flowproof 0.12.1__tar.gz → 0.12.2__tar.gz

{flowproof-0.12.1 → flowproof-0.12.2}/Cargo.lock

@@ -760,7 +760,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.12.1"
+version = "0.12.2"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -779,7 +779,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.12.1"
+version = "0.12.2"
 dependencies = [
  "chrono",
  "flowproof-driver",
@@ -796,7 +796,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.12.1"
+version = "0.12.2"
 dependencies = [
  "ab_glyph",
  "chrono",
@@ -817,7 +817,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-driver"
-version = "0.12.1"
+version = "0.12.2"
 dependencies = [
  "image",
  "postgres",
@@ -831,7 +831,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.12.1"
+version = "0.12.2"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -843,7 +843,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.12.1"
+version = "0.12.2"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -857,7 +857,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.12.1"
+version = "0.12.2"
 dependencies = [
  "jsonschema",
  "regex",

{flowproof-0.12.1 → flowproof-0.12.2}/Cargo.toml

@@ -22,7 +22,7 @@ members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproo
 exclude = ["spike/windows-containment"]
 
 [workspace.package]
-version = "0.12.1"
+version = "0.12.2"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"

{flowproof-0.12.1 → flowproof-0.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.12.1
+Version: 0.12.2
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3

{flowproof-0.12.1 → flowproof-0.12.2}/crates/flowproof-adapters/src/egress_windows/env_block.rs

@@ -198,11 +198,26 @@ mod tests {
         let mut overrides = BTreeMap::new();
         overrides.insert("ZZ_FLOWPROOF_SORT".to_string(), "z".into());
         overrides.insert("AA_FLOWPROOF_SORT".to_string(), "a".into());
+        // Windows runner images carry this same prefix shape as
+        // COMMONPROGRAMFILES and COMMONPROGRAMFILES(X86). Comparing whole
+        // NAME=VALUE entries would put '(' before '=' and falsely call the
+        // correctly name-sorted block unsorted.
+        overrides.insert("MM_FLOWPROOF_SORT".to_string(), "plain".into());
+        overrides.insert("MM_FLOWPROOF_SORT(X86)".to_string(), "qualified".into());
 
         let entries = parse(&environment_block(&overrides, &[]));
-        let upper: Vec<String> = entries.iter().map(|e| e.to_uppercase()).collect();
+        let upper: Vec<String> = entries
+            .iter()
+            .map(|entry| {
+                entry
+                    .split_once('=')
+                    .expect("an environment entry has a name and value")
+                    .0
+                    .to_uppercase()
+            })
+            .collect();
         let mut sorted = upper.clone();
         sorted.sort();
-        assert_eq!(upper, sorted, "the block must be sorted");
+        assert_eq!(upper, sorted, "the block must be sorted by name");
     }
 }

{flowproof-0.12.1 → flowproof-0.12.2}/crates/flowproof-adapters/src/web.rs

@@ -15,6 +15,7 @@ use flowproof_driver::{
 use headless_chrome::browser::tab::{ModifierKey, Tab};
 use headless_chrome::protocol::cdp::Target::CreateTarget;
 use headless_chrome::protocol::cdp::{Emulation, Input, Network, Page};
+use headless_chrome::types::Bounds;
 use headless_chrome::{Browser, LaunchOptions};
 
 use crate::AdapterError;
@@ -526,6 +527,16 @@ fn headed_requested() -> bool {
     std::env::var_os("FLOWPROOF_HEADED").is_some()
 }
 
+/// Headed runs are deliberately private. A shared browser isolates each flow
+/// in an incognito context, which Chromium presents as a second window. When
+/// the flow tab closes, the original window (including the keep-alive tab)
+/// becomes visible again and looks like a leaked browser. A visible run is for
+/// a person to watch, so cold-start reuse is worth less than owning one window
+/// whose lifetime exactly matches the flow.
+fn should_share_browser(headed: bool, no_shared: bool) -> bool {
+    !headed && !no_shared
+}
+
 /// Build the launch options, split out from [`launch_browser`] so the headless
 /// decision is testable without starting a browser.
 fn launch_options_for(
@@ -813,9 +824,14 @@ impl WebAppDriver {
     }
 
     /// A driver on the shared browser (isolated context per flow), or a
-    /// private browser when `FLOWPROOF_NO_SHARED_BROWSER=1`.
+    /// private browser when `FLOWPROOF_NO_SHARED_BROWSER=1` or the browser is
+    /// headed. Headed ownership prevents the keep-alive window from surviving
+    /// after the visible flow window closes.
     pub fn new() -> Result<Self, AdapterError> {
-        if std::env::var_os("FLOWPROOF_NO_SHARED_BROWSER").is_some() {
+        if !should_share_browser(
+            headed_requested(),
+            std::env::var_os("FLOWPROOF_NO_SHARED_BROWSER").is_some(),
+        ) {
             return Ok(Self {
                 browser: launch_browser(&[])?,
                 context_id: None,
@@ -1427,9 +1443,9 @@ fn xpath_literal(text: &str) -> String {
 
 impl Drop for WebAppDriver {
     fn drop(&mut self) {
-        // The shared browser outlives this driver: close the tab so pages
-        // don't accumulate across a suite. A private browser (opt-out) is
-        // torn down with its own process, so nothing to do there.
+        // The shared browser outlives this driver: close the flow tab so pages
+        // don't accumulate across a suite. A private browser (opt-out or
+        // headed) is torn down with its process.
         if self.context_id.is_some() {
             if let Some(tab) = self.tab.take() {
                 let _ = tab.close(false);
@@ -1633,6 +1649,16 @@ impl AppDriver for WebAppDriver {
             None => self.browser.new_tab(),
         }
         .map_err(|e| web_err("opening tab", e))?;
+        // A visible flow is the only Chrome window the user should have to
+        // manage. Chromium's default launch bounds can be a narrow utility
+        // window (and an incognito context used to create another one), so
+        // present the privately-owned headed window at the desktop's normal
+        // maximized size. Device emulation below still pins the page viewport
+        // when the spec requests one.
+        if headed_requested() {
+            tab.set_bounds(Bounds::Maximized)
+                .map_err(|e| web_err("maximizing headed browser window", e))?;
+        }
         // Viewport/UA emulation BEFORE navigation, so the app boots into
         // the emulated device (responsive breakpoints, UA sniffing). NOT
         // best-effort: a flow recorded mobile must never run desktop.
@@ -3134,16 +3160,85 @@ impl AppDriver for WebAppDriver {
                 }
                 return 'body > ' + parts.join(' > ');
               }
+              function compoundCss(el) {
+                const classes = Array.from(el.classList);
+                if (!classes.length) return null;
+                return el.tagName.toLowerCase() + classes.map(cls => '.' + CSS.escape(cls)).join('');
+              }
+              function relativeCss(el, container) {
+                const semantic = semanticCss(el);
+                if (semantic && container.querySelectorAll(semantic).length === 1) return semantic;
+                const compound = compoundCss(el);
+                if (!compound) return null;
+                if (container.querySelectorAll(compound).length === 1) return compound;
+
+                // A value cell often shares its base classes with the label
+                // beside it, while the label has one extra presentation class
+                // (`bg-info`, for example). Excluding that distinguishing
+                // class gives the scoped target a stable, non-positional inner
+                // selector without smuggling visible text into CSS.
+                const extras = new Set();
+                for (const other of container.querySelectorAll(compound)) {
+                  if (other === el) continue;
+                  for (const cls of other.classList) {
+                    if (!el.classList.contains(cls)) extras.add(cls);
+                  }
+                }
+                for (const extra of extras) {
+                  const candidate = compound + ':not(.' + CSS.escape(extra) + ')';
+                  if (container.querySelectorAll(candidate).length === 1) return candidate;
+                }
+                return null;
+              }
+              function scopedReadable(el) {
+                const container = el.parentElement;
+                if (!container) return null;
+                const containerCss = semanticCss(container) || compoundCss(container);
+                const innerCss = relativeCss(el, container);
+                if (!containerCss || !innerCss) return null;
+
+                // Use a neighbouring leaf as the row/card identity. Require
+                // that the anchor identifies one matching container on the
+                // current screen; runtime scoped resolution will enforce the
+                // same relationship again on every replay.
+                const siblings = Array.from(container.children);
+                const before = siblings.slice(0, siblings.indexOf(el)).reverse();
+                const after = siblings.slice(siblings.indexOf(el) + 1);
+                for (const anchorEl of before.concat(after)) {
+                  const anchor = (anchorEl.textContent || '').trim();
+                  if (!anchor || anchor.length > 120) continue;
+                  const matching = Array.from(document.querySelectorAll(containerCss)).filter(candidate =>
+                    Array.from(candidate.children).some(child =>
+                      child !== el && (child.textContent || '').trim() === anchor
+                    )
+                  );
+                  if (matching.length !== 1 || matching[0] !== container) continue;
+                  const containerTarget = 'css:' + containerCss;
+                  const innerTarget = 'css:' + innerCss;
+                  return {
+                    token: 'scoped:' + containerTarget + ' containing ' + JSON.stringify(anchor) +
+                      ' > ' + innerTarget,
+                    container: containerTarget,
+                    anchor,
+                    inner: innerTarget,
+                  };
+                }
+                return null;
+              }
               const all = Array.from(document.querySelectorAll('body *'));
+              const styledLeaf = el => el.children.length === 0 &&
+                ['DIV', 'SPAN'].includes(el.tagName) &&
+                /(?:background|color)\s*:/i.test(el.getAttribute('style') || '');
               const interactive = el => el.matches(
-                'input, button, a, select, textarea, [role=button], [role=checkbox], [role=radio], [role=menuitem]'
-              );
+                'input, button, a, select, textarea, [role=button], [role=checkbox], [role=radio], [role=menuitem], [draggable], [ondrop], .draggable-row, .droparea'
+              ) || (!!el.id && el.children.length === 0 && ['DIV', 'SPAN'].includes(el.tagName)) ||
+                styledLeaf(el);
               const readableLeaf = el => {
                 if (['SCRIPT', 'STYLE', 'NOSCRIPT'].includes(el.tagName)) return false;
                 const text = (el.textContent || '').trim();
-                return text && semanticCss(el) && !Array.from(el.children).some(child =>
+                return text && !Array.from(el.children).some(child =>
                   (child.textContent || '').trim()
-                );
+                ) && (semanticCss(el) || scopedReadable(el));
               };
               const ordered = all.filter(interactive).concat(
                 all.filter(el => !interactive(el) && readableLeaf(el))
@@ -3152,27 +3247,134 @@ impl AppDriver for WebAppDriver {
               const chosen = ordered.filter(el => {
                 const r = el.getBoundingClientRect();
                 const style = getComputedStyle(el);
+                // Authoring inventories the rendered PAGE, not only the
+                // current viewport. A user naturally says "enter the date"
+                // even when the field starts below the fold, and every web
+                // action already scrolls its target into view before acting.
                 const rendered = style.display !== 'none' && style.visibility !== 'hidden' &&
-                  Number(style.opacity) > 0 && r.width > 0 && r.height > 0 &&
-                  r.bottom > 0 && r.right > 0 && r.top < innerHeight && r.left < innerWidth;
+                  Number(style.opacity) > 0 && r.width > 0 && r.height > 0;
                 if (!rendered || seen.has(el)) return false;
                 seen.add(el);
                 return true;
               }).slice(0, 100);
-              return JSON.stringify(chosen.map(el => {
+              const entries = chosen.map(el => {
                 const css = cssPath(el);
+                const scoped = !interactive(el) && !semanticCss(el) ? scopedReadable(el) : null;
                 const label = el.labels && el.labels[0] ? el.labels[0].textContent.trim()
                     : (el.getAttribute('aria-label') || el.getAttribute('placeholder') || '');
-                return {
-                    target: 'css:' + css,
+                const entry = {
+                    target: scoped ? scoped.token : 'css:' + css,
                     css,
                     tag: el.tagName.toLowerCase(),
                     actionable: interactive(el),
                     type: el.getAttribute('type') || undefined,
                     text: (el.textContent || '').trim().slice(0, 80) || undefined,
                     label: label || undefined,
+                    background_color: styledLeaf(el) ? getComputedStyle(el).backgroundColor : undefined,
+                };
+                if (scoped) entry.scope = {
+                  container: scoped.container,
+                  anchor: scoped.anchor,
+                  inner: scoped.inner,
                 };
-              }));
+                return entry;
+              });
+
+              // A human can ask for the number of displayed rows or the
+              // final cell without naming one current row. Represent those
+              // collection identities directly so the model can ground the
+              // intent without inventing a selector from today's DOM.
+              for (const table of document.querySelectorAll('table')) {
+                const tableCss = semanticCss(table);
+                if (!tableCss) continue;
+                const rows = Array.from(table.querySelectorAll('tr'));
+                if (rows.length) {
+                  const css = tableCss + ' tr';
+                  entries.push({
+                    target: 'css:' + css,
+                    css,
+                    tag: 'collection',
+                    actionable: false,
+                    count: rows.length,
+                    label: 'rows in ' + tableCss,
+                  });
+                }
+                const lastCell = table.querySelector('tr:last-child td:last-child');
+                if (lastCell) {
+                  const css = tableCss + ' tr:last-child td:last-child';
+                  entries.push({
+                    target: 'css:' + css,
+                    css,
+                    tag: 'td',
+                    actionable: false,
+                    text: (lastCell.textContent || '').trim().slice(0, 80) || undefined,
+                    label: 'last cell in the final row of ' + tableCss,
+                  });
+                }
+              }
+
+              // Same-origin iframe values are a normal part of the live
+              // scene. Their synthetic token is translated to Target::Framed
+              // before tracing, just like a scoped row token; no synthetic
+              // authoring syntax is persisted or shown to the human.
+              for (const frameEl of document.querySelectorAll('iframe, frame')) {
+                const frameRect = frameEl.getBoundingClientRect();
+                const frameStyle = getComputedStyle(frameEl);
+                if (frameStyle.display === 'none' || frameStyle.visibility === 'hidden' ||
+                    Number(frameStyle.opacity) <= 0 || frameRect.width <= 0 || frameRect.height <= 0) {
+                  continue;
+                }
+                const frame = frameEl.getAttribute('title') || frameEl.getAttribute('name') ||
+                  frameEl.id || frameEl.getAttribute('aria-label');
+                if (!frame) continue;
+                let frameDoc;
+                try { frameDoc = frameEl.contentDocument; } catch (_) { continue; }
+                if (!frameDoc || !frameDoc.body) continue;
+                const inner = [frameDoc.body].concat(Array.from(frameDoc.querySelectorAll(
+                  'input, button, select, textarea, a, [role=button], [role=checkbox], [role=radio], [role=menuitem], [id]'
+                )));
+                for (const el of inner) {
+                  const style = frameDoc.defaultView.getComputedStyle(el);
+                  const rect = el.getBoundingClientRect();
+                  if (style.display === 'none' || style.visibility === 'hidden' ||
+                      Number(style.opacity) <= 0 || rect.width <= 0 || rect.height <= 0) {
+                    continue;
+                  }
+                  let css = el === frameDoc.body ? 'body' : null;
+                  if (!css && el.id) css = '#' + CSS.escape(el.id);
+                  if (!css) {
+                    for (const attr of ['data-testid', 'data-test', 'data-qa', 'aria-label', 'name']) {
+                      const value = el.getAttribute(attr);
+                      if (!value) continue;
+                      const candidate = el.tagName.toLowerCase() + '[' + attr + '="' +
+                        CSS.escape(value) + '"]';
+                      if (frameDoc.querySelectorAll(candidate).length === 1) {
+                        css = candidate;
+                        break;
+                      }
+                    }
+                  }
+                  if (!css) continue;
+                  const innerTarget = 'css:' + css;
+                  const token = 'framed:' + JSON.stringify(frame) + ' > ' + innerTarget;
+                  const actionable = el.matches(
+                    'input, button, select, textarea, a, [role=button], [role=checkbox], [role=radio], [role=menuitem]'
+                  );
+                  const label = el.labels && el.labels[0] ? el.labels[0].textContent.trim()
+                    : (el.getAttribute('aria-label') || el.getAttribute('placeholder') || '');
+                  entries.push({
+                    target: token,
+                    css,
+                    tag: el.tagName.toLowerCase(),
+                    actionable,
+                    text: el === frameDoc.body ? undefined
+                      : (el.value || el.textContent || '').trim().slice(0, 80) || undefined,
+                    label: label || (el === frameDoc.body ? 'scroll surface' : undefined),
+                    scope: { frame, inner: innerTarget },
+                  });
+                }
+              }
+              return JSON.stringify(entries);
             })()
         "#;
         let value = self
@@ -3226,6 +3428,17 @@ mod tests {
         assert!(!headed.headless, "FLOWPROOF_HEADED must show the window");
     }
 
+    /// A visible shared browser leaks its keep-alive window into the user's
+    /// desktop after the flow tab closes. Headless suites retain reuse; either
+    /// explicit opt-out or headed mode must select one privately-owned process.
+    #[test]
+    fn headed_runs_never_use_the_shared_keep_alive_browser() {
+        assert!(super::should_share_browser(false, false));
+        assert!(!super::should_share_browser(true, false));
+        assert!(!super::should_share_browser(false, true));
+        assert!(!super::should_share_browser(true, true));
+    }
+
     /// The headed launch failure must name the display, and must not invent one
     /// when headless fails for an unrelated reason.
     ///

{flowproof-0.12.1 → flowproof-0.12.2}/crates/flowproof-adapters/tests/windows_containment_e2e.rs

@@ -40,7 +40,7 @@
 #![cfg(all(windows, any(feature = "agent", feature = "sap-com")))]
 
 use std::io::Read;
-use std::net::TcpListener;
+use std::net::{IpAddr, Ipv4Addr, TcpListener, UdpSocket};
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::Arc;
 use std::time::Duration;
@@ -59,20 +59,20 @@ const RUN_TIMEOUT: Duration = Duration::from_secs(180);
 /// Bound in the TEST process, not the child's - that is what makes it an
 /// independent witness rather than a restatement of the child's own opinion.
 struct Oracle {
+    host: Ipv4Addr,
     port: u16,
     seen: Arc<AtomicUsize>,
 }
 
 impl Oracle {
-    /// Bind on loopback and accept in the background until dropped.
+    /// Bind on the runner's primary NIC and accept in the background.
     ///
-    /// Loopback is a deliberate choice and was checked on a real runner: the
-    /// spike found WFP's ALE layer classifies and drops loopback connects,
-    /// with `loopback=true` on the drop record. Had it not, an agent could
-    /// reach a local service the flow never declared, which would be a hole
-    /// rather than a convenience.
-    fn bind() -> std::io::Result<Self> {
-        let listener = TcpListener::bind("127.0.0.1:0")?;
+    /// Flowproof deliberately permits 127.0.0.0/8 so a replay can reach its
+    /// local model proxy. Using that address here would test the exception,
+    /// not the default-deny policy. The primary NIC still stays entirely on
+    /// this host while traversing ALE_AUTH_CONNECT like ordinary traffic.
+    fn bind(host: Ipv4Addr) -> std::io::Result<Self> {
+        let listener = TcpListener::bind((host, 0))?;
         let port = listener.local_addr()?.port();
         let seen = Arc::new(AtomicUsize::new(0));
         let counter = seen.clone();
@@ -87,7 +87,7 @@ impl Oracle {
                 counter.fetch_add(1, Ordering::SeqCst);
             }
         });
-        Ok(Self { port, seen })
+        Ok(Self { host, port, seen })
     }
 
     fn sightings(&self) -> usize {
@@ -96,12 +96,40 @@ impl Oracle {
 
     fn allow_entry(&self) -> AllowEntry {
         AllowEntry {
-            host: HostMatch::Ip("127.0.0.1".parse().expect("static addr")),
+            host: HostMatch::Ip(IpAddr::V4(self.host)),
             port: Some(self.port),
         }
     }
 }
 
+/// The address selected by the routing table without sending a packet.
+fn primary_ipv4() -> Option<Ipv4Addr> {
+    UdpSocket::bind("0.0.0.0:0")
+        .and_then(|socket| {
+            socket.connect("192.0.2.1:9")?;
+            socket.local_addr()
+        })
+        .ok()
+        .and_then(|addr| match addr.ip() {
+            IpAddr::V4(ip) if !ip.is_loopback() && !ip.is_unspecified() => Some(ip),
+            _ => None,
+        })
+}
+
+/// A machine with no non-loopback route cannot exercise the policy honestly.
+fn test_host() -> Option<Ipv4Addr> {
+    let host = primary_ipv4();
+    if host.is_some() {
+        return host;
+    }
+    assert!(
+        std::env::var_os("CI").is_none(),
+        "CI must expose a non-loopback IPv4 address for the containment oracle"
+    );
+    eprintln!("SKIP windows containment E2E: no non-loopback IPv4 address");
+    None
+}
+
 /// The probe the contained child runs: connect to each port, write a byte,
 /// and say what happened.
 ///
@@ -114,7 +142,7 @@ impl Oracle {
 /// Only the outer quotes are double quotes. The command line crosses
 /// `CreateProcessW` as ONE string, and nesting doubles inside it is how this
 /// kind of probe usually breaks.
-fn probe_command(ports: &[u16]) -> String {
+fn probe_command(host: Ipv4Addr, ports: &[u16]) -> String {
     let list = ports
         .iter()
         .map(|p| p.to_string())
@@ -123,7 +151,8 @@ fn probe_command(ports: &[u16]) -> String {
     format!(
         "powershell.exe -NoProfile -NonInteractive -Command \
          \"foreach($p in @({list})){{try{{$c=New-Object Net.Sockets.TcpClient;\
-         $c.Connect('127.0.0.1',$p);$s=$c.GetStream();\
+         $t=$c.ConnectAsync('{host}',$p);\
+         if(-not $t.Wait(10000)){{throw 'connect timeout'}};$s=$c.GetStream();\
          $s.Write([Text.Encoding]::ASCII.GetBytes('fp'),0,2);$s.Flush();$c.Close();\
          Write-Output ('PROBE|'+$p+'|CONNECTED')}}catch{{\
          Write-Output ('PROBE|'+$p+'|REFUSED')}}}}\""
@@ -140,7 +169,7 @@ struct Observed {
 /// Run the probe against both oracles, declaring `allow`.
 fn probe_run(declared: &Oracle, undeclared: &Oracle, allow: &[AllowEntry]) -> Observed {
     let outcome = run::run_contained(
-        &probe_command(&[declared.port, undeclared.port]),
+        &probe_command(declared.host, &[declared.port, undeclared.port]),
         &Default::default(),
         &[],
         allow,
@@ -157,6 +186,27 @@ fn probe_run(declared: &Oracle, undeclared: &Oracle, allow: &[AllowEntry]) -> Ob
     }
 }
 
+/// Output capture and the privileged launcher are not witnesses in this test:
+/// the two destination oracles and the WFP audit lane are. GitHub's hosted
+/// Windows runner currently takes the documented CreateProcessWithLogonW
+/// fallback, so accept only those launcher diagnostics while continuing to
+/// reject every audit or collection fault.
+fn assert_evidence_lane_intact(o: &Observed, ev: &str) {
+    let unexpected = o
+        .outcome
+        .faults
+        .iter()
+        .filter(|fault| {
+            !fault.starts_with("the agent was started through CreateProcessWithLogonW")
+                && !fault.starts_with("launch privileges were not all enabled")
+        })
+        .collect::<Vec<_>>();
+    assert!(
+        unexpected.is_empty(),
+        "the containment evidence lane reported faults: {unexpected:?}. {ev}"
+    );
+}
+
 /// Everything a failure needs, in one block, because reproducing this locally
 /// is not an option for most people who will read it.
 fn evidence(label: &str, o: &Observed) -> String {
@@ -204,14 +254,29 @@ fn host_can_enforce() -> bool {
     false
 }
 
-/// The claim, with all three witnesses agreeing.
+/// Prove the positive control first, then invert exactly one declaration.
+///
+/// These phases mutate process-global Windows state (net-event collection and
+/// the interactive desktop ACL), and the positive control also establishes
+/// that this runner's primary-NIC route works before a refusal is treated as
+/// containment evidence. Keeping both phases in one test makes their order
+/// explicit instead of leaving it to Rust's parallel test scheduler.
 #[test]
-fn an_undeclared_destination_is_refused_and_a_declared_one_is_not() {
+fn declared_and_undeclared_destinations_invert_with_the_policy() {
     if !host_can_enforce() {
         return;
     }
-    let declared = Oracle::bind().expect("bind the declared oracle");
-    let undeclared = Oracle::bind().expect("bind the undeclared oracle");
+    let Some(host) = test_host() else {
+        return;
+    };
+    assert_both_declared_destinations_connect(host);
+    assert_undeclared_destination_is_refused(host);
+}
+
+/// The claim, with all three witnesses agreeing.
+fn assert_undeclared_destination_is_refused(host: Ipv4Addr) {
+    let declared = Oracle::bind(host).expect("bind the declared oracle");
+    let undeclared = Oracle::bind(host).expect("bind the undeclared oracle");
 
     let o = probe_run(&declared, &undeclared, &[declared.allow_entry()]);
     let ev = evidence("enforced", &o);
@@ -220,10 +285,7 @@ fn an_undeclared_destination_is_refused_and_a_declared_one_is_not() {
     // anything. A run that never installed its filters and then saw no traffic
     // is not evidence of containment.
     assert!(o.outcome.is_contained(), "the run was not contained. {ev}");
-    assert!(
-        o.outcome.faults.is_empty(),
-        "a fault is the absence of evidence, so nothing below can be certified over it. {ev}"
-    );
+    assert_evidence_lane_intact(&o, &ev);
 
     // Witness 3 first: without it, everything after is consistent with a child
     // that never ran.
@@ -256,18 +318,14 @@ fn an_undeclared_destination_is_refused_and_a_declared_one_is_not() {
 /// The negative control: with the same probe and the undeclared port DECLARED,
 /// the connection must go through.
 ///
-/// This is what makes the test above non-vacuous. If this one ever fails, the
-/// test above stops meaning anything - not because containment broke, but
+/// This is what makes the refusal phase non-vacuous. If this one ever fails,
+/// the refusal stops meaning anything - not because containment broke, but
 /// because the probe stopped reaching the network at all, and a test that
 /// cannot connect when it is allowed to cannot prove anything by failing to
 /// connect when it is not.
-#[test]
-fn the_same_probe_connects_when_the_destination_is_declared() {
-    if !host_can_enforce() {
-        return;
-    }
-    let declared = Oracle::bind().expect("bind the declared oracle");
-    let undeclared = Oracle::bind().expect("bind the second oracle");
+fn assert_both_declared_destinations_connect(host: Ipv4Addr) {
+    let declared = Oracle::bind(host).expect("bind the declared oracle");
+    let undeclared = Oracle::bind(host).expect("bind the second oracle");
 
     let o = probe_run(
         &declared,
@@ -277,6 +335,7 @@ fn the_same_probe_connects_when_the_destination_is_declared() {
     let ev = evidence("negative-control", &o);
 
     assert!(o.outcome.is_contained(), "the run was not contained. {ev}");
+    assert_evidence_lane_intact(&o, &ev);
     assert!(
         o.declared_sightings >= 1 && o.undeclared_sightings >= 1,
         "both destinations were declared, so both must have been reached; a probe that \