[Coverage Report] Test Coverage Report — 2026-10-16

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-16

Overall Coverage

Metric	Coverage
Statements	92.08%
Branches	86.04%
Functions	90.91%
Lines	93.46%

🛡️ Security-Critical Path Status

🟢 OK src/docker-manager.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/host-iptables.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/squid-config.ts: stmts=100% branch=100% funcs=100%
🟢 OK src/cli.ts: stmts=85.71% branch=50% funcs=100%
🟢 OK src/domain-patterns.ts: stmts=100% branch=89.47% funcs=100%

📋 Coverage Table

File	Stmts	Branch	Funcs	Lines	Status
src/bounded-execution/finite-cardinality.ts	46.03%	35.29%	66.66%	52.83%	❌
src/nvx/cleanup-registry.ts	48.21%	38.53%	60%	47.54%	❌
src/microvm/network-reservation.ts	51.5%	54.86%	58.33%	53.27%	⚠️
src/bounded-execution/finite-disclosure.ts	51.78%	11.42%	37.5%	54.16%	⚠️
src/resolved-config-artifact.ts	55.33%	51.66%	87.5%	59.13%	⚠️
src/nvx/cleanup-store.ts	64.04%	55.1%	70%	69.13%	⚠️
src/bounded-execution/strict-json-parser.ts	68.83%	66.99%	100%	83.49%	⚠️
src/nvx/preflight.ts	70.83%	73.33%	54.54%	72.03%	⚠️
src/enclave/runtime-preflight.ts	72.72%	53.33%	100%	70.73%	⚠️
src/test-helpers/config-writer-dependency-mocks.test-utils.ts	73.91%	100%	80%	66.66%	⚠️
src/microvm/rootfs.ts	75.4%	58.33%	100%	75.86%	⚠️
src/bounded-execution/finite-schema.ts	78.94%	77.57%	96.15%	81.68%	⚠️
src/cli.ts	85.71%	50%	100%	85.71%	✅
src/microvm/vsock-client.ts	93.07%	90.6%	91.3%	97.07%	✅
src/enclave/delegation-control-client.ts	94.92%	94.73%	92%	94.53%	✅
src/cloud-hypervisor/api-client.ts	95.06%	82.35%	90.9%	97.33%	✅
src/services/cli-proxy-service.ts	95.23%	90.74%	100%	98.14%	✅
src/cli-workflow.ts	96.62%	94.17%	100%	96.29%	✅
src/cli-options.ts	100%	93.33%	100%	100%	✅
src/docker-manager.ts	100%	100%	100%	100%	✅
TOTAL	92.08%	86.04%	90.91%	93.46%

🔧 Function Audit

=== host-iptables.ts ===
=== squid-config.ts ===
=== domain-patterns.ts branch count ===
if-branches: 2
switch-branches: 1
Test files: 409 / Source files: 395

📅 Recent Source Changes (last 7 days)

src/agent-entrypoint-output.test.ts
src/agent-helper-staging.test.ts
src/agent-runtime-start.test.ts
src/agent-runtime-start.ts
src/api-proxy-config-domains.test.ts
src/api-proxy-config-domains.ts
src/api-proxy-config-validation.test.ts
src/api-proxy-config-validation.ts
src/api-proxy-config-warnings.test.ts
src/api-proxy-config-warnings.ts
---
+export function serializeFiniteSchema(schema: FiniteSchemaNode): FiniteSchemaWireNode {
+export const HOST_EXECUTOR_REJECTION_STAGES = Object.freeze([
+export function readGatewayReadinessResponse(
+export function requireObject(
+export async function writePrivateFile(
+export function resolveArtifactOwner(): { uid: number; gid: number } {
+export function openArtifactDirectory(directory: string): number {
+export function publishFinalResolvedConfig(directory: string, contents: string): void {
+export function publishEarlyResolvedConfig(contents: string): string {
+export function exportResolvedConfigPath(file: string): void {

🔎 Notable Findings

• Security-critical files are healthy: host-iptables.ts, squid-config.ts, and docker-manager.ts are at 100% across all metrics; domain-patterns.ts has 100% statement coverage but only 89.47% branch coverage.
• Lowest coverage is in the bounded-execution and nvx modules: finite-cardinality.ts (46.03% statements, 35.29% branches) and cleanup-registry.ts (48.21% statements, 38.53% branches) are the weakest files.
• finite-disclosure.ts has a severe branch gap: 11.42% branch coverage, with 37.5% function coverage.
• cli.ts branch coverage is 50%: this is the entry point, so the untested branches are worth reviewing even though statement coverage is 85.71%.

🎯 Recommendations

1. High: Add tests for src/bounded-execution/finite-cardinality.ts and src/nvx/cleanup-registry.ts, the two lowest-coverage files (both under 50% statements). Target the uncovered functions first (finite-cardinality.ts at 66.66% funcs, cleanup-registry.ts at 60% funcs).
2. Medium: Cover the untested branches in src/bounded-execution/finite-disclosure.ts (11.42% branch) and src/resolved-config-artifact.ts (51.66% branch, with recent changes to artifact publishing and ownership logic). The new publishFinalResolvedConfig, publishEarlyResolvedConfig, and resolveArtifactOwner functions should have direct tests.
3. Low: Add branch tests for src/cli.ts (50%) and the remaining domain-patterns.ts branches (89.47%) to close out the security-critical entry-point and domain-validation paths.

Generated by Test Coverage Reporter · copilot · sum00 · 0.768 AIC · ⊞ 7.3K · ◷

• expires on Oct 23, 2026, 8:05 PM UTC

[github-actions[bot]]

Oracle Whisper

🔮 The ancient spirits stir, and their gaze falls upon this hall.
The smoke-test wanderer passed here, bearing signs of code and omen.
May the runes of the firewall remain aligned.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent has walked this hall. The omens are read; the firewall remembers this passing.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}