//:Proof · Test Matrix

Verification tests

The same automated test matrix as the dashboard — install gates, CRS parity, FP, ban latency, corpus recall and 72h soak. All measured and reproducible.

Security researcher note: This is not a shop or WooCommerce site. No /products.json, /wp-json/, or /api/item — the 89-gate verification matrix lives here.

99%
Test summary
88/89 tests passed · 1 failed
Proof PDF

Install and security gates · 9

  • API fail-closed — unauthenticated requests return 403

    PASS

    Ban/consult/metrics endpoints reject requests without a token.

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/api_fail_closed_test.sh

  • auth.log sshd ingest — parse + brute threshold

    PASS

    Non-nginx SSH failed-password lines enter the anomaly path.

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/auth_log_e2e.sh

  • Helm chart — template smoke

    PASS

    Helm template validation for customer K8s installs.

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/helm_install_smoke.sh

  • journald export — short-iso + sudo rhost spike

    PASS

    Journald usec timestamps and sudo rhost brute spike ingest.

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/journald_e2e.sh

  • Local security audit — IPC, JWT, secret hygiene

    PASS

    Pre-prod security script matrix; demo password WARN on laptop is OK.

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/local_security_audit.sh

  • Wasm marketplace — signed package gate

    PASS

    Proves unsigned marketplace packages are rejected.

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/marketplace_sig_gate.sh

  • Mesh etcd — fleet policy

    PASS

    etcd mesh backend and MESH_PUB_ENABLED=0 validation.

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/mesh_etcd_e2e.sh

  • Install gate — services, IPC, API fail-closed

    PASS

    systemd, --health, metrics :9091, API_BIND and nginx format green matrix.

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/post_install_verify.sh

  • VM demo gate — post_install 0 FAIL

    PASS

    Final check before laptop/VM demo (repair: sudo vm_demo_gate).

    FAIL: 0 · WARN: 0

    FAIL: 0WARN: 0
    scripts/vm_demo_gate.sh

Competitive and security proof · 80

  • 72h prod stability + low FP

    PASS

    72.0h VPS soak PASS: 863 samples, 0 failures — services up, max RSS 122 MB benign FP 0.2%.

  • 5-minute stability gate (no VPS required)

    PASS

    Confirms daemon and analyzer stay up during a short production-like window.

    5m soak: 10 samples, 0 failures — PASS.

    Sure: 5 dkMax RSS: 110 MB
    scripts/soak_short_proof.sh

  • API mutation audit — ban/unban jsonl trail

    PASS

    Append-only jsonl after POST /ban (/var/lib/log-guardian/).

    audit trail OK — /var/lib/log-guardian/api-mutation-audit.jsonl.

    audit: OK
    scripts/api_mutation_audit_e2e.sh

  • API mutation token — read/mutate POST split

    PASS

    Enterprise: API_TOKEN (GET) + API_MUTATION_TOKEN (POST ban/unban/consult).

    split=ON; read POST 403; mutation POST 200.

    split: on
    scripts/api_mutation_token_e2e.sh

  • ARM64 (aarch64) build smoke

    PASS

    Build path for embedded/ARM Linux targets (no AVX2).

    mode=cross-gnu; target=aarch64.

    mode: cross-gnuhost: x86_64
    scripts/build_arm64.sh

  • Attack map — geo markers + live bans

    PASS

    Proves banned IP locations on the home globe via /api/attack-geo.

    1 markers, source=live; ack=1 ban=0; nav=4 parity=OK.

    markers: 1ack: 1ban: 0nav: 4bans: ipset
    scripts/attack_map_e2e.sh

  • Ban API mTLS — edge client cert + mutation token

    PASS

    Enterprise: nginx mTLS terminate + internal mutation token inject.

    read POST 403; mutation OK; mTLS edge verify.

    mtls: onread_post: 403caddy: onstrict: on
    scripts/ban_api_mtls_e2e.sh

  • Time from threat detection to kernel ban

    PASS

    Median 28.71 ms — target <75.0 ms, ipset confirmed.

  • Ban policy audit + OPENAPI_STRICT

    PASS

    Ban/unban decision trail JSONL + schema; prod API schema validation on.

    decision=force_waf; risk=80.0; OPENAPI_STRICT=1.

    lines: 1decision: force_wafOPENAPI_STRICT: 1
    scripts/ban_policy_audit_e2e.sh

  • AUTO_BAN profile + consult cache + threat intel offline

    PASS

    AUTO_BAN_PROFILE preset, consult cache, threat intel offline fallback.

    6 static checks PASS (AUTO_BAN_PROFILE, CONSULT_CACHE, GeoIP).

    checks: 6
    scripts/ban_profile_e2e.sh

  • Bans + Telegram ack — operator panel API

    PASS

    Operator panel live data via /api/telegram-acks + /bans?search=.

    IP 203.0.113.198; ack yes (utku); ban miss.

    acks: 1ban: missoperator: utku
    scripts/bans_telegram_ops_e2e.sh

  • Processing speed on same log corpus (transparent reference)

    PASS

    Guardian 11709 EPS (single-pass log-WAF); CRS replay 19761 EPS — different architecture, not a speed claim.

  • Compliance — JSON/PDF export (Pro tier)

    PASS

    /api/reports/export — Pro tier PDF; Community gets 403.

    mode=pro-live; tier=pro; controls=12; pdf=OK.

    mode: pro-livetier: pro
    scripts/compliance_export_e2e.sh

  • Copilot — optional Ollama + fallback

    PASS

    Copilot LLM (Ollama) optional; rule-based fallback when absent.

    ollama=yes; source=ollama.

    ollama: yessource: ollama
    scripts/copilot_ollama_e2e.sh

  • CrowdSec LAPI → log-guardian ban API

    complementary
    PASS

    CrowdSec complementary (LAPI) — sync decisions to kernel ban path; not a Fail2ban replacement.

    mode=dry-run; 50 decisions; ban API dry-run; LAPI OK.

    mode: dry-runkarar: 50ban API: dry-runLAPI: OK
    scripts/crowdsec_bouncer_e2e.sh

  • Detection parity with OWASP CRS on same attack lines

    PASS

    Alerts on all 18 attack lines; recall 100.0%, parity 100.0%.

  • Dashboard ban/unban — API + Docker relay (18090)

    PASS

    Proves operators can ban/unban from /bans via the live kernel path.

    Host OK, relay OK, Docker OK — 203.0.113.248.

    host: OKrelay: OKdocker: OKpath: ipc-xdpsoar: onstrict: on
    scripts/dashboard_ban_smoke.sh

  • Dashboard JWT idle — session timeout

    PASS

    middleware iat check; laptop 0m, internet-facing 480m recommended.

    mode=on; idle=240m.

    idle_min: 240
    scripts/dashboard_jwt_idle_gate.sh

  • Dashboard live demo — map + /bans ipset

    PASS

    Operator demo: 4 real kernel bans → LIVE map + /bans unban.

    4 bans applied, 4 synced — http://127.0.0.1:8090.

    applied: 4synced: 4api: 127.0.0.1:8090IPs: 203.0.113.211, 203.0.113.212, 203.0.113.213, 203.0.113.214
    scripts/dashboard_live_demo.sh

  • Dashboard login rate limit — brute-force protection

    PASS

    Prod: HTTP 429 after 10 failed attempts (X-Forwarded-For).

    10 attempts → 429 (probe 203.0.113.88).

    max: 10
    scripts/dashboard_login_rate_limit_e2e.sh

  • Demo rehearsal — presentation readiness gate

    PASS

    demo_3min + :8443 + PDF + live site presentation chain.

    demo_3min=yes; dash=yes; proof 88/89.

    PDF: yesproof: 88/89
    scripts/demo_rehearsal_gate.sh

  • Demo video — 04:00 recording readiness gate

    PASS

    demo_video + SIEM + PDF + presentation_ship — pre-recording automation.

    pdf=yes; ship=yes; siem=yes; proof 88/89.

    SIEM: yesproof: 88/89
    scripts/demo_video_gate.sh

  • DIST_RISK — distributed attack score proof

    PASS

    /24 + UA fp correlation → ban risk bonus; unit test + replay delta.

    risk off=45.0 on=65.0; delta=20.0.

    delta: 20.0risk_off: 45.0risk_on: 65.0
    scripts/dist_risk_proof_e2e.sh

  • Docs consistency — 64 test + HOSTING §8b

    PASS

    Doc vitrine consistency — 64 tests, Telegram cross-link.

    checks OK=53; proof 88/89; hosting §8b=yes.

    checks: 53proof: 88/89
    scripts/docs_consistency_gate.sh

  • Edge protection — nginx + XDP/ipset + threat intel

    PASS

    Origin edge: nginx log format, ipset/XDP ban, threat-intel summary DB.

    IPC ok; ipset-fallback; nginx OK; ipset 0.

    ipc: okxdp: ipset-fallbackipset: 0
    scripts/edge_protection_gate.sh

  • Enterprise escalation — operator playbook

    PASS

    P1-P4 runbook + Telegram/edge operator gates.

    Doc sections 14; live gates 3/3.

    doc: 14gates: 3/3
    scripts/enterprise_escalation_gate.sh

  • Enterprise SOAR gate — Caddy :9443 mTLS + strict

    PASS

    Operator gate: enable/disable SOAR API — split token, Caddy mTLS, loopback strict.

    mode=enterprise; SOAR on; strict=on.

    mode: enterprisesoar: onstrict: oncaddy: OKban_smoke: OK
    scripts/enterprise_soar_gate.sh

  • Fleet multi-node — 2+ agents + targeted dispatch

    PASS

    Proves 2+ telemetry agents and targeted /fleet/dispatch routing.

    4 agents, 4 online; dispatch→node-vm-02; HMAC=OK.

    agents: 4online: 4target: node-vm-02HMAC: OK
    scripts/fleet_multi_node_e2e.sh

  • Fleet offline gate — heartbeat report freshness

    PASS

    Verifies fleet agent report freshness and at least one agent online.

    4/4 online; mode=laptop-simulated; max_age=15.0m.

    online: 4total: 4mode: laptop-simulatedmax_age_m: 15.0
    scripts/fleet_offline_gate.sh

  • FP learn — trusted IP excluded from cluster ban

    PASS

    trusted=10.0.0.50 cluster_banned=False flush=True.

  • False positive rate on benign traffic

    PASS

    500 benign lines, 0.2% FP — target <5.0%.

  • GitHub ship — full pre-push gate

    PASS

    presentation_ship + security_closure + secret scan — git push readiness.

    ship=yes; closure=yes; secret=yes; proof 88/89.

    closure: yesproof: 88/89
    scripts/github_ship_gate.sh

  • Grafana — dashboard $tenant + alert rules

    PASS

    Proves Prometheus tenant variable and Grafana alert provisioning.

    uid log-guardian-01; 13 alerts (13 tenant_id).

    dashboard: log-guardian-01alerts: 13tenant: yes
    scripts/grafana_alert_gate.sh

  • Grafana parity — dashboard mini panels ↔ JSON

    PASS

    grafanaPanels.ts metrics match grafana-dashboard.json.

    Panel 41; dashboard 43 metrics matched.

    panel: 41dash: 43
    scripts/grafana_parity_gate.sh

  • Hardening rollback — rollback readiness

    PASS

    Pre-hardening backup + demo password detection (read-only).

    checks 7/7 OK.

    checks: 7/7
    scripts/hardening_rollback_gate.sh

  • Honeypot / deception — trap metrics

    PASS

    Proves trap_watcher + tarpit deception via Prometheus counters.

    mode=metrics honey=0 lfi=0 c2=0.

    mode: metricshoney: 0lfi: 0c2: 0
    scripts/honeypot_feed_e2e.sh

  • INTEL_BAN_DB — ban_events size + TTL

    PASS

    SQLite ban_events bloat check — does not change ban logic.

    ban_events 1219; legacy 0; stale 0; TTL 7d.

    rows: 1219legacy: 0TTL: 7d
    scripts/intel_ban_db_ops_check.sh

  • IPv6 ban — ipset v6 + API/CLI

    PASS

    RFC 3849 doc prefix — ipset v6 proof vs v4-only rivals.

    via=api; path=ipc-xdp; ip=2001:db8::dead:beef.

    via: apipath: ipc-xdp
    scripts/ipv6_ban_e2e.sh

  • Distributed attack (same UA, different IPs) cluster recall

    PASS

    80 IPs, recall 100.0% (80/80).

  • Live nginx log -> JA3/UA cluster -> ban_pipeline

    PASS

    mode=live-append delta=8 flush=True block=203.0.113.162-203.0.113.166.

  • K8s admission webhook — deny label + allow

    PASS

    Operator admission rejects pods with deny security label.

    mode=docker-standalone; deny label=security.log-guardian.io/deny.

    mode: docker-standalone
    scripts/k8s_admission_test.sh

  • K8s kind cluster — helm dry-run / live

    PASS

    Optional Pro: kind cluster + helm chart live or dry-run proof.

    cluster=lg; mode=dry-run-server.

    mode: dry-run-servercluster: lg
    scripts/k8s_kind_e2e.sh

  • L7 eBPF HTTP probe — prod readiness

    PASS

    Proves daemon IPC + http_l7_probe.o L7 telemetry.

    IPC ok; l7_probe ON; hits=15; xdp=ipset-fallback.

    IPC: okl7_probe: ONhits: 15xdp: ipset-fallback
    scripts/l7_probe_prod_e2e.sh

  • Laptop Core — edge + SOC + ban operator gate

    PASS

    nginx→WAF→ban Core promise — edge, Telegram SOC, ban API.

    edge=skip; soc=yes; ban=yes; xdp=ipset-fallback; proof 88/89.

    xdp: ipset-fallbaproof: 88/89
    scripts/laptop_core_gate.sh

  • Laptop excellence — demo readiness gate

    PASS

    Laptop demo chain — services, :8443, fleet, proof.

    OK=14 WARN=0 FAIL=0; proof 88/89.

    OK: 14FAIL: 0
    scripts/laptop_excellence_gate.sh

  • Lineage → auto incident (single scenario)

    PASS

    INC-* correlation from LOG_SQLI + EBPF_EXECVE signals; single auto-incident proof.

    INC-6a4ecb0c-2382; active=1; signals=LOG_SQLI+EBPF_EXECVE.

    INC: INC-6a4ecb0c-2382IP: 10.0.0.99active: 1
    scripts/lineage_incident_e2e.sh

  • eBPF lineage — openat/execve/connect chain

    PASS

    risk=91.2 events=4 (EXEC_SHELL · FILE_READ · FILE_WRITE · NET_CONNECT) source=daemon_file.

  • Live nginx :80 attack harness (tester + ban)

    PASS

    sent=525 refused=525 kernel=True waf=True.

  • Live ban pipeline (IPC -> XDP/ipset)

    PASS

    IPC ok; 0 IPC, 0 XDP, 0 ipset.

  • Marketplace — signed API (Enterprise tier)

    PASS

    Enterprise /api/marketplace/signed — signature verify; Pro/Community get 403.

    mode=tier_gate; tier=pro; signed=0.

    mode: tier_gatetier: pro
    scripts/marketplace_signed_api_e2e.sh

  • Mesh etcd — docker lab endpoint

    PASS

    Optional fleet: live etcd docker endpoint smoke.

    endpoint=http://127.0.0.1:12379; container=lg-etcd-smoke.

    mode: docker-live
    scripts/mesh_etcd_docker_smoke.sh

  • Mesh etcd — live PUT/GET

    PASS

    Docker etcd v3 round-trip; fleet policy key read/write proof.

    mode=docker-live-rw; key=lg/fleet/policy/test; round_trip=True.

    mode: docker-live-rwendpoint: http://127.0.0.1:12379
    scripts/mesh_etcd_live_e2e.sh

  • Morning operator — fast morning readiness

    FAIL

    Report-first morning gate — no demo_3min, does not disturb other gates.

    presentation_ship

    core: raporproof: 88/89
    scripts/morning_operator_gate.sh

  • mTLS certificate expiry — SOAR lab

    PASS

    client/server/ca.crt expiry — rotation runbook warning.

    min 822 days (warn<=14).

    min_days: 822
    scripts/mtls_cert_expiry_check.sh

  • nginx inline consult API (WAF+CRS before auth_request)

    PASS

    union=403 or1=403 benign=200.

    scripts/nginx_inline_consult_proof.sh

  • nginx hybrid — inline consult + log replay

    PASS

    ModSec/Fail2ban gap: auth_request WAF + access_log single-chain proof.

    mode=inline+log hybrid; edge_sqli=403; replay_alerts=1.

    edge_sqli: 403replay: 1
    scripts/nginx_hybrid_proof.sh

  • OWASP CRS test corpus recall

    PASS

    112.1% recall — 199 lines.

  • Parser fuzz — malformed corpus + mutation

    PASS

    No crash/UB on deterministic malformed log lines; nginx/auth parse reliability.

    593 parses; corpus=36; file=40; mutations=512.

    runs: 593corpus: 36file: 40mutations: 512
    scripts/parser_fuzz_e2e.sh

  • phase100 fast gate — Phases 0-6

    PASS

    Fast gate for phase 0-6 E2E scripts (excluding VPS soak).

    mode=fast; phases=0-6.

    mode: fastphases: 0-6
    scripts/phase100_fast_gate.sh

  • Presentation ship — demo rehearsal + release chain

    PASS

    demo_rehearsal + release_ready — one-command presentation and ship.

    demo=yes; release=yes; artefakt 3/3; proof 88/89.

    artefakt: 3/3proof: 88/89
    scripts/presentation_ship_gate.sh

  • Prod stack — Wasm native + lineage + L7

    PASS

    Stub→prod chain: native Wasm plugin, live lineage, L7 probe.

    wasm=native; lineage=91.2; L7=active; ipc=ok.

    wasm: nativeL7: yesxdp: ipset-fallback
    scripts/prod_stack_e2e.sh

  • Real attack corpus (SQLi/XSS/LFI/RCE/scanner) detection rate

    PASS

    999 lines, avg recall 101.0% — target >=85.0%.

  • Corpus 10K — extended attack set recall

    PASS

    10000 lines, recall 100.1%.

  • Release ready — pre-GitHub release chain gate

    PASS

    ZIP/PDF + docs + live site + fleet chain.

    release=yes; docs=yes; artefakt 3/3; proof 88/89.

    artefakt: 3/3proof: 88/89
    scripts/release_ready_gate.sh

  • SIEM forwarder — alert + ban JSON (:5044)

    PASS

    Proves JSON event_type stream to Splunk/Elastic/Vector targets.

    alert=yes ban=yes port=15044.

    alert: yesban: yesport: 15044
    scripts/siem_export_e2e.sh

  • TAXII/STIX IOC → ban API (confidence gate)

    PASS

    Filters STIX 2.1 indicators by confidence; skips low-trust IOCs from ban path.

    dry-run; 2 IOC (≥70); skipped=1.

    mode: dry-runIOC: 2min conf: 70atlanan: 1
    scripts/taxii_feed_e2e.sh

  • Telegram operator undo — SIGUSR2 (WL/mute)

    PASS

    Reverts mistaken WL/mute/unban without interrupting Telegram poll.

    SIGUSR2 · sigusr2 · IP 203.0.113.198.

    mode: sigusr2ip: 203.0.113.198pass: OK
    scripts/telegram_operator_undo_e2e.sh

  • Telegram SOC — timeline + map + webhook

    PASS

    Proves three operator surfaces emit live evidence together.

    SOC 11 (ack 8); map 1; bans ack 1; webhook undo.

    soc: 11map: 1bans: 1webhook: undo
    scripts/telegram_soc_gate.sh

  • Multi-tenant isolation

    PASS

    Tenant musteri1: 4/4 checks passed.

  • Threat intel sync -> ipset

    PASS

    sync 0s, ioc=10, ipset_delta=0.

  • TR hosting corpus (synthetic anonymized)

    PASS

    100.0% recall — 500 lines · customer_corpus %100.1 (15 attack cat, log_guardian format).

    customer recall: 100.1%attack cats: 15

  • VM fleet keepalive — host + node-vm-02

    PASS

    LAPTOP_OPS fleet + VM keepalive — two nodes Online.

    node-kurtulus-01=Online; node-vm-02=skip; online=2.

    host: Onlinevm: skip
    scripts/vm_fleet_gate.sh

  • VM host prep — pre-sync evidence

    PASS

    Laptop HOST proof before vm_sync.

    ctx host-vbox; proof 88/89; post_install FAIL=0.

    proof: 88/89ctx: host-vbox
    scripts/vm_host_prep_gate.sh

  • VPS XDP — kernel-xdp (laptop: ipset-fallback)

    PASS

    eBPF XDP on real NIC/VPS; laptop ipset-fallback is expected.

    xdp_mode=ipset-fallback; iface=—.

    mode: ipset-fallbackiface: —
    scripts/vps_xdp_proof.sh

  • Wasm native — block-sqli plugin smoke

    PASS

    Proves compiled Wasmtime plugin alerts on SQLi in log replay.

    mode native; 2 native plugins, 1 alerts, 992 B.

    mode: nativeplugins: 2alerts: 1bytes: 992
    scripts/wasm_gate.sh

  • Telegram route + batch — #waf/#ban routing

    PASS

    Proves WARN→DM, CRIT/ban→channel and batch summary routing.

    Mode dry-run; route ON, batch 10s.

    mode: dry-runroute: ONbatch: 10prod: skip
    scripts/webhook_route_proof.sh

  • Telegram Ack — DB counter (24h)

    PASS

    Proves inline Ack bumps events.db and guardian-status/metrics counters.

    ack 3->4; unacked 0->0.

    ack: 3->4unacked: 0->0prom: 4
    scripts/webhook_ack_e2e.sh

  • Telegram prod — live alert/ban/trap/batch

    PASS

    Proves real bot token delivers CRIT/WARN route + batch summary to Telegram.

    mode prod; route ON, batch 10s — alert, ban, trap, batch.

    route: ONbatch: 10kinds: alert,ban,trap,batch
    scripts/webhook_install_prod.sh --test-all

  • Website live — production /tests parity

    PASS

    Production domain SRI + test card parity.

    ceniklinuxlogguardian.org None/89; CSS=yes.

    live: None/89domain: ceniklinuxlogguardian.or
    scripts/website_live_gate.sh

  • Site preview — landing test parity

    PASS

    landing/lib/tests.ts parity with competitive-proof (local test cards).

    Site 89/89 parity; grafana yes; edge yes.

    site: 89proof: 89
    scripts/website_preview_gate.sh