Closing the coverage gaps the review flagged as blind spots we'd be relying on at
release:
4. RELAY LOGIC TESTS. server/test_relay.py (stdlib unittest + a FakeSocket, no network)
covers the address-proof end to end: cookie issued on join, wrong cookie rejected,
right cookie verifies once; enforce mode WITHHOLDS forwarding from an unverified
address then delivers after it proves itself; watch-only forwards but records
would-block; the per-IP cap counts across BOTH v1 and v2; a NAT-rebind clears
verification (spoof-takeover guard); a forged BYE from another address can't evict
the victim; and bad/short/unknown-version headers are refused. Wired into
run-tests.ps1 (Start-Process from server\, SKIPs loudly if no Python) so a relay
change can no longer ship past the gate untested. The relay had ZERO automated
coverage before and auto-updates every user.
5. UPDATER SIGNATURE ENFORCEMENT. Extracted the two refusal branches into a pure
VerifyStagedRelease gate and added UpdaterRefusesUnsignedRelease: no-sig refused,
wrong-key refused, garbage refused, tamper (good sig over changed bytes) refused,
genuine release accepted. ReleaseSigning only proved the crypto; this proves the
updater actually REFUSES - the hijacked-release-stream threat.
6. STREAMING PASSWORD STRENGTHENING. The accept decision is now a pure
ProfilePasswordDialog.RejectionAdviceFor shared by BOTH password dialogs (also
fixes the App-review trim inconsistency - manager dialog compared untrimmed). Test
pins the load-bearing rule: requireStrong DISABLES the unchanged-exemption so an
existing weak "Games" can't keep streaming, while casual mode still grandfathers an
unchanged password and blocks a new weak one, trim-safe.
Plus the NVDA-hang cache assertions in PasswordRules (miss->hit, same-instance repeat,
Prewarm, empty/weak = no work).
Gate 71/71 + 7 relay tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
EdnunpandClaude Fable 5
65e999466d