# Evolution 18 — test plan

Acceptance criteria were written before the implementation was considered done; each maps to something that runs.

| # | Criterion | Where it is tested |
|---|---|---|
| A1 | No action executes without an authorization signed by a pinned approver key and bound to its exact effect set, tool, passport version, runtime, policy version | corpus AB-*, AD-*, PV-01/02 |
| A2 | A changed effect, object or object state invalidates the authorization | AB-01/02, TT-01..04, CR-06 |
| A3 | A swap after admission cannot redirect a pinned execution | TT-05..08; `test_handle_executor_acts_on_the_pinned_object_only` |
| A4 | Authority that ends before the commit point stops the effect | CR-02, CR-04, CR-05; `test_commit_guard_runs_before_the_effect` |
| A5 | A missing, dead, incomplete, same-process or shared-key sensor never raises a level | OC-03..07, EO-06, IE-04; property tests |
| A6 | An undeclared effect, an absent declared effect, or a violated postcondition is FAILED | EO-01..05, AD-01, PE-01 |
| A7 | Contradicting sensors never give VERIFIED | CX-01..03; property test |
| A8 | The verifier's result does not depend on the enforcer's stated level or verdict | OC-02, IE-05, CO-02..05, RC-03; differential property test |
| A9 | Temporal proximity is never a causal link | CO-02; `test_graph_temporal_edge_is_not_a_causal_path` |
| A10 | An authorization admits one execution, across threads and restarts | AB-08, PV-03, PE-03; `test_once_ledger_survives_restart_and_races` |
| A11 | A crash between effect and evidence is AMBIGUOUS, not retried | PE-03 |
| A12 | A partial repair is never reported as a full one | RC-01..04 |
| A13 | Honest actions are VERIFIED (no false block) | EC-01, PE-02, RC-01, end-to-end test |
| A14 | Documented limits are stated by the receipt | EO-07, TT-09 |

Method: real files in a per-scenario temporary directory; real sensor processes; deterministic race injection through
three hooks in the bridge (`after_admission`, `before_commit`, `after_execute`) instead of timing; a manual clock for
expiry; `threading.Barrier` for the two concurrency tests; hypothesis for the grading rules (300 examples per
property); mutation of 26 security checks, each run against the whole corpus in its own process.

Bounds: this host is a production VPS that had an out-of-memory incident earlier the same day from another session's
test. Every run here is under `ulimit -v` 4 GB, serial, with trees of at most ~1,000 small files.

Not planned and not done: fuzzing of the verifier's JSON parser; multi-host tests; tests under a second uid; tests with
a privileged kernel sensor; any test against a live service.