privatae-bastion/docs/claims.md

How each claim is tested

The claims are the points of the security model, and some further ones that page does not list.

Each row names a test in client-go/ that fails if the claim it sits under stops being true. Where a claim, or part of one, has no such test, the row says so. Those parts are enforced only by the code as written.

Claim	Test (file: function)	What it asserts
The bastion dials out	config_test.go: TestNextListenAddr	Each pairing's control port is allocated on 127.0.0.1, from 7878 up.
	mirror_test.go: TestMirrorPeerAllowed	The memory-mirror forwarder accepts only loopback and the replica's own subnet; a LAN address, the default container bridge or an unknown subnet is refused.
	claims_static_test.go: TestEveryListenerThisPackageOpensIsInTheTable	Every listener this package opens outside the tunnel is in a table with its number of call sites; the console, the context page, the mirror push bridge and the action-op probe bind loopback, and the mirror forwarder binds its gateway and loopback. The WireGuard device's own UDP socket is opened in the wireguard module, not this package, and is not in the table.
	claims_static_test.go: TestListenAddressesAreOnlyEverAllocatedOnLoopback	The control and git port addresses are set only by the loopback allocators, or kept from the pairing being replaced.
Inside the tunnel, only gated listeners	anchor_test.go: TestInferenceLaneIsCapsGated	A pairing without the inference family has its forward connections closed and the forwards left out of its heartbeat; granting the family opens them without a restart.
	service_reach_test.go: TestReachGrantSyncAndTheForwardWall	Installing a reach grant is refused without an approval, for another host, or for another machine. serviceReachAllowed, the reach check a slot port runs, then admits the granted host to the granted server only; another server, another host or a revoked grant is refused. The check is called directly, not through the slot listener.
	claims_unix_test.go: TestEachInferenceForwardAdmitsOnlyThePairingThatHoldsInference	Through each forward's accept loop on an in-memory tunnel: a pairing without inference never reaches the upstream, and granting the family lets the next connection through, with no restart.
	claims_unix_test.go: TestTheServiceSlotAdmitsOnlyWithTheFamilyAndAReachGrant	Through the slot listener: a connection is refused with a reach grant but no services family, and with the family but no reach grant for that server; with both it reaches the server's socket.
	claims_static_test.go: TestOnlyTheGatedForwardsListenInsideTheTunnel	Every listener on the tunnel's network stack is one of the five gated forwards (three inference forwards, the service slot and coder runs), each at one call site; only they are handed the stack, and it is otherwise only dialled out of.
	not covered by a test	The reach check's own comparison of a stored grant's machine (service_reach.go, serviceReachAllowed).
Scoped tunnel	claims_tunnel_test.go: TestTheTunnelReachesOnlyThePairedHost	A WireGuard device configured the way a pairing configures it holds one peer, whose only allowed address is the host's /128, before and after an endpoint rotation.
	claims_tunnel_test.go: TestATunnelAddressThatIsNotOneHostIsRefused	A tunnel address that is a prefix, empty, zoned, unspecified, multicast or not an address is refused at tunnel start and at a rotation, and the device is left with no peer.
	claims_static_test.go: TestARotationReachesTheDeviceOnlyThroughSwapPeer	A rotation, a failover and a probe change the live peer through swapPeer, the function the two tests above drive: the variables they call it through are declared with it and never assigned or addressed outside tests.
	claims_unix_test.go: TestAPairingResponseWithAWideTunnelAddressSavesNothing	A pairing response that offers a prefix is refused and leaves no file in the config dir; one that offers a single address pairs.
	claims_unix_test.go: TestRunPairingRefusesAWideTunnelAddress	A pairing file that holds a prefix brings no tunnel up.
	fuzz_tunnel_test.go: FuzzATunnelAddressIsOneHostOrRefused	Whatever the input, the tunnel address check refuses it or returns exactly the one address it was given.
A Host on this machine gets the same walls	local_host_linux_test.go: TestAUnixRedeemURLCannotPointAtATCPAddress	Every network spelling of a redeem URL (a host and port, localhost, user info, another scheme, a relative, unclean or query-carrying path) is refused before the token is read; a TCP listener at the named address gets no connection and no file is written.
	local_host_linux_test.go: TestAUnixPairingPinsTheHostsCA	A --replace whose answer brings another CA is refused and changes nothing; an operator certificate the CA did not sign, a lane socket or runs directory outside the shared directory, or an answer that is not transport unix saves nothing; a platform --replace of the pairing is refused before the platform is called.
	local_host_linux_test.go: TestTheUnixLaneRefusesAPeerWithoutThePinnedCA	A lane server whose certificate another CA signed, or that names another host, is dialled and receives no request.
	local_host_linux_test.go: TestTheUnixLaneCarriesTheBearerAndTheSameProtocol	A pairing with no bearer does not start and dials nothing. With one, the heartbeat and the first frame of every worker carry it; the pools are the tunnel's (two parked harness workers), plus two parked serve workers, and a parked worker serves a harness job over the socket.
	local_host_linux_test.go: TestTheCoderGrantRuleAppliesToAUnixPairing	On an anchored machine a run-up over the unix lane without the standing coder grant is refused at the gate; with the approved grant it passes.
	local_host_linux_test.go: TestARunSocketIsTheOwningPairingsOnly	The owner's run is a 0660 socket in the owner's runs directory, given to the privatae-host group, and reaches the run's control socket; another pairing's directory never gets it, another pairing cannot open it, and once the run is not the pairing's a connection gets nothing and the socket goes.
	local_host_linux_test.go: TestARunSocketGoesAtRunDownAndAtTheWatchdogsStop	The socket is removed at run-down and at the watchdog's stop and does not come back; with no privatae-host group it is root's and the reason is logged.
	local_host_linux_test.go: TestARunsDirectoryTheHostCanChangeGetsNoSocket	A runs directory the Host owns, a group-writable one, one under a directory the Host owns, or one in a shared directory that is not sticky gets no socket, and a link swapped in for the socket between bind and chmod changes nothing; the design's layout (1770 shared directory, runs/ made by the bastion) gets its socket.
	local_host_linux_test.go: TestARunSocketOpensOnlyForALiveRunOfThePairing	No socket is made for a run with no record, another pairing's run or a run the watchdog stopped; another pairing reusing the run_id gets its own.
	local_host_linux_test.go: TestAUnixPairingsRunStillCannotReachThisMachine	A run a unix pairing owns gets 403 from its egress proxy for loopback, this machine's public address and a name for it.
	local_host_linux_test.go: TestTheOwnersImagePrefix	Run-up takes only <prefix>harness-<engine>@sha256:<digest> under the owner's prefix, and pull credentials only for its registry.
	local_host_linux_test.go: TestALocalImageRunsByItsIDWithoutAPull	A local image runs by its ID with no pull only when the image with that ID carries a tag of the named repository.
A Host with no platform reaches your model servers by name, never by address	servelane_netns_linux_test.go: TestTheServeLaneSendsNoPacketForAnAddressInARealNamespace	In a private network namespace, with a second namespace at 10.0.0.2 on this machine's LAN (its default route) and every service set to it: an address sent as the service, a name the lane does not carry, and ollama, llm and pii each answer E with the reason, the beat lists nothing served, and the other computer sees no packet addressed to it, no SYN and no connection, from the lane, the beat, the beat's model-management probe or model:list (which is refused with the reason); a direct dial afterwards is seen. Skipped where a namespace cannot be made.
	servelane_linux_test.go: TestTheServeLaneTakesAServiceNameNeverAnAddress	Over a tcp pairing: an address, a URL or an unknown name sent as the service, a first frame that is not S or is text, an S frame past 1024 bytes, ollama and pii set to addresses that are not this machine, and llm with nothing set each answer E with the reason and nothing after it; a listener at the address named gets no connection.
	servelane_linux_test.go: TestServeVetTargetChecksEveryAddressItWouldDial	A target is dialled at the addresses checked, every one, in the resolver's order: loopback in both families, 0.0.0.0 and :: as loopback, a name whose every answer is loopback (both of localhost's, and ::1 first where the resolver puts it first), and each of this machine's own interface addresses pass; a name with one answer elsewhere, a name that does not resolve, a TEST-NET address, a target with no port or a port out of range are refused.
	servelane_dial_linux_test.go: TestTheServeLaneDialsEachCheckedAddressInTurn	With OLLAMA_ADDR=localhost:<port>, a resolver that answers ::1 first and a stand-in listening on 127.0.0.1 only (nothing on [::1]): a job on the lane is answered by the stand-in, the beat lists ollama in lane_serves, model management is handed 127.0.0.1 and model:list lists the stand-in's models.
	servelane_dial_linux_test.go: TestServePickTakesTheFirstCheckedAddressThatAnswers	Of the addresses checked, the one given to an HTTP client is the first that accepts a connection, the first checked when none does, and a lone address as it is; never one it was not given.
	servelane_linux_test.go: TestTheServeLaneStreamsAChatOverATCPPairing	Over a tcp pairing, a chat to a stand-in OpenAI-compatible server streams: the Host reads chunk 1 before the server writes chunk 3, passed through for llm and through the filter for ollama with models off.
	servelane_linux_test.go: TestTheServeLaneKeepsTheForwardsWalls	With inference off at the machine, a job is refused before ollama sees anything. With models off, and on an anchored machine to its anchor, /api/pull and /api/delete answer 403 and never reach ollama. A member scoped to one model is refused another with 403, which never reaches the server, and is served its own.
	servelane_linux_test.go: TestTheServeLaneHoldsSixteenStreamsAndRefusesTheSeventeenth	Sixteen streams are held open at once; the 17th answers E busy with the reason and never reaches the server; once one ends, the next is accepted.
	servelane_linux_test.go: TestTheServeLaneClosesAStreamIdleForTheBound	With the bound shortened, a server that answers headers and then nothing has its stream closed at the bound, both ends, passed through and through the filter; a stream sending a chunk every 100 ms for four times the bound arrives whole.
	servelane_linux_test.go: TestATCPPairingsBeatAdvertisesOnlyWhatItServes	A tcp pairing's beat with ollama answering, llm unset and pii set to another computer carries lane_serves ["ollama"], embed and its models, llm_port 0, and no llm-openai, pii, pii_port, pii_ok, service slots or coder runs, though the machine could hold both; with all three served it lists and advertises all three, with pii_ok and no pii_port. A unix pairing's beat lists its lane and keeps coder runs; a tunnel pairing's has no lane_serves and keeps pii_port.
	servelane_linux_test.go: TestTheServeLaneAuditsEachJob	A served job writes one audit line with the service, the address dialled and the bytes each way; a refused one writes its reason.
	servelane_models_linux_test.go: TestModelManagementOnALocalPairingReachesOnlyThisMachine	Over a tcp pairing with OLLAMA_ADDR on another computer: the beat offers no model management; model:list, an approved model:pull and model:drop of a model this Host placed are each refused with the reason, at once, with no download job and the ledger unchanged; the bastion prints once in its output which address is not used and what to set. With OLLAMA_ADDR on this machine the same pairing lists its models.
	servelane_models_linux_test.go: TestTheConsoleSaysARefusedTargetOnceUnderConcurrentCallers	Thirty-two callers refusing the same target at once print one line in the bastion's output, and a changed reason prints one more.
	servelane_models_linux_test.go: TestModelDaemonTargetKeepsATunnelPairingsAddress	A tunnel pairing's model management keeps OLLAMA_ADDR wherever it points; the same name running as a local pairing is refused it, and is not counted local once its run ends.
	servelane_models_linux_test.go: TestARefusingHostCannotSpinTheServeWorkers	A Host that answers every parked serve worker with a refused or malformed job gets at most about two workers a second, not a dial loop.
	not covered by a test	A unix pairing's serve jobs end to end: its pool is counted (TestTheUnixLaneCarriesTheBearerAndTheSameProtocol) and its beat read, and the jobs run the same code as a tcp pairing's.
No MCP endpoint	claims_static_test.go: TestNoRouteOpOrDependencySpeaksMCP	Every HTTP route on every listener is in a fixed table and none names MCP; no management op, import or module names MCP; no string in the code is a URL or route with an /mcp path, or names JSON-RPC. The agent clients' tool-server config files are named only in mcpconfig.go, which reads them, and nothing in the config reader imports or can reach a dialler, an HTTP client, a websocket or a process start.
	claims_static_test.go: TestMCPReaderCheckCatchesADialAndAStrayBasename	The check above reports a config reader that starts a process, imports net/http or reaches a dialler through another function, a Windows reader that starts a process, opens a socket, loads a DLL by name or opens a remote registry, and a second file that names a client's config file, the servers key, an /mcp URL or an /mcp route.
Grants are verified here	anchor_test.go: TestPairingGrantSyncWalls	A pairing grant signed by another key, for another machine, naming another anchor, or expired is refused, and the pairing stays pending.
	fuzz_grants_test.go: FuzzAChangedSignedByteNeverVerifies	For each of nine kinds of signed record (pairing grant, pairing revoke, anchor consent, management grant, store grant, move plan, reach grant, op run and op grant), changing any byte of the record or its signature makes it fail to verify.
	session_test.go: TestSessionPinsTheHostKeyWithoutAStoreGrant	The first key offered is pinned; a different key later is refused and the pin is kept.
	anchor_test.go: TestAnchorVerifyKeyPinsFromDCNAndRefusesRepin	The anchor's verify key cannot be re-pinned to a different key.
	session_test.go: TestSessionRefusedWithoutGrantIs126	An op the grant both allows and denies, or a grant that denies *, is refused.
	localdeny_test.go: TestTheLocalSwitchCanOnlyEverRemoveReach	Switching a capability off on this machine never turns a refusal into an allow.
Fixed argv	observe_ops_test.go: TestObserveArgsNeverReachArgv	Shell metacharacters and flags sent as arguments to every observe op are refused or never reach a command line, and each op runs only its pinned argv. Linux only.
	contextextract_test.go: TestCtxExtractRefusesAnUnknownTool	Text extraction runs only tool names from its fixed table.
	observe_reads_linux_test.go: TestObserveJournalRunsOnlyItsPinnedArgv	observe:journal runs systemctl list-units, systemctl list-unit-files and one pinned journalctl; the unit reaches journalctl only as --unit= with a name one of those lists holds, and a unit this machine does not have, or knows only as not found, is refused before journalctl runs. Linux only.
	observe_reads_linux_test.go: TestObserveLoginsRunsItsPinnedArgv	observe:logins runs one pinned journalctl whose only caller value is a whole number of hours; without access to the system journal it runs nothing and its counts read -1, never 0. Linux only.
	observe_reads_linux_test.go: TestObserveLoginsCountsOnlyRootsSSHDLines	Every match observe:logins gives journalctl also needs _UID=0, so a line another account wrote under a process named sshd, or from a shell left in ssh.service, is never counted. Linux only.
	observe_reads_linux_test.go: TestObserveFoldersReadsOnlyTheFolderItStatd	A folder swapped for a link between the walk's stat and its open, or reached through a folder above it that was, is not read and is listed as changed. Linux only.
	observe_reads_linux_test.go: TestObserveFoldersStartsNoWalkPastTheStuckOnes	Past four walks still inside a read that has not returned, observe:folders answers at once and starts no walk; a walk that comes back frees its place. Linux only.
	observe_reads_test.go: TestObserveReadsRefuseBadValuesWithTheRule	A relative folder path, one with .. or under /proc, a unit name outside systemd's alphabet, shaped like a flag or naming a template, and a depth, window or port out of range are refused at exit 2 with the rule broken, without repeating the value.
	fuzz_observe_test.go: FuzzFolderPathIsAbsoluteCleanAndOffTheKernelTrees	Whatever the input, a folder path that passes is absolute and clean, holds no .. and no control character, and is outside /proc, /sys and /dev.
	fuzz_observe_test.go: FuzzUnitNameIsSystemdsAlphabet	Whatever the input, a unit name that passes is in systemd's unit-name alphabet, at most 255 characters, ends in a unit type, does not start with -, . or @, and is the input itself or the input with .service.
	claims_unix_test.go: TestTheAllowlistedOpIgnoresTheCallersArguments	uptime, sent through the management lane with hostile arguments, runs its program with none.
	claims_static_test.go: TestTheAllowlistedOpRunsItsTableArgvOnly	The allowlisted table is exactly uptime with no arguments, and the one command the lane starts is built from the table's argv alone.
	claims_static_test.go: TestFileHandlersStartNoShell	Leaving text extraction (ctx_extract) aside, nothing a context, store or backup handler can reach runs a shell, and the one process any of them can start is the local search agent's Python, which dcn_grant_sync brings up.
Approval on the machine, once enrolled	stepup_test.go: TestStepupVerifyBurnAndApprovals	With no factor enrolled the gate passes; once enrolled, a code is used once, and an approval passes only for the exact terms it was issued for, and only once.
	modelswap_test.go: TestAnApprovalIsSingleUse	A spent approval does not fund a second model download.
	modelswap_test.go: TestUnenrolledMachineCannotHaveAModelPulled	With no factor enrolled, a model pull is refused.
	session_test.go: TestSessionRootRefusedWithoutStepup	A root session with no approval is refused and leaves no transcript.
	session_test.go: TestSessionRootApprovalBindsToSession	The purpose a root approval is bound to differs between two session ids on the same machine. Compared as strings, not through the terminal handler.
	not covered by a test	That a root approval's purpose also names the machine (session.go, purposeForSessionRoot).
On an anchored machine, a write needs an approval	hostops_test.go: TestAnAnchoredBoxRefusesAWriteWithoutApprovalAndRunsItOnceWithOne	With no factor and no device a write is refused; with a device, a write without an approval is refused, an approved one runs once, and a replay is refused.
	hostops_test.go: TestEveryBrokenDeviceApprovalIsRefused	A device approval for other arguments, with a changed signature, expired, for two uses or with no nonce is refused.
	hostops_test.go: TestAConsoleApprovalRunsAWriteOnce	An approval given with the factor enrolled here runs the write once.
	hostops_test.go: TestEveryOpIsReadOrWrite	Every op on the management lane is classified as a read or a write, and a new op counts as a write.
	hostops_test.go: TestRepeatedRefusedWritesQuarantineThePairing	After repeated refused writes the pairing's writes are held, even approved ones; reads and revokes still pass.
	claims_update_forward_test.go: TestANewerSignedReleaseNeedsNoApproval	A self-update to a newer version reaches the signed manifest with no approval; a member host's directive and the local switch still refuse it.
	claims_update_forward_test.go: TestTheBoxTellsTheHostAForwardUpdateNeedsNoApproval	The enforcing report says so, so the host does not ask anyone for a forward update; a build that cannot read its own version says it does not.
	claims_update_forward_test.go: TestAnOlderOrUncomparableVersionStillNeedsAnApproval	A self-update to an older version, the running version spelled differently, a suffixed version, or any version on a build that cannot compare its own is refused without an approval, and the host is told why; with one, a move to an older version proceeds.
Host-written programs run sandboxed first	ops_test.go: TestOpThatWritesOutsideItsEffectsIsRefusedBeforeAnyoneIsAsked	A dry run that writes outside its declared effects, links out of them, or writes to /etc is refused and lands nothing; inside the sandbox the network and /proc are closed. Skipped where the sandbox is unavailable.
	ops_linux_test.go: TestOpDryRunShowsTheChangeAndApplyCommitsExactlyThat	A dry run commits nothing; an apply must name the dry run's change list and carry an approval bound to that op, its parameters, the machine and that change list. Skipped where the sandbox is unavailable.
	ops_test.go: TestOpTermsMutationsAreEachRefused	Each altered field of signed op terms is refused.
	ops_linux_test.go: TestOpSandboxShowsOnlyTheBaseAndWhatTheOpDeclared	In a real sandbox, an op reads the file it declared and the system base; a file beside its own folder, a folder beside it and /etc/shadow read as empty; a declared path that has since become a link onto /etc/ssh refuses the run. Skipped where the sandbox cannot run.
	ops_linux_test.go: TestAnOpaqueNewFolderIsCreatedAndAReplacedOneIsRefused	A folder an op left opaque over one the machine holds (a replaced tree) is refused, inside its effects or not; a new folder the kernel marks opaque is a created folder, and what it holds is read.
	ops_taskcap_linux_test.go: TestARootOpIsStoppedAtItsTaskCap	A root op starting 100 background tasks is stopped at its scope's cap, and its report says the cap held. The scope is made by a stand-in for systemd-run that creates the cgroup directly. Skipped where the sandbox, systemd as init or a pids controller is unavailable.
	ops_view_test.go: TestOpSensitivePathsAreRefusedAtUnderOrAboveAndThroughLinks	A declared path at, under or above a credential store, as written or through a link, is refused; a malformed sensitive_paths refuses every op.
	fuzz_paths_unix_test.go: FuzzAnOpEffectNeverCoversTheMachinesOwnRecord	No accepted effect covers the bastion's own records or the system directories the sandbox masks.
An action op's program reaches only what it declared	ops_action_linux_test.go: TestActionProgramReachesOnlyItsDestinations	In a real unit, an apply reaches its declared destination by name; another port on that address, the declared port on another address, this machine's loopback and the internet are refused. A dry run reaches nothing, its declared destination included, and a name that resolves to the metadata service is refused. Skipped where action ops cannot run.
	ops_action_linux_test.go: TestActionProgramSeesNothingItWasNotGiven	In a real unit, the program runs as a fresh uid with no capabilities and no new privileges; /root, /etc/shadow, the docker and systemd sockets and an abstract socket outside it are out of reach; it reads its declared file and writes to /tmp, but not to the machine: not /usr/local, not a world-writable folder it declared as a read. Skipped where action ops cannot run.
	ops_action_linux_test.go: TestActionCredentialIsHandedAndNothingIsLeft	A sealed credential reaches the program and never its output; after the run no file holds it, the run's tmpfs is unmounted, its work folder and unit are gone, and no process of its uid is left, a detached one included. A dry run handed a credential is refused. Skipped where action ops cannot run.
	ops_action_linux_test.go: TestActionBuilderSocketOnlyInApply	The builder socket reaches the program in an apply through the socket's group, never in a dry run; a socket in root's group, or a machine with no builder, refuses an apply that builds. Skipped where action ops cannot run.
	ops_action_linux_test.go: TestActionVerbCredentialNeverReachesTheRealProgram	In a real unit, a credential a tree.checkout names never reaches the program, while the verb uses it and the program's own credential is handed and scrubbed from its output. Skipped where action ops cannot run.
An action op is never capped, and yields first	ops_action_linux_test.go: TestActionMemoryIsNotCappedAndTheOpYieldsFirst	In a real unit, a run holds 1500 MiB resident with nothing limiting it, and the kernel would kill it first (oom_score_adj 1000). When the machine's free memory falls to the floor, the op is stopped, with a refusal that names its peak. A machine already under the floor starts no op and spends no uid. Skipped where action ops cannot run or 10 GiB is not free.
	ops_action_linux_test.go: TestActionYieldsWhenTheServicesWaitOnMemoryNotForItsOwnStalls	Against a stand-in tree of pressures: neither the op's own slice waiting nor a pod group already waiting stops it; the services' slice rising to 12.5% during the run stops it within seconds; a group that stays at a level does not stop the next run; a group that spiked as the run began and fell back does not hide a later rise. Skipped where action ops cannot run.
	ops_action_linux_test.go: TestActionProgramSeesNothingItWasNotGiven	(also) The real unit's program sits in the ops' slice (privatae_ops.slice; in the suite, a slice of its own), whose own figure the pressure reading leaves out.
	ops_memory_stalls_linux_test.go: TestAnActionOpYieldsToARootOpBesideItNeverToItself	Against stand-in pressures: a root op's scope in the ops' slice rising 12.4% beside an action op counts as another program waiting, while the action op's own unit and the slice's own figure rising never count.
	ops_action_linux_test.go: TestTheMemoryWatchReportsOnlyAKillThatLanded	A kill that finds no unit is not reported as the op stopped.
	ops_action_linux_test.go: TestTheMemoryWatchKeepsTryingUntilTheKillLands	With the machine short before the op's unit exists, the first kill finds nothing; the real unit that starts a second later is still stopped. Skipped where action ops cannot run.
	ops_action_linux_test.go: TestMemoryFloorSitsAboveTheKubeletsEviction	The floor reads the kubelet's eviction line from the k3s config, its drop-ins, the k3s unit's flags, the kubelet config k3s writes, and any kubelet config file or folder a flag names (one named and missing counts as unreadable): percentages, decimals, binary and decimal units, soft as well as hard, and a kubelet config file's form, never a comment. It sits 512 MiB above that line, or at 5% of memory, or at 1 GiB, whichever is largest. A value it cannot read raises the floor to 10% plus 512 MiB.
	ops_action_linux_test.go: TestActionApplyOfAnotherChangeListRunsNothing	An apply whose change list differs from the approved one is refused before the program starts. Skipped where action ops cannot run.
	ops_action_test.go: TestActionManifestRefusesWhatIsNotDeclaredOrNotBounded	An unknown verb or argument, a workload, container, unit or tree named by a parameter, an undeclared credential, verbs without root, a destination on loopback, link-local or a metadata service (also inside NAT64 or IPv4-mapped IPv6), the bastion's own unit, a tree on a credential store, a tree or container moved twice by one op, and more, are each refused when the op arrives.
	ops_action_test.go: TestSealedCredentialsOpenOnlyForThisRunAndThisOp	A credential sealed for another run, to another machine, tampered, expired, undeclared, missing or sent twice is refused.
A standing grant holds to its bounds on the machine	ops_skill_bounds_test.go: TestGrantOutsideItsWindowIsNotNowAndSpendsNothing	An apply outside the grant's window (days, hours, zone, read on the machine's clock) does not run, spends no use and is no strike, and says when the window opens; a dry run is not held; arguments outside the op are still refused. Inside the window it runs and spends one use.
	ops_skill_bounds_test.go: TestGrantInsideItsMinIntervalDoesNotRun	An apply inside the approved interval since the last one does not run, spends nothing and is no strike; past it, it runs.
	ops_skill_bounds_test.go: TestGrantPerDayHoldsAcrossARestart	The runs are logged in the grant's record on disk, and another process reading that record holds the third run in 24 hours as the first did.
	ops_skill_bounds_test.go: TestGrantWithATamperedRunLogIsNoGrant	A record whose run log, uses, approver or seal was edited outside the bastion, or that carries no seal, holds no grant.
	ops_skill_bounds_test.go: TestGrantDiesWithTheKeyThatApprovedIt	A grant keeps the key that approved it; with that device key unpinned, or the console factor enrolled again, it is refused, and unpinning drops it so pinning the key again does not bring it back.
	ops_skill_bounds_test.go: TestGrantDropGoesThroughAQuarantine	op_grant_drop, of one grant or all, goes through while the host's writes are quarantined, with no approval.
	fuzz_grants_test.go: FuzzAGrantsRunBoundsHoldWhateverTheHostSends	A window or rate the machine accepts is one it can hold, and no run inside an interval or past a day's count is let through.
An op with no program needs no sandbox, and a program still does	ops_skill_bounds_test.go: TestProgramOpStillRefusedWithoutTheSandbox	On a machine with no overlay, a files op and an action op with a program are refused before anything runs.
	ops_skill_bounds_test.go: TestVerbsOnlyOpShippingRunIsRefused	An op with interpreter: none that ships a run file is refused at sync; without one it is held.
	ops_verbs_only_linux_test.go: TestVerbsOnlyOpRunsWithNoOverlay	On a machine with no overlay, an op with no program dry-runs as its verbs' own read, applies its verbs once under an approval bound to that list, and is refused, as the machine's own state and no strike, where a verb's tool is missing.
On your own machine, an action op reaches the internet, never your network	ops_action_local_test.go: TestALocalBoxRefusesAnActionOpThatDeclaresAPrivateNetwork	Through op_sync on a local, unanchored machine: an op declaring 10.0.0.2:80, a 192.168.0.0/16, 172.16.0.0/12, CGNAT, ULA or benchmarking address, or 10.0.0.2 inside NAT64 or 6to4, is refused with the reason and what to do instead, and nothing is held; a public address and a name are held.
	ops_action_local_linux_test.go: TestALocalBoxRefusesANameThatResolvesToAPrivateNetworkAtApply	On a local machine a name that resolves to a private address, alone or beside a public one, is refused when an apply resolves its destinations; a public name resolves to its address; on an anchored machine the private name resolves.
	ops_action_local_linux_test.go: TestAPrivateDestinationHeldWhileAnchoredIsRefusedAtApplyOnceTheAnchorIsGone	An op whose destination is 10.0.0.2:80 or its IPv4-mapped form resolves at apply on an anchored machine; once the machine is local, the same destinations are refused at apply.
	ops_action_local_linux_test.go: TestALocalBoxNeverFetchesAVerbsRepositoryFromAPrivateNetwork	On a local machine a verb's fetch (the ancestry check k8s.set_image makes) of a repository whose host resolves to a private address, to a public and an IPv4-mapped private one, or to a link-local one is refused with the reason before git runs; a public host is fetched with git pinned to the checked address (IPv6 bracketed, the URL's port kept), a git that would drop the pin is refused, and an anchored machine fetches from its private forge unpinned.
	ops_action_local_linux_test.go: TestAnAnchoredBoxNeverFetchesAVerbsRepositoryFromItselfOrTheMetadataService	On an anchored machine a verb's fetch (the ancestry check k8s.set_image makes) of a repository whose host resolves to loopback, to a public address beside an IPv4-mapped loopback one, to a link-local address, to a metadata service or to this machine's own address is refused with the reason before git runs; a private forge is fetched pinned to its address.
	ops_action_local_linux_test.go: TestALocalBoxNeverPutsLiveAnImageFromARegistryOnItsNetwork	On a local machine k8s.set_image's plan and apply refuse an image whose registry is a name resolving to a private address, a private address, localhost or a link-local address, with the reason, and set nothing; a public registry and a Docker Hub repository pass the registry check; an anchored machine keeps its private registry.
	ops_verbs_only_linux_test.go: TestSetImageNeedsGitForItsAncestryCheck	k8s.set_image names kubectl and git as the tools it runs, and tree.checkout git; as root, a machine with kubectl and no git is told by the verb check and the beat that it cannot run k8s.set_image.
	ops_action_local_test.go: TestAnAnchoredFleetKeepsItsPrivateDestinations	Through op_sync on an anchored machine: ops declaring a private, CGNAT or ULA address are held; loopback is still refused.
Root verbs move only forward	ops_verbs_linux_test.go: TestSetImageTouchesOnlyTheNamedContainerAndOnlyForward	Against a stand-in kubectl: a digest with no receipt, a receipt from another repository, a container the workload lacks, a live image this machine never rolled (a receipt for it included), another image and a backward commit are each refused with nothing set; a forward roll sets exactly the named container and records it; an image already set still waits for its rollout, and fails when it does not finish. The ancestry answer is a stand-in here.
	ops_verbs_linux_test.go: TestAncestryByFetchRefusesABackwardOrSidewaysCommit	With real git, the ancestry check k8s.set_image makes accepts a forward commit or the same one, and refuses a backward, sideways or unknown commit.
	ops_verbs_linux_test.go: TestTreeCheckoutMovesOnlyForward	With real git: a tree moves forward to the exact commit, runs none of its own hooks, leaves untracked files and nested repositories alone, and refuses a backward or sideways commit, another origin, local changes and a config that could run a program.
	ops_verbs_linux_test.go: TestTreeCheckoutRefusesATreeRootDoesNotControlAndKeepsIgnoredFiles	A tree, .git or anything in it another user owns, or a git config anyone or another group can write, is refused before git runs; a move that would overwrite an ignored file the machine keeps is refused and the file is untouched.
	ops_verbs_linux_test.go: TestTreeCheckoutNeverWritesIntoAFolderRootDoesNotControl	A move that would write into a folder another user owns is refused and writes nothing; a move that leaves that folder alone goes ahead.
	ops_action_test.go: TestReceiptsAreThisMachinesAndBindTheCommit	A receipt this machine signed names the commit behind a digest and never makes it look rolled; the first receipt for a digest stands and a conflicting one is refused; a changed, relabelled or foreign receipt is refused.
A ship plan runs as your device signed it, and only there	ops_plan_test.go: TestAMachineRefusesEveryPlanItShouldNot	A machine refuses a plan whose line, params, commit, expiry or code flag was changed after signing; a line for another machine; a plan naming another key for this machine; a device it never pinned; a line whose input receipt is missing, foreign, from another plan or of a failed step; an expired plan; a line run twice; and a plan older than one it already ran.
	ops_plan_test.go: TestTheDeviceSignsOnlyAPlanWhoseMachinesItPinned	The device refuses a plan naming a machine it has not pinned, puts in its own pinned key for each machine whatever the pod sent, names every step in the words it shows, and signs each plan for a pipeline with a higher version.
	ops_plan_test.go: TestARootPlanNeedsTheCodeOnTheDevice	A plan with root work is refused without the code or with a wrong one, is signed with a right one and says so, and is never signed by "approve all shown".
	ops_plan_test.go: TestARootLineNeedsTheCodeAndTheOpsOwnVerbs	A root line from a plan that does not say the code was given is refused, whatever signed it; a line showing other verbs than its held op declares is refused.
	ops_plan_test.go: TestAnUndoNeedsAFailedLaterLineOfThePlan	An undo is refused for a step the plan does not let be undone, on an earlier step's failure or any success, on a later step whose apply (not check) failed, or for a step this machine never ran; it runs once.
	ops_plan_linux_test.go: TestAnUndoLeavesWhatMovedSinceAlone	An undo takes a workload back only from the state the step left it in; one that moved since is left alone.
	ops_plan_linux_test.go: TestAnUndoRestartsTheUnitOnlyAfterPuttingTheStateBack	An undo of a step that set an image and restarted a unit sets the image back first and restarts the unit after.
	ops_plan_linux_test.go: TestAnUndoOfATreeNeverOverwritesAnIgnoredFile	Moving a tree back is refused when it would overwrite a file the machine keeps and git ignores, each name matched as itself, never as a pattern or pathspec; the file is untouched.
	ops_plan_linux_test.go: TestALineRunsOneAttemptAtATime	In real units: a second attempt of a step is refused while the first runs, and once one passed none runs again. Skipped where action ops cannot run.
	ops_plan_linux_test.go: TestAnUndoAfterARetryGoesBackToBeforeTheFirstAttempt	In real units: a roll that set the image and failed, then passed on its retry, is undone by a failed check to the image live before the first attempt, and never runs again after its undo. Skipped where action ops cannot run.
	ops_plan_linux_test.go: TestOnlyTheLatestAttemptsFailureUndoesTheLine	In real units: an earlier attempt's failure undoes nothing once a later attempt passed, or while a later attempt is the latest; the latest attempt's failure undoes to before the first. Skipped where action ops cannot run.
	ops_plan_linux_test.go: TestALaterLinesCheckUndoesOnlyOnItsLastAttempt	In real units: a check that may still be retried undoes nothing; its last allowed attempt's failure undoes the roll. Skipped where action ops cannot run.
	ops_plan_linux_test.go: TestAVerbThatCannotBeRecordedDoesNotRun	In real units: a verb whose record for the undo cannot be written is not run, and the step fails. Skipped where action ops cannot run.
	ops_plan_linux_test.go: TestAnAttemptTheBastionDiedInIsSettled	An attempt whose bastion process is gone is settled at startup: as it ended, from its kept receipt, or as failed with a signed receipt saying so; an attempt of a live process is never settled.
	ops_plan_linux_test.go: TestARetryLeavesATargetSomethingElseMovedAlone	In real units: a retry of a roll whose workload another pipeline moved after the first attempt is refused, and the undo leaves the other change in place. Skipped where action ops cannot run.
	ops_plan_linux_test.go: TestATargetMovedWhileTheProgramRunsIsLeftAlone	In real units: a workload another pipeline rolls while the line's program runs is not rolled over, and the undo leaves the other change in place. Skipped where action ops cannot run.
	ops_plan_linux_test.go: TestAVerbMovesOnlyFromTheStateItWasApprovedToMoveFrom	A roll whose workload is in another state than the one its change list read and recorded sets nothing; in that state it rolls.
	ops_plan_linux_test.go: TestATreeMovesOnlyFromTheCommitItWasApprovedToMoveFrom	With real git: a tree at another commit than the one its change list read does not move; at that commit it does.
	ops_plan_linux_test.go: TestTwoChangesToOneTargetNeverInterleave	Two rolls of one workload at once: the second waits while the first is between its read and its write, then finds the workload moved and sets nothing.
	ops_plan_linux_test.go: TestAChangeWaitsForOneInFlightOnTheSameTarget	A tree move, a tree undo and an image undo each wait, without reading the target, while another change holds it, and run once it is done.
	ops_verbs_linux_test.go: TestEveryCommandAVerbRunsHasADeadline	Every command a verb runs has a deadline (a minute; a rollout or a unit's restart six, past their own five), so one that never answers cannot hold its target's lock; a command past it is stopped.
	ops_plan_linux_test.go: TestAnUndoReadsItsTargetAgainBeforeItWrites	An image or tree undo reads its target again right before its write; a roll or commit made after its first read is left in place.
	ops_plan_linux_test.go: TestOnlyAProcessKnownToBeGoneIsSettled	An attempt is settled only when its process is known to be gone or replaced under its pid; this process, and any when /proc cannot be read, are not.
	ops_plan_linux_test.go: TestAnUndoMatchesTheReceiptToTheLinesRecord	An undo is refused while an attempt runs, twice, on a later step's failure when this step did not pass, on the step's own failure once an attempt passed, and on an attempt older than the latest. Called directly.
	ops_plan_linux_test.go: TestALinesRecordAndLedgerAgreeAndAreLetGo	An attempt spent with no record of it is refused; a step's record and receipts are let go a week after the plan expires, not before.
	ops_plan_test.go: TestLinesRunInOrderAndOnlyAsOftenAsThePlanAllows	A line is refused until every line before it has a successful signed receipt; a line runs only as many times as the plan allows.
	ops_plan_test.go: TestAPlanCarriesNothingThatCouldHideWhatThePersonReads	The device refuses a plan whose input, params or verbs hold an escape, a line break, a direction mark, a key twice, an unknown verb or argument; its words carry no control character.
	ops_plan_test.go: TestThePageAsksTheCodeForARootPlanAndNeverApprovesItWithAll	The approvals page asks for the code on a root plan's card, leaves it out of "approve all shown" even when its id is posted, refuses it without the code and signs it with it.
	ops_plan_linux_test.go: TestAShipPlanRunsEachLineOnceAndUndoesOnAFailedCheck	In real units against a stand-in kubectl: a build's receipt carries its digest; the roll refuses to run before it and then rolls exactly that digest, adopting the live image as the first roll; a replay is refused; a failed check undoes the roll to the image live before; a plan whose roll names a digest none of its steps built rolls nothing. Skipped where action ops cannot run.
A server in the service slot has no network	service_test.go: TestServiceUpRunsAStayingContainerWithNoPublishedPort	The container starts with --network none, all capabilities dropped, no new privileges and no published port.
	service_reach_test.go: TestReachGrantSyncAndTheForwardWall	Installing a reach grant is refused without an approval, for another host, or for another machine. The reach check then admits the granted host to the granted server only, and a revoked grant admits nothing. Called directly, not through the slot listener.
	claims_unix_test.go: TestTheServiceSlotAdmitsOnlyWithTheFamilyAndAReachGrant	Through the slot listener: each connection is checked, and one without a reach grant for that server, or without the services family, never reaches the server's socket.
	not covered by a test	The reach check's own comparison of a stored grant's machine.
Egress for someone else reaches the public internet, and nothing on this machine or your network that you did not name	coders_linux_test.go: TestCoderEgressRefusesEveryInternalClass	A coder run's proxy refuses every internal class (loopback, RFC 1918, CGNAT, link-local and metadata, ULA, IPv4-mapped, IPv4-compatible, IPv4-translated, NAT64, 6to4, unspecified, 0/8, 198.18/15, 240/4, multicast, fec0::/10), by address and by a name with one such answer among public ones, and localhost names and names that do not resolve.
	coders_linux_test.go: TestCoderEgressRefusesThisMachinesOwnPublicAddress	A public address on this machine's interface is refused in every spelling (IPv4-mapped, NAT64, 6to4) and through a name; a neighbour on the same subnet passes; allow_lan is the one exception.
	coders_linux_test.go: TestCoderEgressLocalAddressesAreReread	An address the machine gains after start is refused; interfaces that cannot be read refuse.
	coders_linux_test.go: TestCoderEgressDialsTheVettedAddressAndHonoursAllowLAN	The proxy returns the vetted addresses, IPv4 first, never the name; a LAN host passes only when named in allow_lan, and an entry with a port only on that port.
	coders_linux_test.go: TestCoderEgressProxyOverTheSocket	Through the run's socket: loopback, LAN, metadata, private and this machine's public address get 403 with the reason, over CONNECT and plain HTTP; a public destination is spliced, and only its vetted address is dialled.
	ownaddr_test.go: TestOwnDestinationAsksTheKernel	With the kernel's answer supplied: an address a local route delivers here is this machine, also as the IPv4 address inside an IPv4-mapped, NAT64 or 6to4 address; a unicast route or no route is not; a failed lookup cannot decide; without a lookup the interface addresses still decide.
	ownaddr_test.go: TestCoderEgressRefusesAnAddressTheKernelDeliversHere	A coder run is refused an address the kernel delivers here, in every spelling, and refused anything when the lookup fails; allow_lan stays the exception.
	ownaddr_netns_linux_test.go: TestAnyIPDestinationsAreRefusedInARealNamespace	In a private network namespace with local 192.0.2.0/24 and local 2001:db8:a::/64 on lo, plus a broadcast route (198.51.101.255), anycast routes (198.51.102.0/24, 2001:db8:d::/64) and a multicast route: the real route lookup reads each as this machine, and a unicast route or no route as not; a 0.0.0.0 listener answers on both local ranges. A coder run's proxy and the anchored egress lane each refuse those addresses (local, broadcast and anycast), the IPv4-mapped and NAT64 forms of each IPv4 one, and a name resolving to each, with the lane's this-machine reason (a name the lane could not resolve does not count), and pass the unicast and no-route addresses and a name resolving to each, dialling the vetted address; each answers 403 end to end with a real dialer, the proxy over its socket and the anchored lane through its connection handler as the anchor host, to CONNECT by address and by name and to plain HTTP. The backup lanes' URL check refuses the same addresses, forms and names as this machine's or its network's and passes the unicast and no-route ones, and their dial wall refuses the local, broadcast and anycast addresses. Nothing reaches the listener. Skipped where a namespace cannot be made.
	ownaddr_netns_linux_test.go: TestOnlyAUnicastRouteLeavesThisMachine	The kernel's route type is read so that only unicast leaves this machine; local, broadcast, anycast, multicast, unspec, nat and xresolve are this machine.
	hostops_test.go: TestAnchoredEgressRefusesLoopbackAndPrivateDestinations	On an anchored machine the egress lane refuses loopback, localhost, private, ULA, link-local, CGNAT and metadata addresses and dials the vetted address; a local machine refuses its own ollama and its LAN.
	ownaddr_test.go: TestAnchoredEgressRefusesThisMachinesOwnAddresses	On an anchored machine the egress lane refuses an address on this machine's interface and one a local route delivers here, in every spelling, and refuses when the lookup fails; a neighbour passes; a local machine refuses those addresses too.
	egress_local_test.go: TestLocalEgressRefusesThisMachineAndTheLAN	On a local machine the egress lane refuses loopback, localhost, unspecified, 0.0.0.0/8, link-local and metadata addresses, this machine's own LAN address and AnyIP range, each also inside an IPv4-mapped, NAT64 or 6to4 address, private, ULA and CGNAT addresses, and a name with one such answer; it dials public addresses, and a name's vetted addresses, never the name.
	egress_network_test.go: TestLocalEgressRefusesTheLANAndTheMesh	On a local machine the egress lane refuses the network around it as an anchored one does: private, ULA, CGNAT and benchmarking addresses, a NAT64 address for one, and a name with any one such answer, each answered 403 through the lane with nothing dialled; a public name passes at its vetted address.
	ownaddr_inside_linux_test.go: TestNetworksInsideThisMachineAreThisMachine	In a private network namespace with two bridges whose only port is a veth (one with an IPv4 and an IPv6 range, one with a public range), a bridge whose port is a dummy, a bridge with no port, a veth routed to directly, a range routed through a veth with this machine's own address on it as the gateway, a veth whose only default route is in another table, a bridge over a VLAN, a route over a dummy link, the network on three veths that carry this machine's main-table default routes (an IPv4 multipath default over two, an IPv6 default over the third: this machine as a container), addresses through those defaults' gateways and a route through a gateway on the dummy-port bridge (a LAN behind a router VM): the real route lookup reads the first seven as this machine and the rest as leaving; a local machine's egress lane refuses the inside addresses, by address and by name, as this machine, refuses the private addresses beyond them as its network, and dials the public ones; a coder run's proxy refuses the public range on an inside network and dials a public address through the gateway; the backup lanes allow the IPv4 and IPv6 addresses through the gateway.
	ownaddr_inside_linux_test.go: TestInsideMachineReadsTheLinkAndABridgesPorts	A veth, and a bridge whose every port is a veth, a tap or a dummy (or that has none), keep a packet on this machine; a bridge with a network card, a VLAN or a bridge among its ports, a network card, loopback, a VPN, a tunnel and a macvlan do not.
	egress_local_test.go: TestLocalEgressLaneNeverDialsThisMachine	Through the lane on a local machine with a real dialer: a request for a loopback listener gets 403 over CONNECT and plain HTTP and never reaches it; a public name is dialled at its vetted address; a dual-stack name falls back to its second address.
	egress_dial_test.go: TestDialEachDoesNotWaitOutAnAddressThatGoesNowhere	The dial both egress lanes share tries only the vetted addresses, in order; an address that never answers holds up the next for well under its share of the budget, and is cancelled once the next answers.
	egress_relay_test.go: TestARefusingHostCannotSpinTheEgressWorkers	A Host that answers every parked egress worker with a job this machine refuses (a request for localhost, a line that is no request) gets at most 16 workers back in two seconds, not a dial loop, and nothing is dialled out.
	egress_relay_test.go: TestEgressWorkersParkAgainAtOnceAfterAJobTheyTook	A worker that took a job parks again at once: 40 accepted jobs through the four workers are each answered 200 well inside the 10 s one wait per job would take.
	egress_local_test.go: TestLocalModelsSwitchLeavesNoEgressRouteToOllama	On a local machine with models switched off for the host, the ollama forward filters, and the egress lane refuses /api/pull to ollama on loopback, localhost and this machine's LAN address without a dial.
	egress_local_test.go: TestAnchoredEgressStillRefusesTheLAN	An anchored machine's egress lane still refuses the LAN addresses a local machine reaches, with its own wording, and passes the public internet.
	egress_obsolete_test.go: TestEveryLaneRefusesTheDeprecatedIPv6Forms	The anchored and the local egress lane each refuse IPv4-compatible (::/96, with a public, a loopback and a LAN address inside), IPv4-translated (::ffff:0:0/96) and site-local (fec0::/10) addresses, and a name with one such answer among public ones, and pass the public internet; a coder run's proxy refuses the same addresses.
	ownaddr_test.go: TestBackupLanesRefuseThisMachinesOwnAddresses	The backup lanes' URL check refuses an address on this machine's interface and one a local route delivers here, in every spelling and through a name, and their dial wall refuses those addresses; a failed lookup refuses both; a neighbour on the subnet passes. With the kernel's answer supplied.
	backupfetch_test.go: TestBackupWallJudgesTheIPv4InsideAndTheReservedRanges	The backup lanes' classifier, address wall and URL check refuse 10.0.0.1 and 127.0.0.1 inside NAT64, 10.0.0.1 inside 6to4 and in the IPv4-compatible and IPv4-translated forms, the metadata address inside 6to4, a local-use NAT64 address, fec0::1, 198.18.0.0/15 (also inside an IPv4-mapped address), 240.0.0.0/4 (also inside NAT64) and 255.255.255.255; public addresses in the NAT64, 6to4 and IPv4-mapped forms, and the addresses either side of 198.18.0.0/15, pass the classifier.
	not covered by a test	A public address that reaches this machine only through a 1:1 NAT in front of it. Nothing refuses it.
Audit rows also reach the system log	auditlog_test.go: TestAuditRowsReachTheSystemLog	The management lane, pairing changes, store ops, terminals and root commands each send the row they write to their file to the system log too, unchanged, with audit and pairing added.
	auditlog_test.go: TestAuditFileRowStandsWithoutASystemLog	A system log that takes nothing costs only that copy; the row is still written to its file.
	auditlog_syslog_test.go: TestAuditRowsDoNotWaitOnAStuckSyslogSocket	A real syslog writer on a socket nobody reads blocks; 5000 rows queued in front of it all return at once and the excess is counted as dropped.
	auditlog_queue_test.go: TestAuditSinkIsTheQueue	The shipped sink is the queue, not the writer.
	auditlog_queue_test.go: TestAuditQueueNeverWaitsOnAStuckWriter	With a writer that never returns, 1000 rows are taken at once, and every row is either written or counted in system_log_dropped on a later line.
	auditlog_queue_test.go: TestAuditSystemLogOmitsTheRootCommandText	A root command's text is not in the system-log line; its digest and length are.
A networked machine is anchored to its first host	pair_anchor_test.go: TestPairAnchorsANetworkedMachineToItsFirstHost	On a networked machine with no anchor, the first pairing made with machine authority anchors it and is active; a local machine, an anchored one (a new host stays pending), a second pairing, and a caller without machine authority are left as they were. claim-anchor afterwards succeeds and changes nothing. Called directly, not through pair's redeem.
	anchor_test.go: TestClaimAnchorWithNoToken	claim-anchor with no token on a machine anchored to that host succeeds and changes nothing, the host named in full, by handle or not at all; when the anchor's pairing is pending or revoked it is refused and the state is left as it was; another host is refused without --rotate.
A root reinstall keeps a paired local machine local	install_sh_test.go: TestInstallShKeepsAPairedLocalMachineLocal	install.sh's check finds a pairing in a folder whose mode is local (or unset), in either folder it looks in; a networked folder, or one with no pairing, gets the networked default. The rest of the installer is not run by a test.
A pairing code pins the Host's CA by its fingerprint	pair_code_linux_test.go: TestAPairingCodePinsTheHostCAByFingerprint	A pairing code whose enroll port presents no CA, another CA, a CA under another fingerprint, a leaf another CA signed, or a leaf without the name host.cseries.internal is refused before the token is spent, and nothing is saved.
	pair_code_linux_test.go: TestAPairingCodePairsAsTheHostCAFileDoes	A good code makes the same TCP pairing --redeem-url and --host-ca make, with that CA pinned; the same code again is "already paired" (exit 3) and changes nothing; a Host of the same name under another CA is a plain refusal.
	pair_code_linux_test.go: TestAPairingCodeIsReadStrictly	A code that is garbled, another version, or has an extra, missing or malformed field is refused, and no refusal repeats the token.
	pair_code_linux_test.go: TestACodeTheHostMadeDecodesAndPins	A recorded code from the C-Series Host's pairing_code decodes to its address and token, and its fingerprint is the one caSHA256 computes from the same CA.
	pair_code_linux_test.go: TestAPairingCodeWithAKeyGivenTwiceIsRefused	A code that names a field twice is refused.
	pair_code_linux_test.go: TestThePinnedChainTakesOnlyAValidCAWithTheFingerprint	A certificate with the fingerprint that is not a CA, an expired CA, or a chain of the leaf alone is refused; the pinned CA after other certificates is the one kept. Called directly, not through TLS.
	pair_code_linux_test.go: TestHostCAFileWithASameNamedHostUnderAnotherCAIsNotAlreadyPaired	With --host-ca too, a Host of the same name under another CA is a plain refusal, not exit 3, and its token is not spent; the same Host under its own CA is exit 3.
	pair_code_linux_test.go: TestARedeemAnsweringAPairedNameUnderAnotherCAIsNotAlreadyPaired	When the redeem answers with a paired name the token's handle did not show, a Host of that name under another CA is a plain refusal, not exit 3, and nothing is saved.
A local machine adds a second host only on a yes typed there	pair_code_linux_test.go: TestALocalMachineAddsASecondHostOnlyOnAYesTypedHere	With no terminal, or any answer but y or yes, the second host is refused before its token is spent and the first pairing is unchanged; callers with no person to ask keep the refusal and open no terminal; a typed yes adds it beside the first.
	pair_code_linux_test.go: TestTheSecondHostAnswerIsNeverReadFromStandardInput	The answer is read from the controlling terminal, never from standard input: with no terminal and a y waiting on standard input, the question finds no terminal, refuses, and leaves standard input unread.
	service_test.go: TestServiceOwnerRuleOnAnAnchoredBox	On a local machine that serves two hosts, a host may not replace or stop a server the other built, and may change its own; with one host no owner rule applies.
	service_test.go: TestCoderRunOwnerRuleOnALocalBoxServingTwoHosts	On a local machine that serves two hosts, a host may not stop a coder run the other started, or one of unknown owner, and may stop its own; with one host nothing changes.
	pair_code_linux_test.go: TestTheSecondHostQuestionEscapesTheTokensName	The second-host question shows a token's name that is not a plain host name quoted, with its control bytes escaped.
The installers keep the pairing code out of every process's arguments	install_sh_test.go: TestInstallShTakesTheCodeOnlyFromTheEnvironment	install.sh takes the code only from PRIVATAE_PAIR_CODE and unsets it before it starts any program: no program it starts, the downloaded bastion included, has the code in its arguments, its shell's command line or its environment, and the code reaches pair - on standard input. Run on stand-in programs; nothing is downloaded.
	install_sh_test.go: TestInstallShRefusesABadPairCodeBeforeDownloading	An empty or partial PRIVATAE_PAIR_CODE, and any unknown argument (the removed --pair and a bare code included), are refused before the download and never echoed.
	install_sh_test.go: TestInstallShPairsOverStdinAndStartsAUserUnit	The pairing functions hand the code to pair - on standard input, then start the bastion; a failed pair starts nothing. Run on stand-in programs, not on a real systemd.
	install_sh_test.go: TestInstallShStopsAnOutsideCopyAndChecksTheUnitStaysUp	On Linux as yourself, a copy of the bastion running outside the user unit is stopped before the unit starts, and a unit that keeps restarting is reported as not running, with a failure. Run on a stand-in systemd, in a PID namespace of its own.
	install_ps1_test.go: TestInstallPs1PairShape	install.ps1 pipes the code to pair -, never into an argument or the output, and checks it before downloading. Read from the file; TestInstallPs1PairBlockRunsUnderPwsh runs the block where pwsh is installed. Not run on Windows.
A terminal is checked here and logged	session_test.go: TestSessionOpensWithoutAGrantOnALocalBox	On a local machine a terminal with no grant and no approval opens and is audited. The same test calls sessionPinOfferedKey directly: the first key offered is pinned and a different one is refused.
	session_test.go: TestSessionRefusedWithoutGrantIs126	A grant that is sent is verified: a bad signature, an op not listed, or an op the grant denies is refused and audited.
	fuzz_grants_test.go: FuzzEachOpIsAllowedOnlyByItsOwnFamily	On an anchored machine the family check (capsAllow) lets a host other than the anchor run an op, the session ops included, only if its pairing grant names that op's family. Called directly, not through the terminal handler.
	session_test.go: TestSessionOnAnAnchoredBoxTheApprovalIsTheWall	On an anchored machine a terminal without an approval is refused, with or without a factor enrolled, is audited and leaves no transcript.
	session_test.go: TestSessionRootRefusedWithoutStepup	A root terminal with no approval is refused and leaves no transcript.
	session_test.go: TestSessionRootApprovalBindsToSession	The purpose a root approval is bound to differs between two session ids on the same machine. Compared as strings, not through the terminal handler.
	session_test.go: TestSessionFramingResizeAndTranscript	An opened session writes a transcript and start and stop lines to the audit log.
	hostops_test.go: TestTheDeviceSignsOnlyWhatItDerivedItself	The approval device refuses to take a root-terminal ask.
Root commands run only under a grant given here with the code	rootexec_test.go: TestRootExecGrantCeremony	The grant exists only after a code from the factor enrolled here checks out, once per code, with an expiry no longer than 30 days; past its expiry or after a revoke it refuses.
	rootexec_test.go: TestRootExecGrantIsAtMostThirtyDays	A 31-day grant is refused and writes nothing, 30 days is granted, and a grant held with a longer term ends 30 days after it was given; one with no grant time is refused.
	rootexec_test.go: TestRootExecRefusals	Through the terminal handler: with no grant, an expired, revoked, other-host or other-machine grant, from a member pairing holding the session family, or with the bastion not root, the command is refused, never starts, leaves no transcript and is audited with its command.
	rootexec_test.go: TestRootExecLocalSwitchRefuses	With session switched off here, a granted command is refused.
	rootexec_test.go: TestRootExecRoundTrip	A granted command returns its stdout, stderr and exit status, and is written to a transcript and to the audit log at start and stop with the command.
	rootexec_test.go: TestRootExecOutputCapIsStated	An output over the cap keeps its first and last half, says how many bytes were cut, and is kept whole in the transcript.
	rootexec_test.go: TestRootExecDeadlineKills	A command past its deadline is killed and answered with 124 and timed_out.
	rootexec_test.go: TestRootExecStopsWhenAWallFallsMidRun	Through the handler: a command already running is killed within one recheck when its grant is revoked or expires, session is switched off here, or the pairing is quarantined, and answered with 126 and a J that says why; while every wall holds, the recheck leaves it alone.
	rootexec_test.go: TestRootExecDeadlineKillsAChildThatIgnoresSIGTERM	Through the handler with the real /bin/sh: at the deadline a child that ignores SIGTERM, holding the output open or not, is gone when the answer arrives, within the deadline and the kill grace. Every signal goes through a fence that admits only the process group the test started.
	rootexec_test.go: TestRootExecBadCommandAndTranscriptFailureAreAudited	A bad command, a bad session id, and a transcript that cannot be opened each leave an audit row with the command (or its size and sha256) and exit 1; none starts.
	rootexec_watch_linux_test.go: TestRootExecWatchKernel	In a private network namespace, through the handler with the real /bin/sh, nftables and a cgroup: a command's connections to outside addresses (IPv4 and IPv6, TCP and UDP) are reported in untrusted_connections; loopback (except a port listed as a relay), the machine's own address and listed platform ranges are not, though they stay in the audit row marked own; a grandchild's connections are caught; what a command reached before its deadline killed it is reported; no table or cgroup is left after any of them, and one left by a dead bastion is removed by the next sweep, with any process in it moved to its parent.
	rootexec_watch_test.go: TestRootExecJCarriesOnlyOutsideConnections	The J frame lists only the destinations outside the platform list (addresses, CIDRs and resolved names), the stop row lists every one and counts the outside ones, the transcript records them; with only loopback and own hosts the field is absent.
	rootexec_watch_test.go: TestRootExecUnwatchedCountsAsOutside	A command whose connections could not be watched is reported with one untrusted entry that says why.
	rootexec_watch_test.go: TestRootExecOwnHostsList	No list means only loopback is own; a broken list or a bad entry reads as empty; a name that does not resolve adds nothing; the outside connections reported are capped and the rest counted.
	claims_unix_test.go: TestAMemberWithoutTheSessionFamilyGetsNoTerminal	Through the terminal handler, on an anchored machine: a host other than the anchor without the session family is refused and leaves no transcript; once the family is granted the same approval opens the terminal.
	claims_unix_test.go: TestAnAnchoredTerminalApprovalOpensOneSessionOnce	Through the handler: an anchored machine's terminal approval is refused for another session, opens its own, and is refused when used again.
	claims_unix_test.go: TestARootTerminalNeedsTheBastionToRunAsRoot	Through the handler: with a factor enrolled and an approval for that session, a bastion not running as root refuses a root terminal, and the same approval opens it once the bastion runs as root.
	claims_unix_test.go: TestADeviceCannotApproveARootTerminal	Through the handler: this machine refuses a device approval for a root terminal, with or without a factor enrolled.
	claims_unix_test.go: TestARootApprovalOpensOneSessionOnce	Through the handler: a root approval is refused for another session, opens its own, and is refused when used again.
	claims_unix_test.go: TestTheSessionHandlerPinsTheOfferedKey	Through the handler: the first key a frame offers is pinned, and a later frame offering another key is refused with the pin kept.
	not covered by a test	That a root approval's purpose names the machine (session.go, purposeForSessionRoot).
Root only where there is no one else to ask	anchor_test.go: TestClaimAnchorWalls	claim-anchor is refused without machine authority. Asserted only when the tests run without root.
	owner_test.go: TestClaimOwner	claim-owner is refused without root and writes nothing. Asserted only when the tests run without root.
	claims_unix_test.go: TestMachineWideFactsNeedMachineAuthority	claim-owner, claim-anchor, claim-anchor --repin and set-mode networked are refused without machine authority and write nothing; with it, each completes (--repin re-pins the anchor to the pairing that holds it). Both halves run whatever user the tests run as.
On macOS and Windows, a networked bastion is the system's service	sysservice_test.go: TestLaunchdPlistRunsTheDaemonAsRootAtBootAndKeepsItAlive	The launchd job is well-formed and runs the program as root at boot, with root's home, and launchd restarts it whenever it exits.
	sysservice_test.go: TestBinaryChainMustBeRootOnly	On macOS the service is refused for a program a non-root user owns, that a group or everyone can write, that is a symlink, or that sits under such a directory. Run against a stand-in for the disk, not on a Mac.
	sysservice_test.go: TestWindowsServiceBinaryMustLiveUnderProgramFiles	On Windows the service is refused for a program outside Program Files, including the per-user install folder.
	sysservice_test.go: TestServiceGuardRefusesAUserspaceBastionBesideTheService	With the service installed, pair, run, status and switch from an account without machine authority are refused; an administrator, and a machine with no service, are not.
	sysservice_test.go: TestServiceModeOpensNothingOnTheDesktop	As a Windows service, the tray, the blocking dialog and the detached relaunch after an update each return before doing anything. Read from the source, not run.
	runlock_unix_test.go: TestARunBesideTheMacServiceIsRefusedBeforeItStarts	With the macOS daemon installed, a second run is refused while the first holds the lock in the state folder, and may run once it is gone; with no daemon nothing is locked. Run against the real lock on Linux; the macOS wiring (runguard_darwin.go) is not run off a Mac.
	not covered by a test	That launchd and the Windows service manager actually restart the bastion after it exits (sysservice_darwin.go, sysservice_windows.go); neither runs off its own platform.
	freeagent_drop_winrules_test.go: TestFaWinOwnerRefusalRunsOnlyAsAPerson	On a Windows service a folder's agent is refused when the folder's owner is SYSTEM, a service account, a BUILTIN group such as Administrators, the built-in Administrator or Guest, or not a person's account; a local, domain or Entra ID user is accepted.
	freeagent_drop_winrules_test.go: TestFaAgentDirStaysOutOfTheFolderWhereTheHandOverIsAPermission	Where the hand-over is a permission entry (Windows), the agent's directory is never made inside the person's folder.
	not covered by a test	That the Windows agent is started under the owner's session token, and that its state leaf's permission is set only while the leaf is empty (freeagent_drop_windows.go); neither runs off Windows.
Observation changes nothing on the machine	observe_endpoints_test.go: TestObserveEndpointAllowedIsTheInverseOfObserveNet	The monitoring ops may reach only private addresses, exactly the ones observe:net refuses.
	observe_endpoints_test.go: TestObserveDialControlRefusesPublicAtConnectTime	A public address is refused at the socket, so a DNS answer cannot move a query outside.
	observe_endpoints_test.go: TestObserveNeverFollowsARedirect	A redirect from a monitoring endpoint is reported as a failure, and its target is never fetched.
	observe_reads_linux_test.go: TestObserveCertReadsOnlyThisMachinesListener	observe:cert is refused for a port no listener on this machine holds, and never dials an address a listener is bound to that this machine does not hold. Linux only.
	claims_static_test.go: TestObserveOpsWriteNothing	Nothing an observe or computer op can reach writes, removes, renames, changes permissions on, mounts or signals anything, apart from the bastion's own audit line and its journal of observe results; the programs those ops run are a fixed list of reads.
	claims_static_test.go: TestNoInputInjection	No input-injection program is run, no Windows input API is loaded, and no script the computer ops run asks for a keystroke, a click or an accessibility action.
A backup's key goes to a host only when you approve it here	backupreseal_test.go: TestBackupResealWaitsForThePersonThenDeliversToTheHostOnly	Through the management lane: a request is filed pending and hands out nothing; another pairing cannot read it; after approval here the host receives the record sealed to its key only; a refusal hands over nothing; a decided request cannot be decided again.
	backupreseal_test.go: TestResealOpensAnAgeWrittenSidecarAndSealsToTheHostAlone	A sidecar written by the age command is resealed byte for byte to the host's key alone (not to the key that opened it, not to another host), and the age command opens the result.
	backupreseal_test.go: TestResealRefusesWhatIsNotTheBackupItClaims	A sidecar of another kind or version, naming another backup, with a malformed stamp or key, sealed to someone else, or oversized, is refused.
	backupreseal_bind_test.go: TestResealRefusesAnotherHostsBackupWhateverTheHostSays	A host holding another host's key file, calling itself that host, is refused when the person approves, and nothing is sealed to it; the other host asking for its own backup is served.
	backupreseal_bind_test.go: TestResealDecideRefusesWhatIsNotThePairingsOwn	The refusal is in the act itself, not only the preview: a request is bound to the pairing and host number that filed it.
	backupreseal_test.go: TestResealTakesBothPlacesABackupIsKept	A key file naming b/<stamp> or s/<stamp> opens and is resealed to the host's key, written by this code and, where the age command is installed, by it.
	backupreseal_test.go: TestResealRefusesAnObjectOutsideBothPlaces	A key file naming any other folder, a path that climbs or nests, or another backup's name is refused.
	backuppush_test.go: TestBackupPushStartRefuses	backup_push refuses, before any job starts, a path outside the backup folder, a subfolder, a path through a linked folder, a link, a file not named like a backup, a folder not shared with the host, plain http, and this machine's or its network's addresses.
	backuppush_test.go: TestBackupPushSendsNothingWhenTheFileIsNotTheOneNamed	A file whose SHA-256 is not the one the host named fails the job before a byte is sent.
	backuppush_headers_test.go: TestBackupPushSendsTheSignedHeaders	The headers an upload address was signed with go on the PUT: a storage that refuses a PUT without If-None-Match: * accepts it, and refuses a second one with 412, reported as such.
	backuppush_headers_test.go: TestBackupPushStartTakesTheHeaders	Through the management lane, If-None-Match: * (as sent, or in lower case) is the only header a host may hand over: any other name (an unexpected header, Host, Content-Length, Transfer-Encoding, Connection), any other value for it, or a split header line is refused before a job starts, and so is a start with no headers.
	backuppush_bound_test.go: TestAPushFromAFolderThatStopsAnsweringFails	A push whose file read never returns, while checking the digest or while sending, fails within the bound with a sentence instead of staying pending.
	backuppush_stuck_test.go: TestRepeatedPushesFromADeadFolderHoldOneRead	Pushes started again and again on a folder whose read never returns leave one blocked read, one open descriptor and no more goroutines; each start after the first stuck read is refused with a sentence.
	backuppush_stuck_test.go: TestAPushFolderIsReadAgainWhenItsReadReturns	Once a stuck read returns, its folder is read again: the next push there reads its file to the end.
	backuppush_stuck_test.go: TestStuckPushReadsAreCappedPerBastion	Across folders the blocked reads never pass the cap, and a start while the cap is held is refused, even from a folder that answers; once the reads return, a push starts.
	backuppush_stuck_test.go: TestAPushWaitingForASlotIsNotBlamedOnItsOwnFolder	A push from a folder that answers, waiting for a slot while other folders' stuck reads hold the cap, fails with the sentence about the cap, not one saying its own folder stopped answering.
	backupreads_test.go: TestAPushIsNotStartedInAFolderWhoseHashingReadIsStuck	A folder whose read for a digest has not returned refuses a push with a sentence and starts no push read there; once the read returns its digest is kept and a push starts.
	backupreads_test.go: TestTheHashingDoesNotReadAFolderWhosePushReadIsStuck	A folder whose push read has not returned is not read for digests, while other folders are; once it returns the folder is read again.
	backupreads_test.go: TestStuckHashingAndPushReadsShareTheCap	A stuck digest read and a stuck push read count toward one cap: at the cap, a folder that answers gets neither a push nor a digest read until one of them returns.
	backuphash_progress_test.go: TestASlowHashThatKeepsAnsweringRefusesNoPushFromItsFolder	A backup read for its digest far longer than the bound, its reads returning all along, does not make its folder stuck: a push of another backup there starts and reads its file while the digest is still being read.
	backuphash_progress_test.go: TestAHashWithNoAnswerForTheBoundStillMarksItsFolderStuck	A read for a digest that answers for a while and then goes without an answer for the bound makes its folder stuck: a push there is refused with the sentence about the digest, the read counts toward the cap, and once it answers its digest is kept and a push starts.
	backuppush_test.go: TestBackupPushNeverFollowsARedirect	An upload address that redirects is reported as a failure, and the redirect's target is never reached.
	backupretention_test.go: TestRetentionIsNotSteeredByTheNamesAHostGives	Files a host names into past days, all arriving today, do not push out the real backups of those days.
	backupretention_test.go: TestRetentionRemovesOnlyWhatThisBastionFetched	Thinning removes no file this bastion did not record fetching (a file you put there, one replaced since it arrived), no file not named like a backup, no link and nothing a link points to, and nothing when .keep-all is present.
	backupreseal_test.go: TestBackupApproveNeedsTheEnrolledFactor	With a second factor enrolled, approving without its code or with a wrong one opens nothing and leaves the request pending.
	backuplist_test.go: TestBackupListShowsOnlyFoldersSharedWithThisHost	A folder shared with one host is listed for that host only, and not once taken back.
	backuphash_bound_test.go: TestAHashReadThatNeverReturnsHoldsUpNoOtherFolder	A file whose read for its digest never returns holds up the digests of other folders only for the bound; nothing more is read from its folder while it is stuck; when it returns its digest is kept and the folder is read again.
	backupshared_bound_test.go: TestASharedFolderThatDoesNotAnswerHoldsUpNothing	A shared folder that hangs when resolved or read is left out of backup_list (named under unavailable) within the bound, and backup_push from it is refused within the bound; the folders that answer are served.
	backupshared_bound_test.go: TestASharedFolderThatNowReachesTheBastionsStateIsLeftOut	A shared folder replaced by a link to the bastion's configuration folder is not listed and not sent from.
	backuproot_test.go: TestTheBackupFolderIsCreatedOnFirstBackupOp	backup_list creates no folder; the first backup op that writes does.
	backuproot_test.go: TestBackupRootsAreEachHostsOwn	A backup op is refused while the host's backup folder is the same as, inside, or contains another paired host's, also through a link.
	backuproot_test.go: TestBackupRootNeverOverlapsTheBastionsOwnState	A backup folder that is or contains the bastion's configuration folder, keys or backup records, or sits in the configuration folder outside backups/, is refused, and none of them can be shared; the default folder is accepted.
No delete op on shared stores	dcn_plan_test.go: TestDcnPlanCheckApplyVerify	A move plan that escapes the store, targets an existing path, or touches an excluded file is refused whole; the op list carries the plan op and no dcn_delete or dcn_remove.
	fuzz_paths_unix_test.go: FuzzMovePlanStaysInsideTheRoot	Any move the plan check passes stays inside the store, targets a path that does not exist yet, and avoids excluded paths and the search agent's folder.
A shared folder serves only what its grant leaves in	dcn_private_test.go: TestDcnTheDefaultGcloudExcludeHoldsOnEveryOp	Through list, stat and read_range on a store granted with the Host's default excludes: nothing in .config/gcloud, at the top of the store or inside home/, is listed, stated or read, as written, with whitespace, through a .. or through a link; a move out of or into it is refused; .config/gcloudx and the rest of .config still read.
	dcn_private_test.go: TestDcnAMultiFolderExcludeMatchesThatRunAnywhere	A pattern with a / matches that run of folders at any depth, with names compared as Linux, macOS and Windows compare them (case, and Windows' trailing dots and spaces); a near miss (.config/gcloudx, .configx/gcloud, the two folders apart or in the other order) is not excluded; slashes at either end or doubled name the same run; one-folder patterns match as before. Judged per platform from any OS.
	fuzz_paths_unix_test.go: FuzzAnExcludedPathIsExcludedHoweverItIsSpelled	Any path the sandbox accepts and the excludes pass opens neither an excluded name nor the search agent's folder, by its spelling or through a link inside the store.
	dcn_private_test.go: TestDcnTheAgentsFolderIsNeverServed	With a grant that excludes nothing: no path in .agent at the top of the store, or in one inside a folder of it, is listed, stated or read, as written, with whitespace, through a .., or through a link to the folder or to a file in it; a move out of or into one is refused; the bastion's own report of a plan it applied, through the real plan op, is still written to .agent/plans.
	dcn_private_test.go: TestDcnTheAgentsFolderIsMatchedHoweverTheNameIsCased	.agent is refused in any case on every OS, and on Windows with trailing dots, spaces or a stream name; .agentx, agent and .agent-old are not. Judged per platform from any OS.
Verified releases	release_sign_test.go: TestATamperedManifestIsRefused	A manifest changed after signing is refused.
	release_sign_test.go: TestAManifestSignedByAnotherKeyIsRefused	A manifest signed by a key the build does not pin is refused.
	release_sign_test.go: TestAnUnsignedManifestIsNotRead	A manifest with no signature reaches neither the updater nor the local page.
	freeagent_managed_test.go: TestFaEnsurePyzVerifiesHash	An agent download whose SHA-256 differs from the manifest is refused and the installed agent's bytes are unchanged; afterwards, with the manifest unreachable, the installed path is still served.
	release_sign_agent_test.go: TestAnOlderSignedAgentManifestDoesNotDowngrade	An older agent version is neither downloaded nor installed.
	claims_update_test.go: TestADigestMismatchNeverSwapsTheBinary	A self-update whose download does not match the manifest's SHA-256 (another build's, empty, truncated) leaves the running binary byte-identical with nothing moved aside.
	claims_update_forward_test.go: TestTheForwardPathInstallsNothingButTheSignedTarget	With no approval, a signed manifest for a version other than the target, and an unsigned manifest for the target, are never downloaded from; a signed manifest naming the target is.
	install_sig_sh_test.go: TestInstallShRefusesAReleaseWhoseSignatureDoesNotVerify	Where the installer's openssl can check Ed25519, a manifest whose signature is another key's, another version's, malformed or missing is refused, and only one signed by a pinned release key passes; CI requires that openssl (PRIVATAE_REQUIRE_OPENSSL).
	not covered by a test	Where the release key is kept; the installer's SHA-256 check.
No secrets cached for git	claims_git_test.go: TestTheGitHelperFetchesATokenPerAuthAndStoresNothing	Each auth asks the daemon for a fresh token; store and erase do nothing; nothing is written to the bastion's config.
	claims_git_test.go: TestNoHelperOnTheMachineStoresTheForgeToken	A real git reading the forge through the proxy, with git's store helper configured before git-setup's lines, after them, or in the repository, authenticates with the host's token and writes it nowhere.
	claims_git_test.go: TestGitSetupResetsTheHelperChainBeforeItsOwnHelper	git-setup prints the reset of the forge's helper chain right before its own helper, for one host and for several.
	claims_git_test.go: TestWithoutTheAuthtypeCapabilityOnlyTheResetProtects	For a git without the authtype capability the helper answers the username and password, and only a helper configured before the reset is kept out.

deploy/check-claims.sh checks that every test this table cites exists in client-go; run it after renaming or removing a test.