Test & QA Report¶
Generated 2026-05-31 · agent commit on main · Go 1.26.3 · darwin/arm64 (Apple M1 Max).
All figures below are reproducible with the commands shown — nothing here is hand-entered.
Summary¶
| Metric | Result |
|---|---|
| Test suites | 15 packages, all PASS under -race |
| Race detector | enabled (-race -covermode=atomic) |
| Total statement coverage | 55.8 % |
DLP engine coverage (internal/dlp) |
86.9 % (load-bearing package) |
go vet |
clean |
staticcheck |
12 low-priority findings (no bugs — see below) |
| TypeScript typecheck (extension + electron) | PASS (enforced in CI) |
How to reproduce¶
cd agent
go test -race -covermode=atomic -coverprofile=coverage.out ./...
go tool cover -func=coverage.out | tail -1 # total coverage
go vet ./...
staticcheck ./... # go install honnef.co/go/tools/cmd/staticcheck@latest
Per-package coverage¶
| Package | Coverage |
|---|---|
internal/dlp |
86.9 % |
internal/rules |
84.6 % |
internal/heartbeat |
78.7 % |
internal/dns |
76.6 % |
internal/profile |
76.6 % |
internal/config |
74.4 % |
internal/updater |
74.2 % |
internal/proxy |
74.1 % |
internal/stats |
65.0 % |
internal/policy |
62.5 % |
internal/store |
57.5 % |
internal/api |
53.0 % |
internal/tamper |
51.8 % |
cmd/agent |
9.4 % (thin wiring; logic lives in covered packages) |
Coverage is concentrated where it matters: the DLP detection engine — the
component that decides block-vs-allow — sits at 86.9 %, and a CI gate
fails the build if internal/dlp average coverage drops below 80 %.
Static analysis¶
staticcheck reports 12 findings, all benign:
- 9 × U1000 — unused symbols (dead fields/vars/funcs kept for clarity or
platform-specific builds, e.g.
uninstallHelperon non-darwin). - 3 × ST1018 — string literals containing Unicode format characters. These
are intentional: they are the homoglyph / zero-width test vectors in
normalize_test.goused to prove the normalizer collapses evasion attempts.
No correctness (SAxxxx) findings.
What the suites cover¶
- Unit + table tests across DNS resolution, policy tiers, DLP pipeline stages, proxy, rule manifest verification, heartbeat, profile locking, stats counters, and the loopback API contract.
- Race detector on every package (concurrency-safe under
-race). - The DLP accuracy corpus and false-positive corpus (see the Security report for precision/recall) run as ordinary tests.
- The privacy invariant is asserted by a test that sweeps the SQLite store (see Security report).
Honest limitations¶
internal/sysconfshows 0 % because its real work is OS-privileged (keychain,networksetup, LaunchDaemon) and is exercised by integration/E2E paths rather than unit coverage.- Total coverage (55.8 %) is pulled down by thin wiring (
cmd/*) and OS-integration code; the security-critical engine is the well-covered part.