@ccoalm/ccl-skills 0.1.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/non-functional-specialized-scenarios.md

@@ -0,0 +1,296 @@
+# Non-Functional And Specialized Testing — Scenario + Assertion Matrices
+
+Per-domain detail for the `## Non-Functional And Specialized Testing` section of `SKILL.md`. The entrypoint keeps the ownership/pointer surface; the domain index, each domain's gate intent, full scenario/assertion matrix, and routing handoffs live here.
+
+## Domain index
+
+This index is a scan aid, not an ownership claim; `testing-strategy` owns gate/evidence selection, while each domain owner keeps implementation semantics and detailed method.
+
+- Performance, load, latency, bundle, or throughput budgets
+- Security-sensitive boundaries
+- High-risk resilience boundaries
+- User-away or idle-return recap generation
+- Persisted tool-output artifacts
+- Progress attachments and terminal notifications
+- Terminal title, tab/sidebar status, and prompt-adjacent status metadata
+- Terminal paste and clipboard ingress
+- Modal terminal text editing
+- Background shell task lifecycle and stalled-prompt watchdogs
+- Foreground-query to background-session handoff
+- Inference quota, capacity, retry, and fallback
+- Prompt cache miss attribution
+- Agent conversation compaction and context reconstruction
+- Persisted settings/config migrations
+- Remote managed runtime policy
+- Client telemetry and remote config control planes
+- User-visible tips, nudges, release notes, and update notices
+- Terminal host sleep-prevention or power assertions
+- Terminal shell delay-loop blocking and auto-backgrounding
+- Local diagnostic, debug, and error sinks
+- Runtime startup trust and configuration bootstrap
+- Host OS and GUI action control
+- Dynamic extensions and agent skills
+- Model-visible instruction-layer composition
+- Model-visible search and code-discovery evidence
+- External tool connectors and approval channels
+- Browser-based local authorization callbacks and token caches
+- Agent memory and shared memory sync
+- Query-time memory recall
+- SDK/headless agent protocol and streaming transport
+- Machine-readable stdout stream purity
+- Model-visible input, attachment, and media ingestion
+- Model-initiated local user questions
+- Slash command and skill invocation control
+- Editor or IDE integrations
+- Remote session token refresh and transport rebuild
+- Local egress relay and inference fixture replay
+- Voice or speech-to-text prompt input
+- Configurable shortcuts and command palettes
+- Terminal, command-line, and text UI surfaces
+- CLI package distribution and self-update
+- Agent task orchestration and background workers
+- Agent-to-agent mailbox and peer messaging
+- Agent tool execution authorization
+- Per-turn model-loop finality
+- Runtime hook configuration and callback control planes
+- Custom terminal status lines, footers, and prompt-adjacent status commands
+- Post-turn hook execution and blocking finality
+- Session discovery, resume, and fork provenance
+- Runtime workspace-scope changes
+- Agent plan-to-execute state transitions
+- Accessibility and visual regression
+- LLM, agent, RAG, model, prompt, and evaluation harness behavior
+
+## Performance, load, latency, bundle, or throughput budgets
+
+place the gate here; use benchmark/performance skills for measurement method.
+
+## Security-sensitive boundaries
+
+require assertion-based negative-path tests for authn/authz, replay, injection, tenant isolation, and permission bypass; use security review skills for audit method.
+
+## High-risk resilience boundaries
+
+require scenario tests or drills for money/quota/accounting, permission uncertainty, tenant/user data isolation, duplicate writes, high-impact AI fallback/refusal, user finality after retry/refresh/offline, and incident traceability. Route product ownership and launch gates through `product-rd-workflow`.
+
+## User-away or idle-return recap generation
+
+test the recap as a model-visible meta-message, not a notification. Cover unsupported or unknown focus state, blurred/idle timer start, focus return clearing timers and aborting in-flight generation, timer firing during loading or an active turn as pending-only behavior, post-turn execution only when the user remains away, feature/settings/policy/privacy gates, no duplicate recap before the next real user turn, empty transcript or unavailable memory fallback, API error and abort fallback, bounded recent-context windows with no full-history or absence claims, no tools/agents/connectors/cache pollution/side effects, stale discard after new user input or session/workspace/root/privacy/policy/settings/focus drift, typed lower-precedence insertion that cannot authorize permissions, complete tasks, or override current intent, prompt-injection resistance for transcript and memory content, structured-output purity, diagnostics redaction, and product-visible dialog choices or dismissal persistence when present. Route runtime semantics to `llm-inference-integration`, visible return-context acceptance to `product-rd-workflow`, visual hierarchy to `product-ui-ux-design`, terminal focus mechanics to `terminal-cli-dev`, rollout/default gates to `platform-release-engineering`, signal schema to `platform-observability`, stale/noisy/misleading recap incidents to `defect-diagnosis`, and security/adversarial review when private transcript, memory, or workspace context can influence the recap.
+
+## Persisted tool-output artifacts
+
+test the replacement path as evidence transformation, not storage plumbing. Cover ordinary small output, oversized text, oversized structured data, aggregate per-message budget replacement, binary resource or fetch output, image/nonpersistable content fallback, empty-result typed markers, persistence failure, read/viewer failure, concurrent writes, marker-visible-before-durable-write, cleanup while a read/viewer is active, late writer after abort, digest or snapshot mismatch, and cleanup or retention policy. Assert preview/full-output separation, explicit format/schema/content-type labels, original-size and truncation metadata, stable replacement records across resume/replay/prompt-cache reuse, immutable digest/snapshot or locked generation for high-risk mutable artifacts, no later replacement of already-unreplaced results, no summary/analysis/absence claim before required chunks are read or unread portions are declared, chunk/search progress accounting, binary extension/viewer dispatch, source permission and provenance labels preserved after local artifact creation, no permission widening through saved paths, and diagnostics redaction for raw output, local paths, tool ids, server/resource identifiers, credentials, and free-form persistence errors. Route runtime semantics to `llm-inference-integration`, connector/resource transport mechanics to `platform-service-connectivity`, signal schema and support-artifact policy to `platform-observability`, stale or misleading-output incidents to `defect-diagnosis`, rollout/default changes to `platform-release-engineering`, and security/adversarial review when sensitive tool output can be written, read back, logged, or summarized.
+
+## Progress attachments and terminal notifications
+
+test progress as a status-channel boundary, not merely a spinner. Cover high-frequency ephemeral ticks for the same parent operation, stateful progress trails with nested messages or task/history milestones, final tool results arriving after progress, progress after abort/cancel/error/success, compaction or resume, parent-operation mismatch, concurrent operations, terminal capability unavailable, multiplexer wrapping, raw fallback signals, percent clamping, explicit terminal clear, structured-output mode, noninteractive mode, copy/scrollback behavior, and diagnostics redaction. Assert that ephemeral ticks replace rather than append when only current display state matters, stateful trails are preserved or merged without losing UI recovery evidence, transcript/replay behavior is stable, no completion or absence claim is inferred from progress alone, stale progress is dropped after session/workspace/root/privacy/policy/input or terminal-generation drift, terminal control sequences and notifications do not pollute stdout, structured protocol frames, transcripts, logs, or copied user content, unsupported terminals degrade quietly, and notification/progress diagnostics omit raw messages, command text, local paths, account/session identifiers, control bytes, credentials, and free-form terminal errors. Route runtime semantics to `llm-inference-integration`, terminal mechanics to `terminal-cli-dev`, signal schema to `platform-observability`, rollout/default policy to `platform-release-engineering`, stale/noisy/misleading progress incidents to `defect-diagnosis`, and product/security review when user attention, privacy, or automation behavior changes.
+
+## Terminal title, tab/sidebar status, and prompt-adjacent status metadata
+
+test terminal chrome as a side channel, not stdout, protocol output, transcript content, copied user content, model-visible evidence, or task finality. Cover pre-emit capability, terminal, multiplexer, settings, trust, managed-policy, privacy, entrypoint, and owner-generation gates; source-class allowlisting; multiplexer passthrough wrapping and escaping; platform-title fallback; disabled/no-op states; null clearing; owner-change clearing; unmount/exit/crash-recovery cleanup for session-owned state; unsupported-terminal fallback; and no clearing of unrelated terminal/user state. Cover title/status label construction from session/task/approval/dialog/loading state; stale title/status rejection after session, workspace/root, permission mode, model, input mode, terminal, settings, trust, policy, or owner drift; animation/tick behavior that does not re-render unrelated primary surfaces; and visible waiting/busy/idle labels that cannot be mistaken for approval, denial, error, completion, or model evidence. For command-backed status lines, rely on the existing custom-status-command boundary for execution authorization, then assert display-side stale rejection, multiline normalization, stable footer height while async output resolves, command failure/fallback, and no focus theft, input submit, scrollback clearing, stdout/protocol pollution, transcript pollution, or copy-selection pollution. Assert style/control/hyperlink/hidden-text stripping before terminal emission and redaction for raw title/status bodies, command text, command output, prompt text, local paths, workspace names, branch names, account/session identifiers, control bytes, credentials, and free-form errors. Route terminal mechanics to `terminal-cli-dev`, model-visible/task-finality exceptions to `llm-inference-integration`, visual meaning to `product-ui-ux-design`, rollout/default policy to `platform-release-engineering`, signal schema to `platform-observability`, stale/misleading metadata incidents to `defect-diagnosis`, and security review when terminal chrome can expose sensitive context or confuse approval/completion state.
+
+## Terminal paste and clipboard ingress
+
+test paste as a terminal input boundary before ordinary text handling and before model-visible insertion, not as ordinary typing. Cover bracketed paste start/end parser state, embedded escape/control sequences treated as literal pasted content, incomplete or canceled paste flush/cancel, empty or non-text clipboard events, large paste thresholding, chunk aggregation, completion timeout, synchronous pending state that prevents a same-batch following key from submitting stale input, ordinary typing after flush, and cleanup of orphan focus or terminal-response fragments without dropping valid text. Cover dragged file and media paths across newline-separated and space-separated forms, quote and shell-escape normalization, absolute and relative path fallback, missing or stale temporary path fallback to clipboard or text, partial media success while preserving non-media text, and rejection of unsupported, unverifiable, empty, oversized, or type-mismatched files before insertion. Cover clipboard probing and hints as opt-in by capability, platform, focus, mount, and input generation; debounced and rate-limited across focus changes; canceled on focus loss, unmount, or stale generation; and unable to steal focus, submit input, mutate history, clear scrollback, or pollute copy selection. For image/media paste, assert trusted-byte type detection, media-type normalization, size/dimension budgets, resize/downsample/store failure handling, best-effort temporary artifact cleanup, source path and filename redaction, and explicit degraded state when runtime input or attachment handoff fails. Assert paste, clipboard, parser, hint, media-path, and temporary-artifact state does not pollute stdout, structured protocol frames, transcripts, logs, copied content, command parsing, history entries, or model-visible context unless the explicit runtime or attachment owner authorizes that exposure. Diagnostics must redact clipboard text, filenames, local paths, media bytes, platform command strings, temporary artifact paths, prompt text, account/session/input identifiers, control bytes, credentials, and free-form native or parser errors. Route terminal mechanics to `terminal-cli-dev`, model-visible insertion and attachment semantics to `llm-inference-integration`, visible recovery/confidence to `product-ui-ux-design`, rollout defaults and limits to `platform-release-engineering`, signal schema to `platform-observability`, stale or lost paste incidents to `defect-diagnosis`, and security review when clipboard, file, media, or diagnostic surfaces can expose sensitive content.
+
+
+### Test-scenario checklist (TC-list scope)
+
+Terminal paste and clipboard-ingress tests: when code changes terminal paste parsing, clipboard probing, dragged-file handling, pasted media, or large-paste batching, assert bracketed-paste start/end state, embedded escape sequences treated as literal text, incomplete-paste flush/cancel behavior, explicit empty paste events, large paste chunk aggregation, completion timeout, synchronous pending state that prevents a following submit key from sending stale input, non-paste multicharacter input fallback, orphan focus or terminal-response fragment cleanup without valid-text loss, file/media path splitting for newline and absolute-path separated input, quoting and shell-escape normalization, relative-path clipboard fallback, unsupported or unverifiable file rejection, partial media success with non-media text preservation, platform clipboard capability unavailable states, debounced/rate-limited focus hints, stale unmounted or generation-drift async callback rejection, temporary artifact cleanup, media byte type detection, size/dimension budget enforcement, final runtime attachment-gate handoff, and diagnostics redaction for clipboard text, filenames, local paths, raw media bytes, platform command strings, credentials, and free-form native errors.
+
+## Modal terminal text editing
+
+test modal editing as a nested command-language state machine, not independent shortcut handlers. Cover insert and command modes; mode toggles and visible mode state; bounded count prefixes; parser states for operators, operator counts, find literals, text-object scopes/types, replace literals, secondary command prefixes, and indent operators; simple motions, word motions, find/repeat-find, text objects, linewise operations, paste before/after, open-line, join, indent/outdent, toggle-case, delete/change/yank, replace, undo, and repeat-last-change. Assert operator/motion range semantics for inclusive, exclusive, and linewise ranges; logical-line versus wrapped-row movement; missing-target and unmatched-delimiter no-ops; cursor clamping after mutations; grapheme/display-width-safe movement, deletion, replacement, and text-object selection; register contents plus linewise metadata; paste count behavior; repeat only after successful compatible mutations; and undo/repeat hooks scoped to the active input. Cover cancellation and stale-state fencing after cancel, focus loss, mode switch, submit, history search, paste, composition input, external insertion, prompt replacement, unmount, resize/cursor-geometry drift, input filtering, and arrow/delete/backspace remapping; no pending operator, literal, count, register, history, paste, composition, external-insertion, or replacement state may leak across those boundaries. Assert modal editor parser state, registers, history/paste/composition buffers, cursor snapshots, and prompt replacement metadata do not pollute stdout, structured protocol output, transcripts, logs, copied content, or model-visible context unless an explicit runtime owner has authorized that exposure. Diagnostics must redact prompt text, register bodies, paste bodies, composition text, history-search text or results, external insertion bodies, replacement prompt bodies, raw command bodies, key/control bytes, cursor or geometry snapshots, local paths, account/session/input identifiers, credentials, and free-form parser errors. Route command mechanics to `terminal-cli-dev`, model-visible or agent-affecting editor state to `llm-inference-integration`, visual discoverability to `product-ui-ux-design`, rollout/default policy to `platform-release-engineering`, signal schema to `platform-observability`, stale or incorrect mutation incidents to `defect-diagnosis`, and security review when prompt text, registers, clipboard-like state, or diagnostics can expose sensitive content.
+
+## Background shell task lifecycle and stalled-prompt watchdogs
+
+test foreground registration, explicit user backgrounding, auto-backgrounding, and already-registered foreground detach as task lifecycle transitions, not process respawns. Cover task id/output/cleanup/progress/completion preservation, duplicate task-start prevention, result-handler races, output flush before finality, final output retention by cursor or digest until required consumers acknowledge or explicitly skip with typed degraded evidence, cleanup/eviction only after final proof is preserved or finality is marked unknown, atomic duplicate-notification suppression, completion/failure/stop/killed status parity across UI, model-visible queued notifications, SDK/control streams, and transcripts, noisy shell stop-output suppression without losing task-terminated finality, owner-scoped child-process and queued-notification cleanup when an agent/session exits, and stale speculation or cached task-summary invalidation after output append, truncation, eviction, progress movement, read-offset change, background state change, notification, or stop/kill events. For stalled-prompt watchdogs, assert no notification while output is still growing or merely slow, two-phase stable-idle detection bound to task id, output generation, read cursor, and progress/event generation, immediate pre-emit tuple recheck, cancellation on output append/progress/status/session/owner drift, one-shot notification only for the matching generation when bounded tail evidence matches an interactive prompt, no false completion/failure status from a prompt warning, cancellation of watchdogs after completion/kill/cleanup, and diagnostics redaction for command text, output tails, prompt bodies, output paths, task ids, account/session identifiers, credentials, and free-form shell errors. Route terminal mechanics to `terminal-cli-dev`, model-visible finality and stale speculation to `llm-inference-integration`, rollout/default policy to `platform-release-engineering`, signal schema to `platform-observability`, stale/hung/duplicate-task incidents to `defect-diagnosis`, and security review when backgrounding or prompt remediation can bypass permission or sandbox expectations.
+
+## Foreground-query to background-session handoff
+
+test main-session backgrounding as a model-loop and session transition, not a local task detach. Cover foreground task priority over session backgrounding, disabled or unsupported session backgrounding, bounded confirmation or double-press windows, ordinary text, scrollback, or reserved-prefix keys not being swallowed, typed foreground abort reason distinct from cancel or failure, stable queued-notification snapshot before transfer, no replacement foreground query started from transferred notifications, notification attachment construction failure, consume-after-delivery semantics, transfer to the intended background owner exactly once, dedupe against notifications already emitted into the foreground transcript, stale queue, session, owner, prompt, policy, or tool-generation rejection, foreground or resume revalidation before accepting new input or inheriting approvals, no duplicate or lost notifications across background and foreground transitions, and diagnostics redaction for prompt text, notification bodies, queued content, local paths, task or session identifiers, credentials, and free-form runtime errors. Route terminal shortcut mechanics to `terminal-cli-dev`, model-visible handoff and notification transfer to `llm-inference-integration`, rollout/default policy to `platform-release-engineering`, signal schema to `platform-observability`, stale/lost/duplicate handoff incidents to `defect-diagnosis`, and product/security review when user-visible backgrounding semantics or sensitive queued content exposure changes.
+
+## Inference quota, capacity, retry, and fallback
+
+test error classification before retry, bounded retry/backoff with jitter, retry-after/reset handling, abort/cancel during waits, retry-inclusive versus retry-exclusive timing, retry amplification across SDK/gateway/queue/job/user retry layers, foreground versus background retry amplification control, persistent/unattended retry heartbeat and maximum wait horizon, stale connection or auth-refresh client recreation only when the full original tuple still matches (principal, account or tenant, workspace, privacy state, route/adapter, provider credential/client generation, provider account/project or API-key scope, quota bucket, billing namespace, region or data-residency endpoint, entitlement state/version, authorization or policy version, prompt or policy version, model generation/params, tool-schema or capability generation, session or job id, session incarnation, and canonical rendered request digest that includes policy/prompt version, model generation/params, and tool-schema or capability generation), cancellation or full rebuild/re-authorize/re-render after any tuple drift, user abort as terminal unless fresh user action restarts the request, malformed request as no-unchanged-retry, context-window overflow with no unchanged retry plus approved floor and fail-closed cases that preserve source ACL/provenance labels and reject merged summaries across differently scoped sources, subscription/quota exhaustion as a zero-retry terminal class unless explicit reset or renewed-quota evidence exists, entitlement denial as a zero-retry terminal class unless fresh entitlement authorization evidence exists, fallback/cooldown/degraded-mode visibility with sanitized reason codes, fallback route changes treated as new authorized/rendered attempts with separate usage attribution, approved quality-equivalence or refusal for high-impact routes, fail-open only for non-critical advisory policy fetches with stale cache that matches the full authorization/targeting tuple, maximum stale age, and monotonic policy/revocation epoch or fresh deny/opt-out watermark, stale advisory data never overriding newer deny, revocation, privacy opt-out, logout, account switch, or entitlement change, fail-closed for safety/entitlement/privacy/permission/policy gates without fresh allow, usage/cost restoration only for the same full retry/re-render tuple with purge or invalidation after any tuple member changes, usage finalization/deduplication by request id, provider request id where available, idempotency key or usage-event id, and attempt id across retry, stream reconnect, late provider completion, and other terminal ledger paths, unknown-cost markers, and per-model/per-route token/cost accounting. Route runtime mechanics and inference-specific event/accounting semantics to `llm-inference-integration`, product acceptance for visible downgrade/refusal to `product-rd-workflow`, retry/fallback/capacity default rollout and rollback evidence to `platform-release-engineering`, security/adversarial review through `cso`, `review`, or equivalent for entitlement, privacy, permission, policy, fail-open, and accounting boundaries, and sink policy, redaction, retention, metric/log transport, and sanitized diagnostics to `platform-observability`.
+
+## Prompt cache miss attribution
+
+test cache-miss detectors as two-phase diagnostic state machines. Cover pre-call snapshot binding for rendered instruction/system digests, tool-schema digests, cache-control scope or TTL class, route/model/effort/output parameters, feature or mode toggles that affect provider cache keys, extra request-body digest, query-source class, session/agent generation, principal/workspace/privacy tuple, and capability/tool generation. Cover immutable request/attempt identity, prompt or message generation, abort generation, provider-response identity where available, session incarnation, rendered-request digest, retry/stream-reconnect/late-abort rejection, and baseline mutation only for the matching attempt. Assert tracked-source caps and eviction, isolation across concurrent agents or short-lived sessions, no cross-source attribution, and cleanup on agent/session end. Cover post-call token-drop thresholds, first-call suppression, unchanged prompt under TTL windows, likely server-side/routing classification, intentional cache-edit deletion, compaction/context reset baseline reset, model/tool/schema/parameter drift attribution only when the bound pre/post tuple proves it, explicit precedence, multi-cause or `unknown`/`ambiguous` classification when evidence is mixed, and no stale false positive after cache deletion or compaction. Assert telemetry contains only booleans, counts, bounded deltas, enum-like cause classes, and sanitized fixed-vocabulary labels; user-configured tool names, connector names, prompts, schemas, request bodies, raw local paths, credentials, raw request/session ids, and free-form errors must be absent. If a local diff/support artifact is written, test approved diagnostic-directory containment, bounded size/retention, raw-sensitive labeling, no automatic upload, sanitized log pointer only, and failure-to-write degradation without losing the primary cache-miss classification. Route runtime semantics to `llm-inference-integration`, support-artifact policy to `platform-observability`, noisy cache-miss incidents to `defect-diagnosis`, and security review when rendered prompts, tool schemas, connector names, request bodies, or local paths could leak.
+
+## Agent conversation compaction and context reconstruction
+
+test trigger threshold math, reserved-output budgeting, warning/error/blocking states, disabled/manual/auto modes, recursion guards for compaction sub-agents, consecutive-failure circuit breaker, prompt-too-long retry that drops old API-round groups without leaving assistant-first or orphaned tool-result sequences, fail-closed behavior when dropped groups contain the only authorization/privacy/policy/source-ACL/provenance/current-intent/pending-task/tool-finality evidence, typed lossy markers for stripped media or deleted tool results, keep-at-least-one recent tool result behavior, direct content-clearing versus cache-editing paths, cache-deletion baseline accounting, time-gap triggers that reset stale micro-compact state, boundary marker ordering, preserved raw-message relink metadata, old-boundary filtering, tool-use/tool-result pair preservation, assistant thinking-block preservation, minimum recent text and token floors, max retained-context cap, session-memory extraction wait/stale timeout/fallback, extraction attempt-id and generation fencing, late extraction rejection after boundary drift/session incarnation change/privacy opt-out/delete/ignore-memory/account/workspace/capability/policy drift, empty or unavailable session memory fallback, resumed-session behavior with unknown summary boundary, post-compact file/plan/skill/tool/agent/external-instruction rehydration size caps plus full authorization/source tuple revalidation, hook instruction merge and abort handling, cache invalidation for file reads, nested memory, prompt sections, classifier/speculative approvals, micro-compact state, and session-message caches, compact telemetry using resulting-context size rather than compaction-call tokens, and no stale prompt-cache-break false positives. Route runtime semantics to `llm-inference-integration`, rollout of threshold/default changes to `platform-release-engineering`, sanitized token/deletion diagnostics to `platform-observability`, product acceptance for user-visible continuation or context-fidelity risk to `product-rd-workflow`, stale/lossy/corrupt context incidents to `defect-diagnosis`, and security/adversarial review to `cso`, `review`, or equivalent when compaction can drop or merge permission, privacy, policy, entitlement, or source-scope evidence.
+
+## Persisted settings/config migrations
+
+test absent source, already-migrated target, explicit user preference, old default, project/workspace/policy-scoped value that must not be promoted, harmless list/set merge with de-duplication, policy-aware authorization/approval migration where deny/revocation and scope narrowing win, eligibility-gated no-op plus later eligibility promotion, repeat-run idempotency, partial write failure, rollback-version read compatibility, legacy-key retention/deletion timing, sanitized logging, and startup behavior when migration fails. For migrated agent/runtime settings, also assert stale prompt/tool cache invalidation, model-visible tool schema recomputation, stale planned tool-call/manifest rejection, and fresh execution-time authorization after permission, model/runtime, tool-source, or default-safety changes. Route rollout/rollback ownership to `platform-release-engineering`.
+
+## Remote managed runtime policy
+
+test eligibility false/no-op, eligible auth sources, auth failure with no retry amplification, timeout/network retry bounds, checksum/ETag cache hit, malformed schema rejection, old-valid-policy replay rejection, rollback below the accepted policy/revocation epoch floor, last-known-good use only within stale policy rules and matching principal/account/tenant/organization/workspace/provider-path-or-source/privacy/auth-source/trust/eligibility/policy/schema tuple with explicit none markers, empty/no-policy response clearing stale cache, cache file write/delete failure behavior, initial-load wait timeout, background polling idempotence, hot-reload notification, principal/account/tenant/organization/workspace/provider path or source/privacy/auth-source/logout/revocation/trust/eligibility drift cache purge, dangerous policy addition or widening review path, non-interactive behavior, deny/revocation/opt-out precedence over stale allow, and fail-closed behavior for permission, credential, destructive-action, sandbox, tool-exposure, privacy, or compliance gates without fresh allow. Route release ownership to `platform-release-engineering`, runtime enforcement to `llm-inference-integration`, and signal/redaction policy to `platform-observability`.
+
+## Client telemetry and remote config control planes
+
+test privacy opt-out and nonessential-traffic suppression, trust-before-auth behavior, login/logout/account-switch reinitialization, persistent queues/caches scoped by account, organization, workspace, provider path, and privacy state, opt-out/logout/account switch/organization switch/revocation/trust-downgrade purge or invalidation, stale cache fallback by risk class, security or entitlement gate freshness, malformed or empty payload rejection, complete-cache replacement without blank-cache poisoning, removed-key cleanup, per-sink kill switches stopping both new sends and retries, sink-specific PII stripping, exposure de-duplication, hard queued events/bytes and TTL overflow behavior, bounded retry/drop, shutdown flush, startup compaction/drop, and late callback rejection after client replacement. Route signal schema and sink policy to `platform-observability`.
+
+## User-visible tips, nudges, release notes, and update notices
+
+test eligibility and suppression as product behavior, not copy. Cover interactive versus noninteractive and automation-safe output modes, privacy or nonessential-traffic disablement, explicit user-disable settings, first-run and long-running-session behavior, cache migration and read/write failure, stale or missing cache fallback, version/window comparison with malformed or prerelease-like values, display caps and explicit partial-data labeling, relevance predicates over local context without leaking raw files, commands, account state, capability names, or private usage, cooldown/history persistence and idempotence, longest-not-shown or priority selection stability, duplicate suppression across restarts, terminal width/height/color fallback, no focus theft, no input submission, no scrollback destruction, no copy-selection pollution, no structured-output pollution, fetch timeout/abort and background error degradation, analytics/logging limited to bounded categories/counts/ids rather than notice bodies or local context, and no "latest" or "complete" claim when data is stale, truncated, cached, partial, or failed. Route product acceptance to `product-rd-workflow`, terminal rendering mechanics to `terminal-cli-dev`, visual hierarchy/accessibility to `product-ui-ux-design`, rollout/default/migration gates to `platform-release-engineering`, signal schema to `platform-observability`, and stale/noisy/disruptive notice incidents to `defect-diagnosis`.
+
+## Terminal host sleep-prevention or power assertions
+
+test this as a local resource lease for active work. Cover supported and unsupported platforms, missing helper or denied capability, foreground busy versus approval-wait/dialog/idle/background-resumable states, overlapping start/stop reference counts, idempotent release after normal completion, error, user interrupt, unmount, parent cancellation, shutdown, stale loading state, or tuple drift, periodic helper refresh only while ownership remains positive, bounded helper lifetime or orphan self-healing after hard process death, unref/nonblocking behavior so timers or helpers do not keep the CLI alive, spawn failure, helper exit, kill failure, cleanup registry failure, no transcript or structured-output pollution, and diagnostics/telemetry redaction for raw helper commands, process ids, local paths, account/session identifiers, exact private-activity durations, and free-form native errors. Route terminal mechanics to `terminal-cli-dev`, model/task active-work semantics to `llm-inference-integration` only when finality changes, rollout/default policy to `platform-release-engineering`, signal schema to `platform-observability`, stale/battery-drain incidents to `defect-diagnosis`, and product/security review when preventing sleep changes visible power, privacy, or device-control expectations.
+
+## Terminal shell delay-loop blocking and auto-backgrounding
+
+test delay-only commands and delay-then-check polling as scheduling behavior, not command parsing trivia. Cover shell-specific parsing for leading delay statements, statement separators, pipelines, subshells or script bodies that should not be shallow-blocked, short pacing delays that remain allowed, longer leading delays that are rejected only when a background or monitor mechanism is available, explicit background mode bypass through the ordinary background-task contract, pure delay commands excluded from automatic backgrounding, command-class allow/deny decisions for auto-backgrounding, disabled/unavailable background tasks, assistant or coordinating modes that detach long-running safe commands, foreground task already registered versus not yet registered, in-place detach preserving task id/output/cleanup/progress/completion notification, no duplicate task-start events, no leaked cleanup callbacks, progress-loop wake after detach, stale invocation or terminal task drift rejection, interrupt-triggered backgrounding distinct from user-requested backgrounding, foreground cleanup skipped only for truly background-owned work, and diagnostics/telemetry redaction for raw command text, arguments, outputs, local paths, task ids, credentials, and free-form shell errors. Route shell/terminal mechanics to `terminal-cli-dev`, task finality to `llm-inference-integration` when shared task semantics change, rollout/default budgets to `platform-release-engineering`, signal schema to `platform-observability`, stale/hung/duplicate-task incidents to `defect-diagnosis`, and security review when command routing or backgrounding can bypass permissions or sandboxing.
+
+## Local diagnostic, debug, and error sinks
+
+test these as privileged support artifacts rather than ordinary telemetry. Cover default metadata-only diagnostic APIs; explicit support-artifact consent/retention/access-audit gates before storing raw prompts, tool inputs or outputs, connector payloads, response bodies, stack traces, local paths, current working directories, project names, account/session identifiers, environment names or values, credentials, or free-form errors; privacy/support/debug mode gating; caller-provided log path containment or approved diagnostic-directory enforcement; sink identity and storage policy binding; low-cardinality category/event validation; multiline escaping for line-oriented formats; pre-sink bounded error queues rechecked against current policy before drain; idempotent sink attach without replay or duplication; in-memory recent-error caps; buffered writer max-count/max-byte overflow ordering; flush/dispose/shutdown finality; failure to create directories or files surfaced as degraded diagnostics when durability is claimed; debug filter include/exclude parsing, invalid mixed filters, uncategorized-message fail-closed behavior when filtering is active, and filter syntax not treated as a privacy boundary. Route signal schema, redaction, retention, and support-artifact policy to `platform-observability`; route runtime emitters to their owning skills.
+
+## Runtime startup trust and configuration bootstrap
+
+test startup as an ordered trust-boundary state machine. Cover pre-trust application of trusted global/user/flag/policy sources by policy, plus project-local or workspace-derived settings only when explicitly allowlisted as safe and unable to widen authority, redirect traffic, load code, change provider/model/routing, modify proxy/TLS material, alter hooks/tools/sandbox/telemetry behavior, affect model-visible context, or expose credentials; all other project-local or workspace-derived settings blocked until trust and fresh authorization; post-trust reapplication with cache/agent/client rebuilds; source precedence and policy locks; host-owned spawn and routing variables preserved against lower-trust overrides; API-only tunnel or routing variables scoped to the intended client and absent from unrelated connector, HTTP, streaming, shell, hook, and tool transports; early certificate, proxy, and mutual-auth setup from trusted sources only, base trust roots preserved when custom trust material is added, bypass rules honored, and stale transport caches cleared after environment changes; invalid config behavior in interactive and noninteractive modes; remote or managed settings eligibility, timeout, no-op, retry, and stale-cache behavior; cwd/project-root/worktree switches that invalidate file, memory, prompt, hook, tool, permission, source-control, and sandbox caches before commands, tools, hooks, skills, background jobs, or model-visible context load from the new root; hook snapshot refresh after root or settings changes; background jobs, prefetches, memory tasks, release notes, telemetry, plugin/sync installs, and cleanup tasks gated by entrypoint mode and trust state; unsafe bypass root/sandbox/no-network checks and fail-closed degraded states; idempotent telemetry/cleanup initialization with retry after failure; shutdown cancellation; and diagnostics redaction for raw paths, environment names/values, provider or endpoint details, credentials, command lines, project structure, config bodies, and free-form setup errors. Route runtime semantics to `llm-inference-integration`, concrete proxy/TLS/transport mechanics to `platform-service-connectivity`, release/default changes to `platform-release-engineering`, signal schema and redaction to `platform-observability`, user-visible trust or degraded-mode acceptance to `product-rd-workflow`, startup incidents to `defect-diagnosis`, and security/adversarial review when startup can load untrusted code/config, widen permissions, redirect traffic, or expose credentials.
+
+## Host OS and GUI action control
+
+test model-driven desktop or host-control tools as high-risk local actions. Cover unsupported platform and missing capability states; permission discovery or access-request paths that can check and explain access without acquiring locks, hiding apps, installing global hotkeys, reading clipboard, sending input, or changing focus; real action paths requiring atomic single-owner lock or lease, re-entrant same-session behavior, live-owner blocking, corrupt or stale lock recovery, blocked-session messaging, owner-bound release, and cleanup on normal turn end, streaming abort, tool abort, shutdown, and cleanup failure. Assert screenshot/display/target-app/coordinate state captured under one generation; coordinate mode and image-resize policy frozen after tool descriptions or model-visible hints render; target app allowlists, hidden/defocused app restoration, and terminal/host exclusion behavior where relevant. Cover keyboard and mouse finality: modifier press failure, mid-action throw, drag/scroll/click failure, reverse release, synthetic abort-key exceptions, no stuck keys/buttons, and visible uncertainty when native input state cannot be proven restored. Cover clipboard finality: save failure, write failure, read-back mismatch blocking paste, paste/restore race, restore failure, multiline paste gates, and no transcript/log leakage of clipboard contents. Cover global abort hotkey registration failure, user abort versus model-synthesized abort key, unregister on release, native event-loop pump reference counting, native-call timeout with late-result suppression, and background enumeration timeout that does not block startup. Diagnostics must redact screen contents, app names, window titles, clipboard text, local paths, raw private-display coordinates, bundle ids, environment values, credentials, command lines, and free-form native errors. Route runtime semantics to `llm-inference-integration`, terminal-specific TTY/raw-mode cleanup to `terminal-cli-dev`, native mobile/app-hosted bridge behavior to `app-cross-platform-dev`, rollout of capability gates to `platform-release-engineering`, signal schema to `platform-observability`, stuck-state incidents to `defect-diagnosis`, product acceptance to `product-rd-workflow`, and security/adversarial review when host control can expose screen contents, send input, leak clipboard, bypass permission, or affect other apps.
+
+## Dynamic extensions and agent skills
+
+test enabled sources contribute only their authorized capability set, while disabled/unavailable/dependency-demoted/policy-blocked/plugin-only-restricted/cache-missing sources do not contribute model-visible descriptions, tools, hooks, settings, or prompt content; source precedence across managed, installed, session-only, built-in, connector-supplied, and local-directory contributions; duplicate names and path-identity de-duplication including symlinked or overlapping directories; restricted-mode bypass attempts; explicit session-only override without crossing managed locks; cache-only startup that never downloads code; full refresh that clears prompt/tool/settings/skill caches; background disk update that remains invisible to the running model until reload/restart/generation change; staging-location materialization, containment and manifest validation before publish, atomic generation swap, incomplete marker rejection, interrupted refresh preserving the prior valid generation, and cache-only startup failing closed on a damaged capability graph; manifest/schema/frontmatter/body validation failure; duplicate capability identifiers; malformed YAML/JSON; path traversal, source-relative path confusion, sanitized cache-path components, empty or partial copy, archive extraction containment, preloaded-cache containment, symlink/dangling-symlink/hardlink behavior, and source-control metadata stripping; remote, connector-supplied, workspace-local, session-supplied, or otherwise unreviewed skill inline-shell, hook-command, shell-capable block, and bundled-code suppression unless declared capabilities, sandbox, short-lived credentials, explicit reviewed execution policy, and fresh authorization are present; and stale planned tool-call or selected-skill rejection after capability, policy, manifest, or settings changes. Route runtime mechanics to `llm-inference-integration`, release rollout of behavior-changing extension sets to `platform-release-engineering`, and signal schema/sanitized diagnostics to `platform-observability`.
+
+## Model-visible instruction-layer composition
+
+test effective instruction order as an asserted contract, not a snapshot of concatenated text. Cover precedence and override negatives across base system instructions, developer/product policy, managed policy, current user intent, workspace/project/user/plugin/config file instructions, agent prompts, mode instructions, output style text, tool and hook context, memory, retrieved content, and append/addendum layers. Assert managed policy, safety, permission, privacy, tool-finality, data-residency, and truthful-reporting constraints survive lower-trust output styles, agents, plugins, project/user files, hooks, memory, retrieved content, and append prompts. Cover file-backed, config-file, markdown-configured, output-style, agent, and mode instruction sources with fresh read authorization, source-scope validation, canonical containment, source-scope labels, symlink/hardlink and time-of-check/time-of-use rejection, stale snapshot rejection, malformed frontmatter/body rejection, duplicate identity precedence, disabled-source exclusion, and lower-precedence untrusted labeling. Test output styles, modes, and agent definitions that keep, suppress, or replace base coding/task instructions; suppression requires an allowlisted product policy and negative assertions that safety, authorization, privacy, tool-use, finality, and truthful-reporting constraints remain. Cover prompt-prefix and section cache boundaries: static/dynamic split, cache partition or invalidation after source digest, trust tier, principal, workspace/root, privacy, policy generation, capability/tool generation, model/prompt generation, mode, output-style, agent, connector, memory, hook, or dynamic-section changes; explicit uncached/cache-breaking sections recompute with a recorded reason; stale cached prompts never survive policy, workspace, privacy, output-style, mode, or agent drift. Cover non-interactive, interactive, resume, compaction, agent-spawn, and background/addendum paths for ordering, duplication, and missing-layer behavior. Diagnostics must redact raw prompt text, local paths, mode/style/agent names, branch names, credentials, config values, free-form file errors, and reversible hashes while preserving bounded categories, counts, precedence classes, and non-reversible digests. Route runtime semantics to `llm-inference-integration`, rollout of instruction defaults to `platform-release-engineering`, sanitized signal policy to `platform-observability`, and security/adversarial review when instructions can override policy, widen permissions, or leak sensitive context.
+
+## Model-visible search and code-discovery evidence
+
+test search, glob, file-suggestion, symbol, reference, definition, hover, and similar discovery paths as evidence contracts, not just string output. Cover query/pattern/path/type/mode/filter binding to principal, session, workspace/root, privacy/source-scope policy, tool-source identity, capability generation, and read-permission decision; validate canonical containment, missing-path and non-directory/file cases, network-path credential-leak avoidance, malformed regex or glob handling, abort/timeout finality, and path normalization. Cover ignore-rule policy and exclusions for hidden, binary, generated, vendored, source-control, plugin/cache, and policy-denied files; assert diagnostics explain bounded categories without exposing raw paths, query text, matched content, filenames, branch names, credentials, command arguments, or free-form server errors. Cover truncation and pagination across content, filenames, and counts; offset behavior; deleted files between scan and stat; deterministic ordering keys for paginated scans including tie-breakers where tests depend on order; result-size caps; and explicit negatives that truncated, paginated, partial, timed-out, aborted, permission-filtered, stale-index, stale-server, or ignore-filtered results cannot justify "not found", "only", "all", or other absence/completeness claims. Cover file-suggestion index freshness: cold full index, tracked-first results, untracked background merge, partial versus full index labeling, cache-generation fences, source-control index changes, ignored-file changes, settings changes, workspace/root changes, plugin/source changes, and stale background merge rejection. Cover code-intelligence freshness: initialization pending/no-server states, opening unread files into the server, maximum file-size rejection, file snapshot/open-state binding, path/URI and line/column normalization, ignored-result filtering for location queries, malformed or missing locations, server errors, and stale result rejection after file, workspace, policy, or server-generation drift. Route runtime semantics to `llm-inference-integration`, sanitized signal policy to `platform-observability`, stale or false-negative incidents to `defect-diagnosis`, rollout of changed search/index defaults to `platform-release-engineering`, and security/adversarial review when discovery may expose sensitive content or widen read scope.
+
+## External tool connectors and approval channels
+
+test credential storage keys include canonical server/config identity, audience/resource identity, principal, account, tenant, organization, workspace, source, and auth-policy generation, with explicit none markers for unavailable scopes; credentials are not reused after server/config/URL/header/source/audience/principal/account/tenant/organization/workspace/auth-policy-generation drift; auth metadata is HTTPS/schema-validated, refresh errors invalidate the correct token class, revocation attempts handle compliant and fallback server behavior without leaking secrets, dynamic header helpers are blocked before workspace trust and are time-bounded with JSON string-only output validation, environment expansion reports missing required variables without logging values, channel/tool-server allowlists are enforced from the actual installed source identity, disabled channels register no handlers, permission relay requires active connection plus explicit relay capability declarations, structured replies bind to a pending request id and original tool-call tuple including connector identity, server identity, canonical config digest, server URL, header/config digest, connector source, audience/resource identity, principal, account, tenant, organization, workspace, policy version, tool-call id, schema version, and normalized invocation digest, duplicate/late/unknown replies are ignored, delete-before-resolve prevents re-entrancy, short approval ids avoid ambiguous/offensive text, previews are bounded, elicitation hooks cannot widen authority, URL/form elicitation completion binds to server plus elicitation id, abort returns cancel, and malformed or untrusted completion fails closed. Route runtime semantics to `llm-inference-integration`, transport reachability to `platform-service-connectivity`, and sanitized diagnostics to `platform-observability`.
+
+## Browser-based local authorization callbacks and token caches
+
+test full flow-attempt tuple binding by provider or authorization-server identity, client or client-registration identity, audience/resource identity, auth source, auth-policy generation, storage backend/cache namespace, verifier/challenge generation and loss, CSRF state, redirect URI, callback listener identity, callback path and host/port, manual versus automatic mode, requested scope set, principal/account/tenant/organization/workspace tuple with explicit none markers, and token-exchange attempt id; test callback listener loopback binding, OS-assigned or explicitly owned port behavior, malformed callback URLs, listener bind failure, provider denial, missing-code and wrong-state rejection, wrong-mode and wrong-tuple rejection, duplicate/late callback rejection, manual-code fallback racing with automatic callback, pending browser response success/error/cancel finality, listener close and handler cleanup on success/failure/timeout/abort/shutdown, and no callback secret or code leakage to child args, model-visible prompts, logs, telemetry, dumps, or fixtures. Cover token exchange success/failure after code receipt, client registration persistence and invalidation, token storage write failure, discovery-state persistence with bounded metadata, refresh single-flight and lock contention, re-read-after-lock, newest-refresh-token use, invalid-grant handling that re-checks storage before clearing, transient retry exhaustion, 401 race recovery after another process refreshed tokens, token-file or secure-storage mtime invalidation, scope expansion or scope drift cache invalidation where refresh cannot elevate scope, logout/account switch/re-enrollment cache purge, auth-source and storage-namespace drift rejection, generation-fenced late token/profile/entitlement/remote-config/cache writes, profile/account/entitlement cache update without clobbering known-good fields after transient profile failure, replaced-client late callback rejection, telemetry auth fallback for expired or unsupported auth, subscriber notification after auth-driven config rebuilds, connector-header/tool-schema/prompt/context/runtime/model-visible capability cache invalidation or generation fencing after auth fact changes, and metadata-only diagnostics without authorization codes, verifier/challenge values, access/refresh tokens, request/response headers, cookies, set-cookie values, device/user codes, full token-endpoint request bodies, raw profile or entitlement payloads, raw error bodies, account emails, stable user identifiers, organization identifiers, callback URLs with codes, live listener ports, endpoint details, credentials, or free-form provider responses. Route runtime semantics to `llm-inference-integration`, local listener transport mechanics to `platform-service-connectivity`, rollout of auth defaults to `platform-release-engineering`, and signal schema and sink policy to `platform-observability`.
+
+## Agent memory and shared memory sync
+
+test private/shared/session scope selection, privacy/privacy-opt-out state, explicit ignore-memory suppression across read, write, background extraction, upload, and cached model-visible memory snapshots; prompt/context cache partition or invalidation by principal, memory scope, memory snapshot/version, deletion state, privacy state, and ignore flag; stale-memory verification before acting on files/functions/flags/policies; duplicate/update behavior; direct-write versus background-extractor mutual exclusion; extractor tool-denial paths; scheduled or accumulated-session consolidation gates for supported mode, settings/policy/privacy, memory-store availability, time/activity thresholds, scan throttling, current-session exclusion, single-owner lock or lease, stale holder reclaim, rollback on fork/start failure or user kill, constrained read-only exploration plus memory-store-only writes, transcript isolation, bounded progress display, completion note only when writes are observed, stale progress rejection, and no last-run advancement on failed consolidation; write confinement to the memory store; secret/credential blocking for every memory store; PII minimization/consent for private/session memory; stricter shared-memory PII blocking; poisoned memory with instruction-like or policy-like content; writer/audience authorization; labeled low-precedence injection; sanitized skipped-file telemetry without values, raw hashes, stable user identifiers, entry bodies, or sensitive paths; path traversal, hardlink, symlink-escape, and time-of-check/time-of-use rejection; malformed remote payload rejection; entry/file/body-size caps; initial pull before context injection; auth/workspace/repository scoping; optimistic-lock conflict retry; same-key conflict policy; partial batch success and retry resume; delete/unshare/local-hide semantics with resurrection prevention where needed; permanent-failure retry suppression and recovery trigger; watcher missed-event fallback; shutdown flush or bounded loss; and cache invalidation after pulled memory changes. Route runtime mechanics to `llm-inference-integration` and log/metric field policy to `platform-observability`.
+
+## Query-time memory recall
+
+test memory entrypoint line and byte caps, truncation warning text or marker, manifest file-count caps, recursive markdown discovery, entrypoint exclusion, per-file frontmatter read-range caps, malformed frontmatter degradation, unreadable-file skip without empty-truth claims, deterministic sorting/capping, type/description/modified-time manifest formatting, already-surfaced suppression, recent-tool context reducing ordinary reference-doc selection while keeping warnings or gotchas eligible, selector tuple binding to query digest/principal/session/workspace/store/snapshot/privacy/ignore/abort state, structured output schema validation, nonexistent filename filtering, malformed selector output, selector timeout/error/cancel fallback to no recalled memory, generation drift between scan/select/read, freshness labels for older memories, stale file/function/flag/policy claim verification before action, low-precedence untrusted wrapping, duplicate recall suppression across turns, and diagnostics redaction for memory bodies, raw queries, filenames, local paths, timestamps tied to private activity, selector prompts or responses, credentials, and free-form errors.
+
+## SDK/headless agent protocol and streaming transport
+
+test frame splitting and safe one-message-per-frame serialization, escaped line terminators, malformed JSON/schema/discriminant rejection, unknown message behavior, max frame and queue sizes, pending request cleanup when input closes, ordered outbound queue behavior, cancellation frames, duplicate/orphan control-response suppression, request/action/session/policy/capability/payload binding, stale response rejection after abort/reconnect/capability change, streamed delta reconstruction versus self-contained snapshot behavior, terminal result preservation, high-watermark resume only after durable apply/write, replay of only unconfirmed outbound messages whose original principal/workspace/session/policy/capability/auth-generation tuple still matches, cancellation or fail-closed unknown-finality visibility when that tuple changes, credential refresh on reconnect, permanent versus retryable close/status handling, heartbeat/liveness timeout, proxy idle mitigation, sleep/wake reconnect budget reset, listener/timer cleanup, serialized batch upload, backpressure blocking, retry-after clamp/jitter, drop visibility, graceful shutdown flush, and close-time bounded loss. For protocol-to-transcript adapters, cover entrypoint-mode conversion policy for assistant/user/system/stream/progress/permission/history/status-only messages; live user echo dedupe without hiding historical user messages; remote tool-result rendering and in-progress tool cleanup even when ordinary user messages are dropped; duplicate init/setup suppression; success result status-only versus error/unknown-finality visibility; task/progress/compaction/heartbeat signals updating counters, loading, timers, stale spinners, and background counts without transcript pollution; product-visible status using only bounded typed markers outside the model-visible transcript or lower-precedence redacted meta/status records with no raw protocol payload; response-timeout reconnect warning cancellation on any valid heartbeat; connection-gap clearing or reconciliation of pending permissions, streaming fragments, in-progress tools, and task counters; viewer/history pagination with sentinel replacement, retryable failed page state, scroll anchoring, cursor preservation, and fill-loop caps when many raw events convert to no visible message; direct, remote-shell, viewer-only, and live actor mode differences; and diagnostics redaction for raw messages, tool names, session ids, transport endpoints, command labels, stderr, prompt text, payload bodies, credentials, and free-form remote errors. Route protocol semantics to `llm-inference-integration`, network transport mechanics to `platform-service-connectivity`, rollout of protocol-version or fallback changes to `platform-release-engineering`, and sanitized diagnostics to `platform-observability`.
+
+## Machine-readable stdout stream purity
+
+when stdout is the structured protocol channel, test channel separation as part of the protocol. Cover guard installation before first structured write, idempotent install/reset, complete structured-frame pass-through, tolerated blank separators, buffering until frame boundaries, valid frames split across writes, multiple complete frames in one write, non-structured stdout from human messages/debug prints/dependency banners/progress/console-style telemetry being diverted to stderr or an approved diagnostic sink, structured protocol errors on stdout versus human validation/setup/degraded messages on stderr, callback/backpressure preservation including return-value propagation, drain or promise ordering, callback exactly-once behavior, and callback ordering relative to frame commit or diversion, partial buffered line handling on abort/exception/broken-pipe/forced-close/shutdown, cleanup restoring the original writer, subprocess/native/inherited-fd stdout isolation or explicit routing, background exporters disabled or rerouted while the protocol channel is active, sanitized diversion markers without raw diverted text, and polluted/truncated/mixed stdout failing as a protocol error unless resynchronization is versioned, bounded, self-delimiting, generation-bound, clears or tombstones pending requests safely, preserves durable high-watermarks, and cannot re-open completed authorization/action paths. Negative tests must include malformed frame or payload data, including malformed JSON for JSON-framed protocols; final partial frame; dependency stdout after startup; child-process stdout; telemetry console output; guard installed too late; writer callback errors; broken-pipe or closed-consumer behavior; and diagnostics that would otherwise expose prompts, paths, credentials, payload bodies, account/session/principal/workspace identifiers, transport or request ids, raw stdout/stderr bytes, or free-form diverted lines. Route runtime semantics to `llm-inference-integration`, human terminal rendering to `terminal-cli-dev`, diagnostic sink policy to `platform-observability`, rollout of output-format defaults to `platform-release-engineering`, and parser-corruption incidents to `defect-diagnosis`.
+
+## Model-visible input, attachment, and media ingestion
+
+test typed prompt input, pasted text, pasted images, client media blocks, file/resource references, queued inputs, bridge inputs, slash or immediate commands, resume, and compaction handoff as separate ingress paths. Assert source type, prompt/turn id, principal/session/workspace scope, input generation, content digest or reference id, media type/schema version, size/dimension budget, storage generation, and extraction result labels are present before context insertion; malformed, empty, over-large, missing-media-type, wrong-media-type, failed-fetch, failed-store, failed-resize, and failed-extract cases fail closed or enter a visible degraded state instead of silent evidence loss. Cover file/resource reference authorization and containment before extraction: fresh read authorization, canonical path or URI containment, ACL/source-scope labels, symlink or hardlink escape rejection, time-of-check/time-of-use swap rejection, stale snapshot rejection, and wrong-workspace or wrong-session denial. Cover command routing from intentional typed command tokens or explicit UI command invocations only, with negative cases for paste-at-start, paste-at-offset, bridge/client payload text, queued notifications, attachment-derived text, generated metadata, and text that begins with command-like characters; explicit bridge-safe or remote-safe allowlists; slash-command versus normal-prompt attachment parity or an explicit no-attachment policy; async fetch/store/resize/extract completion after prompt edit, send finalization, abort, session switch, workspace switch, attachment deletion, compaction, or input-generation drift; abort cleanup and stale-result rejection by digest/generation; hidden media/document payload handling before provider submission or derived storage, including stripping by default or explicit consented preservation for geolocation metadata, document properties, thumbnails, embedded files, hidden layers, comments, and tracked changes; user-visible block or explicit confirmation for evidence-dependent attachment failures; assertions that the model cannot treat missing media/file content as present evidence; injection-resistant wrapping, escaping, and lower-precedence labeling for pasted, OCR, extracted, or attached content that tries to override policy/tools/user intent; metadata redaction for local paths, filenames, raw pasted text, raw media, free-form diagnostics, and reversible hashes; cache/store invalidation after session incarnation, workspace/root, privacy, source trust, attachment snapshot, or prompt-generation drift; and final API-boundary validation after resize or normalization. Route runtime semantics to `llm-inference-integration`, user-visible recovery and confidence to `product-ui-ux-design` only when a visible input surface changes, rollout of media limits/defaults to `platform-release-engineering`, and sanitized signal policy to `platform-observability`.
+
+## Model-initiated local user questions
+
+test the prompt as a deferred human-input and answer-finality boundary, not a read-only helper. Cover schema validation, bounded question and option counts, duplicate question keys, duplicate option identities, malformed metadata, single-select versus multi-select, free-text options, preview incompatibility with multi-select unless explicitly supported, preview sanitization for executable, full-document, style/control, link, hidden-text, and visual-spoofing payloads, notes/annotations, per-question pasted media, media remove/resize/downsample failure, and noninteractive/channel/remote/unattended disabled or relay behavior. Assert submitted, declined/canceled, clarify/reformulate, and plan-approval or plan-exit outcomes stay distinct; clarification and finish-planning feedback must be lower-precedence input and cannot become approval, permission grant, or tool success. Cover single-question auto-submit races, multi-question navigation, text input and external editor stale writes, child/parent keybinding ordering when nested inputs exist, late/duplicate/post-abort submit or cancel, stale question identity, stale media paste id, wrong-question attachment, partial answers, unanswered questions, and result mapping with no fabricated choices. Assert redaction for raw question text, answer text, notes, previews, filenames, media bytes, local paths, metadata sources, credentials, and free-form errors. Route runtime semantics to `llm-inference-integration`, terminal modal and paste mechanics to `terminal-cli-dev`, user-visible question design to product/design owners, rollout defaults to release, signal policy to observability, stale or misleading-answer incidents to diagnosis, and security review when answers, previews, or attachments can authorize actions or expose sensitive content.
+
+## Slash command and skill invocation control
+
+test command registries and command-like invocations as capability/action control planes. Cover source precedence and trust tiers across built-in, managed, user, project, plugin, bundled, workflow, remote, and connector-supplied commands; availability versus enablement; hidden/help visibility; user-invocable versus model-invocable flags; aliases and user-facing-name collisions; duplicate names; stale registry and cache invalidation after skill/plugin/settings/workspace/auth/policy changes; dynamic-skill insertion ordering; and fail-soft behavior when optional command sources fail to load. Assert bridge-safe and remote-safe allowlists separately from ordinary user slash commands, with negatives for local UI commands, local filesystem/git/shell/IDE/connectors actions, rendered commands, and prompt commands that should not run from a remote client. Cover immediate commands and keybinding-triggered commands that bypass queueing: opt-in only, finalized input snapshot, pasted-reference expansion, prompt stash/restore, loading-state races, policy drift, command-generation drift, duplicate submit, abort, and no accidental history/transcript pollution. Cover sensitive arguments and command output: args redacted from transcript/history/telemetry/logs/search, command input/output tags escaped, raw command bodies and hidden model-visible meta-message bodies not leaked outside their intended model-visible channel, and user-visible records retained only under product policy. Cover command completion callbacks: display modes, hidden model-visible meta messages, next-input insertion, auto-query submission, stale/late/duplicate/post-abort completion rejection, and binding to invocation identity, args digest, session/incarnation, command generation, and privacy/policy state. Cover prompt-backed skill expansion: argument substitution, base-directory/resource variables, session variables, shell-capable markdown gated by source trust, scoped allowed-tool rules that do not overwrite higher-priority permissions, hook registration generation, forked-agent/model/effort overrides, and remote command bodies treated as untrusted. Route runtime semantics to `llm-inference-integration`, terminal rendering/keybinding UX to `terminal-cli-dev`, rollout of command availability/defaults to `platform-release-engineering`, signal schema to `platform-observability`, wrong-command or stale-registry incidents to `defect-diagnosis`, product acceptance to `product-rd-workflow`, and security/adversarial review when commands can widen permissions, inject model context, bypass queueing, expose credentials, or trigger local/remote side effects.
+
+## Editor or IDE integrations
+
+test authenticated local endpoint binding, workspace/repository-root matching, parent-process or selected-client disambiguation where relevant, stale lockfile or stale endpoint cleanup, reconnect after editor restart, account/workspace/extension-generation drift rejection, cross-environment path conversion and containment, canonical path and line/column normalization, file mention and range validation, diagnostic schema validation, severity sorting, per-file and total diagnostic caps, cross-turn diagnostic deduplication, delivered-diagnostic reset after file edit/session reset/workspace change, malformed URI fallback without prompt injection, LSP/server subprocess spawn failure, initialization timeout, crash state, bounded restart, pending handler application after lazy startup, request retry only for known transient content-modified cases, didOpen-before-didChange ordering, save/close cleanup, editor diff/open/apply handoff terminal outcomes, expected-old-content or file-version mismatch, user-edited candidate recomputation, abort/unmount/exit cleanup, unknown finality fail-closed behavior, mailbox/inbox polling mark-read only after delivery or durable queueing, busy-state queue drain, stale callback rejection after client replacement, and metadata-only diagnostics without raw paths beyond authorized workspace scope, raw editor tokens, file contents, or private prompt context. Route runtime semantics to `llm-inference-integration`, transport mechanics that exceed existing local control-channel rules to `platform-service-connectivity`, and signal schema/sanitized diagnostics to `platform-observability`.
+
+## Remote session token refresh and transport rebuild
+
+test refresh scheduling as a session/transport state machine, not a timer helper. Cover expiry-decoded scheduling, explicit-TTL scheduling, opaque or undecodable token behavior that preserves an existing refresh chain, refresh-buffer floors/caps, immediate refresh near expiry, bounded missing-token retry, follow-up refresh after successful delivery, single-session and bulk cancellation generation invalidation, and no late timer mutation after teardown. Cover mutual exclusion between proactive refresh and auth-failure recovery before any credential fetch that can advance server-side generation; single refresh-path ownership of new credentials, session generation, worker epoch, transport incarnation, and sequence high-watermark; rejected stale completions after session/account/workspace/privacy/policy drift; transport rebuild with old transport close, fresh auth source, high-watermark carryover, write/history flush gate, stale initial-flush finalizer rejection, and drain only into the matching rebuilt transport. Assert retry exhaustion, malformed credential payloads, invalid generation values, reconnect-budget exhaustion, archive/teardown 401 retry, and unknown delivery finality produce visible degraded states without credential leakage. Diagnostics must expose only bounded cause classes, counts, durations, and stale/drop categories while redacting tokens, headers, request or response bodies, endpoint details, session identifiers, sequence values, local paths, credentials, and free-form errors. Route runtime semantics to `llm-inference-integration`, transport reachability to `platform-service-connectivity`, rollout/defaults to `platform-release-engineering`, signal schema to `platform-observability`, stale/lost refresh incidents to `defect-diagnosis`, and security review when credentials or control channels can leak or cross sessions.
+
+## Local egress relay and inference fixture replay
+
+test loopback-only listener binding, optional setup fail-open before credentials are accepted, fail-closed behavior after a credentialed tunnel starts, bootstrap secret unlink/revoke timing, non-dumpable or equivalent secret containment where available, trust-bundle fetch timeout/failure, child-process proxy/trust environment scoping, bypass-list coverage for loopback/private/control/registry paths, inherited proxy passthrough only under intended parent authority, CONNECT header splitting and oversized header rejection, non-tunnel method rejection, coalesced handshake bytes preserved before upstream open, large payload chunking, malformed tunnel-frame rejection, keepalive and idle timeout behavior, partial-write/backpressure handling in each runtime, no plaintext error after encrypted payload may have begun, cleanup of timers/sockets/listeners, fixture-key stability after cwd/config/temp path, uuid, timestamp, duration, count, and cost normalization, sensitive path/content dehydration before hashing or writing fixtures, CI missing-fixture record gates, stream replay ordering, unique replay message ids, cached usage/cost restoration and deduplication, and no live external dependency in deterministic gates unless explicitly marked live-only. Route relay transport mechanics to `platform-service-connectivity`, inference replay semantics to `llm-inference-integration`, rollout of relay enablement defaults to `platform-release-engineering`, and sanitized diagnostics to `platform-observability`.
+
+## Voice or speech-to-text prompt input
+
+test real microphone/device-open probing, permission prompt and denial, no-device and remote/headless unsupported paths, probe-byte discard with no transcription/model-visible use, native fallback selection, subprocess error-stream backpressure, recorder stop cleanup, fixed sample format, language allowlist and fallback, context-hint cap/sanitization/consent, audio chunk copying before async send, deferred close/finalize so queued audio flushes, keepalive and no-data/safety timers, interim/final ordering, endpoint/finalize behavior, interim promotion on close, error suppression during intentional finalize, stale session/attempt callback rejection, one-time bounded replay under the same principal, account or organization, workspace or repository identity, privacy state, consent or context-hint policy version, language, transcription route or adapter and backend generation, capture attempt id, stream id, copied-audio artifact identity and digest, optional immutable chunk range selector, insertion target, and input generation, duplicate transcript/accounting suppression, cursor or prefix/suffix insertion without clobbering user edits, hold-key leak stripping, focus/silence timeout cleanup, modal or inactive prompt key handling, distinct user-visible states for permission/no-audio/no-speech/connection failure, no false recording/processing/sent/success state before the matching finality stage, and reduced-motion or accessibility-friendly feedback. Route model-visible transcript semantics to `llm-inference-integration`, native capability mechanics to `app-cross-platform-dev`, rollout of enablement defaults to `platform-release-engineering`, and sanitized diagnostics to `platform-observability`.
+
+## Configurable shortcuts and command palettes
+
+test parsing and normalization for modifier/key aliases, platform display labels, single keys, sequences, and whitespace or printable keys; duplicate raw config keys before lossy parsing; duplicate normalized shortcuts inside each scope; reserved/non-rebindable shortcuts; invalid config fallback to defaults; user override ordering; explicit unbind behavior including unbinding a sequence prefix; command-action allowlists and scope restrictions; active-context priority, global versus local handlers, modal priority, propagation/fall-through, and handler cleanup; text input, editable fields, composition/IME, command palette focus, and inactive prompt safety; pending sequence start/cancel/timeout/no-match behavior; keyboard- and screen-reader-reachable discovery, conflict/reset UI, and accessible names for shortcut controls; hot reload, deleted config, parent-directory absence, stale file reads, watcher or polling cleanup, and sanitized warning/count diagnostics. Route UX contract and discovery to `product-ui-ux-design`, web implementation mechanics to `web-react-dev`, app/native mechanics to `app-cross-platform-dev` only when a concrete native or hardware-key surface exists, rollout of default-binding migrations to `platform-release-engineering`, and sanitized diagnostics to `platform-observability`.
+
+## Terminal, command-line, and text UI surfaces
+
+test Unicode display width, combining marks, emoji, East Asian width, zero-width code points, ANSI-stripped measurement, wrapping, truncation, soft-wrap versus hard-newline copy behavior, wide-character spacer cells, style reset, color-depth fallback, no-color mode, selection and search highlight visibility, non-selectable gutters or status chrome, hyperlink or escape-sequence handling, key/paste/mouse/focus parsing, terminal response parsing distinct from user keypresses, raw-mode cleanup, alternate-screen or cursor-state restoration, mouse reporting, bracketed paste, focus reporting, modified keyboard modes, full ANSI style reset, resize clamping, scrollback preservation, user-scroll versus streaming-output pinning, flicker or damage-bound regressions, and bounded memory/redraw cost. Cleanup coverage must include normal exit, error exit, user interrupt, termination signal, child-process crash, resize race, and unmount or parent-cancellation paths. Use unit or snapshot tests for pure rendering and state transitions, PTY integration tests for raw mode and terminal responses, and real terminal smoke when color, cursor, focus, selection, scrollback, or resize behavior cannot be proven lower down. Route implementation mechanics to `terminal-cli-dev`, UX acceptance to `product-ui-ux-design`, rollout of behavior-changing defaults to `platform-release-engineering`, and sanitized diagnostics to `platform-observability`.
+
+## CLI package distribution and self-update
+
+test installation-owner detection for package-manager-managed, bundled/native, local user install, global install, development build, and unknown states; package-manager handoff with no local mutation; config-versus-running-executable mismatch repair; multiple-installation and orphaned-install warnings; PATH and alias diagnostics; permission denial and user repair instructions; channel/direct-version validation; max-version and skip-version gates; authenticated release metadata requiring signed manifest or artifact signature verification against a pinned/trusted key; digest binding to version, channel, platform, and architecture; rejection of unsigned metadata, bad signature, untrusted key, expired or revoked key, replay or downgrade metadata through monotonic release index/channel epoch/freshness window/persisted rollback floor, cross-platform digest confusion, and artifact/digest mismatch; package materialization containment for traversal, absolute paths, symlinks, hardlinks, device/special files, unsafe ownership, unsafe mode bits, and no-follow or descriptor-anchored writes; platform and architecture unsupported paths; transfer timeout/stall retry only for retryable stalls; staging cleanup after failed or interrupted downloads only when paths are installer-owned, sufficiently old, and not protected by lock contention or inconclusive liveness checks; staged-file fsync or platform-equivalent durability, executable bit/metadata validation, and parent-directory durability before success; injected crash/kill/power-loss recovery at every activation phase; startup repair for incomplete activation intent; final installed-target identity validation that the resolved target belongs to the selected installation, digest/version/channel/platform still match the verified artifact, and the launched binary is the intended one before success; atomic symlink swap or platform-equivalent copy activation; restore of the prior executable after copy failure; explicit broken-install finality when restore fails; in-process singleflight or lock contention behavior; per-version process-lifetime locks protecting running versions; stale lock cleanup without PID-reuse deletion; cleanup retaining current, linked, locked, rollback-candidate, and activation-recovery-needed versions until recovery finality; safe removal only of installer-owned launchers or aliases; key id, rotation, revocation, and overlapping trust-window behavior; completion/cache regeneration after successful update; and sanitized diagnostics without raw registry, bucket, token, local path, or command contents. Route release ownership to `platform-release-engineering`, terminal interaction mechanics to `terminal-cli-dev`, and signal schema to `platform-observability`.
+
+## Agent task orchestration and background workers
+
+Test stable task id/type and parent/session correlation; durable task-list namespace binding to principal/session/team/workspace scope; sanitized storage keys; monotonic task ids across deletion/reset; schema validation and legacy-state normalization; list-level and task-level lock contention; create/update/delete/claim operations under concurrency; blocked, already-owned, already-completed, busy-owner, missing, malformed, and deleted task outcomes; dependency graph updates in both directions plus rejection of cycles, dangling dependencies, deleted-task dependencies, cross-list/cross-namespace edges, and stale blocker recomputation before claim or completion; owner assignment and sanitized assignment notification; hook-blocked creation or completion rollback after partial task/list mutation, dependency insertion, owner assignment, or notification staging; foreground-to-background transition; isolated background output versus explicit result merge; output offset/delta reporting; terminal status monotonicity; duplicate completion and duplicate notification suppression; late progress, late message injection, late approval, late poll, and late output rejection after terminal state; stop-task error classes for missing, non-running, unsupported, user-stopped, parent-aborted, timed-out, and dependency-failed paths; parent cancellation cascading only to owned child workers and background processes; orphan cleanup for worker-owned shell/process/session resources; queued-notification cleanup for dead workers; progress counters, recent activity, summaries, usage, todo state, and task metadata sanitization; stalled-interactive-work detection without misclassifying slow work; watcher debounce, fallback polling, missed-event recovery, prompt-submit failure claim release, completed-list hide/reset generation fencing, task-list id switch behavior, and pending-message draining only at safe turn/tool boundaries; resume recovery that persists minimal reconnect metadata, fetches fresh live status, drops archived/missing/unauthorized/terminal work, validates session generation/incarnation and principal/workspace/policy scope, restarts polling without duplicating output, and fences in-flight poll or completion callbacks from overwriting killed/completed state.
+
+Assert multi-step checklist completion without a verification item produces a bounded verification nudge and cannot replace actual verification evidence.
+
+For sidecar summary inference that generates task progress or completed-tool labels, assert no-tool/no-side-effect enforcement, no main-transcript pollution, fresh bounded source snapshots each run, incomplete action/result pair filtering, task or tool-batch identity binding, apply-time generation or digest fencing that discards late labels after source/task drift or terminal state, stale previous-label handling, output length and content bounds, injection-resistant wrapping/escaping for transcript and tool-output content that tries to instruct the labeler, timer/singleflight overlap prevention, abort/stop cleanup, API-error and empty-label fallback, cache-key invariants when tools are listed but denied, cache partition or validation by sidecar purpose/effective tool policy/source snapshot/prompt-model version, redaction of raw prompts, prompt-submit bodies, tool bodies, credentials, local paths, task ids beyond intended audience, teammate/team names, task-list storage keys or paths, assignment payloads, raw diagnostic strings, and unrelated worker output, and summary-only semantics that cannot satisfy task/tool/permission/side-effect finality.
+
+For writes, tool actions, remote calls, or other external side effects, assert task id plus execution-attempt/effect id or idempotency key binding, durable prepared/committed/failed/unknown finality, retry/replacement-worker reconciliation of committed or unknown effects, no re-execution without durable no-commit proof, and repair visibility for unknown finality.
+
+Routing: runtime mechanics -> `llm-inference-integration`; user-visible/degraded/stale/misleading progress labels -> `product-rd-workflow` (and `product-ui-ux-design` when rendered); behavior-changing default rollout -> `platform-release-engineering`; signal schema / sanitized diagnostics -> `platform-observability`.
+
+## Agent-to-agent mailbox and peer messaging
+
+test recipient parsing for named teammate, broadcast, local peer, remote peer, empty target, empty scheme target, disallowed address syntax, and required preview/summary behavior for plain messages where the UI depends on it; structured message restrictions that forbid broadcast and unsupported cross-session sends; shutdown response destination and reject-reason requirements; permission, approval, plan, mode, sandbox, task, team-permission, and shutdown control-message schema validation; and role/authority checks for leader-only or requester-only actions. Cover cross-machine prompt consent as bypass-immune and not classifier-approvable, then revalidate peer handle, connection state, recipient identity, and transport generation immediately before send after the consent wait. Cover mailbox path/key sanitization, lock acquisition, lock failure distinct from empty inbox or sent success, re-read-before-append, concurrent writers, read failure distinct from empty inbox, write failure surfaced as not-sent, mark-read only after delivery into model context or durable queueing, mark-read failure surfaced as delivery uncertainty rather than delivered success, crash before mark-read replay, duplicate poll deduplication by stable message/request/tool ids, permission queue deduplication, immediate idle submit versus busy queue/drain, and clearing queued messages only after successful submit. Control replies must bind to pending request id, sender role/control-channel authority, target agent, tool or task id, session/incarnation, policy/capability/permission generation, and original payload digest; reject forged, late, duplicate, unknown, stale, role-invalid, or post-terminal responses. Broadcast tests must assert explicit recipient enumeration, self-exclusion, bounded fanout, and per-recipient delivery/failure accounting. Prompt-facing wrappers need escaping or bounding for sender-controlled attributes and message bodies, untrusted-context labeling, XML/markup injection resistance, maximum body/queue size behavior, and diagnostics redaction for raw message bodies, prompts, control payloads, socket paths, session handles, local transport addresses, credentials, and sensitive paths. Route runtime semantics to `llm-inference-integration`, transport mechanics that exceed existing local or streaming channel rules to `platform-service-connectivity`, signal schema/sink policy to `platform-observability`, product acceptance for autonomous permission or shutdown behavior to `product-rd-workflow`, and security/adversarial review when messages can authorize side effects or inject model-visible prompts.
+
+## Agent tool execution authorization
+
+test allow/deny/ask, hook, classifier, cached approval, and user-edited approvals are bound to the exact tool-use id, normalized arguments, final normalized invocation/resource set, invocation digest, working directory, permission mode, policy version, principal/session identity, capability generation, tool source/server identity, and schema version; reject stale approvals after abort/cancel/retry, user edit, hook-updated input, permission update, mode change, working-directory change, policy refresh, or capability reload; and assert persisted approvals use narrowest-reusable scope with revocation, expiration, or revalidation after policy/principal/capability/workspace/schema changes. Cover hook allow that still loses to deny/ask rules, hook/schema failure, late hook result, prompt-hook malformed JSON, agent-hook turn/timeout cancellation, additional-context injection that cannot grant permission, permission-denied retry hints that still require a fresh invocation, and non-interactive/headless paths that log the same decision semantics. For shell tools, cover compound commands, pipes/operators, redirections, heredocs, substitutions, wrappers, environment assignment stripping, bare-shell or wrapper prefix suggestions, deny precedence, destructive-operation approval, read-only false positives through flags/subcommands, parser unavailable/too-complex/divergent fail-closed behavior, subcommand fanout caps, and sandbox auto-allow only after deny/ask and path checks. For filesystem tools, cover path normalization versus user-visible input, denied settings/policy files, prior-full-read requirement, partial-read rejection, stale mtime/content rejection immediately before write, ambiguous replacement, secret-bearing store rejection, output redirection containment, end-of-options paths, traversal/encoded/Unicode traversal, null-byte paths, glob behavior, platform path forms, symlink/hardlink/time-of-check swaps, parent creation outside the critical section, undo/history/diff evidence, and large-output/file-size limits. For sandbox policy, cover enabled/disabled/unavailable/bypassed/excluded-command/managed-lock/dependency-missing/platform-unsupported/weaker-isolation states, stale config refresh after settings or permission updates, network proxy/domain allowlist behavior, and unsandboxed fallback that never becomes permission allow. Route runtime mechanics to `llm-inference-integration`, release rollout of tool/sandbox defaults to `platform-release-engineering`, and signal schema/sanitized diagnostics to `platform-observability`.
+
+## Per-turn model-loop finality
+
+test accepted user or queued input is persisted before model call or resume dependency; streamed assistant blocks, progress/control attachments, compact or recovery boundaries, and tool results are recorded in order; buffered transcript writes flush before terminal result when the host can exit; and replay after crash or resume cannot fork, duplicate, or lose the accepted turn. Cover streamed tool-use batches where every tool-use id receives exactly one terminal tool result, including normal completion, missing tool, permission denial, validation error, streaming fallback, model error after a partial tool call, sibling tool failure, user interrupt, submit interrupt, abort before streaming starts, abort during streaming, abort during tool execution, and max-turn or budget stop. Assert partial assistant messages from fallback are tombstoned or otherwise excluded from continuation, in-progress or queued tools get bounded synthetic terminal results when execution cannot finish, and orphan tool calls never reach transcript, cache, protocol stream, or next model input. Cover queued command and notification snapshots before attachment, target agent/session scoping, prompt versus task-notification routing, consume-once removal only after successful attachment or delivery, stale or unrecoverable queue state surfaced as uncertainty, and no cross-agent prompt leakage. Cover hook-stopped continuation, dynamic tool refresh or context modifier between turns, stale permission/tool-schema rejection after refresh, usage/cost/stop-reason deduplication, permission-denial reporting, structured-output retry exhaustion where relevant, terminal success versus runtime-error classification, and diagnostics redaction for raw prompts, queued bodies, tool inputs or outputs, local paths, credentials, provider payloads, and free-form runtime errors. Route runtime semantics to `llm-inference-integration`, signal schema/sanitized diagnostics to `platform-observability`, stale/lost/duplicate-turn incidents to `defect-diagnosis`, and product acceptance to `product-rd-workflow` only when turn finality changes user-visible workflow outcomes.
+
+## Runtime hook configuration and callback control planes
+
+test effective hook-set construction by source precedence, policy locks, disabled-all and managed-only states, lower-trust override attempts, source-scope restriction, session-only callback registration/removal, and duplicate or colliding hook identities. Cover initial snapshot capture, explicit snapshot refresh after settings edits, stale settings-cache reset, overlapping config writes/cache resets/tool-start snapshots, immutable per-turn/tool/task/watcher generation binding, serialized or compare-and-swap publication from one authoritative source snapshot, failed refresh retaining the prior valid generation, old-generation isolation for already-running work, new-generation visibility only after reload/restart or explicit generation change, and stale hook results or callback successes discarded after config, policy, workspace, principal, session, capability, sandbox, or working-directory drift. Assert hook output schema/discriminant validation, malformed JSON failure class, timeout/abort cleanup, recursive hook suppression, prompt/model-backed hook no-transcript-pollution where required, external-hook URL allowlists, proxy/sandbox routing, SSRF guard, redirect blocking, header-value sanitization, environment-variable allowlist intersection, missing-secret diagnostics without values, outbound payload allowlist and redaction for raw prompts, tool arguments/results, file contents, local paths, environment values, URLs, headers, and diagnostic strings, and output size/content bounds. Cover hook-provided input updates, permission updates, additional context, environment edits, dynamic watch paths, tool-output mutation, and stop/continuation blocking as untrusted control inputs that cannot bypass deny/ask rules or durable finality. For file watching and working-directory hooks, test path containment against the current authorized root set, relative path resolution after directory changes, symlink or deleted-path drift, watcher restart/close ordering, stale dynamic paths after removal, cleanup on shutdown, and degraded-state diagnostics when watcher or environment cleanup fails. Diagnostics across hook setup, refresh, execution, watcher, cleanup, and degraded-state paths must preserve only categorical state, counts, bounded durations, and sanitized reason codes while redacting raw prompts, tool inputs or outputs, file contents, local paths, URLs, headers, environment values, credentials, and free-form diagnostic strings. Route runtime semantics to `llm-inference-integration`, behavior-changing rollout to `platform-release-engineering`, signal schema to `platform-observability`, and security/adversarial review when hooks can execute code, call network services, mutate permissions, expose files, or inject model-visible context.
+
+## Custom terminal status lines, footers, and prompt-adjacent status commands
+
+test these as both external command execution and terminal chrome. Cover trust not accepted, managed disable-all, managed-only source precedence, user-disabled and missing-command cases, noninteractive/automation/structured-output suppression, child-agent or remote-like modes where status fields would describe the wrong process, allowlisted structured input fields and redaction for workspace paths, session identifiers, account state, cost, quota, context, model, permission, input-mode, branch/worktree, and transcript metadata, malformed or oversized input serialization, command timeout/abort, settings hot reload, debounce and in-flight cancellation, unmount cleanup, stale output rejection after session/workspace/permission/model/input-mode/settings/trust/policy/terminal-generation drift, stdout trimming and multiline normalization, nonzero exit and stderr behavior, output-size bounds, ANSI/style reset, stable fullscreen footer height, narrow terminal truncation, no focus theft, no input submission, no scrollback destruction, no copy-selection pollution, no machine-readable output pollution, and diagnostics/telemetry limited to bounded categories, lengths, counts, and sanitized reason codes rather than raw command, output, paths, identifiers, or free-form errors. Route terminal mechanics to `terminal-cli-dev`, generic hook trust/source semantics to `llm-inference-integration`, rollout/default changes to `platform-release-engineering`, signal schema to `platform-observability`, visible product semantics to `product-rd-workflow`, stale/wrong/noisy status incidents to `defect-diagnosis`, and security/adversarial review when status commands can execute code, call network services, or expose sensitive runtime state.
+
+## Post-turn hook execution and blocking finality
+
+test post-turn context snapshotting for eligible entrypoints, query-source and agent-identity gating, cache-safe snapshot ownership, and background bookkeeping suppression in modes or child agents that must not own main-session state. Cover ordering across ordinary stop hooks, task-completed hooks, idle hooks, and cleanup jobs; background suggestion, memory, classification, and cleanup jobs isolated from the main transcript unless they produce authorized messages; main-thread-only cleanup for shared process state; per-hook progress/effect ids; bounded aggregation of stdout/stderr-like output into summaries; blocker versus nonblocking-error distinction; hidden meta blocker messages returned as continuation blockers; prevent-continuation attachments; abort/cancel during hook execution returning durable prevented-continuation state; orchestration failure surfacing as degraded warning without inventing a blocker; notifications only when output or errors exist; duplicate summary/notification suppression; late hook/background results rejected after abort, new input, workspace/root switch, session/agent drift, hook-set generation drift, permission/policy drift, or terminal continuation state; and diagnostics redaction for raw hook commands, prompts, outputs, task or team names, local paths, credentials, telemetry ids, and free-form errors. Route runtime semantics to `llm-inference-integration`, behavior-changing rollout to `platform-release-engineering`, user-visible finality or notification acceptance to `product-rd-workflow`, signal schema to `platform-observability`, stale/lost-blocker incidents to `defect-diagnosis`, and security/adversarial review when hooks can execute code, mutate permissions, or expose sensitive context.
+
+## Session discovery, resume, and fork provenance
+
+test candidate discovery for every supported discovery scope, such as current workspace, sibling workspaces, or all known workspaces, plus negative behavior for unsupported scopes; renamed or tagged sessions; summary/title search; stale index or lite metadata; direct transcript lookup fallback; duplicate ids or duplicate leaves; current-session self-match suppression; auxiliary/background transcript suppression; missing or corrupt transcript files; and cross-workspace candidates that require an explicit context switch. Assert that discovery indexes and result lists are scope-authorized and redacted before model/UI exposure; cross-workspace discovery must expose only sanitized existence or counts until a context switch is authorized, with negative assertions for workspace names, paths, branch names, titles, session ids, and other raw metadata. Assert that resume binds the selected transcript to principal, account, tenant, organization, or explicit absent-scope markers; workspace or repository identity; canonical working root; branch/worktree identity where present; privacy state; session id; transcript artifact identity plus content digest, signed or manifested transcript generation, or monotonic durable append/high-watermark identity; session incarnation; policy/permission generation; tool/capability generation; prompt/model generation; and source trust scope before restoring model-visible context or tools. Cover modified times and search metadata as hints only; stale file, skill, memory, prompt, approval, session-message, tool, capability, tool-server, connector, and settings-derived cache clearing or revalidation before rehydration; stable immutable snapshot or locked-generation reads across candidate selection/transcript open/rehydration/fork-copy preparation; high-watermark revalidation immediately before restore or fork copy; concurrent append/delete/rename/compaction/partial-copy drift rejection; restoration of cost, content-replacement, attribution, worktree, task, agent, and metadata state only under matching tuple or explicit migration rules; and fail-closed behavior for ambiguous matches, stale metadata, missing fork point, wrong workspace, policy drift, permission drift, or deleted worktree/root. For forked sessions, assert fresh session incarnation, verified parent transcript chain, authorized per-message prefix selection, per-message/attachment/replacement-record/summary/source-scope provenance checks, rejection or typed redaction of summaries merged across differently scoped parent sources, fork-point containment, durable message-id remapping, tool-use/tool-result pairing, parent-child transcript separation, copied-prefix effect/finality records preserved as immutable parent provenance and no-reexecute barriers, unknown/committed effects blocking automatic child retry until reconciled, no undo-history or removable-worktree ownership inheritance, no pending approval or permission-bypass inheritance, no live task/remote credential/cache/cost/usage-counter reuse without child-tuple rebinding, and separation for file-history state, replacement records, memory writes, side-effect ledgers, diagnostics, and raw prompts, paths, branch names, transcript bodies, stable ids, credentials, and free-form metadata. Route runtime semantics to `llm-inference-integration`, product acceptance to `product-rd-workflow` only when resume/fork behavior changes user-visible finality or permission outcomes, rollout of metadata migration/defaults to `platform-release-engineering`, sanitized diagnostics to `platform-observability`, stale/wrong-session incidents to `defect-diagnosis`, and security/adversarial review when transcript or permission state can cross principal, workspace, privacy, or child-session boundaries.
+
+## Runtime workspace-scope changes
+
+test adding, removing, and persisting working directories as permission transitions. Cover canonical path expansion and platform normalization, stable filesystem identity or realpath-equivalent where available, non-existent path, inaccessible path, non-directory target, root path rejection or explicit broad-scope handling, duplicate root, child root under an existing root, sibling or unrelated root that widens scope, broad home/drive/root requests, parent root that widens scope, symlink or hardlink target drift between validation, persistence, sandbox refresh, and use, case-insensitive filesystem collisions, traversal and trailing-separator normalization, session-only versus persisted lifetime, persistence failure or partial write, rollback/retry behavior, cross-session startup rehydration, and concurrent add/remove/persist races under serialized or compare-and-swap root-set generation fencing. Assert root-set changes invalidate cached approvals, planned tool invocations, file/source caches, prompt-visible file context, permission suggestions, and sandbox allowlists keyed to the previous root set; pending or queued filesystem-capable commands must re-authorize against the new root set before execution. Removal or scope shrink must reject stale writes, reads, shell commands, late callbacks, resumed sessions, and queued filesystem-capable actions under the removed root. Cover blocked shell path suggestions and write-redirection suggestions that propose adding a directory: the suggested directory must be canonical, minimally scoped, user-visible before approval, not silently persisted, and unable to bypass deny rules. Sandbox coverage must prove config refresh happens before the next filesystem-capable command and that refresh failure, stale config, or unsandboxed fallback is surfaced as permission uncertainty rather than allow; crash or failure between memory update, persistence, and sandbox refresh must not report a broader durable scope than actually committed. Diagnostics must redact raw local paths, sensitive project structure, denied path values, and full command contents while preserving enough categorical evidence to debug scope decisions. Route runtime semantics to `llm-inference-integration`, persisted-setting rollout to `platform-release-engineering`, signal schema to `platform-observability`, product acceptance to `product-rd-workflow`, and security/adversarial review when scope widening can expose sensitive files or authorize side effects.
+
+## Agent plan-to-execute state transitions
+
+test entering planning suppresses write-capable tools except explicitly scoped plan artifacts; exit is rejected outside planning state; approval prompts bind to the current contained plan artifact identity, plan digest/snapshot generation, approval request id, approver/source identity, principal/account/tenant/organization scope with explicit none markers when absent, session/incarnation, workspace, privacy/data-residency/source-scope authorization, policy/capability generation, prior permission mode and effective permission state, and target execution mode; user-edited approved plans are written back, re-snapshotted, and become the implementation source; execution revalidates the approved digest or immutable snapshot immediately before implementation and rejects post-approval content, path, containment, privacy/source scope, or snapshot drift without re-approval; empty/missing plan, stale plan file, plan path outside allowed storage, resume without plan artifact, forked session plan copy or re-snapshot under the child identity plus re-approval unless the original approval covers the child tuple, compaction rehydration, and remote/local handoff each preserve source labels and fail closed when recovery cannot prove the approved and authorized plan. Cover approval rejection, forged approver, duplicate reply, late reply after mode drift, stale reply after policy/capability/workspace/session/principal/account/tenant/organization/privacy/source-scope drift, remote event batches containing approval plus later failure, timeout with pending approval, timeout before any plan, transient polling failures, and ambiguous finality. Test permission restoration separately: prior safe mode restores only if still allowed; automatic or bypass-like modes disabled by circuit breaker, settings, revocation, or policy drift fall back to default with user-visible notice; broad cached approvals, persisted approvals, and dangerous rules stripped during planning are restored only when the target mode and current policy explicitly permit them and their original approval tuple still matches principal/account/tenant/organization/workspace/session/incarnation, working directory, tool source/schema/capability generation, resource scope, revocation floor, and policy generation. Route runtime semantics to `llm-inference-integration`, rollout of plan/permission defaults to `platform-release-engineering`, product acceptance for mandatory planning gates to `product-rd-workflow`, stale/lost-plan incidents to `defect-diagnosis`, sanitized transition diagnostics to `platform-observability`, and security/adversarial review when approvals can widen permissions or authorize side effects.
+
+## Accessibility and visual regression
+
+require gated, assertion-based evidence; use `product-ui-ux-design` for criteria, then `app-cross-platform-dev`, `miniapp-product-dev`, `web-react-dev`, or `terminal-cli-dev` for stack-specific implementation.
+
+## LLM, agent, RAG, model, prompt, and evaluation harness behavior
+
+route implementation detail to `llm-inference-integration`.
+
+
+## Configurable terminal keybinding tests
+
+Configurable terminal keybinding tests: when code changes keymap schema, default/user merge, shortcut parsing, action dispatch, context priority, or hot reload, assert valid and invalid schema handling, feature-gated customization, fallback to defaults, ordered user override precedence, explicit unbind/null shadowing, raw duplicate-key detection before parser collapse, normalized duplicate detection, invalid context/action warnings, command-bound shortcut routing to the command-invocation allow path, platform and terminal reserved shortcuts, non-rebindable shortcuts, modifier alias behavior, escape-key modifier quirks, chords with prefix capture, longer-chord priority over single-key matches, null-unbound chord shadowing, chord timeout/cancel, wheel or non-key events, active-context priority over global actions, modal/text-input safety, handler registration/unregistration, propagation stop only after consumed actions, sync initial load versus async reload parity, half-written config stabilization, deletion reset, parse failure behavior, watcher/timer cleanup, and diagnostics redaction for raw config paths, binding bodies, command names, prompt text, credentials, and free-form parse errors.