[Coverage Report] 📊 Test Coverage Report — 2026-10-08

[github-actions[bot]]

Overall Coverage

Metric	Covered / Total	%
Statements	21,011 / 22,949	91.55%
Lines	19,819 / 21,302	93.03%
Functions	3,277 / 3,632	90.22%
Branches	12,606 / 14,783	85.27%

Source: pre-computed coverage/coverage-summary.json (not re-run).

🛡️ Security-Critical Path Status

File	Stmts	Branches	Notes
src/host-iptables.ts	100% (6/6)	n/a (0)	Only 3 lines tracked; likely a thin re-export after refactor. Real logic may live elsewhere.
src/squid-config.ts	100% (4/4)	n/a (0)	Only 2 lines tracked; same caveat.
src/domain-patterns.ts	100% (25/25)	89.47% (17/19)	Two uncovered branches.
src/docker-manager.ts	100% (20/20)	n/a (0)	Only 19 lines tracked, which is low for a file described as 3,900+ lines. Verify the coverage map is complete.

The low tracked-line counts for the three security files suggest the coverage map may not reflect their real size. Confirm before treating these as fully covered.

📋 Coverage Table (files below 80%)

File	Stmts	Branches	Funcs	Priority
src/nvx/cleanup-registry.ts	42.80%	32.11%	54.23%	🔴 CRITICAL
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%	🔴 CRITICAL
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.50%	🟡 LOW (brief)
src/microvm/network-reservation.ts	51.50%	54.86%	58.33%	🟡 LOW (brief)
src/bounded-execution/finite-schema.ts	57.07%	56.88%	73.91%	🟡 LOW (brief)

Also below 80% in the summary: src/cloud-hypervisor-runtime-backend.ts (functions 50%, 3 of 6 covered) and src/artifact-permissions.ts (branches 80%, functions 80%, statements 82%, borderline).

🔧 Function Audit

• Function coverage is below 60% in finite-disclosure.ts (37.5%), cleanup-registry.ts (54.2%), cloud-hypervisor-runtime-backend.ts (50%), and network-reservation.ts (58.3%).
• The cloud-hypervisor-runtime-backend.ts gap has 3 uncovered functions in a 7-statement file.
• finite-disclosure.ts has 5 of 8 functions uncovered and only 4 of 35 branches covered. This is the weakest-tested file by branch count.

📅 Recent Source Changes (last 7 days)

Not available. The git history query was denied in this run, so recent source changes could not be listed. Coverage changes versus the previous report also could not be computed, so no trend is shown.

🔎 Notable Findings

• The two CRITICAL files (nvx/cleanup-registry.ts, bounded-execution/finite-cardinality.ts) are both under 50% statement coverage. Cleanup and cardinality logic are the likeliest to hide resource-leak or bounds bugs.
• finite-disclosure.ts has 11% branch coverage. Its disclosure branches are largely untested.
• Security-critical files host-iptables.ts, squid-config.ts, and domain-patterns.ts report 100% coverage, but their tracked line counts are very small. The report may be missing real code.
• Overall metrics (91.6% statements, 85.3% branches) are healthy. The gaps are concentrated in a few newer modules.

🎯 Recommendations

1. High: Add tests for src/nvx/cleanup-registry.ts, focusing on cleanup ordering and failure paths. It is at 42.8% statements and 32.1% branches.
2. High: Add tests for src/bounded-execution/finite-cardinality.ts covering boundary and overflow cases. It is at 46% statements and 35% branches.
3. Medium: Verify the coverage instrumentation for host-iptables.ts, squid-config.ts, and docker-manager.ts. Confirm that the tracked line counts match the real source files, then add tests for any missing iptables and ACL generation paths.

Lower-priority follow-ups: finite-disclosure.ts branch coverage (11%), cloud-hypervisor-runtime-backend.ts function coverage (50%), and network-reservation.ts.

Generated by Test Coverage Reporter · copilot · sum00 · 1.18 AIC · ⊞ 7K · ◷

• expires on Oct 15, 2026, 4:37 AM UTC