deadbyte-mcp 0.8.7

package/test/containment.test.mjs

@@ -0,0 +1,557 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { test } from 'node:test';
+import { validateContainmentResult } from '../src/containment-result.mjs';
+
+const launcherSource = fileURLToPath(new URL('../native/deadbyte-contain.cpp', import.meta.url));
+const probeSource = fileURLToPath(new URL('../native/containment-probe.cpp', import.meta.url));
+
+function valid(mode = 'lpac') {
+  const lpac = mode === 'lpac';
+  return {
+    status: 'passed',
+    backend: lpac ? 'windows-lpac' : 'windows-appcontainer',
+    mode,
+    appcontainer_sid: 'S-1-15-2-test',
+    job_assigned: true,
+    active_process_limit: 1,
+    process_memory_limit_bytes: 134217728,
+    job_assignment: 'atomic-attribute',
+    job_breakaway_enabled: false,
+    job_ui_restrictions: true,
+    child_control: 'job-active-process-limit',
+    child_process_policy: 'not-used',
+    network_capabilities: 0,
+    result_channel: 'inherited-handle',
+    timed_out: false,
+    child_exit_code: 0,
+    profile_cleanup_ok: true,
+    probe: {
+      token_query_ok: true,
+      token_appcontainer_query_ok: true,
+      token_appcontainer_query_error: 0,
+      token_lpac_query_ok: lpac,
+      token_lpac_query_error: lpac ? 0 : 87,
+      capability_query_ok: true,
+      capability_query_error: 0,
+      token_is_appcontainer: true,
+      token_is_lpac: lpac,
+      capability_count: 0,
+      aap_canary_readable: !lpac,
+      aap_canary_error: lpac ? 5 : 0,
+      aap_mode_evidence_ok: true,
+      outside_read_denied: true,
+      inside_write_ok: true,
+      child_process_denied: true,
+      normal_child_execution_denied: true,
+      breakaway_child_execution_denied: true
+    }
+  };
+}
+
+test('containment result validator accepts the complete LPAC invariant set', () => {
+  const result = validateContainmentResult(valid('lpac'), 'lpac');
+  assert.equal(result.ok, true);
+  assert.equal(result.lpac, true);
+});
+
+test('containment result validator accepts the complete regular AppContainer invariant set', () => {
+  const result = validateContainmentResult(valid('appcontainer'), 'appcontainer');
+  assert.equal(result.ok, true);
+  assert.equal(result.lpac, false);
+});
+
+test('containment result validator refuses mode confusion', () => {
+  assert.throws(() => validateContainmentResult(valid('appcontainer'), 'lpac'), /does not match expected/);
+});
+
+test('containment result validator rejects a readable host canary', () => {
+  const r = valid();
+  r.probe.outside_read_denied = false;
+  assert.throws(() => validateContainmentResult(r), /host canary was readable/);
+});
+
+test('containment result validator rejects any granted capability', () => {
+  const r = valid();
+  r.probe.capability_count = 1;
+  assert.throws(() => validateContainmentResult(r), /token has capabilities/);
+});
+
+test('containment result validator rejects child payload execution', () => {
+  const r = valid();
+  r.probe.normal_child_execution_denied = false;
+  r.probe.child_process_denied = false;
+  assert.throws(() => validateContainmentResult(r), /child payload execution/);
+});
+
+
+test('containment result validator rejects a non-LPAC token when LPAC is expected', () => {
+  const r = valid('lpac');
+  r.probe.token_is_lpac = false;
+  assert.throws(() => validateContainmentResult(r, 'lpac'), /not running in LPAC/);
+});
+
+test('containment result validator accepts regular AppContainer when LPAC-specific query is unavailable but AAP behavior proves regular mode', () => {
+  const r = valid('appcontainer');
+  r.probe.token_lpac_query_ok = false;
+  r.probe.token_lpac_query_error = 87;
+  r.probe.token_is_lpac = false;
+  const result = validateContainmentResult(r, 'appcontainer');
+  assert.equal(result.ok, true);
+  assert.equal(result.lpac_token_query_available, false);
+  assert.equal(result.aap_mode_evidence_ok, true);
+});
+
+test('containment result validator rejects LPAC when regular AppContainer is expected', () => {
+  const r = valid('appcontainer');
+  r.probe.token_lpac_query_ok = true;
+  r.probe.token_lpac_query_error = 0;
+  r.probe.token_is_lpac = true;
+  assert.throws(() => validateContainmentResult(r, 'appcontainer'), /unexpectedly reports LPAC/);
+});
+
+test('containment result validator rejects regular AppContainer when AAP behavioral mode evidence fails', () => {
+  const r = valid('appcontainer');
+  r.probe.aap_canary_readable = false;
+  r.probe.aap_canary_error = 5;
+  r.probe.aap_mode_evidence_ok = false;
+  assert.throws(() => validateContainmentResult(r, 'appcontainer'), /ALL_APPLICATION_PACKAGES canary/);
+});
+
+test('containment result validator requires LPAC-specific token query for LPAC mode', () => {
+  const r = valid('lpac');
+  r.probe.token_lpac_query_ok = false;
+  r.probe.token_lpac_query_error = 87;
+  r.probe.token_is_lpac = false;
+  r.probe.token_query_ok = false;
+  assert.throws(() => validateContainmentResult(r, 'lpac'), /TokenIsLessPrivilegedAppContainer query failed win32=87/);
+});
+
+test('containment result validator rejects LPAC that can read the AAP canary', () => {
+  const r = valid('lpac');
+  r.probe.aap_canary_readable = true;
+  r.probe.aap_canary_error = 0;
+  r.probe.aap_mode_evidence_ok = false;
+  assert.throws(() => validateContainmentResult(r, 'lpac'), /unexpectedly read the ALL_APPLICATION_PACKAGES canary/);
+});
+
+test('containment result validator rejects missing Job assignment', () => {
+  const r = valid();
+  r.job_assigned = false;
+  assert.throws(() => validateContainmentResult(r), /Job object was not assigned/i);
+});
+
+test('containment result validator rejects timeout', () => {
+  const r = valid();
+  r.timed_out = true;
+  assert.throws(() => validateContainmentResult(r), /timed out/);
+});
+
+test('containment result validator rejects non-atomic Job assignment', () => {
+  const r = valid();
+  r.job_assignment = 'suspended-before-resume';
+  assert.throws(() => validateContainmentResult(r), /job assignment is not atomic/i);
+});
+
+test('containment result validator rejects enabled breakaway', () => {
+  const r = valid();
+  r.job_breakaway_enabled = true;
+  assert.throws(() => validateContainmentResult(r), /breakaway is enabled/i);
+});
+
+test('containment result validator rejects the broken token child-policy mechanism', () => {
+  const r = valid();
+  r.child_process_policy = 'restricted';
+  assert.throws(() => validateContainmentResult(r), /child-process policy is still enabled/i);
+});
+
+test('containment result validator rejects breakaway child payload execution', () => {
+  const r = valid();
+  r.probe.breakaway_child_execution_denied = false;
+  r.probe.child_process_denied = false;
+  assert.throws(() => validateContainmentResult(r), /child payload execution|breakaway child payload/i);
+});
+
+
+test('containment result validator rejects a filesystem result channel', () => {
+  const r = valid();
+  r.result_channel = 'path';
+  assert.throws(() => validateContainmentResult(r), /result channel/);
+});
+
+test('native launcher uses atomic Job assignment and excludes the broken child-policy attribute', async () => {
+  const source = await readFile(launcherSource, 'utf8');
+  for (const contract of [
+    'PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES',
+    'PROC_THREAD_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY',
+    'PROCESS_CREATION_ALL_APPLICATION_PACKAGES_OPT_OUT',
+    'ContainerMode::AppContainer',
+    'ContainerMode::Lpac',
+    '--mode',
+    'PROC_THREAD_ATTRIBUTE_JOB_LIST',
+    'JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE',
+    'JOB_OBJECT_LIMIT_ACTIVE_PROCESS',
+    'CapabilityCount = 0',
+    'PROC_THREAD_ATTRIBUTE_HANDLE_LIST',
+    'CreatePipe(result)',
+    '--result-handle',
+    'job-active-process-limit',
+    'atomic-attribute',
+    'job_breakaway_enabled'
+  ]) {
+    assert.match(source, new RegExp(contract.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+  }
+  assert.doesNotMatch(source, /PROC_THREAD_ATTRIBUTE_CHILD_PROCESS_POLICY/);
+  assert.doesNotMatch(source, /PROCESS_CREATION_CHILD_PROCESS_RESTRICTED/);
+  assert.doesNotMatch(source, /CREATE_SUSPENDED/);
+  assert.doesNotMatch(source, /AssignProcessToJobObject/);
+  assert.doesNotMatch(source, /JOB_OBJECT_LIMIT_BREAKAWAY_OK/);
+  assert.doesNotMatch(source, /JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK/);
+});
+
+test('native build script targets Windows 10 and preserves MSVC diagnostics', async () => {
+  const buildScript = fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url));
+  const source = await readFile(buildScript, 'utf8');
+  for (const contract of [
+    '/D_WIN32_WINNT=0x0A00',
+    '/DWINVER=0x0A00',
+    '/W4 /WX',
+    'CONTAINMENT-BUILD.txt',
+    "Invoke-MsvcStage -Name 'launcher'",
+    "Invoke-MsvcStage -Name 'probe'"
+  ]) {
+    assert.match(source, new RegExp(contract.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+  }
+  assert.match(source, /\$VsWhereCandidates = @\(\)/);
+  assert.match(source, /if \(\$\{env:ProgramFiles\(x86\)\}\)/);
+  assert.match(source, /if \(\$env:ProgramFiles\)/);
+  assert.ok(source.includes("$VsWhereCandidates += 'C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\vswhere.exe'"));
+  assert.doesNotMatch(source, /\$VsWhere = Join-Path \$\{env:ProgramFiles\(x86\)\}/);
+});
+
+
+
+test('native build command composition is Windows PowerShell 5.1 parser-safe', async () => {
+  const buildScript = fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url));
+  const source = await readFile(buildScript, 'utf8');
+  assert.match(source, /Windows PowerShell 5\.1 has no PowerShell pipeline-chain/);
+  assert.match(source, /\$Cmd = 'call "\{0\}" -no_logo -arch=x64 -host_arch=x64 && \{1\}' -f \$VsDevCmd, \$Command/);
+  assert.match(source, /\$AuditCmd = 'call "\{0\}" -no_logo -arch=x64 -host_arch=x64 && dumpbin/);
+  assert.doesNotMatch(source, /`"/);
+  assert.doesNotMatch(source, /\$[A-Za-z]+Command\s*=\s*"cl /);
+});
+test('native launcher link contract includes Ole32 for CoTaskMemFree', async () => {
+  const buildScript = fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url));
+  const source = await readFile(buildScript, 'utf8');
+  assert.match(source, /userenv\.lib advapi32\.lib Ole32\.lib/);
+});
+
+test('native probe link contract includes Advapi32 for token inspection APIs', async () => {
+  const buildScript = fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url));
+  const source = await readFile(buildScript, 'utf8');
+  assert.match(source, /\$ProbeCommand = .*advapi32\.lib/);
+});
+
+test('native launcher narrows SID text only through explicit ASCII validation', async () => {
+  const source = await readFile(launcherSource, 'utf8');
+  assert.match(source, /static std::string NarrowAscii/);
+  assert.match(source, /EscapeJson\(NarrowAscii\(sidText\)\)/);
+  assert.doesNotMatch(source, /std::string\(sidText\.begin\(\), sidText\.end\(\)\)/);
+});
+
+
+test('native result channel is an explicitly inherited one-way handle, not a result path grant', async () => {
+  const launcher = await readFile(launcherSource, 'utf8');
+  const probe = await readFile(probeSource, 'utf8');
+  assert.match(launcher, /PROC_THREAD_ATTRIBUTE_HANDLE_LIST/);
+  assert.match(launcher, /CreateProcessW\(nullptr, mutableCommand\.data\(\), nullptr, nullptr,\s*TRUE,/s);
+  assert.match(launcher, /SetHandleInformation\(resultRead\.get\(\), HANDLE_FLAG_INHERIT, 0\)/);
+  assert.match(launcher, /--result-handle/);
+  assert.match(probe, /ParseInheritedHandle/);
+  assert.match(probe, /WriteHandle\(resultHandle/);
+  assert.doesNotMatch(launcher, /result\.json/);
+  assert.doesNotMatch(probe, /--result(?:\s|\")/);
+});
+
+test('containment smoke preserves parseable failed measurements instead of discarding child exit evidence', async () => {
+  const smoke = fileURLToPath(new URL('../src/containment-smoke.mjs', import.meta.url));
+  const source = await readFile(smoke, 'utf8');
+  assert.match(source, /validateContainmentResult\(parsed, requestedMode\)/);
+  assert.match(source, /child_exit=/);
+  assert.match(source, /launcher_exit=/);
+});
+
+
+
+test('containment validator reports the probe invariant before aggregate failed status', () => {
+  const r = valid('appcontainer');
+  r.status = 'failed';
+  r.child_exit_code = 2;
+  r.probe.inside_write_ok = false;
+  assert.throws(
+    () => validateContainmentResult(r, 'appcontainer'),
+    /could not write its own profile/
+  );
+});
+
+test('containment smoke includes the raw probe measurement on invariant failure', async () => {
+  const smoke = fileURLToPath(new URL('../src/containment-smoke.mjs', import.meta.url));
+  const source = await readFile(smoke, 'utf8');
+  assert.match(source, /probe=\$\{JSON\.stringify\(parsed\.probe \?\? null\)\}/);
+});
+
+test('native LPAC probe uses the static MSVC runtime', async () => {
+  const buildScript = fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url));
+  const source = await readFile(buildScript, 'utf8');
+  assert.match(source, /\$ProbeCommand = .*\/MT .*\$Probe/);
+});
+
+test('native build audits the probe for dynamic MSVC and UCRT dependencies', async () => {
+  const buildScript = fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url));
+  const source = await readFile(buildScript, 'utf8');
+  assert.match(source, /dumpbin \/nologo \/dependents/);
+  assert.match(source, /vcruntime/);
+  assert.match(source, /msvcp/);
+  assert.match(source, /ucrtbase/);
+  assert.match(source, /probe_dynamic_crt_dependencies/);
+});
+
+test('native launcher preserves symbolic early-loader failure evidence', async () => {
+  const source = await readFile(launcherSource, 'utf8');
+  assert.match(source, /0xC0000142u/);
+  assert.match(source, /STATUS_DLL_INIT_FAILED/);
+  assert.match(source, /child_exit_hex=/);
+  assert.match(source, /child_exit_name=/);
+});
+
+
+test('native bootstrap probes have custom no-CRT entrypoints', async () => {
+  const kernel = await readFile(fileURLToPath(new URL('../native/bootstrap-kernel32.cpp', import.meta.url)), 'utf8');
+  const advapi = await readFile(fileURLToPath(new URL('../native/bootstrap-advapi32.cpp', import.meta.url)), 'utf8');
+  for (const source of [kernel, advapi]) {
+    assert.match(source, /extern "C" void WINAPI BootstrapEntry\(\)/);
+    assert.doesNotMatch(source, /std::/);
+    assert.doesNotMatch(source, /#include <(?:string|vector|cstdio|cstdlib)>/);
+  }
+  assert.match(kernel, /GetCommandLineW/);
+  assert.match(kernel, /WriteFile/);
+  assert.match(advapi, /OpenProcessToken/);
+  assert.match(advapi, /GetTokenInformation/);
+});
+
+test('native build links bootstrap probes without default CRT libraries', async () => {
+  const buildScript = fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url));
+  const source = await readFile(buildScript, 'utf8');
+  assert.match(source, /\/entry:BootstrapEntry/);
+  assert.match(source, /\/nodefaultlib kernel32\.lib/);
+  assert.match(source, /\/nodefaultlib kernel32\.lib advapi32\.lib/);
+  assert.match(source, /bootstrap-kernel32/);
+  assert.match(source, /bootstrap-advapi32/);
+});
+
+
+test('native launcher applies ALL_APPLICATION_PACKAGES opt-out only in LPAC mode', async () => {
+  const source = await readFile(launcherSource, 'utf8');
+  assert.match(source, /if \(lpacMode\) \{[\s\S]*PROC_THREAD_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY/);
+  assert.match(source, /const DWORD kAttributeCount = lpacMode \? 4u : 3u/);
+  assert.match(source, /BackendName\(mode\)/);
+});
+
+test('full probe validates requested mode with LPAC API evidence plus AAP behavioral evidence', async () => {
+  const probe = await readFile(probeSource, 'utf8');
+  assert.match(probe, /--expect-lpac/);
+  assert.match(probe, /const bool lpacApiEvidenceOk/);
+  assert.match(probe, /const bool aapModeEvidenceOk/);
+  assert.match(probe, /const bool modeMatches = lpacApiEvidenceOk && aapModeEvidenceOk/);
+  assert.doesNotMatch(probe, /isAppContainer && isLpac && capabilities == 0/);
+});
+
+
+test('full probe records per-query Win32 evidence instead of collapsing LPAC query failure into a generic token failure', async () => {
+  const probe = await readFile(probeSource, 'utf8');
+  for (const contract of [
+    'token_appcontainer_query_ok',
+    'token_appcontainer_query_error',
+    'token_lpac_query_ok',
+    'token_lpac_query_error',
+    'capability_query_ok',
+    'capability_query_error',
+    'QueryTokenFlag',
+    'QueryCapabilityCount'
+  ]) {
+    assert.match(probe, new RegExp(contract));
+  }
+  assert.match(probe, /!expectLpac \|\| lpacQuery\.ok/);
+});
+
+test('full containment uses an ALL_APPLICATION_PACKAGES canary as behavioral regular-vs-LPAC evidence', async () => {
+  const launcher = await readFile(launcherSource, 'utf8');
+  const probe = await readFile(probeSource, 'utf8');
+  assert.match(launcher, /S-1-15-2-1/);
+  assert.match(launcher, /ProtectCanaryForUserAndAllAppPackages/);
+  assert.match(launcher, /--aap-canary/);
+  assert.match(probe, /--aap-canary/);
+  assert.match(probe, /aap_canary_readable/);
+  assert.match(probe, /aap_mode_evidence_ok/);
+  assert.match(probe, /expectLpac \? !aapCanaryReadable : aapCanaryReadable/);
+});
+
+test('bootstrap diagnostic compares regular AppContainer and LPAC with zero capabilities', async () => {
+  const bootstrap = fileURLToPath(new URL('../src/containment-bootstrap.mjs', import.meta.url));
+  const source = await readFile(bootstrap, 'utf8');
+  assert.match(source, /const modes = \['appcontainer', 'lpac'\]/);
+  assert.match(source, /variable_under_test: 'PROCESS_CREATION_ALL_APPLICATION_PACKAGES_OPT_OUT'/);
+  assert.match(source, /capabilities_per_mode: 0/);
+  assert.match(source, /lpac-aap-optout-bootstrap-boundary/);
+  assert.match(source, /spawn\(launcher, \['--mode', mode, probe\]/);
+  assert.doesNotMatch(source, /mode = 'appcontainer'.*lpac/s);
+});
+
+test('package exposes separate LPAC and regular AppContainer smoke gates', async () => {
+  const packageJson = JSON.parse(await readFile(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
+  assert.equal(packageJson.scripts['containment:smoke:lpac'], 'node src/containment-smoke.mjs lpac');
+  assert.equal(packageJson.scripts['containment:smoke:appcontainer'], 'node src/containment-smoke.mjs appcontainer');
+});
+
+test('construction ladder starts from Microsoft-style security-capabilities-only baseline', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/appcontainer-stage.cpp', import.meta.url)), 'utf8');
+  assert.match(source, /L"security-only"/);
+  assert.match(source, /PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES/);
+  assert.match(source, /CapabilityCount = 0/);
+  assert.match(source, /DWORD flags = EXTENDED_STARTUPINFO_PRESENT/);
+  assert.match(source, /AtLeast\(stage, Stage::ProfileCwd\)/);
+});
+
+test('construction ladder adds containment mechanisms as isolated transitions', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/appcontainer-stage.cpp', import.meta.url)), 'utf8');
+  for (const contract of [
+    'profile-cwd',
+    'unicode-env',
+    'no-window',
+    'suspended',
+    'child-policy',
+    'handle-list',
+    'job-basic',
+    'job-ui-full-common',
+    'PROC_THREAD_ATTRIBUTE_CHILD_PROCESS_POLICY',
+    'PROC_THREAD_ATTRIBUTE_HANDLE_LIST',
+    'AssignProcessToJobObject',
+    'SetJobUiLimits'
+  ]) {
+    assert.match(source, new RegExp(contract.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+  }
+});
+
+test('construction entrypoint probe is no-CRT and proves execution only through exit code 66', async () => {
+  const probe = await readFile(fileURLToPath(new URL('../native/bootstrap-exitcode.cpp', import.meta.url)), 'utf8');
+  const build = await readFile(fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url)), 'utf8');
+  assert.match(probe, /extern "C" void WINAPI BootstrapExitEntry\(\)/);
+  assert.match(probe, /ExitProcess\(66\)/);
+  assert.doesNotMatch(probe, /std::/);
+  assert.match(build, /\/entry:BootstrapExitEntry/);
+  assert.match(build, /\/nodefaultlib kernel32\.lib/);
+});
+
+test('construction diagnostic reports the first failing transition without fallback', async () => {
+  const source = await readFile(fileURLToPath(new URL('../src/containment-construction.mjs', import.meta.url)), 'utf8');
+  assert.match(source, /'security-only'/);
+  assert.match(source, /'job-ui-full-common'/);
+  assert.match(source, /first-failing-transition/);
+  assert.match(source, /minimal-appcontainer-createprocess-bootstrap-failed/);
+  assert.doesNotMatch(source, /fallback/i);
+});
+
+test('construction launcher includes the SDDL declaration and retains Advapi32 linkage for ConvertSidToStringSidW', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/appcontainer-stage.cpp', import.meta.url)), 'utf8');
+  const build = await readFile(fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url)), 'utf8');
+  assert.match(source, /#include <sddl\.h>/);
+  assert.match(source, /ConvertSidToStringSidW/);
+  assert.match(build, /\$StageLauncherCommand = .*advapi32\.lib/);
+});
+
+test('construction diagnostic refuses to run when native build artifacts are missing', async () => {
+  const source = await readFile(fileURLToPath(new URL('../src/containment-construction.mjs', import.meta.url)), 'utf8');
+  assert.match(source, /requireBuiltArtifact\('construction launcher', launcher\)/);
+  assert.match(source, /requireBuiltArtifact\('exit-code bootstrap', probe\)/);
+  assert.match(source, /run npm run containment:build first/);
+  assert.match(source, /await stat\(file\)/);
+});
+
+
+test('child-control matrix isolates policy, suspended start, delayed Job, and atomic Job', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/child-control-stage.cpp', import.meta.url)), 'utf8');
+  for (const contract of [
+    'baseline',
+    'policy-direct',
+    'suspended',
+    'suspended-policy',
+    'job-delayed',
+    'job-delayed-ui',
+    'job-atomic',
+    'job-atomic-ui',
+    'job-atomic-policy',
+    'PROC_THREAD_ATTRIBUTE_CHILD_PROCESS_POLICY',
+    'PROC_THREAD_ATTRIBUTE_JOB_LIST',
+    'AssignProcessToJobObject',
+  ]) {
+    assert.match(source, new RegExp(contract.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+  }
+});
+
+test('Job child-control candidate sets active process limit one and never enables breakaway', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/child-control-stage.cpp', import.meta.url)), 'utf8');
+  assert.match(source, /JOB_OBJECT_LIMIT_ACTIVE_PROCESS/);
+  assert.match(source, /ActiveProcessLimit = 1/);
+  assert.match(source, /job_breakaway_enabled\\\":false/);
+  assert.doesNotMatch(source, /JOB_OBJECT_LIMIT_BREAKAWAY_OK/);
+  assert.doesNotMatch(source, /JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK/);
+});
+
+test('child-control hostile probe tests normal creation and explicit Job breakaway execution', async () => {
+  const source = await readFile(fileURLToPath(new URL('../native/child-control-probe.cpp', import.meta.url)), 'utf8');
+  assert.match(source, /RunChild\(childPath, 0\)/);
+  assert.match(source, /CREATE_BREAKAWAY_FROM_JOB/);
+  assert.match(source, /child_exit_code == 66u/);
+  assert.match(source, /normalDenied && breakawayDenied/);
+});
+
+test('child-control diagnostic has no automatic fallback and prefers atomic Job only after observed denial', async () => {
+  const source = await readFile(fileURLToPath(new URL('../src/containment-child-control.mjs', import.meta.url)), 'utf8');
+  assert.match(source, /child-policy-alone-bootstrap-boundary/);
+  assert.match(source, /child-policy-suspended-interaction/);
+  assert.match(source, /atomic-job-active1-direct-and-breakaway-denied/);
+  assert.match(source, /deniesBoth\(results\['job-atomic'\]\)/);
+  assert.doesNotMatch(source, /automatic fallback/i);
+});
+
+test('native build produces child-control launcher and hostile probe with MSVC', async () => {
+  const source = await readFile(fileURLToPath(new URL('../scripts/build-containment.ps1', import.meta.url)), 'utf8');
+  assert.match(source, /child-control-stage\.cpp/);
+  assert.match(source, /child-control-probe\.cpp/);
+  assert.match(source, /Invoke-MsvcStage -Name 'child-control-launcher'/);
+  assert.match(source, /Invoke-MsvcStage -Name 'child-control-probe'/);
+  assert.match(source, /child_control_launcher_sha256/);
+  assert.match(source, /child_control_probe_sha256/);
+});
+
+test('package exposes explicit child-control diagnostic gate', async () => {
+  const packageJson = JSON.parse(await readFile(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
+  assert.equal(packageJson.scripts['containment:child-control'], 'node src/containment-child-control.mjs');
+});
+
+
+test('full containment probe verifies normal and explicit breakaway child payload denial', async () => {
+  const source = await readFile(probeSource, 'utf8');
+  assert.match(source, /--child-sentinel/);
+  assert.match(source, /RunChildSentinel\(0\)/);
+  assert.match(source, /CREATE_BREAKAWAY_FROM_JOB/);
+  assert.match(source, /exit_code == 66u/);
+  assert.match(source, /normal_child_execution_denied/);
+  assert.match(source, /breakaway_child_execution_denied/);
+});
+
+test('package default containment smoke targets the observed regular AppContainer baseline', async () => {
+  const packageJson = JSON.parse(await readFile(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
+  assert.equal(packageJson.scripts['containment:smoke'], 'node src/containment-smoke.mjs appcontainer');
+});

package/test/controller-r21.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller = process.env.DEADBYTE_CONTROLLER_UNDER_TEST
+  || fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+
+test('R21 binds local readiness to the verified Bridge listener PID', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /function Get-LocalReadyListenerOwners/);
+  assert.match(source, /Get-NetTCPConnection/);
+  assert.match(source, /OwningProcess/);
+  assert.match(source, /\[int\]\$_\.LocalPort -eq \[int\]\$uri\.Port/);
+  assert.doesNotMatch(source, /Get-NetTCPConnection -State Listen -LocalPort/);
+  assert.match(source, /function Test-LocalReadyOwned/);
+  assert.match(source, /Test-LocalReadyOwned \$Cfg \$bridge/);
+  assert.match(source, /Assert-LocalReadyPortAvailable/);
+});
+
+test('R21 handles empty cloud logs and waits for tunnel origin metadata', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /function Read-TextFileSafe/);
+  assert.match(source, /Read-TextFileSafe \$file/);
+  assert.match(source, /function Wait-CurrentUrl/);
+  assert.match(source, /Wait-CurrentUrl \$Cfg/);
+  assert.doesNotMatch(source, /Start-Sleep -Milliseconds 350/);
+});

package/test/controller-r211.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller = process.env.DEADBYTE_CONTROLLER_UNDER_TEST
+  || fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+
+test('R21.1 binds controller execution to CoreRoot controller directory', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /function Assert-ControllerRootBound/);
+  assert.match(source, /Join-Path \(\[string\]\$Cfg\.CoreRoot\) 'controller'/);
+  assert.match(source, /System\.StringComparison\]::OrdinalIgnoreCase/);
+  const calls = source.match(/Assert-ControllerRootBound \$cfg/g) || [];
+  assert.equal(calls.length, 2);
+});
+
+test('R21.1 validates controller root before creating command runtime directories', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /function Run-Command[\s\S]*?\$cfg = Get-Config\s+Assert-ControllerRootBound \$cfg\s+Ensure-Directory \$RuntimeDir/);
+});

package/test/controller-r212.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller = process.env.DEADBYTE_CONTROLLER_UNDER_TEST
+  || fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+
+async function source() { return readFile(controller, 'utf8'); }
+
+test('R21.2 observes higher-integrity images through limited process query', async () => {
+  const s = await source();
+  assert.match(s, /function Get-LimitedProcessImagePath/);
+  assert.match(s, /PROCESS_QUERY_LIMITED_INFORMATION/);
+  assert.match(s, /QueryFullProcessImageName/);
+  assert.match(s, /Get-LimitedProcessImagePath \$ProcessId/);
+});
+
+test('R21.2 tries limited image query before MainModule fallback', async () => {
+  const s = await source();
+  const limited = s.indexOf('Get-LimitedProcessImagePath $ProcessId');
+  const mainModule = s.indexOf('$p.MainModule.FileName');
+  assert.ok(limited >= 0 && mainModule >= 0 && limited < mainModule);
+});
+
+test('R21.2 distinguishes existing but unobservable processes and fails closed', async () => {
+  const s = await source();
+  assert.match(s, /Reason='process-unobservable'/);
+  assert.match(s, /'process-unobservable','pid-reused'/);
+  assert.doesNotMatch(s, /Reason='process-unobservable'[\s\S]{0,300}Remove-Item -LiteralPath \(Ledger-Path/);
+});

package/test/controller-r24-dns.test.mjs

@@ -0,0 +1,14 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+const controller = fileURLToPath(new URL('../controller/deadbyte-controller.ps1', import.meta.url));
+
+test('R24 public gates require bounded stable DNS readiness before side effects', async () => {
+  const source = await readFile(controller, 'utf8');
+  assert.match(source, /function Wait-PublicDnsReady/);
+  assert.match(source, /System\.Net\.Dns.*GetHostAddresses/);
+  assert.match(source, /consecutive.*3/i);
+  assert.match(source, /Wait-PublicDnsReady \$Cfg \$url/);
+  assert.doesNotMatch(source, /retry.*autonomous_goal_run/i);
+});