Appearance
Integration
Integration suites validate cross-domain, end-to-end flows that combine multiple Canonical tests to prove precedence, fail‑closed behavior, and consistent enforcement across channels. These suites are flow-centric; applications are incidental test vehicles.
ID convention: INTEG-[SHORT-THEME]-[NN]
- SHORT-THEME: 2–3 word UPPERCASE kebab-case slug (for example,
PROXY-FAIL) - NN: 2‑digit sequence within the flow family
Suites Summary
| ID | Canonical IDs | Flow | Procedure | Expected Outcome |
|---|---|---|---|---|
| INTEG-PROXY-FAIL-01 | NET-EGRESS-09, NET-EGRESS-10, DM-WEB-04 | Proxy Fail‑Closed Uploads | Stop proxy or present wrong CA; attempt browser upload (including chunked). | Denied; no direct fallback; audit shows proxyEnforced: true with reason: "proxyUnavailable" or "pinningFailed"; uploads action: "deny". |
| INTEG-FILE-ASSOC-01 | HARD-FILES-ASSOC-02, DM-WEB-02, NET-EGRESS-05, NET-EGRESS-06 | Files → Open With → Browser → Upload | From Files tab, Open With → Browser; attempt upload; try env/proxy bypass. | Routing authorized; upload denied; bypass fails; audit action: "deny", proxyEnforced: true, relevant rule.id. |
| INTEG-DNS-BYPASS-01 | NET-DNS-01, NET-EGRESS-01, DM-WEB-02 | DNS/Direct‑IP Uploads Blocked | Upload to DNS‑blocked domain, then direct IP. | Both denied; no fallback; audit action: "deny", proxyEnforced: true, rule.id. |
| INTEG-IPV6-PARITY-01 | NET-EGRESS-05, NET-EGRESS-06, DM-WEB-02 | IPv6 Parity for Web Uploads | Upload over IPv4, then repeat over IPv6. | Both denied; same semantics; audit parity including ipVersion. |
| INTEG-PAC-FALLBACK-01 | NET-EGRESS-08, NET-EGRESS-12, NET-EGRESS-10 | PAC/WPAD Hygiene — No Direct Fallback | Break PAC/WPAD; attempt HTTPS/CONNECT and direct paths. | Denied; proxyEnforced: true; reason reflects PAC/WPAD failure or pinning. |
| INTEG-DM-PRECEDENCE-01 | DM-CLIP-01, DM-DRAG-02, DM-SCREEN-04, DM-SCREEN-07 | Cross‑Channel Precedence | Attempt same content via clipboard, drag‑and‑drop, screen. | All denied; consistent rule.id, classification.normalized[]; screen shows watermarkTemplateUsed if enabled. |
| INTEG-DEVICE-UPLOAD-01 | DM-DEVICE-05, DM-DEVICE-02, DM-WEB-02, NET-EGRESS-05 | USB to Browser Upload Block | Attach USB; attempt enumerate/write; attempt upload of device‑sourced file. | Device actions denied; upload denied; proxy bypass fails; audit shows deny with proxyEnforced: true. |
| INTEG-PROC-REDACT-01 | DM-PROCEXT-01, DM-PROCEXT-02, DM-PROCEXT-03, DM-WEB-02 | External Processor Redaction Chain | Send to processor; attempt to upload processed output. | Denied or processed per policy; audit shows processor provenance, classification.normalized[], integrity.hash. |
| INTEG-AUDIT-FAIL-01 | HARD-POLICY-03, NET-EGRESS-01, DM-WEB-02 | Audit Failure Gated, Fail‑Closed Egress | Disable audit temporarily; attempt launch and upload. | Launch/egress gated; upload denied; audit action: "deny" with reason for gating; integrity present for recorded attempts. |
| INTEG-POLICY-ROLLBACK-01 | HARD-POLICY-02, HARD-POLICY-08, HARD-POLICY-09, HARD-POLICY-10, NET-EGRESS-01 | Policy Rollback/Identity Tamper Blocks Launch and Egress | Present tampered/rolled‑back policy; attempt launch + egress. | Launch denied; no egress; audit action: "deny", reason indicates identity/rollback failure. |
| INTEG-NAMED-NET-HTTP-01 | NET-ISOLATE-04, DM-WEB-02, NET-EGRESS-10 | Named Network HTTP Access | Sandbox A runs python -m http.server; Sandbox B on same --network browses and downloads; host and other segment cannot connect. | Intra‑segment allow; downloads contained; uploads denied or processed; host/cross‑segment denied. |