Test report
Shadow agent, L360 operations, autopilot, dependency twin, predictive resilience and the live ecosystem, together with the regression suite for every earlier layer.
329 automated checks and page loads passed. 6 defects were found by this testing and fixed; each is listed in section 9 with the regression test that now guards it.
1. Executive summary
Every layer added in this engagement: the shadow agent, the L360 operations layer built from the client's v6 to v9 scripts and receipt logs, the autopilot and demo world, the sovereign dependency twin, predictive resilience, executive questions, and the live ecosystem graph. The foundation layers (HVT governance, rules, OTP kernel, receipts vault, continuity, model routing, satellite lab, SSOS mesh) were covered by the regression suite, re-run in full.
Five distinct tiers: Property tests invariant under any input; Differential tests against real Python serialisation and the physical HVT gateway; Negative & Security tests covering tampering, injection, and permissions; a 45-minute simulated soak with human intervention; and a full browser sweep across multiple roles and viewports.
The client's v8 and v9 receipt logs verify (8/8 and 11/11) and every decision replays identically through our port of their switch. 190/190 edits caught at the right receipt. The serialiser matches Python on 300/300 identical requests. The shadow agent's pre-flight matched the real HVT outcome on 60/60 requests and flagged 10/10 of the intended proposals, with 0/2 false alarms. In the soak, no effect was executed without human sign-off and the autopilot never approved or recertified unauthorized assets.
Network, orbit, telemetry readings and dependency cascades are modeled or simulated to prove deterministic compliance with stated specifications. Tests confirm software behaves correctly on its formal models. Real-world operator hardware, production LLM weights, and third-party penetration testing are detailed separately in Section 9.
2. Scope and method
SECTION 02| Layer | What was exercised | Report Section |
|---|---|---|
| Client receipt logs (v8, v9) | Verification, Python-exact serialisation, 190 single-field tamper attempts, reorder and deletion, reference-switch replay, decision matrix | Section 3 |
| L360 network model | 541-node mesh, routing properties, five stress scenarios, link exposure, 531-node compromise sweep | Section 3 |
| L360 live governance | Seven incident types, approvals, rejections, expiry, recertification, identity reissue, persistence, ledger integrity | Section 3 |
| Shadow agent | Authority limits, 13 review cases, pre-flight accuracy over 60 requests in 5 agent states, briefings, annotation | Section 4 |
| Dependency twin | Health arithmetic, cascade timing, monotonicity, cycles, validation, live binding | Section 4 |
| Resilience, executive questions, graph | Cycle, decision window, eight questions, graph integrity, demo world | Section 4 |
| Security | Permission matrix, fuzzing, injection, traversal, secrets, authentication | Section 5 |
| Performance | Model compute times, API latency, 100 sequential incidents | Section 6 |
| Soak simulation | 45 simulated minutes with autopilot, agents, shadow and a scripted human; 10 invariants each minute | Section 7 |
| User interface | 28 pages x 5 roles, 18 flows, 4 widths | Section 8 |
| Earlier layers | Existing regression suite, 71 tests in 13 files | Section 10 |
node --test "test/*.test.mjs", node tools/verify.mjs, node tools/ui-sweep.mjs, node tools/build-report.mjs3. Results by layer
SECTION 03Client receipt logs (L360 v8, v9) 10/10 PASS
The supplied logs, the Python-compatible serialiser, tamper detection and replay through a port of the client switch.
L360 network model (SSOS mesh) 10/10 PASS
Routing invariants, stress scenarios, exposure and the compromised-node sweep on the 541-node modeled mesh.
L360 live governance flow 14/14 PASS
Network AI, ground AI and satellites as real HVT systems: every incident, approval, refusal, recovery and the evidence it leaves.
4. Shadow agent, dependency twin, resilience
SECTION 04Shadow agent 26/26 PASS
Authority limits, review accuracy (detection and false positives), pre-flight prediction accuracy against the real HVT gateway, briefings.
Dependency twin 11/11 PASS
Health arithmetic, cascade timing, monotonicity, cycle safety, input validation and binding to live systems.
Resilience, executive questions and live graph 8/8 PASS
Cycle, decision windows, distinctions, the eight questions and the integrity of the live graph.
5. Security
SECTION 05Role matrix over every new endpoint, malformed and hostile input, oversized bodies, and the guarantee that nothing returns a server error.
6. Performance
SECTION 06Build and compute times for the heavy models and API latency under repeated calls (single process, this machine).
| Operation | Median | 95th percentile | Max | Runs |
|---|---|---|---|---|
| Mesh build (541 nodes, 2,173 links) | 4.1 ms | 4.7 ms | 4.7 ms | 5 |
| One routing evaluation | 0.3 ms | 0.4 ms | 0.7 ms | 50 |
| Five stress scenarios x 3 snapshots | 32.4 ms | 32.4 ms | 32.4 ms | 1 |
| Sweep of 531 single-node quarantines | 174 ms | 174 ms | 174 ms | 1 |
| Link exposure | 3.1 ms | 4.6 ms | 4.6 ms | 3 |
| GET /api/world (populated demo world) | 89 ms | 103.8 ms | 136.2 ms | 60 |
| GET /api/chairman (populated demo world) | 82.2 ms | 93.3 ms | 95.1 ms | 60 |
| GET /api/l360 (populated demo world) | 60.3 ms | 74.7 ms | 125.6 ms | 60 |
| GET /api/l360/map (populated demo world) | 54.5 ms | 69.9 ms | 110.8 ms | 60 |
| GET /api/deptwin (populated demo world) | 67 ms | 68.7 ms | 78.8 ms | 60 |
| GET /api/shadow (populated demo world) | 60.9 ms | 72.4 ms | 84.9 ms | 60 |
| GET /api/resilience (populated demo world) | 47.5 ms | 60.4 ms | 105.5 ms | 60 |
| GET /api/autopilot (populated demo world) | 60.5 ms | 64.6 ms | 92.9 ms | 60 |
7. Soak simulation
SECTION 0745 simulated minutes of the whole platform at one tick per second with a scripted human who approves, rejects and recertifies. Invariants are checked every minute. 10/10 checks PASS.
| What the simulated 45 minutes produced | Value |
|---|---|
| Ticks | 2,700 (one per simulated second) |
| L360 incidents run by the autopilot | 30 |
| Agent runs / proposals made | 255 / 155 (from the ledger) |
| HVT decisions | allowed 352, needed a human 71, denied 110, held 31 |
| Human actions (scripted) | 56 approvals executed, 15 rejections, 21 recertifications; peak queue 6 |
| Shadow reviews (agents, approvals, L360) | 253: agree 43, caution 200, disagree 10 |
| L360 steps and outcomes | 86: ESCALATE 7, HOLD 22, REVOKE 12, ALLOW 45; reference switch agrees on 86/86 |
| OTP kernel outcomes | VERIFIED 97 |
| Consequence receipts | verified 97, unverified 0, mismatched 0 |
| Configuration changes applied | 51 |
| Ledger | 3,827 entries, hash chain intact |
8. The Executive's Eight Questions (Answered from Live Data)
SECTION 0898 alert(s) and 2 governed event(s) recently. Desalination reservoir_days_cover became OK; network_pressure_bar became OK.
10 dependency entity(ies) hurt, 0 L360 node(s) out of service. Food supply (60%), Electricity grid (74%), Desalination (77%), Emergency services (84%).
1 knock-on effect(s) projected. Ground stations in ~2 h (after Electricity grid). Oil and LNG terminal reaches critical in ~48s (low confidence).
Critical services are exposed: Food supply, Electricity grid, Desalination water supply, Emergency & public services (all criticality 5/5).
Shortest decision window: already closed for Oil & LNG export and Desalination network. Strategic grain reserve: 99s of decision time left.
15 governed proposal(s) staged, 10 entity(ies) with alternatives (e.g., L360 quarantine GEO-0E, switch tanker water supply in 48h, solar generation in 12h).
15 approval(s) for an approver, 0 recertification(s) for a governor (e.g., Approver sign-off on resource.configure for grid and desalination).
3 verified receipt(s), 39 shadow review(s), ledger intact. Readings and cascades are MODELLED/simulated; 0 receipts contradicted by independent observation.
9. Defects found and fixed, findings, limits
SECTION 09| ID | Severity | Area | Defect | Found by | Fix | Guarded by |
|---|---|---|---|---|---|---|
| D1 | High | API | A request whose JSON body was null, an array, a string or a number crashed the handler and returned HTTP 500 on every new endpoint. | Fuzzing (201 hostile requests) | Body must be a JSON object; anything else returns 400 bad_body. | regressions test, fuzz check |
| D2 | Medium | Client receipt verifier | Verifying a receipt list containing null items or a null evidence field threw an exception (HTTP 500) instead of reporting a broken chain. | Fuzzing the verify endpoint | Verifier and replay treat malformed receipts as a broken chain; no exception. | regressions test, fuzz check |
| D3 | Medium | Shadow agent | A proposal to change a setting on a system that does not exist was rated AGREE (the justification check was skipped when the system was not found). | Review accuracy cases (13 cases) | An unknown system is now a failed justification check, so the verdict is DISAGREE. | regressions test, review check |
| D4 | High | Dependency twin | With circular dependencies the health of an entity depended on the order in which entities were evaluated (a result computed while the cycle was being cut was cached). A dependent of a failed entity could show as healthy. | Cycle-safety test | Health is now the fixed point of the dependency equations: it starts at each entity's own health and only decreases, so it converges and is order independent. | regressions test, cycle check |
| D5 | Low | L360 comparison column | The comparison with the client's reference switch was judged after the effect had been applied, so restore authority showed 'HOLD, differs' in 16 of 97 soak steps (83% agreement). | Soak simulation (agreement check, target 90%) | The reference is now judged on the state the request saw, before any effect. Agreement is 100%. | regressions test, soak check |
| D6 | Low | User interface | The Shadow page overflowed horizontally at 800 px wide, and the Live ecosystem and Dependency twin pages kept two columns at phone width so the graph was unreadably small. | Responsive sweep (4 widths x 4 pages) | Tables scroll inside their card and the two-column layout becomes one column below 900 px. | responsive sweep |
- Head truncation: The client receipt chain cannot detect removal of the newest receipts: a truncated log still verifies. An external head anchor (such as this platform's ledger head) is needed.
- Demo key signature: The client receipt format signs with a published demo key. Anyone holding it can forge a complete valid chain; real use needs hardware-backed keys and independent witnesses (the client's own scripts say so).
- Approver attribution: The client receipts do not record the approver or the affected nodes, so approval cannot be bound to a person from the receipt alone. This platform's receipts do.
Model fidelity: The constellation, link budget, latency, readings and dependency graph are modeled or simulated. Tests show internal consistency and physical plausibility, not agreement with a real network.
Real language models: Runs used the built-in rules engine. Claude and other providers were not called, so output quality of live model analysis is untested here.
Real hardware and operators: Nothing controls hardware; no real satellite, grid, port or plant was connected.
Independent assurance: No external penetration test, red team, code audit or certification. The evidence status table reports "Certified: 0" for the same reason.
Scale and concurrency: One process, a handful of systems and users. No load test with many concurrent sessions.
Simulator pace: The simulated feed develops incidents within 1 to 3 minutes; with the default 5-minute time to adapt, almost every decision window reads "closed". Set time to adapt to 30-60s in Predictive resilience to see open windows.
10. Appendix: regression suite (all layers)
SECTION 1071 of 71 tests passed across 13 files.
| File | Layer | Tests | Passed |
|---|---|---|---|
| agents.test.mjs | AI agents under HVT | 7 | 7/7 |
| continuity.test.mjs | Continuity and crisis | 5 | 5/5 |
| deploy.test.mjs | Deployment and hardening | 1 | 1/1 |
| hvt.test.mjs | HVT governance core | 9 | 9/9 |
| layers1.test.mjs | Ecosystem layers (charter, intelligence, twins, partners) | 2 | 2/2 |
| layers2.test.mjs | Ecosystem layers (missions, domains) | 5 | 5/5 |
| mvp.test.mjs | Platform core, OTP, interlink, ledger | 9 | 9/9 |
| router.test.mjs | Model routing | 4 | 4/4 |
| rules.test.mjs | Rules and rulebooks | 6 | 6/6 |
| satlab.test.mjs | Satellite lab | 5 | 5/5 |
| shadow.test.mjs | Shadow agent, L360, autopilot, dependency twin, resilience | 7 | 7/7 |
| ssos.test.mjs | SSOS, mesh, simulated feed, traffic, photonic | 8 | 8/8 |
| vault.test.mjs | Receipts and vault | 3 | 3/3 |