1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
Candidate SHA-256: 991a9548054179821055a063dd8134637b727fb06108c62bcbd2214015cebf03
xray-core-26.3.27-alt2.x86_64
libnftnl-1.3.2-alt1.x86_64
libmnl-1.0.5-alt2.d24c886.x86_64
Running: cli_acceptance-8ac5b3df5e4cd10a
running 2 tests
test subscription_url_cannot_be_passed_on_the_command_line ... ok
test help_describes_the_controller_commands_without_contacting_services ... ok
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
Running: roentgen-2037e66e0f348630
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
Running: diagnostics_acceptance-f430a3a9a6964e8f
running 10 tests
test cancelling_a_bus_diagnostic_stops_it_without_changing_proxy_intent ... ok
test cli_exits_unsuccessfully_when_the_provider_rate_limits_a_diagnostic ... ok
test controller_ping_uses_the_selected_trojan_path_with_verified_tls_without_enabling ... ok
test controller_records_a_failed_check_when_a_previously_working_probe_cannot_start ... ok
test controller_rejects_an_untrusted_target_or_local_proxy_without_direct_fallback ... ok
test controller_rejects_redirects_oversized_ping_and_error_downloads ... ok
test controller_rejects_streamed_json_errors_without_misclassifying_payload_fields ... ok
test controller_speed_stops_at_the_first_byte_or_duration_limit ... ok
test provider_retry_after_blocks_manual_ping_and_speed_for_both_header_forms ... ok
test scheduled_checks_use_only_selection_never_run_speed_and_do_not_overlap ... ok
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.82s
Running: controller_acceptance-7693ccc2191fcbcc
running 8 tests
test denied_operations_leave_durable_state_unchanged ... ok
test importing_requires_explicit_selection_and_enabling ... ok
test mixed_base64_import_keeps_all_rows_and_prohibits_invalid_selection ... ok
test losing_a_selection_keeps_enabled_intent_and_blocks_without_replacement ... ok
test failed_fetch_preserves_selection_but_an_empty_received_list_clears_it ... ok
test label_changes_keep_identity_but_duplicate_candidates_clear_selection ... ok
test persisted_intent_restores_under_protection_after_controller_restart ... ok
test explicit_unset_and_deletion_never_disable_or_select_another_entry ... ok
test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
Running: roentgen-0d6b8b6ef4b4cfd3
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
Running: vm_guard_acceptance.py
{
"passed": [
"private IPv4/IPv6 destinations stay direct on ports 53 and 18080",
"public IPv4/IPv6 destinations are blocked on ports 53 and 18080",
"UDP DNS follows the same IPv4/IPv6 private/public destination rule",
"classified incoming TCP connection survives guard replacement and toggles",
"preexisting outgoing TCP connection receives no established-flow exemption",
"explicit disabled guard restores ordinary direct routing"
]
}
Running: vm_boot_acceptance.py hang
{
"passed": [
"guard remains armed while controller is stopped",
"explicit recovery terminates a hung controller and persists disabled intent before releasing protection"
],
"recovery_seconds": 0.03
}
Running: vm_boot_acceptance.py prepare-boot
Enabled/blocked boot fixture prepared; reboot the VM next.
Rebooting the authorized ALT VM.
Running: vm_boot_acceptance.py verify-boot
{
"passed": [
"normal reboot restores enabled/blocked intent",
"guard becomes active before NetworkManager",
"SIGKILL does not release guard protection",
"systemd restarts the controller without disabling intent"
],
"guard_active_us": 5099817,
"network_manager_active_us": 5246105
}
Running: vm_controller_acceptance.py
{
"passed": [
"real HTTP import remains disabled/unselected and public CLI output omits credentials",
"noninteractive non-root mutation is denied with durable state unchanged",
"terminal polkit prompts under an ordinary user; cancellation leaves selection, intent and generation unchanged",
"terminal polkit rejects a wrong password and authorizes the real mutation after valid VM-fixture PAM authentication",
"polkit site allow policy authorizes the actual ordinary bus caller",
"mixed update retains ordered invalid/unsupported rows and normalized identity",
"whole-document failure preserves selection while received empty list clears it",
"unsupported packaged Xray activation is rejected before enabled intent changes",
"service restart retains explicit selection and disabled intent",
"editor receives literal arguments and a user-owned private snapshot that is removed afterward",
"ordinary-user TUI renders, accepts navigation/help/quit, restores terminal modes, and preserves service intent",
"restart and scheduled retry preserve blocked intent after failed compatibility checks",
"restart with unset selection removes stale capture and keeps TUN forwarding blocked",
"explicit recovery persists disabled intent even with malformed editable TOML",
"subscription deletion clears selection without replacement",
"missing durable enabled state fails closed; only explicit recovery initializes disabled state",
"uninstall retains saved data by default, explicit purge removes it, and system Xray remains installed"
]
}
ALL AVAILABLE VM TESTS PASSED: 20 Rust acceptance tests and 29 VM workflow checks
Post-validation restoration: roentgen-before-implementation checkpoint restored.
SSH/PVE guest identity verified by the reset helper.
Read-only guest checks confirmed no product executable, configuration, state,
fixture accounts, roentgen nftables table, or test-installed Xray package remained.
|
