# Security and recovery verification

Run tests on synthetic projects and isolated installation/data directories. Do not test against employee schedules or client repositories.

## Required checks

- Local context preparation and host-native task execution without any administration service; reference hash drift and direct internal-worker misuse fail clearly.
- Project and source traversal, links, Windows aliases, secret material, external instructions and cross-project identifiers remain rejected or quarantined.
- Effective GitHub read/write rights, authentication failure, confirmed denial, ambiguous 404, revocation and offline operation.
- MCP tool discovery followed by one scoped read; configured-only and missing MCP never count as connected.
- Immutable source identity/revision, duplicate import, conflicting content and lock contention.
- Context synchronization preserves concurrent edits; network retry is explicit; allowlisted files and every outgoing commit are scanned before publication.
- Installation/update/rollback/uninstall honor the ownership ledger, reject changed user files and recover partial transactions.
- Daily update cache, disabled setting, one notice/version, native-channel suppression and harmless network failures. Download/install/activation remain separate.
- Final package scan excludes client projects, credentials, source fixtures, local settings and old runtime automation.

## Commands

```sh
npm run build --prefix platform
npm run test:compiled --prefix platform
npm run check:generated --prefix platform
npm run check:knowledge --prefix platform
npm run check:structural --prefix platform
npm run pack:local --prefix platform
```

Use Node 20/22 and pinned npm 10.9.4. The test runner uses synthetic fixtures; it does not authorize real repository creation, pushes, installs in a real host home or customer source reads. Generated files, compiler checks and installer doctor prove different properties from live model execution. Record each separately in verification.md.

The host's sandbox and permissions enforce model/tool access. The local context manifest documents scopes, source trust and references; it is not a cryptographic authority over arbitrary host actions. Parent-worker checks prevent accidental routing errors, not hostile users who can edit local files. There is no DRM or remote deletion.