From PLAN.md step 10. Spec: docs/spec.md. Phase 1.
Files: tests/integration/test_canaries.py, tests/integration/test_reproducibility.py, tests/fixtures/README.md, .github/workflows/ci.yml
Changes: Wire Goal 5 and Goal 2 into CI as build-failing gates. Source the malicious canary and record its origin and licence.
Test that proves it: benign canary produces zero labels — any label fails the build (Goal 5, and the standing FP review for every wholesale-admitted source including pawpatrules). Malicious canary produces at least one label. Reproducibility: two full --offline runs against the same capture and pinned snapshot are identical after canonicalisation, excluding only started_at/finished_at/duration_seconds and packet_filter.log (Goal 2). Fault-injection test for every Phase 1 loss condition in spec §11.
Depends on: 9. Note: the malicious canary is the one unresolved input (spec §14); if it slips, the benign canary and reproducibility gates land without it and the sensitivity test follows.
From
PLAN.mdstep 10. Spec:docs/spec.md. Phase 1.Files:
tests/integration/test_canaries.py,tests/integration/test_reproducibility.py,tests/fixtures/README.md,.github/workflows/ci.ymlChanges: Wire Goal 5 and Goal 2 into CI as build-failing gates. Source the malicious canary and record its origin and licence.
Test that proves it: benign canary produces zero labels — any label fails the build (Goal 5, and the standing FP review for every wholesale-admitted source including
pawpatrules). Malicious canary produces at least one label. Reproducibility: two full--offlineruns against the same capture and pinned snapshot are identical after canonicalisation, excluding onlystarted_at/finished_at/duration_secondsandpacket_filter.log(Goal 2). Fault-injection test for every Phase 1 loss condition in spec §11.Depends on: 9. Note: the malicious canary is the one unresolved input (spec §14); if it slips, the benign canary and reproducibility gates land without it and the sensitivity test follows.