This matrix maps the v0.1 adversarial requirements to executable tests. Native-only checks are explicitly gated so a headless non-Windows runner cannot create a false release signal.
| Boundary | Automated evidence |
|---|---|
| Path traversal and root-prefix confusion | tests/unit/path-guard.test.ts |
| Symlink or Windows junction escape | tests/unit/path-guard.test.ts, tests/integration/filesystem.test.ts |
| Nested state and sensitive directory mutation | tests/unit/path-guard.test.ts, tests/integration/filesystem.test.ts |
| NTFS alternate data streams | tests/unit/path-guard.test.ts on Windows |
| Malicious repository instructions | tests/integration/adversarial.test.ts verifies provenance and output redaction |
| Repository hook execution | tests/integration/git.test.ts installs a failing hook and proves ForgeBridge does not run it |
| Command, ref, executable, or configuration injection | tests/integration/adversarial.test.ts, tests/integration/git.test.ts, tests/integration/terminal.test.ts, tests/unit/tunnel-client.test.ts |
| Malformed MCP and control payloads | tests/integration/adversarial.test.ts, tests/integration/http-transport.test.ts |
| Oversized HTTP, file, browser, and process output | tests/integration/http-transport.test.ts, tests/integration/filesystem.test.ts, tests/integration/terminal.test.ts, tests/e2e/browser.test.ts, tests/unit/output-buffer.test.ts |
| Pathological regular-expression isolation | tests/integration/filesystem.test.ts |
| Secret leakage to results, logs, and Git findings | tests/unit/redactor.test.ts, tests/integration/jobs.test.ts, tests/integration/git.test.ts, tests/integration/adversarial.test.ts |
| Request cancellation and owned-tree termination | tests/integration/terminal.test.ts records a real descendant PID and verifies it is gone, and tests/integration/adversarial.test.ts covers MCP cancellation |
| MCP connection loss with a durable job | tests/integration/adversarial.test.ts |
| Permission bypass, replay, scope, and grant limits | tests/unit/permission-engine.test.ts, tests/integration/mcp.test.ts |
| Browser redirect, download confinement, no-clobber screenshots, and observation eviction | tests/e2e/browser-mcp.test.ts, tests/e2e/browser.test.ts |
| Audit record schema and post-start tamper detection | tests/unit/audit.test.ts |
| Persisted job log confinement | tests/integration/jobs.test.ts |
| Semantic native Windows UI and literal input handling | tests/e2e/windows-uia.test.ts with FORGEBRIDGE_NATIVE_UIA_TEST=1 |
| Multi-file debugging, stale writes, hostile content, reconnect, browser, and hostile Git | tests/e2e/torture-lab.test.ts |
| Chromium disconnect recovery | tests/e2e/browser.test.ts |
| Malformed job state and occupied HTTP port | tests/integration/jobs.test.ts, tests/integration/http-transport.test.ts |
| Bounded audit pagination while verifying the full chain | tests/unit/audit.test.ts |
| Repeated MCP, job, browser, and reconnect resource cleanup | tests/e2e/soak.test.ts |
| Agent restart state and session-boundary behavior | tests/integration/agent-restart.test.ts |
The production dependency audit command is pnpm audit --prod. A zero-finding audit is necessary
but does not replace review of transitive package behavior or release artifact provenance.