ChronoSeal Testing Strategy

ChronoSeal maintains a security-focused test suite designed to validate cryptographic correctness, client/server deterministic parity, and sandbox limits.

As of v1.0.2, the project contains 100 passing tests across the workspaces:

Workspace Crate	Test Count	Validation Scope
`chronoseal-server`	38	API handlers, rate limiters, storage persistence, and fingerprint constraints
`chronoseal-wasm`	24	Key generation, signing, VM instruction runners, and state transitions
`shared` (unit tests)	36	Blake3 folding, gene mutation opcodes, and program serializations
`shared` (property tests)	2	Proptest input fuzzing to confirm panic-resistance invariants
Total	100	Comprehensive Attestation Coverage

Core Test Categories

1. Browser Fingerprint Hardening (v1.0.2)

Enforces strict limits on metadata values to protect the attestation pipeline from adversarial inputs. Tests assert limits like CPU count (1..=256), device pixel ratio, aspect ratio bounds, and the rejection of malformed or non-finite values (NaN and Infinity).

2. Session Lifecycle & Replay Resistance

Verifies session establishing, expiration rules, and invalid key boundaries. Critical checks assert that repeating a successful heartbeat or tampering with the synthetic gene commitment leads to immediate rejection.

3. Mathematical VM Engine Parity

Evaluates VM opcode parsing, stack underflow boundaries, and wrapping arithmetic calculations (XOR, AND, Rotate, Add, Sub, Mul). Tests run the VM state engine across both WebAssembly and server Rust environments to confirm absolute mathematical consensus.

4. Synthetic Gene Mutation Parity

Validates state vector updates across seeded RNG sequences, table-driven inputs, and random program arrays to assert that the client and server gene buffers never drift.

5. Property-Based Fuzzing

Leverages proptest to exercise the VM execution and gene serialization paths under billions of random input vectors, guaranteeing that the daemon never panics on malformed network payloads.

Running the Test Suite

Run the entire workspace suite:

Shell

cargo test --workspace

Run crate-specific test sets:

Shell

# Test server components only
cargo test -p chronoseal-server

# Test fingerprint hardening suite only
cargo test -p chronoseal-server fingerprint

# Test WASM modules only
cargo test -p chronoseal-wasm

# Test shared libraries and property tests
cargo test -p shared

Release-Blocking Security Invariants

The following unit tests guard critical security boundaries. Any failure in these tests blocks release compilation:

test_replay_attack_is_rejected: Protects against session hijack.
test_mutation_commitment_tamper_is_rejected: Ensures gene commitment authenticity.
test_vm_execute_never_panics: Ensures VM robustness against invalid opcodes.
rejects_invalid_aspect_ratios / rejects_invalid_hardware_concurrency: Protects against fingerprint parser exploits.