Runtime invariant verification

Use current INVARIANTS.md and source, not historical guard diagrams. Read the shared guard, route inventory, shim and execution boundaries before testing. This checks the supplied implementation; it does not authorize policy changes.

Boundary	Current contract	Runnable evidence
I6	Server/common/LLM/shim never call pipeline code; only shim spawns the whitelisted child	cargo test --locked --test invariant_guard
Requests	Rate, exact origin, direct loopback/no proxy, account/RBAC, mutation CSRF	cargo test --locked --test auth_guards --test secure_portal --test security_headers
Browser arguments	Fixed check-profile names, bounded arguments, no arbitrary command; reason/confirm explicit	cargo test --locked --test shim_and_agent_routes
Default configuration	Master/deepagent/clone-write gates false; fresh auth/TLS and web settings true, empty URL allowlist; existing choices retained; quoted security switches invalid	cargo test --locked --test invariant_guard --test common_layer
Mutation policy	Reloaded write gates, clone jail, exact edits and reviewed-tree approval before commit/push/publication	cargo test --locked --test write_policy --test real_repo_loop
Web evidence	Exact/wildcard permission, checked DNS pinning, bounded retrieval and current-policy revocation	cargo test --locked --test panels --test web_research
Native TLS	Owned handshake, exact certificate/origin and platform trust validation	Desktop tests plus actual native acceptance recorded in the PR body

The optional harness API key grants no authority and cannot bypass login. writes_enabled: true and mode write do not arm the combined coding policy. Public login/minimal status still get early guards. Web selection, chat sessions, detached jobs and schedules are private to the account (unassigned legacy records stay quarantined until explicit adoption); persona, pinned notes, model selection, spend and agentic run records remain shared portal resources.

Run with isolated homes and provider credentials excluded. Check Cargo's own exit status and every failure/skip. Required native sandbox tests may need the operator's normal terminal rather than an outer restricted sandbox; never weaken the application profile. Backend/fixture tests do not prove native GUI or live model behavior. Record tested source, commands, outcomes and unresolved limits.