@ai-ecoverse/slicc-browsers 1.21.1 → 1.22.1

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.21.1",
+  "setVersion": "1.22.1",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -103,9 +103,10 @@
     "siteIsolationOff": "the browser runs without site isolation, so a cross-site iframe shares its parent's process",
     "inboundDelay": "a harness gate holding browser-to-guard messages until release during a history restore, with seed and release evidence",
     "forwardAudit": "a complete browser-side forwarding ledger for history-restore probes and for checks of a command's forwarded params (client.forwarded)",
-    "stockSetup": "the guard admits stock clients' setup calls: init scripts with no code (the no-code regex is matched on the whole string without the multiline flag), the four display emulation calls, bindings scoped to an isolated world, Page.createIsolatedWorld on an ordinary frame with grantUniveralAccess and contentSecurityPolicy stripped and no executionContextId for any other frame, and Target.setAutoAttach narrowed to tab targets (pages under the tab held like pages, with the same URL redaction in targetInfo)",
+    "stockSetup": "the guard admits stock clients' setup calls: init scripts with no code (the no-code regex is matched on the whole string without the multiline flag), the four display emulation calls, bindings scoped to an isolated world, Page.createIsolatedWorld on an ordinary frame with grantUniveralAccess and contentSecurityPolicy stripped and no executionContextId for any other frame, and Target.setAutoAttach that either narrows to tab targets or hides per target so no protected-origin page, iframe or worker reaches the client (pages under the tab held like pages, with the same URL redaction in targetInfo)",
     "syntheticAutoAttach": "the transport has no native Target.setAutoAttach, so the guard attaches new tabs, pages and their children itself and synthesizes Target.attachedToTarget, with the same placement and holds",
-    "secureOrigin": "the fixture and page origins are secure contexts (HTTPS), so service worker registration is available"
+    "secureOrigin": "the fixture and page origins are secure contexts (HTTPS), so service worker registration is available",
+    "closeProtected": "the guard lets Target.closeTarget close a protected tab"
   },
   "placeholders": {
     "target": "the target's origin; {plain} on the control",
@@ -130,7 +131,8 @@
     "probe": "guard-driver.mjs probe({log}, {tag})",
     "pageTarget": "the current page target id",
     "responseOrigin": "the fixture response CORS origin",
-    "browserUi": "the id of one of Chrome's own browser_ui targets, which the runner looks up with its own CDP"
+    "browserUi": "the id of one of Chrome's own browser_ui targets, which the runner looks up with its own CDP",
+    "workerTarget": "the id of the protected-origin worker the unguarded spawnWorker step created"
   },
   "vectors": [
     {
@@ -1706,6 +1708,7 @@
         },
         "closeRefused": {
           "means": "protected error-page restore: closeRefused",
+          "unless": ["closeProtected"],
           "check": {
             "result": "errorPage",
             "path": "result.closeRefused",
@@ -1713,6 +1716,16 @@
             "observer": "client"
           }
         },
+        "closed": {
+          "means": "protected error-page restore: Target.closeTarget on the locked tab is answered with success and the tab is gone",
+          "check": {
+            "result": "errorPage",
+            "path": "result.closed",
+            "equals": true,
+            "observer": "client"
+          },
+          "requires": ["closeProtected"]
+        },
         "attachRedacted": {
           "means": "protected error-page restore: attachRedacted",
           "check": {
@@ -1754,6 +1767,7 @@
           "evaluateRefused": false,
           "attachRefused": false,
           "closeRefused": false,
+          "closed": true,
           "attachRedacted": false,
           "fullURL": true
         }
@@ -1770,6 +1784,7 @@
         "evaluateRefused": true,
         "attachRefused": true,
         "closeRefused": true,
+        "closed": true,
         "attachRedacted": true,
         "fullURL": false
       }
@@ -1887,6 +1902,7 @@
         },
         "closeRefused": {
           "means": "protected error-page sticky: closeRefused",
+          "unless": ["closeProtected"],
           "check": {
             "result": "errorPage",
             "path": "result.closeRefused",
@@ -1894,6 +1910,16 @@
             "observer": "client"
           }
         },
+        "closed": {
+          "means": "protected error-page sticky: Target.closeTarget on the locked tab is answered with success and the tab is gone",
+          "check": {
+            "result": "errorPage",
+            "path": "result.closed",
+            "equals": true,
+            "observer": "client"
+          },
+          "requires": ["closeProtected"]
+        },
         "stickyError": {
           "means": "protected error-page sticky: stickyError",
           "check": {
@@ -1944,6 +1970,7 @@
           "evaluateRefused": false,
           "attachRefused": false,
           "closeRefused": false,
+          "closed": true,
           "stickyError": true,
           "attachRedacted": false,
           "fullURL": true
@@ -1961,6 +1988,7 @@
         "evaluateRefused": true,
         "attachRefused": true,
         "closeRefused": true,
+        "closed": true,
         "stickyError": true,
         "attachRedacted": true,
         "fullURL": false
@@ -2080,6 +2108,7 @@
         },
         "closeRefused": {
           "means": "protected error-page sticky (query): closeRefused",
+          "unless": ["closeProtected"],
           "check": {
             "result": "errorPage",
             "path": "result.closeRefused",
@@ -2087,6 +2116,16 @@
             "observer": "client"
           }
         },
+        "closed": {
+          "means": "protected error-page sticky (query): Target.closeTarget on the locked tab is answered with success and the tab is gone",
+          "check": {
+            "result": "errorPage",
+            "path": "result.closed",
+            "equals": true,
+            "observer": "client"
+          },
+          "requires": ["closeProtected"]
+        },
         "stickyError": {
           "means": "protected error-page sticky (query): stickyError",
           "check": {
@@ -2137,6 +2176,7 @@
           "evaluateRefused": false,
           "attachRefused": false,
           "closeRefused": false,
+          "closed": true,
           "stickyError": true,
           "attachRedacted": false,
           "fullURL": true
@@ -2154,6 +2194,7 @@
         "evaluateRefused": true,
         "attachRefused": true,
         "closeRefused": true,
+        "closed": true,
         "stickyError": true,
         "attachRedacted": true,
         "fullURL": false
@@ -2273,6 +2314,7 @@
         },
         "closeRefused": {
           "means": "protected error-page sticky (fragment): closeRefused",
+          "unless": ["closeProtected"],
           "check": {
             "result": "errorPage",
             "path": "result.closeRefused",
@@ -2280,6 +2322,16 @@
             "observer": "client"
           }
         },
+        "closed": {
+          "means": "protected error-page sticky (fragment): Target.closeTarget on the locked tab is answered with success and the tab is gone",
+          "check": {
+            "result": "errorPage",
+            "path": "result.closed",
+            "equals": true,
+            "observer": "client"
+          },
+          "requires": ["closeProtected"]
+        },
         "stickyError": {
           "means": "protected error-page sticky (fragment): stickyError",
           "check": {
@@ -2330,6 +2382,7 @@
           "evaluateRefused": false,
           "attachRefused": false,
           "closeRefused": false,
+          "closed": true,
           "stickyError": true,
           "attachRedacted": false,
           "fullURL": true
@@ -2347,6 +2400,7 @@
         "evaluateRefused": true,
         "attachRefused": true,
         "closeRefused": true,
+        "closed": true,
         "stickyError": true,
         "attachRedacted": true,
         "fullURL": false
@@ -26267,7 +26321,7 @@
         {
           "cdp": "Page.addScriptToEvaluateOnNewDocument",
           "params": {
-            "source": "// slicc\u2028fetch
fetch(new URL('/doc?n=bound-ls-{tag}', location.href)).catch(()=>{})\n//# sourceURL=slicc-ls-{tag}\n",
+            "source": "// slicc
fetch(new URL('/doc?n=bound-ls-{tag}', location.href)).catch(()=>{})\n//# sourceURL=slicc-ls-{tag}\n",
             "worldName": "slicc-bound-ls-{tag}"
           },
           "as": "boundLs",
@@ -26279,7 +26333,7 @@
         {
           "cdp": "Page.addScriptToEvaluateOnNewDocument",
           "params": {
-            "source": "// slicc\u2029fetch
fetch(new URL('/doc?n=bound-ps-{tag}', location.href)).catch(()=>{})\n//# sourceURL=slicc-ps-{tag}\n",
+            "source": "// slicc
fetch(new URL('/doc?n=bound-ps-{tag}', location.href)).catch(()=>{})\n//# sourceURL=slicc-ps-{tag}\n",
             "worldName": "slicc-bound-ps-{tag}"
           },
           "as": "boundPs",
@@ -26315,7 +26369,7 @@
         {
           "cdp": "Page.addScriptToEvaluateOnNewDocument",
           "params": {
-            "source": "\ufefffetch(new URL('/doc?n=bound-bom-{tag}', location.href)).catch(()=>{})\n//# sourceURL=slicc-bom-{tag}\n",
+            "source": "fetch(new URL('/doc?n=bound-bom-{tag}', location.href)).catch(()=>{})\n//# sourceURL=slicc-bom-{tag}\n",
             "worldName": "slicc-bound-bom-{tag}"
           },
           "as": "boundBom",
@@ -27963,8 +28017,7 @@
             "or": {
               "served": "{target}/doc?n={tag}",
               "observer": "fixture"
-            },
-            "required": true
+            }
           }
         },
         {
@@ -29095,9 +29148,10 @@
       },
       "expected": {
         "admitted": true,
-        "workerAttached": false,
+        "workerAttached": "either",
         "workerExists": true
-      }
+      },
+      "designDependent": ["workerAttached"]
     },
     {
       "id": "C3.tab-iframe-leak",
@@ -29396,8 +29450,1714 @@
       "expected": {
         "admitted": true,
         "workerExists": true,
-        "workerAttached": false
-      }
+        "workerAttached": "either"
+      },
+      "designDependent": ["workerAttached"]
+    },
+    {
+      "id": "C3.protected-worker-dedicated",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener-{tag}"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": true,
+            "flatten": true,
+            "filter": [
+              {
+                "type": "page",
+                "exclude": true
+              },
+              {}
+            ]
+          },
+          "session": "browser",
+          "as": "tabs",
+          "requires": ["autoAttach", "browserSession", "stockSetup"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Target.setAutoAttach",
+              "params": {
+                "autoAttach": true,
+                "waitForDebuggerOnStart": true,
+                "flatten": true,
+                "filter": [{}]
+              }
+            }
+          ],
+          "requires": ["autoAttach"],
+          "where": {
+            "type": "page"
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "spawnWorker": "dedicated",
+          "url": "{target}/doc?n=host-{tag}",
+          "as": "spawn",
+          "requires": ["autoAttach"]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n=host-{tag}",
+            "ms": 5000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{workerTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "reuseSession": true,
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "wait": 1500
+        },
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"]
+        },
+        {
+          "probeSessions": {
+            "since": "spawn",
+            "path": "/worker.js",
+            "attach": ["attach"]
+          },
+          "as": "probe",
+          "requires": ["autoAttach"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["autoAttach", "browserSession", "stockSetup"],
+      "observe": {
+        "admitted": {
+          "means": "the guard answered tabs without an error and the unguarded spawn finished",
+          "check": {
+            "all": [
+              {
+                "result": "tabs",
+                "path": "ok",
+                "equals": true,
+                "observer": "client"
+              },
+              {
+                "result": "spawn",
+                "path": "result.exists",
+                "equals": true,
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "dependsOn": []
+        },
+        "workerExists": {
+          "means": "the unguarded spawn left a live protected-origin worker",
+          "dependsOn": [],
+          "check": {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "workerAttached": {
+          "means": "the client got Target.attachedToTarget for a worker",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "workerListed": {
+          "means": "Target.getTargets shows the protected worker script URL to the client",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "targetId": "{workerTarget}"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker",
+                    "url": {
+                      "$contains": "{target}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker",
+                    "url": {
+                      "$contains": "/worker.js"
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "absencePoll": true
+        },
+        "workerDiscovered": {
+          "means": "a discovery event carries the protected worker script URL to the client",
+          "dependsOn": [],
+          "requires": ["discovery"],
+          "check": {
+            "any": [
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "attachSession": {
+          "means": "Target.attachToTarget on the worker targetId returned a session",
+          "dependsOn": [],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "Target.attachToTarget on the worker targetId was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        },
+        "workerReachable": {
+          "means": "a client session can evaluate in the protected worker global scope",
+          "dependsOn": [],
+          "check": {
+            "result": "probe",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in served the protected host document and the unguarded worker still exists",
+      "liveCheck": {
+        "all": [
+          {
+            "loaded": "{target}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "admitted": true,
+          "workerExists": true,
+          "workerAttached": "either",
+          "workerListed": true,
+          "attachSession": true,
+          "attachRefused": false,
+          "workerReachable": "either"
+        }
+      },
+      "expected": {
+        "admitted": true,
+        "workerExists": true,
+        "workerAttached": false,
+        "workerListed": false,
+        "workerDiscovered": false,
+        "attachSession": false,
+        "attachRefused": "either",
+        "workerReachable": false
+      },
+      "designDependent": ["attachRefused", "workerAttached"]
+    },
+    {
+      "id": "C3.protected-worker-shared",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener-{tag}"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": false,
+            "flatten": true,
+            "filter": [
+              {
+                "type": "page",
+                "exclude": true
+              },
+              {}
+            ]
+          },
+          "session": "browser",
+          "as": "tabs",
+          "requires": ["autoAttach", "browserSession", "stockSetup"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Target.setAutoAttach",
+              "params": {
+                "autoAttach": true,
+                "waitForDebuggerOnStart": true,
+                "flatten": true,
+                "filter": [{}]
+              }
+            }
+          ],
+          "requires": ["autoAttach"],
+          "where": {
+            "type": "page"
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "spawnWorker": "shared",
+          "url": "{target}/doc?n=host-{tag}",
+          "as": "spawn",
+          "requires": ["autoAttach"]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n=host-{tag}",
+            "ms": 5000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{workerTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "reuseSession": true,
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "wait": 1500
+        },
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"]
+        },
+        {
+          "probeSessions": {
+            "since": "spawn",
+            "path": "/shared-worker.js",
+            "attach": ["attach"]
+          },
+          "as": "probe",
+          "requires": ["autoAttach"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["autoAttach", "browserSession", "stockSetup"],
+      "observe": {
+        "admitted": {
+          "means": "the guard answered tabs without an error and the unguarded spawn finished",
+          "check": {
+            "all": [
+              {
+                "result": "tabs",
+                "path": "ok",
+                "equals": true,
+                "observer": "client"
+              },
+              {
+                "result": "spawn",
+                "path": "result.exists",
+                "equals": true,
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "dependsOn": []
+        },
+        "workerExists": {
+          "means": "the unguarded spawn left a live protected-origin worker",
+          "dependsOn": [],
+          "check": {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "workerAttached": {
+          "means": "the client got Target.attachedToTarget for a shared_worker",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "/shared-worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "workerListed": {
+          "means": "Target.getTargets shows the protected worker script URL to the client",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "targetId": "{workerTarget}"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "shared_worker"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "shared_worker",
+                    "url": {
+                      "$contains": "{target}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "shared_worker",
+                    "url": {
+                      "$contains": "/shared-worker.js"
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "absencePoll": true
+        },
+        "workerDiscovered": {
+          "means": "a discovery event carries the protected worker script URL to the client",
+          "dependsOn": [],
+          "requires": ["discovery"],
+          "check": {
+            "any": [
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "/shared-worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "/shared-worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "attachSession": {
+          "means": "Target.attachToTarget on the worker targetId returned a session",
+          "dependsOn": [],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "Target.attachToTarget on the worker targetId was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        },
+        "workerReachable": {
+          "means": "a client session can evaluate in the protected worker global scope",
+          "dependsOn": [],
+          "check": {
+            "result": "probe",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in served the protected host document and the unguarded worker still exists",
+      "liveCheck": {
+        "all": [
+          {
+            "loaded": "{target}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "admitted": true,
+          "workerExists": true,
+          "workerAttached": true,
+          "workerListed": true,
+          "attachSession": true,
+          "attachRefused": false,
+          "workerReachable": true
+        }
+      },
+      "expected": {
+        "admitted": true,
+        "workerExists": true,
+        "workerAttached": false,
+        "workerListed": false,
+        "workerDiscovered": false,
+        "attachSession": false,
+        "attachRefused": "either",
+        "workerReachable": false
+      },
+      "designDependent": ["attachRefused"]
+    },
+    {
+      "id": "C3.protected-service-worker",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener-{tag}"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": false,
+            "flatten": true,
+            "filter": [
+              {
+                "type": "page",
+                "exclude": true
+              },
+              {}
+            ]
+          },
+          "session": "browser",
+          "as": "tabs",
+          "requires": ["autoAttach", "browserSession", "stockSetup"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Target.setAutoAttach",
+              "params": {
+                "autoAttach": true,
+                "waitForDebuggerOnStart": true,
+                "flatten": true,
+                "filter": [{}]
+              }
+            }
+          ],
+          "requires": ["autoAttach"],
+          "where": {
+            "type": "page"
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "spawnWorker": "service",
+          "url": "{target}/doc?n=host-{tag}",
+          "as": "spawn",
+          "requires": ["autoAttach", "secureOrigin"]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n=host-{tag}",
+            "ms": 5000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{workerTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "reuseSession": true,
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "wait": 1500
+        },
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"]
+        },
+        {
+          "probeSessions": {
+            "since": "spawn",
+            "path": "/sw.js",
+            "attach": ["attach"]
+          },
+          "as": "probe",
+          "requires": ["autoAttach"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["autoAttach", "browserSession", "stockSetup", "secureOrigin"],
+      "observe": {
+        "admitted": {
+          "means": "the guard answered tabs without an error and the unguarded spawn finished",
+          "check": {
+            "all": [
+              {
+                "result": "tabs",
+                "path": "ok",
+                "equals": true,
+                "observer": "client"
+              },
+              {
+                "result": "spawn",
+                "path": "result.exists",
+                "equals": true,
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "dependsOn": []
+        },
+        "workerExists": {
+          "means": "the unguarded spawn left a live protected-origin worker",
+          "dependsOn": [],
+          "check": {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "workerAttached": {
+          "means": "the client got Target.attachedToTarget for a service_worker",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "/sw.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "workerListed": {
+          "means": "Target.getTargets shows the protected worker script URL to the client",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "targetId": "{workerTarget}"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "service_worker"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "service_worker",
+                    "url": {
+                      "$contains": "{target}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "service_worker",
+                    "url": {
+                      "$contains": "/sw.js"
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "absencePoll": true
+        },
+        "workerDiscovered": {
+          "means": "a discovery event carries the protected worker script URL to the client",
+          "dependsOn": [],
+          "requires": ["discovery"],
+          "check": {
+            "any": [
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "/sw.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "/sw.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "attachSession": {
+          "means": "Target.attachToTarget on the worker targetId returned a session",
+          "dependsOn": [],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "Target.attachToTarget on the worker targetId was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        },
+        "workerReachable": {
+          "means": "a client session can evaluate in the protected worker global scope",
+          "dependsOn": [],
+          "check": {
+            "result": "probe",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in served the protected host document and the unguarded worker still exists",
+      "liveCheck": {
+        "all": [
+          {
+            "loaded": "{target}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "admitted": true,
+          "workerExists": true,
+          "workerAttached": true,
+          "workerListed": true,
+          "attachSession": true,
+          "attachRefused": false,
+          "workerReachable": true
+        }
+      },
+      "expected": {
+        "admitted": true,
+        "workerExists": true,
+        "workerAttached": false,
+        "workerListed": false,
+        "workerDiscovered": false,
+        "attachSession": false,
+        "attachRefused": "either",
+        "workerReachable": false
+      },
+      "designDependent": ["attachRefused"]
+    },
+    {
+      "id": "C3.protected-worker-framed",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener-{tag}"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": true,
+            "flatten": true,
+            "filter": [
+              {
+                "type": "page",
+                "exclude": true
+              },
+              {}
+            ]
+          },
+          "session": "browser",
+          "as": "tabs",
+          "requires": ["autoAttach", "browserSession", "stockSetup"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Target.setAutoAttach",
+              "params": {
+                "autoAttach": true,
+                "waitForDebuggerOnStart": true,
+                "flatten": true,
+                "filter": [{}]
+              }
+            }
+          ],
+          "requires": ["autoAttach"],
+          "where": {
+            "types": ["page", "iframe"]
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "spawnWorker": "dedicated",
+          "url": "{target}/doc?n=host-{tag}",
+          "frame": "{ordinary}/doc?n=host-{tag}",
+          "as": "spawn",
+          "requires": ["autoAttach"]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n=host-{tag}",
+            "ms": 5000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{workerTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "reuseSession": true,
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "wait": 1500
+        },
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"]
+        },
+        {
+          "probeSessions": {
+            "since": "spawn",
+            "path": "/worker.js",
+            "attach": ["attach"]
+          },
+          "as": "probe",
+          "requires": ["autoAttach"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["autoAttach", "browserSession", "stockSetup"],
+      "observe": {
+        "admitted": {
+          "means": "the guard answered tabs without an error and the unguarded framed spawn finished",
+          "check": {
+            "all": [
+              {
+                "result": "tabs",
+                "path": "ok",
+                "equals": true,
+                "observer": "client"
+              },
+              {
+                "result": "spawn",
+                "path": "result.exists",
+                "equals": true,
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "dependsOn": []
+        },
+        "workerExists": {
+          "means": "the unguarded spawn left a live worker from a protected-origin iframe",
+          "dependsOn": [],
+          "check": {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "workerAttached": {
+          "means": "the client got Target.attachedToTarget for a worker from a protected iframe",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "workerListed": {
+          "means": "Target.getTargets shows the protected worker script URL to the client",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "targetId": "{workerTarget}"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker",
+                    "url": {
+                      "$contains": "{target}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker",
+                    "url": {
+                      "$contains": "/worker.js"
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "absencePoll": true
+        },
+        "workerDiscovered": {
+          "means": "a discovery event carries the protected worker script URL to the client",
+          "dependsOn": [],
+          "requires": ["discovery"],
+          "check": {
+            "any": [
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "attachSession": {
+          "means": "Target.attachToTarget on the worker targetId returned a session",
+          "dependsOn": [],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "Target.attachToTarget on the worker targetId was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        },
+        "workerReachable": {
+          "means": "a client session can evaluate in the protected worker global scope",
+          "dependsOn": [],
+          "check": {
+            "result": "probe",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in served the protected iframe document and the unguarded framed worker still exists",
+      "liveCheck": {
+        "all": [
+          {
+            "loaded": "{ordinary}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "loaded": "{target}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "admitted": true,
+          "workerExists": true,
+          "workerAttached": "either",
+          "workerListed": true,
+          "attachSession": true,
+          "attachRefused": false,
+          "workerReachable": "either"
+        }
+      },
+      "expected": {
+        "admitted": true,
+        "workerExists": true,
+        "workerAttached": false,
+        "workerListed": false,
+        "workerDiscovered": false,
+        "attachSession": false,
+        "attachRefused": "either",
+        "workerReachable": false
+      },
+      "designDependent": ["attachRefused", "workerAttached"]
     }
   ]
 }