Battle Tested

Current status

Campaign environment

Linux amd64 container; Go 1.25; Node 22; Nift source/output verification; pure-Go SQLite; race instrumentation; and CGO-free cross-builds for Linux, macOS and Windows on amd64 and arm64. The final pre-BH17 baselines were Warden 14969f3, website source 9adc6f7 and generated website 0c83e00.

Evidence standard

• a named threat and reproducible adversarial test;
• a regression for every repaired finding;
• full Go, race, vet, frontend and Nift gates;
• exact commits, documentation and retained limitations.

BH00 evidence

All 35 API routes register through one policy inventory and carry exactly one public, session, capability or WebSocket boundary. A regression rejects duplicate, unclassified and capability-less authoritative routes. The threat model records browser, proxy, filesystem, PTY, provider, SQLite and OS-user boundaries.

BH01 evidence

All API request bodies now have a 64 MiB outer bound in addition to smaller handler-specific limits. Unsupported content encodings are rejected before handlers run, API responses are non-cacheable, error responses retain browser security headers, and request headers are capped at 1 MiB.

BH02 evidence

Persistent browser sessions are capped at 32 per account, with expired and oldest sessions pruned during creation. Every authenticated request revalidates both the account and the exact login identity, so removed or disabled identities lose access immediately. Tests cover cap enforcement and identity-state revocation.

BH03 evidence

TOTP login challenges are IP-bound and consumed on their first verification attempt, preventing replay even after an invalid cross-IP attempt. Google OAuth state is single-use and capped at 128 pending flows. Warden accepts a Google profile only when it has an immutable subject and verified email. Tests cover replay, IP binding and state exhaustion.

BH04 evidence

Every capability-classified route is exercised against a session that lacks its required capability. The same issued session is denied immediately after its role loses authority, administrative subroutes derive explicit capabilities, and account-owned session identifiers cannot be revoked by another account.

BH05 evidence

Trusted proxy data is accepted only from a loopback peer. Multi-valued forwarded protocols fail closed, only the first forwarded client hop is considered, and invalid values fall back safely. Terminal WebSockets require a valid session, capability, CSRF token and an Origin whose scheme and host both match the effective request origin. Tests prove CSRF and origin rejection occurs before terminal work begins.

BH06 evidence

Archive extraction now preflights entry count, expanded size, expansion ratio, paths and file types before writing. Content is extracted into a private sibling staging directory and published by rename only after every entry succeeds. Existing targets are never merged or overwritten. Copy and compression refuse symlinks and special files, with regression cases for zip-slip, high-ratio archives and symlink chains.

BH07 evidence

Git operations use a fixed executable and argument arrays, insert -- before user-controlled paths, disable repository hooks, external diffs, pagers and terminal prompting, cap combined output at 4 MiB and time out after ten seconds. Tests stage a dash-prefixed filename and prove a hostile pre-commit hook is not executed. Workspace search remains RE2-based and bounded to 500 results, 2 MiB files and 32 MiB undo state.

BH08 evidence

PTY input frames must be masked, final, free of reserved bits and no larger than 64 KiB. Terminal scrollback is capped at 256 KiB and durable sessions at 16 per account. Loader and shell-startup injection variables are removed from child environments. Disconnect terminates the shell process group, not only its leader, so descendants do not survive an ordinary socket close.

BH09 evidence

Prompts, provider JSON and restored session exports are bounded independently. Provider objects have depth, collection and string limits; credential-shaped fields and the effective provider key are redacted before streaming to the browser. Provider session identifiers use a strict 128-character alphabet before becoming command arguments, and exports have separate 8 MiB output and 256 KiB error limits. Model/provider events remain labelled provider data, not Warden authorization evidence.

BH10 evidence

The 256-bit master key is generated into a mode-0600 temporary file, synced and installed without overwrite. Key and ciphertext paths must be regular files, ciphertext is authenticated with a fresh AES-GCM nonce, and a corrupt or mismatched store cannot replace the last known-good in-memory snapshot. Configuration imports validate the entire candidate set before replacement. Instance, authentication and account deletion actions require the acting account's current password in addition to session capability and CSRF checks.

BH11 evidence

Typed administration resolves fixed executable names only from system binary directories, uses argument arrays and a minimal environment, enforces per-operation timeouts, and caps command input/output at 1 MiB. Website definitions reject non-loopback proxies, stale revisions and invalid identifiers. Generated Caddy values are quoted, disabled-site comments are line-sanitized, and fragments are atomically replaced. Tests cover executable-path rejection, input limits, stale saves and configuration-line injection.

BH12 evidence

Audit events use a versioned envelope with request correlation, action, target, outcome, actor identity and timestamp. Authorization failures create denied evidence before returning. Central redaction tests inject canaries into every credential-shaped field and prove they are absent from both SQLite and log output. Details, exports and retention are bounded. Local logs remain attributable evidence, not a tamper-proof ledger.

BH13 evidence

Tests build every historical migration prefix and upgrade it without losing a durable canary. Startup performs SQLite integrity checking, refuses corrupt and future schemas, and converges under four simultaneous open attempts. Password-encrypted backup tests recover configuration and provider secrets with the correct password and reject incorrect credentials. The recovery guide requires an offline whole-directory snapshot and makes downgrade refusal explicit.

BH14 evidence

Six retained native fuzz targets cover domain and loopback-upstream validation, agent session identifiers, audit redaction, Git status parsing and cron syntax. Seed corpora run in every ordinary test; selected targets also ran for two seconds during the checkpoint. A 32-worker stress case performs 3,200 concurrent redactions under the race detector. Exact HTTP, file, terminal, session, process, audit and database ceilings are published in the resource inventory. These campaign durations are regression evidence, not universal exhaustion claims.

BH15 evidence

A hostile-display smoke test exercises the shared HTML escaper with injected markup and event handlers, and rejects high-risk DOM execution primitives. The embedded dashboard now includes skip navigation, a consistent visible focus ring, polite status announcements and effective reduced-motion behavior. The existing responsive breakpoints were audited against Explorer, Editor, Terminal, Agent and administration layouts; authority remains enforced by the server rather than hidden controls.

BH16 evidence

The release workflow defaults to read-only permissions, grants write access only to the release job and pins its two official actions to reviewed commits. One script cross-builds six CGO-free, trim-path archives, checks for local build paths and emits SHA-256 checksums. The installer verifies that manifest before extraction; its smoke test proves both a clean per-user install and checksum-failure refusal. A full-history scan rejects compiled executable magic, archive extensions and oversized Git blobs.

BH17 evidence

A fresh instance started on loopback with Linux capabilities removed and new privilege prohibited, returned first-run state and browser security headers, then shut down cleanly. The container prohibited switching uid to nobody, so a dedicated-account smoke remains an operator deployment check. Proxy regressions cover direct-peer trust, ambiguous forwarding, effective HTTPS scheme, CSRF and WebSocket origins. Documentation checks keep Caddy/nginx directives aligned. The environment lacked both proxy daemons, so this is not a live proxy-version compatibility claim.

Checkpoint ledger

Retained authority limit

Other retained risks

• local SQLite and file audit evidence is attributable, not tamper-proof;
• reading both master.key and secrets.json grants secret-reading authority;
• Linux-specific privileged integrations require deployment testing even though six binary targets build;
• TLS, reverse-proxy maintenance, host hardening and restore drills remain operator responsibilities.