test coverage improvements; mTLS enforcement; agent broke :(

evidence/templates/browser-matrix.md

@@ -0,0 +1,28 @@
+# Browser Test Matrix
+
+## How To Complete
+
+1. Copy this template into a run folder (or let `collect_evidence.sh` do it).
+2. Fill metadata first: date, URL, commit.
+3. For each browser cell, use one of: `PASS`, `FAIL`, `PARTIAL`, `N/A`.
+4. Add a short symptom in `Notes` for every non-pass result.
+5. Add exact artifact paths in `Evidence Path` (screenshots/HAR/console output).
+
+## Metadata
+
+Date (UTC):
+Environment URL:
+Commit:
+Run ID:
+
+| Area | Chrome | Firefox | Safari | Edge | Notes | Evidence Path |
+|---|---|---|---|---|---|---|
+| Login / OIDC |  |  |  |  |  |  |
+| Dashboard |  |  |  |  |  |  |
+| Key upload |  |  |  |  |  |  |
+| Server registration |  |  |  |  |  |  |
+| Access approve/revoke |  |  |  |  |  |  |
+| Audit logs |  |  |  |  |  |  |
+| Server detail + heartbeat |  |  |  |  |  |  |
+| Browser shell page render |  |  |  |  |  |  |
+| Browser shell interactive session |  |  |  |  |  |  |

evidence/templates/security-test-report.md

@@ -0,0 +1,50 @@
+# Security Test Report
+
+## How To Complete
+
+1. Fill metadata fields and keep them aligned with the evidence run ID.
+2. For each test row, set `Pass/Fail` to `PASS`, `FAIL`, `PARTIAL`, or `N/A`.
+3. Put concrete observations in `Actual` (status code, rejection text, behavior).
+4. Always link an evidence artifact path for each completed row.
+5. Keep findings evidence-backed; avoid conclusions without artifacts.
+
+## Metadata
+
+Date (UTC):
+Environment URL:
+Commit:
+Run ID:
+Tester:
+
+## Scope
+
+- Authentication and session handling
+- Authorization boundaries
+- Token handling
+- Input validation
+- File/command safety
+- WebSocket controls
+
+## Test Cases
+
+| ID | Area | Test | Expected | Actual | Pass/Fail | Evidence Path |
+|---|---|---|---|---|---|---|
+| SEC-01 | Input validation | Submit malformed SSH key payload | 4xx with validation error |  |  |  |
+| SEC-02 | Auth bypass | Call admin API as non-admin | 403 |  |  |  |
+| SEC-03 | Token misuse | Use revoked/invalid agent token | 401/403 |  |  |  |
+| SEC-04 | Object permission | Access server not granted to user | 403 |  |  |  |
+| SEC-05 | Session/CSRF | Unsafe method without CSRF/session validity | Blocked |  |  |  |
+| SEC-06 | File handling | Upload invalid file/path content | Rejected safely |  |  |  |
+| SEC-07 | Command injection | Shell input escaping checks | No command injection path |  |  |  |
+| SEC-08 | WebSocket shell auth | Open shell WS without scope | Rejected |  |  |  |
+| SEC-09 | Host key verification | Shell verifies host identity | Verified or documented gap |  |  |  |
+
+## Findings
+
+- High:
+- Medium:
+- Low:
+
+## Follow-up Actions
+
+- 

evidence/templates/standards-checklist.md

@@ -0,0 +1,44 @@
+# Standards Checklist
+
+## How To Complete
+
+1. Fill metadata and ensure it matches the evidence run folder.
+2. Use one status value per row: `Meets`, `Partially Meets`, `Does Not Meet`, `Not Evaluated`.
+3. Add at least one concrete artifact path for each status decision.
+4. In `Notes`, explain why the evidence is sufficient or insufficient.
+5. Keep `Gap Summary` focused on what still blocks compliance confidence.
+
+## Metadata
+
+Date (UTC):
+Environment URL:
+Commit:
+Run ID:
+
+## OWASP ASVS (selected)
+
+| Control | Requirement | Status | Evidence Path | Notes |
+|---|---|---|---|---|
+| V1 | Architecture/design documented |  |  |  |
+| V2 | Authentication controls |  |  |  |
+| V3 | Session management |  |  |  |
+| V4 | Access control enforcement |  |  |  |
+| V5 | Input validation and encoding |  |  |  |
+| V7 | Error handling and logging |  |  |  |
+| V8 | Data protection at rest/in transit |  |  |  |
+| V10 | Malicious code / injection resistance |  |  |  |
+
+## NIST SP 800-53 / 800-63-aligned checks (selected)
+
+| Control Family | Requirement | Status | Evidence Path | Notes |
+|---|---|---|---|---|
+| AC | Least privilege / access enforcement |  |  |  |
+| AU | Auditable events and retention |  |  |  |
+| IA | Identity proofing and authentication federation |  |  |  |
+| SC | Cryptographic protections and key handling |  |  |  |
+| CM | Configuration and change management |  |  |  |
+| CP | Resilience / single point of failure acknowledgement |  |  |  |
+
+## Gap Summary
+
+-