Skip to content

test(incidents): address #52 reviewer notes — full benign coverage + snapshot caveat #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
askalf merged 1 commit into from
Jul 16, 2026
Merged

test(incidents): address #52 reviewer notes — full benign coverage + snapshot caveat #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions incidents/INCIDENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,3 +70,7 @@ Evidence:

*Fixtures are synthetic; attacker hosts are reserved `.example` names. Reproduce with*
`node incidents/run-incidents.mjs` *(add `PICKET_CDP=http://127.0.0.1:9222` to run through real Chrome).*

> **This file is a generated snapshot** — regenerate it with `npm run demo:incidents` after any
> change to the detector or fixtures. The verdicts are enforced for real in CI by
> `test/incidents.test.mjs`, which is the source of truth; this document is a human-readable receipt.
4 changes: 4 additions & 0 deletions incidents/run-incidents.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,10 @@ ${r.evidence.length ? 'Evidence:\n' + r.evidence.map((e) => `- \`${String(e).rep

*Fixtures are synthetic; attacker hosts are reserved \`.example\` names. Reproduce with*
\`node incidents/run-incidents.mjs\` *(add \`PICKET_CDP=http://127.0.0.1:9222\` to run through real Chrome).*

> **This file is a generated snapshot** — regenerate it with \`npm run demo:incidents\` after any
> change to the detector or fixtures. The verdicts are enforced for real in CI by
> \`test/incidents.test.mjs\`, which is the source of truth; this document is a human-readable receipt.
`;
writeFileSync(here('INCIDENTS.md'), md);
console.log(' wrote incidents/incidents.json and incidents/INCIDENTS.md\n');
Expand Down
3 changes: 3 additions & 0 deletions test/incidents.test.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,9 @@ const BENIGN = {
'legal ToS (supersede prior agreements)': '<p>These terms supersede all prior agreements and instructions between the parties.</p>',
'calendar app marketing (your calendar/contacts/emails)': '<p>Sync your calendar and manage your contacts. Your emails stay private.</p>',
'sysadmin docs (system directive / admin override)': '<p>Run the system directive to restart. The admin override flag skips confirmation.</p>',
'support macro (should not disclose ... to the user)': '<p>Agents should not disclose ticket internals to the user without a manager sign-off.</p>',
'privacy policy (your data / browsing history)': '<p>We never share your personal data. Your browsing history is yours. Export your data anytime.</p>',
'helpdesk (do not forward ... to anyone)': '<p>To reset your password, do not forward your reset code to anyone. We will never email you asking for it.</p>',
};
for (const [name, page] of Object.entries(BENIGN)) {
test(`FP discipline: benign "${name}" stays ALLOW`, async () => {
Expand Down