Testing Squatter

The standard module gate runs host-side Go tests, provider contract tests, package/install checks, PE inspection, and source-contract tests. Wine-backed runtime tests are separated because they need a Windows execution environment. The module CI gate also enforces one aggregate line-coverage result across Squatter's production Go code.

Primary Checks

task modules:test
task bazel:test -- //:modules_test

This gate covers the provider, shell, SMB pipe client, wire framing, transfer client, Squatter package checks, workspace module-install checks, PE inspection, and source layout contracts.

Go Coverage Ratchet

task modules:squatter:coverage

This task collects one LCOV report from the provider, shell, SMB pipe, wire, and file-transfer suites, then fails below 90% aggregate line coverage. The current result is 90.59% (5,340 of 5,895 instrumented lines). Windows payload and functional-harness sources are not hidden inside that Go percentage; their behavior is proven at the Wine boundary below.

Wine Runtime Checks

task modules:wine-test
task modules:wine-test-32
task modules:wine-test-64

The Wine suite runs C/C++ integration checks for command execution, echo, file transfer, frames, framing, nanopb round trips, and the GoogleTest smoke path for both 32-bit and 64-bit builds.

Docker Wine Functional Boundary

task modules:wine-docker-test

The Docker check receives the concrete x86 and x64 PE artifacts from Bazel, creates isolated WINEARCH=win32 and WINEARCH=win64 prefixes as a non-root user, and runs the real Go black-box functional harness against each payload. Its enforced matrix covers all 17 runtime modules on both ABIs (34 of 34 module/ABI cells), configured TCP bind, reverse TCP, and SMB named pipe transports on both ABIs (6 of 6 transport/ABI cells), and the console-fallback and real Service Control Manager lifecycles on both ABIs (4 of 4 service/ABI cells). Tests validate structured results and stream close/error lifecycles through the Squatter wire protocol rather than merely inspecting PE headers.

Mesh and PKI Integration

The Docker boundary uses the provider's real generation path to stamp each PE's transport configuration, applies a standard payload-tls-server credential stamp, and launches the resulting artifact under Wine. It surveys that endpoint into a stable Mesh node and route, opens a squatter+tls stream, verifies the stamped certificate against the generated root, negotiates TLS 1.3 directly with payload wolfSSL, and carries Squatter OPEN, DATA, and CLOSE frames through Mesh. This passes on both ABIs (2 of 2 Mesh/TLS cells). Each ABI also mutates one manifest byte and one stamped-state header byte in separate launches, proving the payload rejects either damaged form instead of starting or falling back to plaintext.

Additional provider tests cover multiple independent endpoints, conflicting routes, mismatched stamp envelopes, corrupt, expired, and oversized bundles, certificate/key consistency, and unstamped raw streams. The static payload checks require wolfSSL entry points and reject Schannel, Secur32, Crypt32, CNG, and CRT imports.

Evidence Report

task test:report refreshes line coverage, the full Docker Wine matrix, and the browsable test evidence consumed by the docs site. The report's Coverage tab shows each ratchet and E2E matrix count. Its Jobs tab opens the Squatter Wine E2E job by default and presents a human-oriented coverage matrix, per-ABI feature checklists, and timed test-case tables. Complete Docker, Wine, and Go output remains available in labeled, collapsible raw transcript appendices and through the complete-log link. The Suites tab presents repository rollups separately.

Static and Shape Checks

PE inspection verifies the produced payload shape, transport and PKI stamp markers, no-CRT boundary, and absence of Windows TLS/security runtime dependencies. Source-contract tests protect the expected Windows payload layout, wolfSSL implementation, and fail-closed stamp path. Manual static checks for the C tree live under modules/squatter/windows/src.

task bazel:test -- //modules/squatter/windows:squatter_x86_exe_pe_test
task bazel:test -- //modules/squatter/windows:source_contract_test
task bazel:build -- //modules/squatter/windows/src:static_analysis