From fc3c1d51b1be9db6ba6ad286584fbc34bb305f38 Mon Sep 17 00:00:00 2001
From: Andrew Guschin <guschin@altlinux.org>
Date: Fri, 30 Oct 2026 03:32:00 +0400
Subject: Fix protected activation ordering and diagnostic review findings

---
 docs/validation/linux-vm.txt | 67 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 docs/validation/linux-vm.txt

(limited to 'docs/validation')

diff --git a/docs/validation/linux-vm.txt b/docs/validation/linux-vm.txt
new file mode 100644
index 0000000..604a6de
--- /dev/null
+++ b/docs/validation/linux-vm.txt
@@ -0,0 +1,67 @@
+Candidate SHA-256: 1da493619f430722743b1013faf70da0298d71df620662b6589ccc48e6a5873e
+Running: cli_acceptance-8ac5b3df5e4cd10a
+
+running 2 tests
+test subscription_url_cannot_be_passed_on_the_command_line ... ok
+test help_describes_the_controller_commands_without_contacting_services ... ok
+
+test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+
+Running: roentgen-2037e66e0f348630
+
+running 0 tests
+
+test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+
+Running: roentgen-0d6b8b6ef4b4cfd3
+
+running 0 tests
+
+test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+
+Running: controller_acceptance-7693ccc2191fcbcc
+
+running 8 tests
+test importing_requires_explicit_selection_and_enabling ... ok
+test denied_operations_leave_durable_state_unchanged ... ok
+test losing_a_selection_keeps_enabled_intent_and_blocks_without_replacement ... ok
+test mixed_base64_import_keeps_all_rows_and_prohibits_invalid_selection ... ok
+test failed_fetch_preserves_selection_but_an_empty_received_list_clears_it ... ok
+test persisted_intent_restores_under_protection_after_controller_restart ... ok
+test label_changes_keep_identity_but_duplicate_candidates_clear_selection ... ok
+test explicit_unset_and_deletion_never_disable_or_select_another_entry ... ok
+
+test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+
+Running: vm_guard_acceptance.py
+{
+  "passed": [
+    "private IPv4/IPv6 destinations stay direct on ports 53 and 18080",
+    "public IPv4/IPv6 destinations are blocked on ports 53 and 18080",
+    "UDP DNS follows the same IPv4/IPv6 private/public destination rule",
+    "classified incoming TCP connection survives guard replacement and toggles",
+    "preexisting outgoing TCP connection receives no established-flow exemption",
+    "explicit disabled guard restores ordinary direct routing"
+  ]
+}
+Running: vm_controller_acceptance.py
+{
+  "passed": [
+    "real HTTP import remains disabled/unselected and public CLI output omits credentials",
+    "noninteractive non-root mutation is denied with durable state unchanged",
+    "polkit site allow policy authorizes the actual ordinary bus caller",
+    "mixed update retains ordered invalid/unsupported rows and normalized identity",
+    "whole-document failure preserves selection while received empty list clears it",
+    "unsupported packaged Xray activation is rejected before enabled intent changes",
+    "service restart retains explicit selection and disabled intent",
+    "editor receives literal arguments and a user-owned private snapshot that is removed afterward",
+    "ordinary-user TUI renders, accepts navigation/help/quit, restores terminal modes, and preserves service intent",
+    "restart and scheduled retry preserve blocked intent after failed compatibility checks",
+    "restart with unset selection removes stale capture and keeps TUN forwarding blocked",
+    "explicit recovery persists disabled intent even with malformed editable TOML",
+    "subscription deletion clears selection without replacement",
+    "missing durable enabled state fails closed; only explicit recovery initializes disabled state",
+    "uninstall retains saved data by default, explicit purge removes it, and system Xray remains installed"
+  ]
+}
+ALL AVAILABLE VM TESTS PASSED
-- 
cgit v1.2.3