@ai-ecoverse/slicc-browsers 1.22.0 → 1.22.1

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.22.0",
+  "setVersion": "1.22.1",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -103,7 +103,7 @@
     "siteIsolationOff": "the browser runs without site isolation, so a cross-site iframe shares its parent's process",
     "inboundDelay": "a harness gate holding browser-to-guard messages until release during a history restore, with seed and release evidence",
     "forwardAudit": "a complete browser-side forwarding ledger for history-restore probes and for checks of a command's forwarded params (client.forwarded)",
-    "stockSetup": "the guard admits stock clients' setup calls: init scripts with no code (the no-code regex is matched on the whole string without the multiline flag), the four display emulation calls, bindings scoped to an isolated world, Page.createIsolatedWorld on an ordinary frame with grantUniveralAccess and contentSecurityPolicy stripped and no executionContextId for any other frame, and Target.setAutoAttach narrowed to tab targets (pages under the tab held like pages, with the same URL redaction in targetInfo)",
+    "stockSetup": "the guard admits stock clients' setup calls: init scripts with no code (the no-code regex is matched on the whole string without the multiline flag), the four display emulation calls, bindings scoped to an isolated world, Page.createIsolatedWorld on an ordinary frame with grantUniveralAccess and contentSecurityPolicy stripped and no executionContextId for any other frame, and Target.setAutoAttach that either narrows to tab targets or hides per target so no protected-origin page, iframe or worker reaches the client (pages under the tab held like pages, with the same URL redaction in targetInfo)",
     "syntheticAutoAttach": "the transport has no native Target.setAutoAttach, so the guard attaches new tabs, pages and their children itself and synthesizes Target.attachedToTarget, with the same placement and holds",
     "secureOrigin": "the fixture and page origins are secure contexts (HTTPS), so service worker registration is available",
     "closeProtected": "the guard lets Target.closeTarget close a protected tab"
@@ -131,7 +131,8 @@
     "probe": "guard-driver.mjs probe({log}, {tag})",
     "pageTarget": "the current page target id",
     "responseOrigin": "the fixture response CORS origin",
-    "browserUi": "the id of one of Chrome's own browser_ui targets, which the runner looks up with its own CDP"
+    "browserUi": "the id of one of Chrome's own browser_ui targets, which the runner looks up with its own CDP",
+    "workerTarget": "the id of the protected-origin worker the unguarded spawnWorker step created"
   },
   "vectors": [
     {
@@ -28016,8 +28017,7 @@
             "or": {
               "served": "{target}/doc?n={tag}",
               "observer": "fixture"
-            },
-            "required": true
+            }
           }
         },
         {
@@ -29148,9 +29148,10 @@
       },
       "expected": {
         "admitted": true,
-        "workerAttached": false,
+        "workerAttached": "either",
         "workerExists": true
-      }
+      },
+      "designDependent": ["workerAttached"]
     },
     {
       "id": "C3.tab-iframe-leak",
@@ -29449,8 +29450,1714 @@
       "expected": {
         "admitted": true,
         "workerExists": true,
-        "workerAttached": false
-      }
+        "workerAttached": "either"
+      },
+      "designDependent": ["workerAttached"]
+    },
+    {
+      "id": "C3.protected-worker-dedicated",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener-{tag}"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": true,
+            "flatten": true,
+            "filter": [
+              {
+                "type": "page",
+                "exclude": true
+              },
+              {}
+            ]
+          },
+          "session": "browser",
+          "as": "tabs",
+          "requires": ["autoAttach", "browserSession", "stockSetup"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Target.setAutoAttach",
+              "params": {
+                "autoAttach": true,
+                "waitForDebuggerOnStart": true,
+                "flatten": true,
+                "filter": [{}]
+              }
+            }
+          ],
+          "requires": ["autoAttach"],
+          "where": {
+            "type": "page"
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "spawnWorker": "dedicated",
+          "url": "{target}/doc?n=host-{tag}",
+          "as": "spawn",
+          "requires": ["autoAttach"]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n=host-{tag}",
+            "ms": 5000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{workerTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "reuseSession": true,
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "wait": 1500
+        },
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"]
+        },
+        {
+          "probeSessions": {
+            "since": "spawn",
+            "path": "/worker.js",
+            "attach": ["attach"]
+          },
+          "as": "probe",
+          "requires": ["autoAttach"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["autoAttach", "browserSession", "stockSetup"],
+      "observe": {
+        "admitted": {
+          "means": "the guard answered tabs without an error and the unguarded spawn finished",
+          "check": {
+            "all": [
+              {
+                "result": "tabs",
+                "path": "ok",
+                "equals": true,
+                "observer": "client"
+              },
+              {
+                "result": "spawn",
+                "path": "result.exists",
+                "equals": true,
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "dependsOn": []
+        },
+        "workerExists": {
+          "means": "the unguarded spawn left a live protected-origin worker",
+          "dependsOn": [],
+          "check": {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "workerAttached": {
+          "means": "the client got Target.attachedToTarget for a worker",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "workerListed": {
+          "means": "Target.getTargets shows the protected worker script URL to the client",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "targetId": "{workerTarget}"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker",
+                    "url": {
+                      "$contains": "{target}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker",
+                    "url": {
+                      "$contains": "/worker.js"
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "absencePoll": true
+        },
+        "workerDiscovered": {
+          "means": "a discovery event carries the protected worker script URL to the client",
+          "dependsOn": [],
+          "requires": ["discovery"],
+          "check": {
+            "any": [
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "attachSession": {
+          "means": "Target.attachToTarget on the worker targetId returned a session",
+          "dependsOn": [],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "Target.attachToTarget on the worker targetId was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        },
+        "workerReachable": {
+          "means": "a client session can evaluate in the protected worker global scope",
+          "dependsOn": [],
+          "check": {
+            "result": "probe",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in served the protected host document and the unguarded worker still exists",
+      "liveCheck": {
+        "all": [
+          {
+            "loaded": "{target}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "admitted": true,
+          "workerExists": true,
+          "workerAttached": "either",
+          "workerListed": true,
+          "attachSession": true,
+          "attachRefused": false,
+          "workerReachable": "either"
+        }
+      },
+      "expected": {
+        "admitted": true,
+        "workerExists": true,
+        "workerAttached": false,
+        "workerListed": false,
+        "workerDiscovered": false,
+        "attachSession": false,
+        "attachRefused": "either",
+        "workerReachable": false
+      },
+      "designDependent": ["attachRefused", "workerAttached"]
+    },
+    {
+      "id": "C3.protected-worker-shared",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener-{tag}"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": false,
+            "flatten": true,
+            "filter": [
+              {
+                "type": "page",
+                "exclude": true
+              },
+              {}
+            ]
+          },
+          "session": "browser",
+          "as": "tabs",
+          "requires": ["autoAttach", "browserSession", "stockSetup"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Target.setAutoAttach",
+              "params": {
+                "autoAttach": true,
+                "waitForDebuggerOnStart": true,
+                "flatten": true,
+                "filter": [{}]
+              }
+            }
+          ],
+          "requires": ["autoAttach"],
+          "where": {
+            "type": "page"
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "spawnWorker": "shared",
+          "url": "{target}/doc?n=host-{tag}",
+          "as": "spawn",
+          "requires": ["autoAttach"]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n=host-{tag}",
+            "ms": 5000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{workerTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "reuseSession": true,
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "wait": 1500
+        },
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"]
+        },
+        {
+          "probeSessions": {
+            "since": "spawn",
+            "path": "/shared-worker.js",
+            "attach": ["attach"]
+          },
+          "as": "probe",
+          "requires": ["autoAttach"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["autoAttach", "browserSession", "stockSetup"],
+      "observe": {
+        "admitted": {
+          "means": "the guard answered tabs without an error and the unguarded spawn finished",
+          "check": {
+            "all": [
+              {
+                "result": "tabs",
+                "path": "ok",
+                "equals": true,
+                "observer": "client"
+              },
+              {
+                "result": "spawn",
+                "path": "result.exists",
+                "equals": true,
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "dependsOn": []
+        },
+        "workerExists": {
+          "means": "the unguarded spawn left a live protected-origin worker",
+          "dependsOn": [],
+          "check": {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "workerAttached": {
+          "means": "the client got Target.attachedToTarget for a shared_worker",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "/shared-worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "workerListed": {
+          "means": "Target.getTargets shows the protected worker script URL to the client",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "targetId": "{workerTarget}"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "shared_worker"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "shared_worker",
+                    "url": {
+                      "$contains": "{target}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "shared_worker",
+                    "url": {
+                      "$contains": "/shared-worker.js"
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "absencePoll": true
+        },
+        "workerDiscovered": {
+          "means": "a discovery event carries the protected worker script URL to the client",
+          "dependsOn": [],
+          "requires": ["discovery"],
+          "check": {
+            "any": [
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "/shared-worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "shared_worker",
+                      "url": {
+                        "$contains": "/shared-worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "attachSession": {
+          "means": "Target.attachToTarget on the worker targetId returned a session",
+          "dependsOn": [],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "Target.attachToTarget on the worker targetId was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        },
+        "workerReachable": {
+          "means": "a client session can evaluate in the protected worker global scope",
+          "dependsOn": [],
+          "check": {
+            "result": "probe",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in served the protected host document and the unguarded worker still exists",
+      "liveCheck": {
+        "all": [
+          {
+            "loaded": "{target}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "admitted": true,
+          "workerExists": true,
+          "workerAttached": true,
+          "workerListed": true,
+          "attachSession": true,
+          "attachRefused": false,
+          "workerReachable": true
+        }
+      },
+      "expected": {
+        "admitted": true,
+        "workerExists": true,
+        "workerAttached": false,
+        "workerListed": false,
+        "workerDiscovered": false,
+        "attachSession": false,
+        "attachRefused": "either",
+        "workerReachable": false
+      },
+      "designDependent": ["attachRefused"]
+    },
+    {
+      "id": "C3.protected-service-worker",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener-{tag}"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": false,
+            "flatten": true,
+            "filter": [
+              {
+                "type": "page",
+                "exclude": true
+              },
+              {}
+            ]
+          },
+          "session": "browser",
+          "as": "tabs",
+          "requires": ["autoAttach", "browserSession", "stockSetup"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Target.setAutoAttach",
+              "params": {
+                "autoAttach": true,
+                "waitForDebuggerOnStart": true,
+                "flatten": true,
+                "filter": [{}]
+              }
+            }
+          ],
+          "requires": ["autoAttach"],
+          "where": {
+            "type": "page"
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "spawnWorker": "service",
+          "url": "{target}/doc?n=host-{tag}",
+          "as": "spawn",
+          "requires": ["autoAttach", "secureOrigin"]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n=host-{tag}",
+            "ms": 5000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{workerTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "reuseSession": true,
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "wait": 1500
+        },
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"]
+        },
+        {
+          "probeSessions": {
+            "since": "spawn",
+            "path": "/sw.js",
+            "attach": ["attach"]
+          },
+          "as": "probe",
+          "requires": ["autoAttach"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["autoAttach", "browserSession", "stockSetup", "secureOrigin"],
+      "observe": {
+        "admitted": {
+          "means": "the guard answered tabs without an error and the unguarded spawn finished",
+          "check": {
+            "all": [
+              {
+                "result": "tabs",
+                "path": "ok",
+                "equals": true,
+                "observer": "client"
+              },
+              {
+                "result": "spawn",
+                "path": "result.exists",
+                "equals": true,
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "dependsOn": []
+        },
+        "workerExists": {
+          "means": "the unguarded spawn left a live protected-origin worker",
+          "dependsOn": [],
+          "check": {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "workerAttached": {
+          "means": "the client got Target.attachedToTarget for a service_worker",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "/sw.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "workerListed": {
+          "means": "Target.getTargets shows the protected worker script URL to the client",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "targetId": "{workerTarget}"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "service_worker"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "service_worker",
+                    "url": {
+                      "$contains": "{target}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "service_worker",
+                    "url": {
+                      "$contains": "/sw.js"
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "absencePoll": true
+        },
+        "workerDiscovered": {
+          "means": "a discovery event carries the protected worker script URL to the client",
+          "dependsOn": [],
+          "requires": ["discovery"],
+          "check": {
+            "any": [
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "/sw.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "service_worker",
+                      "url": {
+                        "$contains": "/sw.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "attachSession": {
+          "means": "Target.attachToTarget on the worker targetId returned a session",
+          "dependsOn": [],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "Target.attachToTarget on the worker targetId was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        },
+        "workerReachable": {
+          "means": "a client session can evaluate in the protected worker global scope",
+          "dependsOn": [],
+          "check": {
+            "result": "probe",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in served the protected host document and the unguarded worker still exists",
+      "liveCheck": {
+        "all": [
+          {
+            "loaded": "{target}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "admitted": true,
+          "workerExists": true,
+          "workerAttached": true,
+          "workerListed": true,
+          "attachSession": true,
+          "attachRefused": false,
+          "workerReachable": true
+        }
+      },
+      "expected": {
+        "admitted": true,
+        "workerExists": true,
+        "workerAttached": false,
+        "workerListed": false,
+        "workerDiscovered": false,
+        "attachSession": false,
+        "attachRefused": "either",
+        "workerReachable": false
+      },
+      "designDependent": ["attachRefused"]
+    },
+    {
+      "id": "C3.protected-worker-framed",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener-{tag}"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": true,
+            "flatten": true,
+            "filter": [
+              {
+                "type": "page",
+                "exclude": true
+              },
+              {}
+            ]
+          },
+          "session": "browser",
+          "as": "tabs",
+          "requires": ["autoAttach", "browserSession", "stockSetup"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Target.setAutoAttach",
+              "params": {
+                "autoAttach": true,
+                "waitForDebuggerOnStart": true,
+                "flatten": true,
+                "filter": [{}]
+              }
+            }
+          ],
+          "requires": ["autoAttach"],
+          "where": {
+            "types": ["page", "iframe"]
+          }
+        }
+      ],
+      "trigger": [
+        {
+          "spawnWorker": "dedicated",
+          "url": "{target}/doc?n=host-{tag}",
+          "frame": "{ordinary}/doc?n=host-{tag}",
+          "as": "spawn",
+          "requires": ["autoAttach"]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n=host-{tag}",
+            "ms": 5000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{workerTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "reuseSession": true,
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "wait": 1500
+        },
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"]
+        },
+        {
+          "probeSessions": {
+            "since": "spawn",
+            "path": "/worker.js",
+            "attach": ["attach"]
+          },
+          "as": "probe",
+          "requires": ["autoAttach"]
+        }
+      ],
+      "targets": ["seven", "vault"],
+      "requires": ["autoAttach", "browserSession", "stockSetup"],
+      "observe": {
+        "admitted": {
+          "means": "the guard answered tabs without an error and the unguarded framed spawn finished",
+          "check": {
+            "all": [
+              {
+                "result": "tabs",
+                "path": "ok",
+                "equals": true,
+                "observer": "client"
+              },
+              {
+                "result": "spawn",
+                "path": "result.exists",
+                "equals": true,
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "dependsOn": []
+        },
+        "workerExists": {
+          "means": "the unguarded spawn left a live worker from a protected-origin iframe",
+          "dependsOn": [],
+          "check": {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "workerAttached": {
+          "means": "the client got Target.attachedToTarget for a worker from a protected iframe",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.attachedToTarget",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "workerListed": {
+          "means": "Target.getTargets shows the protected worker script URL to the client",
+          "dependsOn": [],
+          "check": {
+            "any": [
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "targetId": "{workerTarget}"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker"
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker",
+                    "url": {
+                      "$contains": "{target}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "result": "targets",
+                "path": "result.targetInfos",
+                "equals": {
+                  "$some": {
+                    "type": "worker",
+                    "url": {
+                      "$contains": "/worker.js"
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          },
+          "absencePoll": true
+        },
+        "workerDiscovered": {
+          "means": "a discovery event carries the protected worker script URL to the client",
+          "dependsOn": [],
+          "requires": ["discovery"],
+          "check": {
+            "any": [
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "targetId": "{workerTarget}"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker"
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetCreated",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "{target}"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              },
+              {
+                "event": "Target.targetInfoChanged",
+                "where": {
+                  "params": {
+                    "targetInfo": {
+                      "type": "worker",
+                      "url": {
+                        "$contains": "/worker.js"
+                      }
+                    }
+                  }
+                },
+                "observer": "client"
+              }
+            ],
+            "observer": "client"
+          }
+        },
+        "attachSession": {
+          "means": "Target.attachToTarget on the worker targetId returned a session",
+          "dependsOn": [],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "Target.attachToTarget on the worker targetId was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        },
+        "workerReachable": {
+          "means": "a client session can evaluate in the protected worker global scope",
+          "dependsOn": [],
+          "check": {
+            "result": "probe",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the stand-in served the protected iframe document and the unguarded framed worker still exists",
+      "liveCheck": {
+        "all": [
+          {
+            "loaded": "{ordinary}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "loaded": "{target}/doc?n=host-{tag}",
+            "observer": "fixture"
+          },
+          {
+            "result": "spawn",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "admitted": true,
+          "workerExists": true,
+          "workerAttached": "either",
+          "workerListed": true,
+          "attachSession": true,
+          "attachRefused": false,
+          "workerReachable": "either"
+        }
+      },
+      "expected": {
+        "admitted": true,
+        "workerExists": true,
+        "workerAttached": false,
+        "workerListed": false,
+        "workerDiscovered": false,
+        "attachSession": false,
+        "attachRefused": "either",
+        "workerReachable": false
+      },
+      "designDependent": ["attachRefused", "workerAttached"]
     }
   ]
 }