# Quality Assurance & Testing Strategy

`nx9-wg` enforces a comprehensive, multi-tiered verification strategy designed to guarantee code correctness, memory safety, failure semantics, and secret protection.

---

## 1. Test Suite Summary & Quality Gates

| Tier | Test Suite / Check | Scope & Execution Target | Current Status |
| :--- | :--- | :--- | :---: |
| **Tier 1** | Code Formatting | `cargo fmt --all -- --check` | **PASS** (Zero diffs) |
| **Tier 2** | Type & Borrow Check | `cargo check --workspace` | **PASS** (Zero errors) |
| **Tier 3** | Workspace Unit Tests | `cargo test --workspace` | **PASS** (**91 / 91 passed**) |
| **Tier 4** | Clippy Linter Check | `cargo clippy --workspace --all-targets --all-features -- -D warnings` | **PASS** (Zero warnings) |
| **Tier 5** | Release Compilation | `cargo build --release` | **PASS** (Clean build) |
| **Tier 6** | Comprehensive CLI Suite | `LIVE=0 bash scripts/test-cli-comprehensive.sh` | **PASS** (**203 passed** / 7 skipped) |
| **Tier 7** | Native Integration Suite | `LIVE=0 bash scripts/test-native-integration.sh` | **PASS** (**19 passed** / 1 skipped) |
| **Tier 8** | Dedicated Live Kernel Suite | `LIVE=0 bash scripts/test-live-kernel.sh` | **PASS** (**23 passed** / 1 skipped) |
| **Tier 9** | Subprocess Safety Audit | Automated source scan for `Command::new` | **PASS** (Zero subprocesses) |
| **Tier 10** | Secret Leakage Audit | Automated scan for plaintext credentials | **PASS** (Zero secrets leaked) |
| **Tier 11** | Release Package Check | Standalone archive extraction & verification | **PASS** (Independent execution) |

---

## 2. SAFE Mode (`LIVE=0`) vs Real-Kernel Mode (`LIVE=1`)

To guarantee safety when developing on unprivileged developer workstations:

### SAFE Mode (`LIVE=0` — Default)
- Uses real in-memory SQLite stores and dry-run Netlink message builders.
- Validates CLI parsers, JSON/YAML/CSV output formatters, route equality rules, and read-only reconciliation planning.
- Automatically skips live kernel mutation steps that require root or `CAP_NET_ADMIN`.

### Real-Kernel Mode (`LIVE=1` — Dedicated Host Only)
- Requires `root` or `CAP_NET_ADMIN` in a dedicated, disposable Linux VM.
- Creates real kernel WireGuard interfaces (e.g. `nx9t...`), attaches IPv4/IPv6 addresses, installs routes in the kernel routing table, configures `table inet nx9_wg` in Netfilter, and validates live handshake telemetry.

---

## 3. Automated Subprocess & Secret Audits

Every verification run executes strict source-level security audits:

1. **Subprocess Audit**: Confirms zero instances of `std::process::Command`, `tokio::process::Command`, `Command::new`, or shell scripts in production Rust crates.
2. **Secret Redaction Audit**: Confirms that password hashes, private keys, preshared keys, and token hashes are never printed in human-readable status outputs or logs.
3. **Environment Audit**: Confirms that all recognized environment variables strictly observe the `NX9_WG_*` namespace.