Security regression, fuzz, and privacy-invariant tests (#38) #96

Merged

lost-rob0t merged 2 commits from agent/issue-38-security-fuzz-integrity into main

2026-08-30 09:24:23 +00:00

lost-rob0t commented

2026-08-30 09:14:35 +00:00

(Migrated from github.com)

Implements #38.

RED commit: new fuzz/meta/invariant tests with genuine failures proving missing controls:

IpcRequestCodec.encode does not enforce token capabilities client-side (server-side decode does)
DiagnosticBundle accepts content-shaped reason codes (secret could enter bundles)
scripts/verify-failure-modes lacks the zero-selection scenario (8/9 modes)

GREEN adds those controls + docs/testing.md fuzz documentation.

Implements #38. RED commit: new fuzz/meta/invariant tests with genuine failures proving missing controls: - `IpcRequestCodec.encode` does not enforce token capabilities client-side (server-side decode does) - `DiagnosticBundle` accepts content-shaped reason codes (secret could enter bundles) - `scripts/verify-failure-modes` lacks the zero-selection scenario (8/9 modes) GREEN adds those controls + docs/testing.md fuzz documentation.