[Coverage Report] Test Coverage Report — 2026-10-07

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-07

Overall Coverage

Metric	Covered / Total	%
Lines	19,638 / 21,113	93.01%
Statements	20,816 / 22,749	91.50%
Functions	3,244 / 3,596	90.21%
Branches	12,474 / 14,629	85.26%

Aggregate coverage is above 80%, but several individual files are well below that threshold (see the table and gaps below).

🛡️ Security-Critical Path Status

File	Stmts	Branches	Functions	Status
src/host-iptables.ts	100% (6/6)	100% (0/0)	100% (3/3)	✅ Fully covered, but only 6 statements; verify this is not a thin re-export shim
src/squid-config.ts	100% (4/4)	100% (0/0)	100% (2/2)	✅ Fully covered, but only 4 statements; same caveat
src/domain-patterns.ts	100% (25/25)	89.47% (17/19)	100% (3/3)	✅ Good; 2 uncovered branches
src/docker-manager.ts	100% (20/20)	100% (0/0)	100% (15/15)	✅ Covered, but the file is reported at 20 statements despite being described as 3,900+ lines; verify the coverage map
src/cli.ts	85.71% (6/7)	50% (1/2)	100% (0/0)	⚠️ One uncovered statement and one uncovered branch

📋 Coverage Table

Files flagged in the pre-computed gap brief:

File	Priority	Stmts	Branches	Functions
src/nvx/cleanup-registry.ts	🔴 CRITICAL	42.80% (119/278)	32.11% (70/218)	54.23% (32/59)
src/bounded-execution/finite-cardinality.ts	🔴 CRITICAL	46.03% (29/63)	35.29% (12/34)	66.66% (8/12)
src/microvm/network-reservation.ts	🟢 LOW	51.50% (120/233)	54.86% (79/144)	58.33% (28/48)
src/bounded-execution/finite-disclosure.ts	🟢 LOW	51.78% (29/56)	11.42% (4/35)	37.50% (3/8)
src/bounded-execution/finite-schema.ts	🟢 LOW	57.07% (125/219)	56.88% (124/218)	73.91% (17/23)

🔧 Function Audit

• src/nvx/cleanup-registry.ts: 27 of 59 functions have no coverage. This is the largest untested surface in the repo.
• src/bounded-execution/finite-disclosure.ts: 5 of 8 functions are uncovered, and only 4 of 35 branches are exercised.
• src/types/index.ts is at 16.66% function coverage (3/18), though its statement coverage is 100%. This is a type-only module, so the low figure is likely an artifact of how functions are counted.

📅 Recent Source Changes (last 7 days)

Not available. Shell access was denied during this run, so git log could not be executed.

🔎 Notable Findings

• Non-security-critical modules carry the largest gaps. nvx/cleanup-registry.ts (42.8% statements) and bounded-execution/finite-cardinality.ts (46.0%) are the worst-covered files and are flagged CRITICAL in the brief.
• Branch coverage in bounded-execution/finite-disclosure.ts is 11.42% (4/35), the weakest branch figure in the report.
• Security-critical files show 100% coverage but very few statements. host-iptables.ts (6) and squid-config.ts (4) are suspiciously small for their roles. The real logic may live in other modules, which would mean the security-critical coverage picture is incomplete.

🎯 Recommendations

1. High: Add tests for src/nvx/cleanup-registry.ts, focusing on the 27 uncovered functions and the branch gap (32%). Cleanup paths are a resource-safety concern.
2. High: Verify that src/host-iptables.ts and src/squid-config.ts are the real implementation files and not shims. If logic has moved, update the coverage map and confirm the iptables and Squid ACL generators are tested directly.
3. Medium: Raise branch coverage in src/bounded-execution/finite-disclosure.ts (11.42%) and src/bounded-execution/finite-cardinality.ts (35.29%) with tests for the error and edge-case branches.

Generated from pre-computed coverage data. Recent-change analysis was not run.

Generated by Test Coverage Reporter · copilot · sum00 · 1.09 AIC · ⊞ 7K · ◷

• expires on Oct 14, 2026, 9:13 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-14T21:13:41.790Z.

Closed by Workflow