[Coverage Report] Test Coverage Analysis & Security-Critical Path Audit

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-23

Overall Coverage

Metric	Coverage	Count
Statements	92.68%	10,688 / 11,532
Branches	86.00%	5,898 / 6,858
Functions	93.09%	1,483 / 1,593
Lines	93.80%	10,242 / 10,918

Status: Excellent overall coverage with strong performance across all metrics. Statements and lines exceed 92%, functions at 93%, with branch coverage at a solid 86%.

---

🛡️ Security-Critical Path Status

The following files are essential for the firewall's security model:

File	Type	Priority
src/bounded-execution/finite-disclosure.ts	Enclave protocol (request/result validation)	CRITICAL ⚠️
src/enclave/runtime-preflight.ts	Enclave runtime bootstrap & validation	HIGH
src/host-iptables-*.ts	Network isolation & firewall rules	HIGH
src/squid-config-*.ts	Domain ACL & HTTP/HTTPS filtering	HIGH
src/docker-manager-*.ts	Container lifecycle & orchestration	HIGH

Key Finding: The critical finite-disclosure module has extremely low coverage (9.26% statements, 0.26% branches), representing a significant security audit gap.

---

📋 Coverage Table

Critical Gaps (< 10%)

• src/bounded-execution/finite-disclosure.ts: 9.26% stmt | 0.26% branch
  • 34 KB module defining enclave finite-disclosure protocol v2 (schema validation, cardinality calculation)
  • Nearly untested despite handling request/result wire protocol

Low Coverage (66–73%)

• src/enclave/runtime-preflight.ts: 66.66% stmt | 41.02% branch
• src/microvm/rootfs.ts: 71.69% stmt | 54.54% branch
• src/commands/validators/config-assembly.ts: 73.68% stmt | 25% branch (branch coverage critical gap)

Well-Covered Files

• src/api-proxy-config-domains.ts: 100% coverage
• src/cli-options.ts: ~95% coverage
• src/docker-manager.test.ts suite: well-covered

---

🔧 Function Audit

Total Functions: 1,483 / 1,593 covered (93.09%)

Uncovered Function Categories:

• Error handlers and edge-case handlers in enclave bootstrap
• Fallback retry logic in runtime-preflight
• Validator helper functions in config-assembly
• Utility functions in rootfs initialization

Most Comprehensive Test Coverage:

• API proxy domain configuration (10/10 functions)
• CLI options parsing (>95% functions)
• Container orchestration flows (>90% functions)

---

📅 Recent Source Changes (last 7 days)

Based on directory structure analysis:

• Enclave infrastructure (src/enclave/, src/bounded-execution/)
• Cloud Hypervisor support (src/microvm/)
• Configuration validators and command handlers
• Docker manager and network isolation layers

The enclave and microvm modules represent recent development efforts, which correlates with their lower test coverage.

---

🔎 Notable Findings

1. Critical Security Audit Gap: finite-disclosure.ts (9.26% coverage) is a 34 KB, hand-written recursive-descent parser for a security-critical wire protocol. Despite its complexity and security implications, it has near-zero test coverage. This file handles schema validation, cardinality calculations with BigInt, and request/result canonicalization — all attack surfaces.

2. Branch Coverage Deficit: While statement coverage is excellent (92.68%), branch coverage lags at 86% (960 branches uncovered). Files like config-assembly.ts show this pattern clearly (73.68% stmt but only 25% branch), indicating untested error paths and conditional logic.

3. Enclave Infrastructure Undertested: New enclave subsystem files (runtime-preflight.ts, finite-disclosure.ts) have significantly lower coverage than the stable core firewall components, suggesting they were recently added and not yet fully integrated into the test suite.

4. Excellent Core Firewall Coverage: Mature components like domain ACL config (api-proxy-config-domains.ts), CLI parsing, and container management maintain 95%+ coverage, indicating stable, well-tested code.

---

🎯 Recommendations

HIGH PRIORITY

1. Add comprehensive tests for finite-disclosure.ts (currently 9.26%)
   • Create unit tests for schema parser edge cases (deeply nested objects, large cardinality values, invalid JSON)
   • Test cardinality calculation with BigInt for all algebra constructs
   • Add fuzz tests for malformed schemas and result payloads
   • Target: Reach 80%+ statement and branch coverage
   • Rationale: This 34 KB security-critical module handles untrusted input (schemas and results) and uses hand-written parsing logic without a general JSON Schema validator; its low coverage represents a significant audit gap.

MEDIUM PRIORITY

2. Increase branch coverage across config validators (config-assembly.ts at 25% branch)

   • Add tests for error conditions in configuration assembly
   • Test all conditional branches in validation logic
   • Include edge cases (empty config, malformed inputs, conflicting flags)
   • Target: Reach 70%+ branch coverage
   • Rationale: Validators are critical for security; untested branches mean untested failure paths.

3. Improve enclave runtime preflight tests (runtime-preflight.ts at 66.66%)

   • Add tests for bootstrap failure scenarios
   • Test concurrent initialization edge cases
   • Add timeout and retry logic tests
   • Target: Reach 80%+ coverage
   • Rationale: New infrastructure needs comprehensive testing before production use.

LOW PRIORITY

4. Add microvm rootfs initialization tests (rootfs.ts at 71.69%)
   • Test filesystem layout edge cases
   • Add tests for permission and mount scenarios
   • Can be deferred until microvm support is released to users

Generated by Test Coverage Reporter · sum00 · 19 AIC · ⊞ 5.4K · ◷

• expires on Aug 30, 2026, 5:44 PM UTC