[Coverage Report] Test Coverage Report — 2026-10-08

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-08

Overall Coverage

Metric	Covered / Total	%
Lines	19,759 / 21,252	92.97%
Statements	20,942 / 22,896	91.46%
Functions	3,266 / 3,618	90.27%
Branches	12,550 / 14,729	85.20%

Trend: no prior baseline was available in this run, so no delta is reported.

🛡️ Security-Critical Path Status

File	Stmts	Branches	Status
src/host-iptables.ts	100% (6)	100% (0)	⚠️ Small file; verify core logic is covered elsewhere
src/squid-config.ts	100% (4)	100% (0)	⚠️ Small file; verify core logic is covered elsewhere
src/domain-patterns.ts	100% (25)	89.47%	✅ Branch gaps minor
src/docker-manager.ts	100% (20)	100% (0)	⚠️ Only 20 statements for a 3,900+ line module; coverage metric looks incomplete
src/cli.ts	85.71% (7)	50% (2)	🟡 Half of branches uncovered

The low statement counts on host-iptables.ts, squid-config.ts, and docker-manager.ts suggest these files are thin entry points. Their 100% figures may not reflect coverage of the iptables rule generation, Squid ACL generation, or container lifecycle logic. This needs confirmation before relying on them.

📋 Coverage Table

Files from the pre-computed gap brief:

Severity	File	Stmts	Branches	Funcs
🔴 CRITICAL	src/nvx/cleanup-registry.ts	42.80%	32.11%	54.23%
🔴 CRITICAL	src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%
🟡 LOW	src/microvm/network-reservation.ts	51.50%	54.86%	58.33%
🟡 LOW	src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.50%
🟡 LOW	src/bounded-execution/finite-schema.ts	57.07%	56.88%	73.91%

Related files below 70% statement coverage (not in the brief): src/nvx/cleanup-store.ts (65.59%), src/microvm/rootfs.ts (71.69%).

🔧 Function Audit

• src/nvx/cleanup-registry.ts: 27 of 59 functions have no coverage.
• src/bounded-execution/finite-disclosure.ts: 5 of 8 functions have no coverage, and 31 of 35 branches are uncovered.
• src/bounded-execution/finite-cardinality.ts: 4 of 12 functions have no coverage.
• src/types/index.ts: 15 of 18 functions have no coverage (16.66%). Likely re-exports, so low priority.

📅 Recent Source Changes (last 7 days)

Not available. Git history could not be read in this run because shell access was denied, so this section is unpopulated.

🔎 Notable Findings

• src/nvx/cleanup-registry.ts is the largest gap: 158 of 218 branches and 178 of 278 statements are uncovered. It also has the lowest branch coverage in the report.
• src/bounded-execution/finite-disclosure.ts has 11.42% branch coverage, which is far below its statement coverage of 51.78%. The brief rates it LOW, but the branch gap is wide.
• The three security-critical files that show 100% have very few statements, so the headline figure overstates real coverage of their logic.
• Overall coverage is above 85% on every metric, but the gaps are concentrated in a few modules.

🎯 Recommendations

1. High: Add tests for src/nvx/cleanup-registry.ts, covering the 27 uncovered functions and the uncovered branches. Target at least 70% statement coverage first.
2. High: Add tests for src/bounded-execution/finite-cardinality.ts, starting with its 4 uncovered functions and the 22 uncovered branches.
3. Medium: Verify that src/host-iptables.ts, src/squid-config.ts, and src/docker-manager.ts cover their real logic. Check whether the rule and ACL generators live in other modules and whether those modules are included in coverage. Also add branch tests for src/cli.ts (currently 50%) and src/bounded-execution/finite-disclosure.ts (11.42%).

Generated from pre-computed coverage data. No source or test files were modified.

Generated by Test Coverage Reporter · copilot · sum00 · 1.23 AIC · ⊞ 7K · ◷

• expires on Oct 15, 2026, 12:12 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-15T00:12:26.070Z.

Closed by Workflow