaves no room for test refactoring or minor regressions. Increase threshold to 45% to enforce meaningful coverage growth.
   • Effort: Medium (requires new tests; see priorities 1–3 above).

⚪ Low Priority

6. NVX module test scaffolding (0% → target 30%+)
   • Note: src/nvx/index.ts is a re-export module (0% coverage is acceptable for pure exports). Prioritize tests for cleanup-registry.ts and preflight.ts only if these modules enter the critical data-flow path.

Generated by Test Coverage Reporter · copilot · sum00 · 13.3 AIC · ⊞ 5.3K · ◷

• expires on Sep 29, 2026, 3:39 AM UTC