# AEGIS — Security Testing Strategy

- **Document ID:** ARCH-38
- **Phase:** E.2 — Verification Methodology
- **Status:** Draft for review (post four-reviewer discipline)
- **Version:** 0.1
- **Date:** 2026-07-10
- **Owner:** Chief Security Architect

---

## 1. Purpose

Codify how AEGIS tests security. Complements ARCH-19 (Secure Coding) rules M-42..M-46 with a full testing strategy. Implements the "Verification Culture" mandate: tests are first-class, authored alongside architecture.

## 2. Test Pyramid (Security-Focused)

From most to least frequent:

| Tier | Purpose | Owner | Cadence |
|---|---|---|---|
| **T-1 Unit** | Function-level correctness | Author | Per commit |
| **T-2 Property** | Security invariants (attenuation, monotonicity, propagation) | Author + Reviewer | Per commit; CI-blocking (Golden Invariants) |
| **T-3 Fuzz** | Parser robustness at boundaries | Author + Fuzzing owner | Continuous; per-release regression |
| **T-4 Integration** | Cross-engine flows via Kernel | Subsystem + integration team | Per PR touching integration paths |
| **T-5 Contract** | Substitutable-substrate contracts | Subsystem + platform | Per PR + per topology |
| **T-6 Chaos / Failure-mode** | Engine + system behavior under failure | Ops + Recovery | Weekly + on schema change |
| **T-7 Threat Simulation** | Reproducible adversary scenarios | Red team + Threat modeling | Monthly + on incident |
| **T-8 Red Team** | Live scoped engagement | External + internal red | Quarterly + on major release |
| **T-9 External Audit** | Independent verification | External auditor | Annually |

## 3. Coverage Requirements

- **Kernel + Cryptographic Identity + Audit + Watchdog** — branch coverage ≥ 90%; mandatory property test coverage of Golden Invariants.
- **Other security-critical engines** — branch coverage ≥ 80%.
- **Standards + governance code** — coverage measured; targets per component.
- Coverage regressions block merge (Golden regression gate, ARCH-28 §4).

## 4. Fuzz Testing

- **Targets.** Ingest parsers (raw event, syslog RFCs, cloud audit formats, plugin manifest, ADR schema, capability tokens), AI response parsers (structured DraftRecommendation), audit-record parsers (used by verifier CLI).
- **Frameworks.** `cargo-fuzz` / `libfuzzer` for Rust; `jazzer.js` or similar for TS; targeted fuzz harnesses in test suite.
- **Continuous.** OSS-Fuzz-style continuous fuzzing on hot targets; new corpus checked in per release.

## 5. Property-Based Testing

Mandatory properties (Golden Invariants — ARCH-19 M-43a, ARCH-28 §4):
- Capability attenuation (delegation never broadens).
- Classification propagation (never silently downgraded).
- Audit hash-chain monotonicity.
- Revocation propagation (revoked tokens fail verify).
- Time monotonicity.
- Redaction correctness (secrets never surface in outputs).
- Watchdog quorum decision behavior.
- Evidence citation resolvability.

## 6. Contract Testing

Every substitutable substrate (Kafka/Redpanda, ClickHouse/OpenSearch, KMS providers, IdPs, AI providers) has a contract test suite. Deployment-time execution against actual chosen backend (ARCH-26 D-26-2).

## 7. Chaos Security Engineering (Overview — detailed in ARCH-46)

- Failure-mode injection per engine.
- Watchdog silencing scenarios.
- Network partition.
- KMS unavailability.
- Audit substrate slow-down (verifies fail-secure).
- Kernel Emergency Mode entry.

## 8. Test Independence

- Test authors ≠ code authors for security-critical Golden Invariants; second author from a different team.
- Test infrastructure (CI runners, fixtures) governed like config (ARCH-22).
- Test fixtures signed; fixture drift monitored.

## 9. Regression Prevention (Mandate #40)

- Every fixed security bug produces a regression test committed with the fix; test cannot be removed without ARCH-19-EXCEPTION.
- Regression suite runs on every PR + every release.

## 10. Independent Architecture Review

- **F-1.** *T-2 property authorship is hard.* Framework + examples + reviewer support; property library grows.
- **F-2.** *T-7/T-8 findings backlogged.* Findings become tickets with SLOs.

## 11. Adversarial Architect Review

- **A-1.** *Attacker disables a Golden test.* CI enforcement + auditor visibility + special-approver requirement.
- **A-2.** *Fuzz corpus poisoned.* Corpus versioned + signed; regression across corpus versions.
- **A-3.** *Coverage padding.* Reviewer + auditor sample tests for meaningfulness.

## 12. Operational Reliability Review

- **O-1.** Test-suite time budget documented; parallelised.
- **O-2.** Flaky test policy: quarantine → fix or delete quickly; flake rate a metric.
- **O-3.** Onboarding includes hands-on with property + fuzz frameworks.

## 13. Self-Critique

- **S-1.** *90% coverage is aspirational for TS async code.* Guidance + exceptions with debt entries.
- **S-2.** *Test authorship overhead is real.* Accepted; verification is first-class culture.

## 14. First-Target Analysis and Redesign

**Target:** flaky tests. Attackers and drift both benefit from tests that "sometimes pass" — teams learn to retry rather than fix. **Response:** flake rate is a security metric; quarantine SLO; recurring flakes become incidents; test-independence + external audit sample.

## 15. Decisions

### D-38-1. Nine-tier testing pyramid with Golden Invariants at T-2

- **Reason.** Structural regression prevention.

### D-38-2. Test independence for Golden Invariants

- **Reason.** Second-author defense against author-blind spots.

## 16. Change Log

- **0.1 (2026-07-10)** — Initial draft.