[Coverage Report] Test Coverage Analysis Report — 2026-08-16

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-16

Overall Coverage

The test suite has identified critical coverage gaps in security-sensitive and newer architectural modules. While baseline coverage appears to meet minimum thresholds, specific security-critical paths in the bounded-execution subsystem and enclave architecture require immediate attention.

Primary Concern: A critical module with only 9.26% statement coverage has been flagged for urgent remediation.

🛡️ Security-Critical Path Status

Module	Priority	Coverage	Status	Risk Level
src/bounded-execution/finite-disclosure.ts	🔴 CRITICAL	9.26% stmts / 0.26% branches	⚠️ URGENT	HIGH
src/enclave/runtime-preflight.ts	🟡 MEDIUM	66.66% stmts / 41.02% branches	⚠️ Needs improvement	MEDIUM
src/commands/validators/config-assembly.ts	🟡 MEDIUM	69.69% stmts / 20% branches	⚠️ Needs improvement	MEDIUM
src/microvm/rootfs.ts	🟡 MEDIUM	71.69% stmts / 54.54% branches	⚠️ Acceptable	LOW
src/cloud-hypervisor/virtiofsd.ts	🟡 MEDIUM	72.51% stmts / 55.35% branches	⚠️ Acceptable	LOW

📋 Coverage Table

Coverage Gap Summary:

• Critical (< 15% statements): 1 file
• Low (60-80% statements): 4 files
• Target Threshold: 80% statements, 70% branches

Identified Gaps:

CRITICAL:  src/bounded-execution/finite-disclosure.ts
           → 9.26% statements (326/3524 covered)
           → 0.26% branches (virtually untested branch paths)
           → Risk: Credential disclosure, finite-disclosure protocol logic

LOW:       src/enclave/runtime-preflight.ts
           → 66.66% statements (requires 14 more lines)
           → 41.02% branches (conditional paths missing)

LOW:       src/commands/validators/config-assembly.ts
           → 69.69% statements (needs 9+ more lines)
           → 20% branches (error handling untested)

LOW:       src/microvm/rootfs.ts
           → 71.69% statements (acceptable drift)
           → 54.54% branches (edge cases unvalidated)

LOW:       src/cloud-hypervisor/virtiofsd.ts
           → 72.51% statements (acceptable drift)
           → 55.35% branches (fallback paths untested)

🔧 Function Audit

finite-disclosure.ts Analysis:
This module implements the enclave finite-disclosure protocol v2, a critical boundary for:

• Request/result schema validation
• Information-budget cardinality calculation
• Credential/privacy boundary enforcement
• Wire protocol version checking

Current Coverage Issues:

• Schema parsing logic: mostly untested
• Cardinality computation: limited test vectors
• Result validation: edge cases not covered
• Error/abort paths: virtually no coverage

Recommendation: Establish exhaustive test suite for schema algebra, cardinality edge cases (BigInt boundaries), and malformed input rejection.

---

enclave/runtime-preflight.ts Analysis:
Validates pre-flight checks for enclave execution. Gap areas:

• Error recovery paths (41% → 100% branch coverage needed)
• Resource validation edge cases
• Timeout boundary conditions

---

commands/validators/config-assembly.ts Analysis:
Validates AWF config assembly. Critical gaps:

• Branch coverage extremely low at 20%
• Error handling paths largely untested
• Config merge/inheritance logic needs better coverage

📅 Recent Source Changes (last 7 days)

Key recent additions affecting coverage:

• Bounded-execution module enhancements (finite-disclosure protocol updates)
• Enclave runtime preflight validation (new feature)
• Cloud Hypervisor integration (microVM backend)
• Config assembly validators (configuration system expansion)

All these new paths should be covered by corresponding test additions.

🔎 Notable Findings

1. Finite-Disclosure Protocol Critically Undercovered
   The credential/privacy boundary mechanism (finite-disclosure.ts) has only 9.26% statement coverage and 0.26% branch coverage. This module enforces information-budget constraints and validates agent responses against declared schemas—a security-critical function that requires comprehensive testing.

2. Branch Coverage Lagging Behind Statement Coverage
   Across all flagged files, branch coverage is significantly lower than statement coverage (0-55% vs 9-72%). This indicates that conditional/error paths are inadequately tested, reducing confidence in error handling and edge case behavior.

3. Enclave Architecture Modules Moderately Untested
   New enclave-related modules (runtime-preflight, virtiofsd) have 60-75% coverage. These support the unified enclave architecture introduced in recent commits and should reach 80%+ before production use.

4. Cloud Hypervisor Integration Partially Tested
   The microVM backend (cloud-hypervisor, rootfs modules) has ~72% statement coverage. While acceptable, branch coverage gaps suggest insufficient testing of failure modes and fallback scenarios.

🎯 Recommendations

🔴 HIGH — Execute Immediately

1. Expand finite-disclosure.ts Test Suite

• Priority: CRITICAL
• Scope: Increase statement coverage from 9.26% → 80%+ and branch coverage from 0.26% → 70%+
• Action:
  • Add comprehensive test vectors for schema parsing (const, enum, boolean, integer, object, tuple, array, union)
  • Test cardinality calculation edge cases (BigInt boundaries, nested structures)
  • Add malformed/out-of-spec schema rejection tests
  • Test result envelope validation (ok/error status)
  • Test information-budget bit reservation logic
  • Validate wire protocol version checking
  • Test all timing bucket boundary conditions
• Effort: ~3-4 days
• Why: This module enforces credential/privacy boundaries and information budgets for enclave responses—a direct security control

---

🟡 MEDIUM — Address Before Feature Freeze

2. Complete Branch Coverage for Enclave Validators

• Priority: HIGH
• Scope: Increase config-assembly branch coverage from 20% → 70%+; runtime-preflight from 41% → 70%+
• Action:
  • Map untested branch paths in config-assembly validators (error conditions, validation failures)
  • Add integration tests for config merge/inheritance scenarios
  • Test runtime-preflight recovery paths and resource validation edge cases
  • Add timeout boundary and resource exhaustion scenarios
• Effort: ~2 days
• Why: Validators control configuration security and enclave startup safety; incomplete branch coverage means error handling is unverified

---

🟡 MEDIUM — Plan for Next Sprint

3. Improve Cloud Hypervisor Integration Testing

• Priority: MEDIUM
• Scope: Increase rootfs.ts (71.69%) and virtiofsd.ts (72.51%) branch coverage to 80%+
• Action:
  • Add tests for microVM root filesystem mount edge cases
  • Test virtiofsd bridge failure modes and fallback behavior
  • Add integration tests for cloud-hypervisor backend initialization
  • Test resource cleanup and error propagation paths
• Effort: ~1.5 days
• Why: Cloud Hypervisor is the preview microVM backend; branch coverage ensures reliability under failure conditions

---

Summary

Immediate action required on the finite-disclosure protocol module (9.26% coverage). This security-critical module implements credential boundaries and must be thoroughly tested before further enclave development. Secondary priority: complete branch coverage for all validator modules to ensure robust error handling.

Generated by Test Coverage Reporter · sum00 · 19.5 AIC · ⊞ 5.3K · ◷

• expires on Aug 23, 2026, 6:44 PM UTC