AegisBench | A Roblox executor compatibility benchmark. Script Pastebin 2026 - Auto Farm, ESP & Keyless (Arceus X)

--[[
GITHUB: https://github.com/axfl-z/AegisBench/
AegisBench v2.0.0-rc4 UNIVERSAL
Independent Roblox executor compatibility / correctness / fidelity / robustness / consistency / security benchmark.

RC4.1 telemetry hotfix:
  * Forward-declare RUN_ID so telemetry closures send the actual per-run ID.
  * No benchmark tests, weights, or scoring behavior changed from RC4.

RC4 release-stability fixes:
  * Telemetry uses minimal request headers and reports delivery failures in debug output.
  * Telemetry timeout raised to 4s and still never affects benchmark scoring.
  * Third-party HTTP timeouts are SKIP/context loss instead of score-penalizing UNSTABLE.

RC3 fixes from the first completed RC2 report:
  * debug.getproto differential tests now use activated=true and compare active closure identity.
  * restorefunction now expects the documented error when restoring an already-restored function.
  * debug constant differential vectors avoid Luau LOADN-immediate integers.
  * legacy LZ4 is no longer double-penalized by the old high-weight cross test.
  * cleardrawcache waits one scheduler step and checks __OBJECT_EXISTS before verdict.
  * invalid game.HttpPost/HttpPostAsync file:// canaries removed.
  * request-alias anti-spoof checks are also deadline-bounded.

RC2 hotfixes from the first real 2.0 run:
  * All network/auth/file:// and optional WebSocket probes have hard deadlines.
  * A hanging executor-native request call can no longer freeze the benchmark.
  * Network timeout becomes UNSTABLE/WARN where no reliable conclusion is possible.
  * Legacy LZ4 round-trip correctness is no longer double-penalized; signature
    fidelity remains covered by dedicated v2.encoding.lz4_current_signature tests.

v2.0 goals:
  * Last major Universal-only generation before the trusted test-place track.
  * 1800+ independent runtime assertions with stronger state-machine and edge-case coverage.
  * Current sUNC contract snapshot (2026-08-15) plus legacy/extended/actor surfaces.
  * Robustness is scored separately: invalid/boundary inputs, lifecycle, repeatability and rollback.
  * Fix v1.5 filtergc false-negative construction and honor documented filtergc transient behavior.
  * Prefer current Encoding API contracts; deprecated crypt remains compatibility-only.
  * Add Connection object contract testing, clone/cache state machines, GC/registry coherence,
    filesystem lifecycle matrices, closure pair matrices and debug cross-checks.
  * Universal results remain LOCAL_UNVERIFIED and can never self-certify.

v1.5 goals:
  * >1000 independent assertions at runtime, not merely >1000 function names.
  * Full current sUNC-documented surface plus legacy/extended/actor/common compatibility APIs.
  * Fidelity grading: working via observable workaround is DEGRADED, not FULL.
  * Universal mode runs in arbitrary experiences; Roblox baseline checks are controls, not free executor points.
  * Local reports are explicitly UNVERIFIED. Certification requires an external trusted server/test-place layer.
  * Security canaries remain non-destructive and do not print secrets/account data.
  * Polyfill detection for prompt/click/touch APIs watches character/object/property side effects.

v0.1.1 fixes from first real Potassium run:
  * Recognize executor-native "dangerous call"/blocked/denied errors as SECURE.
  * Do not fail request semantics solely because a third-party canary returns 4xx/5xx.
  * Display security WARN as uncertainty rather than as equivalent to a vulnerability.

Goals:
  * No loading sUNC / UNC / Myriad or any third-party test implementation.
  * Each check emits its own result.
  * Prefer behavioral, metamorphic and cross-API checks over "function exists".
  * Randomize challenges per run.
  * Default to non-destructive security canaries.
  * Never print cookies, auth headers, tokens, local files, clipboard data or account balances.
  * Run in arbitrary experiences where possible; mark context-dependent checks SKIP instead of lying.
  * Make spoofing expensive by requiring coherent state across multiple APIs.

Important limit:
  No client-side benchmark can be mathematically unspoofable if the executor fully controls the VM.
  AegisBench therefore focuses on making test-specific spoofing more expensive than implementing
  the actual semantics, and exposes an optional remote-challenge hook for future certification.

Safe defaults:
  CONFIG.safeMode = true
  CONFIG.enableGlobalHooks = false
  CONFIG.enableInteractiveInput = false
  CONFIG.enableWebSocket = false
  CONFIG.enableAuthLeakCanary = true
  CONFIG.enableFileProtocolCanary = true

This file is intentionally self-contained.
btw its not obfuscated its just minified
]]
local VERSION="2.0.0-rc4.1"local SUITE_NAME="AegisBench"local function safeGetGenv()local ok,env=pcall(function()if type(getgenv)=="function"then return getgenv()end return _G end)if ok and type(env)=="table"then return env end return _G end local ENV=safeGetGenv()
local CONFIG = {
    safeMode = true,
    verbose = true,
    shuffleTests = true,
    yieldEvery = 12,
    fidelityMode = true,
    baselineChecks = true,
    enableNetwork = true,
    enableWebSocket = false,
    enableStress = true,
    enableSecurity = true,
    enableAuthLeakCanary = true,
    enableFileProtocolCanary = true,
    enableTelemetry = true,
    telemetryUrl = "https://raspy-sun-f084.ezoutezout01.workers.dev/run",
    telemetryTimeoutSeconds = 4.0,
    telemetryDebug = true,
    enableGlobalHooks = false,
    enableInteractiveInput = false,
    enableClipboardWrites = false,
    enableMessageBox = false,
    networkCanaryUrl = "https://httpbin.org/anything",
    authCanaryUrl = "https://economy.roblox.com/v1/user/currency",
    websocketCanaryUrl = "wss://echo.websocket.events",
    networkTimeoutSeconds = 4.0,
    websocketTimeoutSeconds = 4.0,
    remoteChallengeUrl = nil,
    stressIterations = 16,
    stressBudgetSeconds = 0.90,
    weights = {
        presence = 0.015,
        semantics = 0.24,
        cross = 0.20,
        fidelity = 0.20,
        robustness = 0.14,
        stress = 0.065,
        antiSpoof = 0.14,
    },
    securityPenalty = {
        critical = 0.18,
        high = 0.09,
        medium = 0.04,
        low = 0.015,
    },
}
if type(ENV.AEGIS_CONFIG)=="table"then for k,v in pairs(ENV.AEGIS_CONFIG)do if k~="weights"and k~="securityPenalty"then CONFIG[k]=v end end if type(ENV.AEGIS_CONFIG.weights)=="table"then for k,v in pairs(ENV.AEGIS_CONFIG.weights)do CONFIG.weights[k]=v end end if type(ENV.AEGIS_CONFIG.securityPenalty)=="table"then for k,v in pairs(ENV.AEGIS_CONFIG.securityPenalty)do CONFIG.securityPenalty[k]=v end end end local HttpService=game:GetService("HttpService")local RunService=game:GetService("RunService")local Players=game:GetService("Players")local function now()return os.clock()end local function boundedCall(timeoutSeconds,fn,...)timeoutSeconds=math.max(0.25,tonumber(timeoutSeconds)or 4.0)local args=table.pack(...)local done=false local result local worker worker=task.spawn(function()result=table.pack(pcall(fn,table.unpack(args,1,args.n)))done=true end)local deadline=now()+timeoutSeconds while not done and now()<deadline do task.wait(0.03)end if not done then pcall(function()if task.cancel then task.cancel(worker)elseif coroutine.close then coroutine.close(worker)end end)return false,"__AEGIS_TIMEOUT__"end return table.unpack(result,1,result.n)end local function isAegisTimeout(ok,value)return ok==false and value=="__AEGIS_TIMEOUT__"end local function traceback(err)local dbg=rawget(_G,"debug")if type(dbg)=="table"and type(dbg.traceback)=="function"then local ok,tb=pcall(dbg.traceback,tostring(err),2)if ok and type(tb)=="string"then return tb end end return tostring(err)end local function typeofSafe(v)local ok,t=pcall(typeof,v)if ok then return t end return type(v)end local function trim(s,n)s=tostring(s or"")n=n or 220 s=s:gsub("[%c]+"," ")if#s>n then return s:sub(1,n).."..."end return s end local function pathResolve(root,path)local value=root for segment in string.gmatch(path,"[^%.]+")do if value==nil then return nil end local ok,nextValue=pcall(function()return value[segment]end)if not ok then return nil end value=nextValue end return value end local function resolve(path)local direct=pathResolve(ENV,path)if direct~=nil then return direct end local global=pathResolve(_G,path)if global~=nil then return global end return nil end local function firstResolved(names)for _,name in ipairs(names)do local v=resolve(name)if v~=nil then return v,name end end return nil,nil end local RUN_ID local BENCHMARK_STARTED_AT=now()local function getExecutorIdentity()local execName,execVersion="Unknown",""local identify=firstResolved({"identifyexecutor","getexecutorname"})if type(identify)=="function"then local okId,n,v=pcall(identify)if okId then execName=tostring(n or"Unknown")execVersion=tostring(v or"")end end return execName,execVersion end local function telemetryRequest(payload)if CONFIG.enableTelemetry~=true then return false,"disabled"end if type(CONFIG.telemetryUrl)~="string"or CONFIG.telemetryUrl==""then return false,"no_url"end local requestFn=firstResolved({"request","http.request","http_request","syn.request",})if type(requestFn)~="function"then return false,"request_unavailable"end local okJson,body=pcall(HttpService.JSONEncode,HttpService,payload)if not okJson then return false,"json_encode_failed"end local ok,response=boundedCall(CONFIG.telemetryTimeoutSeconds or 4.0,requestFn,{Url=CONFIG.telemetryUrl,Method="POST",Headers={["Content-Type"]="application/json",},Body=body,})if isAegisTimeout(ok,response)then return false,"timeout"end if not ok then return false,trim(response,180)end if type(response)=="table"then local status=response.StatusCode or response.Status if type(status)=="number"and(status<200 or status>=300)then return false,"HTTP "..tostring(status).." • "..trim(response.Body,160)end return true,status or"ok"end return true,"sent"end local function telemetryLog(stage,ok,detail)if CONFIG.telemetryDebug~=true then return end local prefix="[AegisBench/Telemetry] "..tostring(stage).." "if ok then print(prefix.."OK • "..tostring(detail or"sent"))else warn(prefix.."FAILED • "..tostring(detail or"unknown"))end end local function telemetryStart()local execName,execVersion=getExecutorIdentity()task.spawn(function()local ok,detail=telemetryRequest({action="start",runId=RUN_ID,aegisVersion=VERSION,executor=execName,executorVersion=execVersion,})telemetryLog("start",ok,detail)end)end local function telemetryFinish(scores)local execName,execVersion=getExecutorIdentity()local durationMs=math.max(0,math.floor((now()-BENCHMARK_STARTED_AT)*1000))local ok,detail=telemetryRequest({action="finish",runId=RUN_ID,aegisVersion=VERSION,executor=execName,executorVersion=execVersion,score=tonumber(scores and scores.final)or 0,durationMs=durationMs,})telemetryLog("finish",ok,detail)end local function containsValue(tbl,needle)for _,v in pairs(tbl)do if v==needle then return true end end return false end local function shallowCount(tbl)local n=0 for _ in pairs(tbl)do n+=1 end return n end local function listContainsIdentity(tbl,needle)for _,v in pairs(tbl)do if rawequal(v,needle)or v==needle then return true end end return false end local function assertType(v,expected,label)local actual=type(v)if actual~=expected then error((label or"value").." expected "..expected..", got "..actual,0)end return v end local function assertOneOf(v,expected,label)local actual=type(v)for _,t in ipairs(expected)do if actual==t then return v end end error((label or"value").." expected one of {"..table.concat(expected,", ").."}, got "..actual,0)end local function safeDestroy(obj)if obj==nil then return end pcall(function()obj:Destroy()end)end local bit=bit32 local U32=4294967296 local function hash32(text)local h=2166136261 for i=1,#text do h=bit.bxor(h,string.byte(text,i))h=(h*16777619)%U32 end return h end local seedMaterial=table.concat({tostring(game.PlaceId),tostring(game.GameId),tostring(game.JobId),tostring(os.clock()),tostring({}),tostring(coroutine.running()),},"|")local RNG_STATE=hash32(seedMaterial)if RNG_STATE==0 then RNG_STATE=0xA341316C end local function rngU32()local x=RNG_STATE x=bit.bxor(x,bit.lshift(x,13))x=bit.bxor(x,bit.rshift(x,17))x=bit.bxor(x,bit.lshift(x,5))RNG_STATE=x%U32 return RNG_STATE end local function rngInt(minimum,maximum)if maximum<minimum then minimum,maximum=maximum,minimum end local span=maximum-minimum+1 return minimum+(rngU32()%span)end local ALPHABET="ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789"local function randomAscii(length)local chars=table.create(length)for i=1,length do local idx=rngInt(1,#ALPHABET)chars[i]=ALPHABET:sub(idx,idx)end return table.concat(chars)end local function randomBytes(length)local chars=table.create(length)for i=1,length do chars[i]=string.char(rngInt(0,255))end return table.concat(chars)end local RUN_NONCE=randomAscii(18)RUN_ID=string.format("%08x-%s",rngU32(),RUN_NONCE)local B64_ALPHABET="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"local function refBase64Encode(data)local bytes={string.byte(data,1,#data)}local out={}local i=1 while i<=#bytes do local a=bytes[i]or 0 local b=bytes[i+1]or 0 local c=bytes[i+2]or 0 local triple=a*65536+b*256+c local s1=math.floor(triple/262144)%64 local s2=math.floor(triple/4096)%64 local s3=math.floor(triple/64)%64 local s4=triple%64 table.insert(out,B64_ALPHABET:sub(s1+1,s1+1))table.insert(out,B64_ALPHABET:sub(s2+1,s2+1))if i+1<=#bytes then table.insert(out,B64_ALPHABET:sub(s3+1,s3+1))else table.insert(out,"=")end if i+2<=#bytes then table.insert(out,B64_ALPHABET:sub(s4+1,s4+1))else table.insert(out,"=")end i+=3 end return table.concat(out)end local function hexLooksValid(s)return type(s)=="string"and#s>0 and s:match("^[0-9a-fA-F]+$")~=nil end local function normalizedHash(s)if type(s)~="string"then return nil end return s:gsub("%s+",""):lower()end local KNOWN_HASHES={sha1={abc="a9993e364706816aba3e25717850c26c9cd0d89d",},sha256={abc="ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",},md5={abc="900150983cd24fb0d6963f7d28e17f72",},}local function buildDynamicFunction(body)local ls=resolve("loadstring")if type(ls)~="function"then return nil,"loadstring unavailable"end local fn,err=ls(body)if type(fn)~="function"then return nil,err or"loadstring failed"end local ok,result=pcall(fn)if not ok then return nil,result end return result end local STATUS={PASS="PASS",DEGRADED="DEGRADED",INCONSISTENT="INCONSISTENT",UNSTABLE="UNSTABLE",FAIL="FAIL",MISSING="MISSING",SKIP="SKIP",WARN="WARN",SECURE="SECURE",VULN="VULN",}local DIMENSIONS={baseline=true,presence=true,semantics=true,cross=true,fidelity=true,robustness=true,stress=true,antiSpoof=true,security=true,}local tests={}local results={}local function register(spec)assert(type(spec)=="table","test spec must be table")assert(type(spec.id)=="string","test id missing")assert(type(spec.name)=="string","test name missing")assert(type(spec.category)=="string","test category missing")assert(type(spec.dimension)=="string"and DIMENSIONS[spec.dimension],"invalid dimension")assert(type(spec.run)=="function","test run missing")spec.weight=tonumber(spec.weight)or 1 spec.severity=spec.severity or"medium"table.insert(tests,spec)end local function resultObject(status,message,meta)return{status=status,message=message,meta=meta,}end local function PASS(message,meta)return resultObject(STATUS.PASS,message,meta)end local function DEGRADED(message,meta)return resultObject(STATUS.DEGRADED,message,meta)end local function INCONSISTENT(message,meta)return resultObject(STATUS.INCONSISTENT,message,meta)end local function UNSTABLE(message,meta)return resultObject(STATUS.UNSTABLE,message,meta)end local function FAIL(message,meta)return resultObject(STATUS.FAIL,message,meta)end local function MISSING(message,meta)return resultObject(STATUS.MISSING,message,meta)end local function SKIP(message,meta)return resultObject(STATUS.SKIP,message,meta)end local function WARN(message,meta)return resultObject(STATUS.WARN,message,meta)end local function SECURE(message,meta)return resultObject(STATUS.SECURE,message,meta)end local function VULN(message,meta)return resultObject(STATUS.VULN,message,meta)end local function logResult(spec,result,elapsed)local symbol=({PASS="✅",DEGRADED="🟡",INCONSISTENT="🟠",UNSTABLE="🟣",FAIL="⛔",MISSING="⭕",SKIP="⏭️",WARN="⚠️",SECURE="🛡️",VULN="🚨",})[result.status]or"•"local line=string.format("%s [%s] %-14s %-20s %s",symbol,result.status,spec.dimension,spec.category,spec.id)if result.message and result.message~=""then line..=" • "..trim(result.message,180)end line..=string.format(" • %.2fms",elapsed*1000)if result.status==STATUS.FAIL or result.status==STATUS.MISSING or result.status==STATUS.VULN or result.status==STATUS.DEGRADED or result.status==STATUS.INCONSISTENT or result.status==STATUS.UNSTABLE then warn(line)else print(line)end end local function executeTest(spec)local start=now()local ok,ret=xpcall(function()return spec.run()end,traceback)local elapsed=now()-start local result if not ok then result=FAIL(ret)elseif type(ret)=="table"and type(ret.status)=="string"then result=ret elseif ret==nil then result=PASS()elseif ret==true then result=PASS()elseif ret==false then result=FAIL("returned false")else result=PASS(tostring(ret))end result.id=spec.id result.name=spec.name result.category=spec.category result.dimension=spec.dimension result.weight=spec.weight result.severity=spec.severity result.elapsed=elapsed table.insert(results,result)if CONFIG.verbose then logResult(spec,result,elapsed)end end local function shuffleInPlace(list)for i=#list,2,-1 do local j=rngInt(1,i)list[i],list[j]=list[j],list[i]end end local CAPABILITIES={{"cache.invalidate",{"cache.invalidate"},"Cache"},{"cache.iscached",{"cache.iscached"},"Cache"},{"cache.replace",{"cache.replace"},"Cache"},{"cloneref",{"cloneref"},"Cache"},{"compareinstances",{"compareinstances"},"Cache"},{"checkcaller",{"checkcaller"},"Closures"},{"clonefunction",{"clonefunction"},"Closures"},{"getcallingscript",{"getcallingscript"},"Closures"},{"getscriptclosure",{"getscriptclosure","getscriptfunction"},"Closures"},{"hookfunction",{"hookfunction","replaceclosure"},"Closures"},{"iscclosure",{"iscclosure"},"Closures"},{"islclosure",{"islclosure"},"Closures"},{"isexecutorclosure",{"isexecutorclosure","checkclosure","isourclosure"},"Closures"},{"loadstring",{"loadstring"},"Closures"},{"newcclosure",{"newcclosure"},"Closures"},{"restorefunction",{"restorefunction"},"Closures"},{"getfunctionhash",{"getfunctionhash"},"Closures"},{"rconsoleclear",{"rconsoleclear","consoleclear"},"Console"},{"rconsolecreate",{"rconsolecreate","consolecreate"},"Console"},{"rconsoledestroy",{"rconsoledestroy","consoledestroy"},"Console"},{"rconsoleinput",{"rconsoleinput","consoleinput"},"Console"},{"rconsoleprint",{"rconsoleprint","consoleprint"},"Console"},{"rconsolesettitle",{"rconsolesettitle","rconsolename","consolesettitle"},"Console"},{"crypt.base64encode",{"base64encode","crypt.base64encode","crypt.base64.encode","crypt.base64_encode","base64.encode","base64_encode"},"Crypt"},{"crypt.base64decode",{"base64decode","crypt.base64decode","crypt.base64.decode","crypt.base64_decode","base64.decode","base64_decode"},"Crypt"},{"crypt.encrypt",{"crypt.encrypt"},"Crypt"},{"crypt.decrypt",{"crypt.decrypt"},"Crypt"},{"crypt.generatebytes",{"crypt.generatebytes"},"Crypt"},{"crypt.generatekey",{"crypt.generatekey"},"Crypt"},{"crypt.hash",{"crypt.hash"},"Crypt"},{"debug.getconstant",{"debug.getconstant"},"Debug"},{"debug.getconstants",{"debug.getconstants"},"Debug"},{"debug.getinfo",{"debug.getinfo"},"Debug"},{"debug.getproto",{"debug.getproto"},"Debug"},{"debug.getprotos",{"debug.getprotos"},"Debug"},{"debug.getstack",{"debug.getstack"},"Debug"},{"debug.getupvalue",{"debug.getupvalue"},"Debug"},{"debug.getupvalues",{"debug.getupvalues"},"Debug"},{"debug.setconstant",{"debug.setconstant"},"Debug"},{"debug.setstack",{"debug.setstack"},"Debug"},{"debug.setupvalue",{"debug.setupvalue"},"Debug"},{"readfile",{"readfile"},"Filesystem"},{"listfiles",{"listfiles"},"Filesystem"},{"writefile",{"writefile"},"Filesystem"},{"makefolder",{"makefolder"},"Filesystem"},{"appendfile",{"appendfile"},"Filesystem"},{"isfile",{"isfile"},"Filesystem"},{"isfolder",{"isfolder"},"Filesystem"},{"delfolder",{"delfolder"},"Filesystem"},{"delfile",{"delfile"},"Filesystem"},{"loadfile",{"loadfile"},"Filesystem"},{"dofile",{"dofile"},"Filesystem"},{"isrbxactive",{"isrbxactive","isgameactive"},"Input"},{"mouse1click",{"mouse1click"},"Input"},{"mouse1press",{"mouse1press"},"Input"},{"mouse1release",{"mouse1release"},"Input"},{"mouse2click",{"mouse2click"},"Input"},{"mouse2press",{"mouse2press"},"Input"},{"mouse2release",{"mouse2release"},"Input"},{"mousemoveabs",{"mousemoveabs"},"Input"},{"mousemoverel",{"mousemoverel"},"Input"},{"mousescroll",{"mousescroll"},"Input"},{"keypress",{"keypress"},"Input"},{"keyrelease",{"keyrelease"},"Input"},{"fireclickdetector",{"fireclickdetector"},"Instances"},{"fireproximityprompt",{"fireproximityprompt"},"Instances"},{"firetouchinterest",{"firetouchinterest"},"Instances"},{"getcallbackvalue",{"getcallbackvalue"},"Instances"},{"getconnections",{"getconnections"},"Instances"},{"firesignal",{"firesignal"},"Signals"},{"replicatesignal",{"replicatesignal"},"Signals"},{"getcustomasset",{"getcustomasset","getsynasset"},"Instances"},{"gethiddenproperty",{"gethiddenproperty"},"Instances"},{"sethiddenproperty",{"sethiddenproperty"},"Instances"},{"gethui",{"gethui"},"Instances"},{"getinstances",{"getinstances"},"Instances"},{"getnilinstances",{"getnilinstances"},"Instances"},{"isscriptable",{"isscriptable"},"Instances"},{"setscriptable",{"setscriptable"},"Instances"},{"setrbxclipboard",{"setrbxclipboard"},"Instances"},{"getrawmetatable",{"getrawmetatable"},"Metatable"},{"hookmetamethod",{"hookmetamethod"},"Metatable"},{"getnamecallmethod",{"getnamecallmethod"},"Metatable"},{"isreadonly",{"isreadonly"},"Metatable"},{"setrawmetatable",{"setrawmetatable"},"Metatable"},{"setreadonly",{"setreadonly","make_writeable"},"Metatable"},{"identifyexecutor",{"identifyexecutor","getexecutorname"},"Misc"},{"lz4compress",{"lz4compress"},"Misc"},{"lz4decompress",{"lz4decompress"},"Misc"},{"messagebox",{"messagebox"},"Misc"},{"queue_on_teleport",{"queue_on_teleport","queueonteleport"},"Misc"},{"request",{"request","http.request","http_request"},"Network"},{"setclipboard",{"setclipboard","toclipboard"},"Misc"},{"setfpscap",{"setfpscap"},"Misc"},{"getgc",{"getgc"},"Environment"},{"getreg",{"getreg"},"Environment"},{"filtergc",{"filtergc"},"Environment"},{"getgenv",{"getgenv"},"Environment"},{"getloadedmodules",{"getloadedmodules"},"Environment"},{"getrenv",{"getrenv"},"Environment"},{"getrunningscripts",{"getrunningscripts"},"Environment"},{"getscriptfromthread",{"getscriptfromthread"},"Environment"},{"getscriptbytecode",{"getscriptbytecode","dumpstring"},"Environment"},{"getscripthash",{"getscripthash"},"Environment"},{"getscripts",{"getscripts"},"Environment"},{"getsenv",{"getsenv"},"Environment"},{"getthreadidentity",{"getthreadidentity","getidentity","getthreadcontext"},"Identity"},{"setthreadidentity",{"setthreadidentity","setidentity","setthreadcontext"},"Identity"},{"Drawing",{"Drawing"},"Drawing"},{"Drawing.new",{"Drawing.new"},"Drawing"},{"Drawing.Fonts",{"Drawing.Fonts"},"Drawing"},{"isrenderobj",{"isrenderobj"},"Drawing"},{"getrenderproperty",{"getrenderproperty"},"Drawing"},{"setrenderproperty",{"setrenderproperty"},"Drawing"},{"cleardrawcache",{"cleardrawcache"},"Drawing"},{"WebSocket",{"WebSocket"},"WebSocket"},{"WebSocket.connect",{"WebSocket.connect"},"WebSocket"},{"getactors",{"getactors"},"Actors"},{"run_on_actor",{"run_on_actor"},"Actors"},{"get_comm_channel",{"get_comm_channel"},"Actors"},{"create_comm_channel",{"create_comm_channel"},"Actors"},{"isparallel",{"isparallel"},"Actors"},{"getactorthreads",{"getactorthreads"},"Actors"},{"run_on_thread",{"run_on_thread"},"Actors"},{"getfunctionbytecode",{"getfunctionbytecode"},"Extended"},{"setstackhidden",{"setstackhidden"},"Extended"},{"getnilcallback",{"getnilcallback"},"Extended"},}local CAPABILITY_BY_ID={}for _,cap in ipairs(CAPABILITIES)do CAPABILITY_BY_ID[cap[1]]=cap end for _,cap in ipairs(CAPABILITIES)do local id=cap[1]local aliases=cap[2]local category=cap[3]register({id="presence."..id,name=id.." is exposed",category=category,dimension="presence",weight=1,run=function()local v,name=firstResolved(aliases)if v==nil then return MISSING("none of: "..table.concat(aliases,", "))end return PASS("resolved as "..name.." ("..type(v)..")")end,})register({id="shape."..id,name=id.." has plausible shape",category=category,dimension="antiSpoof",weight=0.35,run=function()local v,name=firstResolved(aliases)if v==nil then return MISSING()end if id=="Drawing"or id=="Drawing.Fonts"or id=="WebSocket"then if type(v)~="table"and type(v)~="userdata"then return FAIL(name.." expected table/userdata, got "..type(v))end return PASS()end if type(v)~="function"then return FAIL(name.." expected function, got "..type(v))end return PASS()end,})end register({id="semantics.loadstring.math",name="loadstring compiles and executes dynamic code",category="Closures",dimension="semantics",weight=2.0,run=function()local f=resolve("loadstring")if type(f)~="function"then return MISSING()end local a=rngInt(1000,9999)local b=rngInt(1000,9999)local chunk,err=f("return "..tostring(a).." + "..tostring(b))if type(chunk)~="function"then return FAIL("compiler did not return function: "..tostring(err))end if chunk()~=a+b then return FAIL("dynamic arithmetic mismatch")end local bad,compileErr=f("local =")if bad~=nil or type(compileErr)~="string"then return FAIL("compiler error contract is wrong")end return PASS()end,})register({id="semantics.clonefunction.identity",name="clonefunction preserves behavior but not identity",category="Closures",dimension="semantics",weight=2.0,run=function()local clone=resolve("clonefunction")if type(clone)~="function"then return MISSING()end local token=randomAscii(21)local function original(x)return token..":"..tostring(x)end local copy=clone(original)if type(copy)~="function"then return FAIL("clone is not a function")end if copy==original then return FAIL("clone is identical to original")end if copy(17)~=original(17)then return FAIL("behavior mismatch")end return PASS()end,})register({id="semantics.newcclosure.classification",name="newcclosure changes closure classification",category="Closures",dimension="semantics",weight=2.0,run=function()local ncc=resolve("newcclosure")local isc=resolve("iscclosure")local isl=resolve("islclosure")if type(ncc)~="function"or type(isc)~="function"then return MISSING()end local token=randomAscii(12)local function lfn(x)return token,x end local cfn=ncc(lfn)if type(cfn)~="function"then return FAIL("newcclosure returned "..type(cfn))end if cfn==lfn then return FAIL("newcclosure returned same identity")end if not isc(cfn)then return FAIL("result not classified as C closure")end if isc(lfn)then return FAIL("Luau closure misclassified as C")end if type(isl)=="function"and not isl(lfn)then return FAIL("Luau closure not classified as L closure")end local a,b=cfn(99)if a~=token or b~=99 then return FAIL("behavior changed")end return PASS()end,})register({id="semantics.hookfunction.roundtrip",name="hookfunction mutates target and returns callable original",category="Closures",dimension="semantics",weight=3.0,run=function()local hook=resolve("hookfunction")or resolve("replaceclosure")if type(hook)~="function"then return MISSING()end local before=randomAscii(15)local after=randomAscii(15)local function target(x)return before,x+1 end local replacement=function(x)return after,x+2 end local original=hook(target,replacement)if type(original)~="function"then return FAIL("original reference is not callable")end local a1,b1=target(8)local a2,b2=original(8)if a1~=after or b1~=10 then return FAIL("hook did not affect target")end if a2~=before or b2~=9 then return FAIL("returned original does not preserve original behavior")end if original==target then return FAIL("original reference aliases hooked target")end return PASS()end,})register({id="stress.hookfunction.multi",name="hookfunction handles multiple independent randomized closures",category="Closures",dimension="stress",weight=1.5,run=function()if not CONFIG.enableStress then return SKIP("stress disabled")end local hook=resolve("hookfunction")or resolve("replaceclosure")if type(hook)~="function"then return MISSING()end local started=now()for i=1,math.min(CONFIG.stressIterations,8)do local a=randomAscii(10)local b=randomAscii(10)local function target()return a end local original=hook(target,function()return b end)if target()~=b or original()~=a then return FAIL("iteration "..i.." coherence failure")end if now()-started>CONFIG.stressBudgetSeconds then return WARN("budget exceeded before all iterations")end end return PASS()end,})register({id="semantics.checkcaller.boolean",name="checkcaller returns boolean in executor scope",category="Closures",dimension="semantics",weight=1.0,run=function()local f=resolve("checkcaller")if type(f)~="function"then return MISSING()end local v=f()if type(v)~="boolean"then return FAIL("expected boolean, got "..type(v))end if v~=true then return WARN("executor scope returned false")end return PASS()end,})register({id="semantics.isexecutorclosure.discrimination",name="isexecutorclosure discriminates executor and Roblox closures",category="Closures",dimension="semantics",weight=2.0,run=function()local f=firstResolved({"isexecutorclosure","checkclosure","isourclosure"})if type(f)~="function"then return MISSING()end local ours=function()return RUN_NONCE end local a=f(ours)local b=f(print)if a~=true then return FAIL("executor Luau closure not recognized")end if b~=false then return FAIL("Roblox/C closure falsely recognized as executor closure")end return PASS()end,})local function makeConstantProbe()local text="AEGIS_"..randomAscii(16)local number=rngInt(100000,900000)local src=string.format([[
        return function()
            local a = %q
            local b = %d
            return a, b
        end
    ]],text,number)local fn,err=buildDynamicFunction(src)return fn,text,number,err end register({id="semantics.debug.getconstants.dynamic",name="debug.getconstants observes randomized function constants",category="Debug",dimension="semantics",weight=3.0,run=function()local f=resolve("debug.getconstants")if type(f)~="function"then return MISSING()end local probe,text,number,err=makeConstantProbe()if type(probe)~="function"then return SKIP("dynamic probe unavailable: "..tostring(err))end local constants=f(probe)if type(constants)~="table"then return FAIL("expected table, got "..type(constants))end local sawText=false local sawNumber=false for _,v in pairs(constants)do if v==text then sawText=true end if v==number then sawNumber=true end end if not sawText or not sawNumber then return FAIL("randomized constants not observed")end return PASS("found runtime challenge constants")end,})register({id="antispoof.debug.getconstants.input_independence",name="debug.getconstants changes with different randomized functions",category="Debug",dimension="antiSpoof",weight=3.0,run=function()local f=resolve("debug.getconstants")if type(f)~="function"then return MISSING()end local p1,s1,n1=makeConstantProbe()local p2,s2,n2=makeConstantProbe()if type(p1)~="function"or type(p2)~="function"then return SKIP("dynamic probes unavailable")end local c1=f(p1)local c2=f(p2)if type(c1)~="table"or type(c2)~="table"then return FAIL("non-table constants result")end local c1Has1,c1Has2=containsValue(c1,s1)or containsValue(c1,n1),containsValue(c1,s2)or containsValue(c1,n2)local c2Has1,c2Has2=containsValue(c2,s1)or containsValue(c2,n1),containsValue(c2,s2)or containsValue(c2,n2)if not c1Has1 or not c2Has2 then return FAIL("own constants missing")end if c1Has2 and c2Has1 then return FAIL("results appear input-independent / globally hardcoded")end return PASS()end,})register({id="semantics.debug.getconstant.search",name="debug.getconstant can locate a randomized constant",category="Debug",dimension="semantics",weight=2.0,run=function()local f=resolve("debug.getconstant")if type(f)~="function"then return MISSING()end local probe,text,number=makeConstantProbe()if type(probe)~="function"then return SKIP("dynamic probe unavailable")end local found=false for i=1,12 do local ok,value=pcall(f,probe,i)if ok and(value==text or value==number)then found=true break end end if not found then return FAIL("none of first 12 indexes matched randomized constants")end return PASS()end,})register({id="semantics.debug.getupvalue.identity",name="debug.getupvalue returns the captured sentinel",category="Debug",dimension="semantics",weight=2.5,run=function()local f=resolve("debug.getupvalue")if type(f)~="function"then return MISSING()end local sentinel={nonce=RUN_NONCE,value=rngU32()}local function probe()return sentinel end local got=f(probe,1)if got~=sentinel then return FAIL("captured sentinel identity mismatch")end return PASS()end,})register({id="cross.debug.setupvalue_getupvalue",name="debug.setupvalue and getupvalue agree on mutated state",category="Debug",dimension="cross",weight=3.0,run=function()local get=resolve("debug.getupvalue")local set=resolve("debug.setupvalue")if type(get)~="function"or type(set)~="function"then return MISSING()end local before=randomAscii(13)local after=randomAscii(13)local value=before local function probe()return value end local old=get(probe,1)if old~=before then return FAIL("getupvalue did not see initial value")end set(probe,1,after)local got=get(probe,1)local ran=probe()if got~=after or ran~=after then return FAIL("mutation not reflected consistently")end return PASS()end,})register({id="cross.debug.setconstant_execution",name="debug.setconstant changes actual function execution",category="Debug",dimension="cross",weight=3.0,run=function()local get=resolve("debug.getconstants")local set=resolve("debug.setconstant")if type(get)~="function"or type(set)~="function"then return MISSING()end local before="ORIG_"..randomAscii(14)local after="NEW_"..randomAscii(14)local src=string.format("return function() return %q end",before)local probe=buildDynamicFunction(src)if type(probe)~="function"then return SKIP("dynamic probe unavailable")end local constants=get(probe)if type(constants)~="table"then return FAIL("getconstants did not return table")end local idx for i,v in pairs(constants)do if v==before then idx=i break end end if type(idx)~="number"then return FAIL("could not locate original constant")end set(probe,idx,after)if probe()~=after then return FAIL("function execution did not reflect mutation")end local updated=get(probe)if type(updated)~="table"or not containsValue(updated,after)then return FAIL("getconstants did not reflect setconstant")end return PASS()end,})register({id="semantics.debug.getinfo.local_function",name="debug.getinfo describes a known local function coherently",category="Debug",dimension="semantics",weight=2.0,run=function()local f=resolve("debug.getinfo")if type(f)~="function"then return MISSING()end local function twoArgs(a,b)return a,b end local info=f(twoArgs)if type(info)~="table"then return FAIL("expected table")end if info.func~=nil and info.func~=twoArgs then return FAIL("func identity mismatch")end if info.numparams~=nil and info.numparams~=2 then return FAIL("numparams expected 2, got "..tostring(info.numparams))end if info.nups~=nil and(type(info.nups)~="number"or info.nups<0)then return FAIL("invalid nups")end if info.what~=nil and type(info.what)~="string"then return FAIL("what must be string")end return PASS()end,})register({id="semantics.debug.getprotos.shape",name="debug.getprotos returns callable inner prototypes",category="Debug",dimension="semantics",weight=2.5,run=function()local f=resolve("debug.getprotos")if type(f)~="function"then return MISSING()end local function outer()local function one()return"ONE_"end local function two()return"TWO_"end return one,two end local protos=f(outer)if type(protos)~="table"then return FAIL("expected table")end if#protos<2 then return FAIL("expected at least 2 protos, got "..tostring(#protos))end for i=1,math.min(#protos,2)do if type(protos[i])~="function"then return FAIL("proto "..i.." is "..type(protos[i]))end end return PASS()end,})local FS_ROOT=".aegis_"..RUN_NONCE local FS_READY=false local function fsPrepare()if FS_READY then return true end local make=resolve("makefolder")local isfolder=resolve("isfolder")local del=resolve("delfolder")if type(make)~="function"or type(isfolder)~="function"then return false end if isfolder(FS_ROOT)and type(del)=="function"then pcall(del,FS_ROOT)end local ok=pcall(make,FS_ROOT)if not ok or not isfolder(FS_ROOT)then return false end FS_READY=true return true end local function fsPath(name)return FS_ROOT.."/"..name end register({id="cross.fs.write_read_roundtrip",name="writefile/readfile round-trip randomized text",category="Filesystem",dimension="cross",weight=3.0,run=function()local write=resolve("writefile")local read=resolve("readfile")if type(write)~="function"or type(read)~="function"then return MISSING()end if not fsPrepare()then return FAIL("could not prepare sandbox folder")end local value="TXT|"..randomAscii(40).."|"..tostring(rngU32())local path=fsPath("roundtrip_"..randomAscii(7)..".txt")write(path,value)local got=read(path)if got~=value then return FAIL("readback mismatch")end return PASS()end,})register({id="cross.fs.binary_roundtrip",name="filesystem preserves binary bytes including NUL",category="Filesystem",dimension="cross",weight=3.0,run=function()local write=resolve("writefile")local read=resolve("readfile")if type(write)~="function"or type(read)~="function"then return MISSING()end if not fsPrepare()then return FAIL("could not prepare sandbox folder")end local value="\0AEGIS\0"..randomBytes(48).."\0END"local path=fsPath("binary_"..randomAscii(7)..".bin")write(path,value)local got=read(path)if#got~=#value or got~=value then return FAIL("binary payload changed")end return PASS()end,})register({id="cross.fs.append_read",name="appendfile composes exact content visible to readfile",category="Filesystem",dimension="cross",weight=2.5,run=function()local write=resolve("writefile")local append=resolve("appendfile")local read=resolve("readfile")if type(write)~="function"or type(append)~="function"or type(read)~="function"then return MISSING()end if not fsPrepare()then return FAIL("could not prepare sandbox folder")end local a=randomAscii(11)local b=randomAscii(13)local c=randomAscii(17)local path=fsPath("append_"..randomAscii(6)..".txt")write(path,a)append(path,b)append(path,c)if read(path)~=a..b..c then return FAIL("append sequence mismatch")end return PASS()end,})register({id="cross.fs.isfile_delete",name="isfile follows delfile state transitions",category="Filesystem",dimension="cross",weight=2.5,run=function()local write=resolve("writefile")local isfile=resolve("isfile")local del=resolve("delfile")if type(write)~="function"or type(isfile)~="function"or type(del)~="function"then return MISSING()end if not fsPrepare()then return FAIL("could not prepare sandbox folder")end local path=fsPath("delete_"..randomAscii(7)..".txt")if isfile(path)then pcall(del,path)end write(path,RUN_NONCE)if not isfile(path)then return FAIL("isfile false after write")end del(path)if isfile(path)then return FAIL("isfile true after delete")end return PASS()end,})register({id="cross.fs.folder_lifecycle",name="makefolder/isfolder/delfolder lifecycle is coherent",category="Filesystem",dimension="cross",weight=2.5,run=function()local make=resolve("makefolder")local isfolder=resolve("isfolder")local del=resolve("delfolder")if type(make)~="function"or type(isfolder)~="function"or type(del)~="function"then return MISSING()end if not fsPrepare()then return FAIL("could not prepare sandbox folder")end local path=fsPath("folder_"..randomAscii(7))if isfolder(path)then pcall(del,path)end make(path)if not isfolder(path)then return FAIL("isfolder false after makefolder")end del(path)if isfolder(path)then return FAIL("isfolder true after delfolder")end return PASS()end,})register({id="cross.fs.listfiles_created_set",name="listfiles observes independently created randomized files",category="Filesystem",dimension="cross",weight=3.0,run=function()local make=resolve("makefolder")local write=resolve("writefile")local list=resolve("listfiles")local read=resolve("readfile")local isfile=resolve("isfile")if type(make)~="function"or type(write)~="function"or type(list)~="function"or type(read)~="function"then return MISSING()end if not fsPrepare()then return FAIL("could not prepare sandbox folder")end local folder=fsPath("list_"..randomAscii(7))pcall(make,folder)local payload=randomAscii(22)local expectedNames={}for i=1,3 do local name="f"..i.."_"..randomAscii(6)..".txt"local path=folder.."/"..name write(path,payload..":"..i)expectedNames[path]=true end local files=list(folder)if type(files)~="table"then return FAIL("listfiles returned "..type(files))end local found=0 for _,path in pairs(files)do if expectedNames[path]then found+=1 elseif type(isfile)=="function"and isfile(path)then local ok,body=pcall(read,path)if ok and type(body)=="string"and body:sub(1,#payload)==payload then found+=1 end end end if found<3 then return FAIL("observed "..found.."/3 created files")end return PASS()end,})register({id="semantics.fs.loadfile.args_errors",name="loadfile executes local code and reports compile errors",category="Filesystem",dimension="semantics",weight=2.5,run=function()local write=resolve("writefile")local load=resolve("loadfile")if type(write)~="function"or type(load)~="function"then return MISSING()end if not fsPrepare()then return FAIL("could not prepare sandbox folder")end local path=fsPath("load_"..randomAscii(7)..".luau")write(path,"return ... + 7")local fn,err=load(path)if type(fn)~="function"then return FAIL("valid file did not compile: "..tostring(err))end local n=rngInt(10,100)if fn(n)~=n+7 then return FAIL("arguments/result mismatch")end write(path,"local =")local bad,compileErr=load(path)if bad~=nil or type(compileErr)~="string"then return FAIL("invalid file did not return compiler error")end return PASS()end,})register({id="stress.fs.randomized_roundtrips",name="filesystem survives repeated randomized small round-trips",category="Filesystem",dimension="stress",weight=2.0,run=function()if not CONFIG.enableStress then return SKIP("stress disabled")end local write=resolve("writefile")local read=resolve("readfile")local del=resolve("delfile")if type(write)~="function"or type(read)~="function"then return MISSING()end if not fsPrepare()then return FAIL("could not prepare sandbox folder")end local started=now()for i=1,CONFIG.stressIterations do local path=fsPath("stress_"..randomAscii(9)..".dat")local payload=randomBytes(rngInt(8,96))write(path,payload)if read(path)~=payload then return FAIL("round-trip mismatch at iteration "..i)end if type(del)=="function"then pcall(del,path)end if now()-started>CONFIG.stressBudgetSeconds then return WARN("time budget exceeded at iteration "..i)end end return PASS()end,})register({id="cross.crypt.base64.reference",name="base64 encoder matches independent reference on randomized bytes",category="Crypt",dimension="cross",weight=3.0,run=function()local enc=firstResolved({"crypt.base64encode","crypt.base64.encode","crypt.base64_encode","base64.encode","base64_encode"})if type(enc)~="function"then return MISSING()end for i=1,6 do local data=randomBytes(rngInt(0,50))local expected=refBase64Encode(data)local got=enc(data)if got~=expected then return FAIL("reference mismatch on vector "..i)end end return PASS()end,})register({id="cross.crypt.base64.roundtrip",name="base64 encode/decode randomized binary round-trip",category="Crypt",dimension="cross",weight=3.0,run=function()local enc=firstResolved({"crypt.base64encode","crypt.base64.encode","crypt.base64_encode","base64.encode","base64_encode"})local dec=firstResolved({"crypt.base64decode","crypt.base64.decode","crypt.base64_decode","base64.decode","base64_decode"})if type(enc)~="function"or type(dec)~="function"then return MISSING()end for i=1,7 do local data=randomBytes(rngInt(1,80))local encoded=enc(data)local decoded=dec(encoded)if decoded~=data then return FAIL("round-trip mismatch on vector "..i)end end return PASS()end,})register({id="semantics.crypt.generatebytes.length_variance",name="crypt.generatebytes returns requested entropy-sized values",category="Crypt",dimension="semantics",weight=2.0,run=function()local gen=resolve("crypt.generatebytes")local dec=firstResolved({"crypt.base64decode","crypt.base64.decode","crypt.base64_decode","base64.decode","base64_decode"})if type(gen)~="function"then return MISSING()end local previous for _,size in ipairs({1,7,16,31,64})do local value=gen(size)if type(value)~="string"then return FAIL("size "..size.." returned "..type(value))end local raw=value if type(dec)=="function"then local ok,decoded=pcall(dec,value)if ok and type(decoded)=="string"then raw=decoded end end if#raw~=size then return FAIL("requested "..size.." bytes, observed "..#raw)end if previous~=nil and value==previous then return FAIL("identical output across distinct calls/sizes")end previous=value end return PASS()end,})register({id="semantics.crypt.hash.known_vectors",name="crypt.hash matches known vectors where supported",category="Crypt",dimension="semantics",weight=3.0,run=function()local hash=resolve("crypt.hash")if type(hash)~="function"then return MISSING()end local tested=0 for algorithm,vectors in pairs(KNOWN_HASHES)do local ok,got=pcall(hash,"abc",algorithm)if ok and type(got)=="string"then tested+=1 local normalized=normalizedHash(got)if normalized~=vectors.abc then return FAIL(algorithm.." known vector mismatch")end end end if tested==0 then return WARN("none of sha1/sha256/md5 accepted")end return PASS("validated "..tested.." algorithms")end,})register({id="antispoof.crypt.hash.input_sensitivity",name="crypt.hash responds to randomized input changes",category="Crypt",dimension="antiSpoof",weight=2.0,run=function()local hash=resolve("crypt.hash")if type(hash)~="function"then return MISSING()end local a=randomAscii(31)local b=randomAscii(31)if a==b then b..="x"end local ok1,h1=pcall(hash,a,"sha256")local ok2,h2=pcall(hash,b,"sha256")if not ok1 or not ok2 then return SKIP("sha256 unsupported")end if type(h1)~="string"or type(h2)~="string"then return FAIL("hash output not string")end if h1==h2 then return FAIL("different randomized inputs produced identical hash")end if not hexLooksValid(h1)and#h1<20 then return WARN("unusual hash format")end return PASS()end,})register({id="cross.crypt.encrypt_decrypt",name="encrypt/decrypt randomized round-trip with fresh keys",category="Crypt",dimension="cross",weight=3.0,run=function()local encrypt=resolve("crypt.encrypt")local decrypt=resolve("crypt.decrypt")local genKey=resolve("crypt.generatekey")if type(encrypt)~="function"or type(decrypt)~="function"or type(genKey)~="function"then return MISSING()end for i=1,4 do local key=genKey()local raw=randomBytes(rngInt(12,80))local ok,encrypted,iv=pcall(encrypt,raw,key,nil,"CBC")if not ok then return FAIL("encrypt failed on vector "..i..": "..tostring(encrypted))end if type(encrypted)~="string"or encrypted==raw then return FAIL("ciphertext invalid")end local ok2,decrypted=pcall(decrypt,encrypted,key,iv,"CBC")if not ok2 then return FAIL("decrypt failed on vector "..i)end if decrypted~=raw then return FAIL("round-trip mismatch on vector "..i)end end return PASS()end,})register({id="cross.lz4.roundtrip",name="LZ4 randomized round-trip",category="Misc",dimension="cross",weight=2.5,run=function()local compress=resolve("lz4compress")local decompress=resolve("lz4decompress")if type(compress)~="function"or type(decompress)~="function"then return MISSING()end for i=1,6 do local raw if i%2==0 then raw=string.rep(randomAscii(4),rngInt(10,40))else raw=randomBytes(rngInt(16,160))end local compressed=compress(raw)if type(compressed)~="string"then return FAIL("compress returned "..type(compressed))end local currentOk,restored=pcall(decompress,compressed)if not(currentOk and restored==raw)then local legacyOk,legacyRestored=pcall(decompress,compressed,#raw)if not(legacyOk and legacyRestored==raw)then return FAIL("round-trip mismatch on vector "..i)end end end return PASS()end,})register({id="semantics.getcallbackvalue.local_bindable",name="getcallbackvalue returns exact BindableFunction callback",category="Instances",dimension="semantics",weight=2.5,run=function()local f=resolve("getcallbackvalue")if type(f)~="function"then return MISSING()end local bindable=Instance.new("BindableFunction")local token=randomAscii(15)local function callback()return token end bindable.OnInvoke=callback local got=f(bindable,"OnInvoke")safeDestroy(bindable)if got~=callback then return FAIL("callback identity mismatch")end if got()~=token then return FAIL("callback behavior mismatch")end return PASS()end,})register({id="semantics.getconnections.lifecycle",name="getconnections observes and controls a local BindableEvent connection",category="Instances",dimension="semantics",weight=3.0,run=function()local f=resolve("getconnections")if type(f)~="function"then return MISSING()end local ev=Instance.new("BindableEvent")local count=0 local connection=ev.Event:Connect(function()count+=1 end)local connections=f(ev.Event)if type(connections)~="table"or#connections<1 then connection:Disconnect()safeDestroy(ev)return FAIL("no connection returned")end local candidate for _,c in pairs(connections)do if type(c)=="table"or type(c)=="userdata"then candidate=c break end end if not candidate then connection:Disconnect()safeDestroy(ev)return FAIL("no connection object")end if type(candidate.Disable)=="function"and type(candidate.Enable)=="function"then candidate:Disable()ev:Fire()task.wait()if count~=0 then connection:Disconnect()safeDestroy(ev)return FAIL("Disable did not suppress callback")end candidate:Enable()ev:Fire()task.wait()if count~=1 then connection:Disconnect()safeDestroy(ev)return FAIL("Enable did not restore callback")end end connection:Disconnect()safeDestroy(ev)return PASS()end,})register({id="cross.getinstances.created_instance",name="getinstances contains a freshly created unique Instance",category="Instances",dimension="cross",weight=2.5,run=function()local f=resolve("getinstances")if type(f)~="function"then return MISSING()end local marker=Instance.new("Folder")marker.Name="Aegis_"..randomAscii(14)marker.Parent=nil local list=f()local found=type(list)=="table"and listContainsIdentity(list,marker)safeDestroy(marker)if not found then return FAIL("fresh instance absent")end return PASS()end,})register({id="cross.getnilinstances.created_nil_instance",name="getnilinstances contains a freshly nil-parented unique Instance",category="Instances",dimension="cross",weight=3.0,run=function()local f=resolve("getnilinstances")if type(f)~="function"then return MISSING()end local marker=Instance.new("Folder")marker.Name="AegisNil_"..randomAscii(15)marker.Parent=nil local list=f()if type(list)~="table"then safeDestroy(marker)return FAIL("expected table")end local found=listContainsIdentity(list,marker)safeDestroy(marker)if not found then return FAIL("fresh nil-parented instance absent")end return PASS()end,})register({id="semantics.gethui.instance",name="gethui returns a stable Instance container",category="Instances",dimension="semantics",weight=1.5,run=function()local f=resolve("gethui")if type(f)~="function"then return MISSING()end local a=f()local b=f()if typeofSafe(a)~="Instance"or typeofSafe(b)~="Instance"then return FAIL("non-Instance result")end if a~=b then return WARN("container identity changes between calls")end return PASS(a.ClassName)end,})register({id="cross.cache.invalidate_identity",name="cache.invalidate changes wrapper identity for same engine object",category="Cache",dimension="cross",weight=2.0,run=function()local invalidate=resolve("cache.invalidate")if type(invalidate)~="function"then return MISSING()end local container=Instance.new("Folder")local part=Instance.new("Part")part.Name="P_"..randomAscii(8)part.Parent=container local before=container:FindFirstChild(part.Name)invalidate(before)local after=container:FindFirstChild(part.Name)safeDestroy(container)if before==after then return FAIL("wrapper identity unchanged")end return PASS()end,})register({id="cross.cloneref_compareinstances",name="cloneref and compareinstances agree on engine identity",category="Cache",dimension="cross",weight=3.0,run=function()local clone=resolve("cloneref")local compare=resolve("compareinstances")if type(clone)~="function"or type(compare)~="function"then return MISSING()end local part=Instance.new("Part")local ref=clone(part)if ref==part then safeDestroy(part)return FAIL("cloneref returned same wrapper")end if compare(part,ref)~=true then safeDestroy(part)return FAIL("compareinstances rejected clone")end local newName="A_"..randomAscii(10)ref.Name=newName if part.Name~=newName then safeDestroy(part)return FAIL("clone did not reference same engine object")end safeDestroy(part)return PASS()end,})register({id="cross.hiddenproperty.roundtrip",name="gethiddenproperty/sethiddenproperty round-trip a disposable Fire",category="Instances",dimension="cross",weight=2.5,run=function()local get=resolve("gethiddenproperty")local set=resolve("sethiddenproperty")if type(get)~="function"or type(set)~="function"then return MISSING()end local fire=Instance.new("Fire")local ok,before,hidden=pcall(get,fire,"size_xml")if not ok then safeDestroy(fire)return SKIP("size_xml unavailable on this client build")end local target=(tonumber(before)or 5)+1 local okSet=pcall(set,fire,"size_xml",target)if not okSet then safeDestroy(fire)return FAIL("sethiddenproperty errored")end local okAfter,after=pcall(get,fire,"size_xml")safeDestroy(fire)if not okAfter or after~=target then return FAIL("hidden property mutation not observable")end if hidden~=nil and type(hidden)~="boolean"then return FAIL("hidden flag has invalid type")end return PASS()end,})register({id="semantics.getrawmetatable.locked_table",name="getrawmetatable bypasses __metatable lock",category="Metatable",dimension="semantics",weight=2.5,run=function()local f=resolve("getrawmetatable")if type(f)~="function"then return MISSING()end local mt={__metatable="LOCKED_"..randomAscii(8),__index=function()return RUN_NONCE end,}local obj=setmetatable({},mt)local got=f(obj)if got~=mt then return FAIL("raw metatable identity mismatch")end return PASS()end,})register({id="cross.setrawmetatable_behavior",name="setrawmetatable changes observable table behavior",category="Metatable",dimension="cross",weight=2.5,run=function()local setraw=resolve("setrawmetatable")local getraw=resolve("getrawmetatable")if type(setraw)~="function"or type(getraw)~="function"then return MISSING()end local a=randomAscii(11)local b=randomAscii(11)local obj=setmetatable({},{__index=function()return a end,__metatable="locked"})if obj.foo~=a then return FAIL("probe setup failed")end setraw(obj,{__index=function()return b end,__metatable="locked2"})if obj.foo~=b then return FAIL("behavior unchanged")end local mt=getraw(obj)if type(mt)~="table"then return FAIL("new raw metatable unavailable")end return PASS()end,})register({id="cross.setreadonly_mutability",name="setreadonly/isreadonly changes actual table mutability",category="Metatable",dimension="cross",weight=3.0,run=function()local set=resolve("setreadonly")or resolve("make_writeable")local is=resolve("isreadonly")if type(set)~="function"or type(is)~="function"then return MISSING()end local t={value=1}table.freeze(t)if is(t)~=true then return FAIL("frozen table not detected readonly")end set(t,false)local ok=pcall(function()t.value=2 end)if not ok or t.value~=2 then return FAIL("table remained immutable")end if is(t)==true then return WARN("isreadonly still true after unfreeze")end return PASS()end,})register({id="semantics.hookmetamethod.local_object",name="hookmetamethod changes a locked local object's metamethod",category="Metatable",dimension="semantics",weight=3.0,run=function()local hook=resolve("hookmetamethod")local ncc=resolve("newcclosure")if type(hook)~="function"then return MISSING()end local oldValue=randomAscii(12)local newValue=randomAscii(12)local indexer=function()return oldValue end if type(ncc)=="function"then indexer=ncc(indexer)end local obj=setmetatable({},{__index=indexer,__metatable="locked",})local original=hook(obj,"__index",function()return newValue end)if obj.anything~=newValue then return FAIL("hook did not change behavior")end if type(original)~="function"then return FAIL("original metamethod not returned")end if original(obj,"anything")~=oldValue then return FAIL("original metamethod behavior mismatch")end return PASS()end,})register({id="semantics.getnamecallmethod.global",name="getnamecallmethod observes a real namecall",category="Metatable",dimension="semantics",weight=2.0,run=function()if not CONFIG.enableGlobalHooks then return SKIP("global hooks disabled by default")end local hook=resolve("hookmetamethod")local getMethod=resolve("getnamecallmethod")if type(hook)~="function"or type(getMethod)~="function"then return MISSING()end local observed local original original=hook(game,"__namecall",function(...)if observed==nil then local ok,method=pcall(getMethod)if ok then observed=method end end return original(...)end)game:GetService("Lighting")pcall(function()hook(game,"__namecall",original)end)if observed~="GetService"then return FAIL("expected GetService, got "..tostring(observed))end return PASS()end,})register({id="cross.getgenv.global_visibility",name="getgenv writes are visible through executor global resolution",category="Environment",dimension="cross",weight=2.5,run=function()local f=resolve("getgenv")if type(f)~="function"then return MISSING()end local env=f()if type(env)~="table"then return FAIL("getgenv returned "..type(env))end local key="__AEGIS_"..randomAscii(15)local value=randomAscii(18)env[key]=value local readback=env[key]env[key]=nil if readback~=value then return FAIL("global write/read mismatch")end if f()~=env then return FAIL("getgenv identity changes")end return PASS()end,})register({id="semantics.getrenv.game",name="getrenv exposes the Roblox environment game reference",category="Environment",dimension="semantics",weight=2.0,run=function()local f=resolve("getrenv")if type(f)~="function"then return MISSING()end local env=f()if type(env)~="table"then return FAIL("getrenv returned "..type(env))end if env.game~=game then return FAIL("renv.game identity mismatch")end return PASS()end,})register({id="cross.getgc.dynamic_closure",name="getgc observes a fresh randomized closure",category="Environment",dimension="cross",weight=3.0,run=function()local f=resolve("getgc")if type(f)~="function"then return MISSING()end local token=randomAscii(19)local function marker()return token end if marker()~=token then return FAIL("marker setup failed")end local list=f(false)if type(list)~="table"then return FAIL("getgc(false) returned "..type(list))end if not listContainsIdentity(list,marker)then return FAIL("fresh closure not found")end return PASS()end,})register({id="cross.getgc.include_tables",name="getgc(true) can include a unique live table",category="Environment",dimension="cross",weight=2.5,run=function()local f=resolve("getgc")if type(f)~="function"then return MISSING()end local marker={__aegis=RUN_NONCE,rand=randomAscii(14),}local ok,list=pcall(f,true)if not ok then return SKIP("includeTables=true unsupported")end if type(list)~="table"then return FAIL("expected table")end if not listContainsIdentity(list,marker)then return FAIL("fresh table not found")end return PASS()end,})register({id="semantics.identity.get_type",name="getthreadidentity returns a plausible numeric identity",category="Identity",dimension="semantics",weight=1.5,run=function()local get=firstResolved({"getthreadidentity","getidentity","getthreadcontext"})if type(get)~="function"then return MISSING()end local id=get()if type(id)~="number"then return FAIL("expected number, got "..type(id))end if id<0 or id>100 then return WARN("unusual identity "..tostring(id))end return PASS(tostring(id))end,})register({id="cross.identity.set_get_restore",name="setthreadidentity is reflected by getthreadidentity and restores state",category="Identity",dimension="cross",weight=3.0,run=function()local get=firstResolved({"getthreadidentity","getidentity","getthreadcontext"})local set=firstResolved({"setthreadidentity","setidentity","setthreadcontext"})if type(get)~="function"or type(set)~="function"then return MISSING()end local original=get()local target=(original==3)and 2 or 3 local okSet,err=pcall(set,target)if not okSet then return FAIL("set failed: "..tostring(err))end local observed=get()pcall(set,original)if observed~=target then return FAIL("getter did not reflect target")end if get()~=original then return WARN("identity restore did not stick")end return PASS()end,})register({id="semantics.getscripts.shape",name="getscripts returns only script-like Instances",category="Environment",dimension="semantics",weight=1.5,run=function()local f=resolve("getscripts")if type(f)~="function"then return MISSING()end local list=f()if type(list)~="table"then return FAIL("expected table")end if#list==0 then return WARN("empty result")end local checked=0 for _,v in pairs(list)do if checked>=20 then break end checked+=1 if typeofSafe(v)~="Instance"then return FAIL("non-Instance entry")end if not(v:IsA("LocalScript")or v:IsA("ModuleScript")or v:IsA("Script"))then return FAIL("unexpected class "..v.ClassName)end end return PASS("checked "..checked)end,})register({id="semantics.getloadedmodules.shape",name="getloadedmodules returns ModuleScripts",category="Environment",dimension="semantics",weight=1.5,run=function()local f=resolve("getloadedmodules")if type(f)~="function"then return MISSING()end local list=f()if type(list)~="table"then return FAIL("expected table")end if#list==0 then return WARN("empty result")end local checked=0 for _,v in pairs(list)do if checked>=20 then break end checked+=1 if typeofSafe(v)~="Instance"or not v:IsA("ModuleScript")then return FAIL("non-ModuleScript entry")end end return PASS("checked "..checked)end,})local function findAnimateScript()local player=Players.LocalPlayer if not player then return nil end local character=player.Character if not character then return nil end return character:FindFirstChild("Animate")end register({id="semantics.getscriptbytecode.character",name="getscriptbytecode returns non-empty bytecode for a real LocalScript",category="Environment",dimension="semantics",weight=2.5,run=function()local f=firstResolved({"getscriptbytecode","dumpstring"})if type(f)~="function"then return MISSING()end local scriptObj=findAnimateScript()if not scriptObj then return SKIP("Character.Animate unavailable")end local bytecode=f(scriptObj)if type(bytecode)~="string"or#bytecode==0 then return FAIL("empty/non-string bytecode")end return PASS("bytes="..tostring(#bytecode))end,})register({id="antispoof.getscriptbytecode.input_variance",name="getscriptbytecode differs for distinct scripts when context allows",category="Environment",dimension="antiSpoof",weight=1.5,run=function()local f=firstResolved({"getscriptbytecode","dumpstring"})if type(f)~="function"then return MISSING()end local player=Players.LocalPlayer if not player or not player:FindFirstChildOfClass("PlayerScripts")then return SKIP("PlayerScripts unavailable")end local scripts={}for _,inst in ipairs(player.PlayerScripts:GetDescendants())do if inst:IsA("LocalScript")then table.insert(scripts,inst)if#scripts>=2 then break end end end if#scripts<2 then return SKIP("need two LocalScripts")end local ok1,a=pcall(f,scripts[1])local ok2,b=pcall(f,scripts[2])if not ok1 or not ok2 or type(a)~="string"or type(b)~="string"then return FAIL("bytecode retrieval failed")end if a==b and scripts[1]~=scripts[2]then return WARN("distinct scripts produced identical bytecode")end return PASS()end,})local function getRequest()local f,name=firstResolved({"request","http.request","http_request"})return f,name end register({id="semantics.request.get",name="request performs a real GET and returns structured response",category="Network",dimension="semantics",weight=3.0,run=function()if not CONFIG.enableNetwork then return SKIP("network disabled")end local request,alias=getRequest()if type(request)~="function"then return MISSING()end local url=CONFIG.networkCanaryUrl.."?aegis="..RUN_NONCE local ok,response=boundedCall(CONFIG.networkTimeoutSeconds,request,{Url=url,Method="GET",Headers={["X-Aegis-Run"]=RUN_ID,},})if isAegisTimeout(ok,response)then return SKIP("external network timeout; excluded from executor score")end if not ok then return FAIL("request errored: "..tostring(response))end if type(response)~="table"then return FAIL("response is "..type(response))end local status=response.StatusCode or response.Status local body=response.Body if type(status)~="number"then return FAIL("missing numeric status")end if type(body)~="string"then return FAIL("non-string body")end if status>=500 then return PASS(alias.." transport OK; remote endpoint status="..status)end if status>=400 then return PASS(alias.." transport OK; HTTP status="..status)end if status<100 or status>599 then return FAIL("implausible HTTP status "..tostring(status))end return PASS(alias.." status="..status)end,})register({id="antispoof.request.nonce_echo",name="network response reflects a randomized per-run query nonce",category="Network",dimension="antiSpoof",weight=3.0,run=function()if not CONFIG.enableNetwork then return SKIP("network disabled")end local request=getRequest()if type(request)~="function"then return MISSING()end local nonce="N_"..randomAscii(24)local url=CONFIG.networkCanaryUrl.."?nonce="..nonce local ok,response=boundedCall(CONFIG.networkTimeoutSeconds,request,{Url=url,Method="GET",})if isAegisTimeout(ok,response)then return SKIP("external network timeout; nonce evidence unavailable")end if not ok or type(response)~="table"or type(response.Body)~="string"then return WARN("could not obtain response body")end if not response.Body:find(nonce,1,true)then return WARN("endpoint did not echo nonce; anti-spoof evidence unavailable")end return PASS()end,})register({id="semantics.request.invalid_method",name="request handles malformed/unsupported methods without fake success",category="Network",dimension="semantics",weight=1.5,run=function()if not CONFIG.enableNetwork then return SKIP("network disabled")end local request=getRequest()if type(request)~="function"then return MISSING()end local ok,response=boundedCall(CONFIG.networkTimeoutSeconds,request,{Url=CONFIG.networkCanaryUrl,Method="AEGIS_INVALID_"..randomAscii(7),})if ok and type(response)=="table"then local status=response.StatusCode or response.Status if status==200 then return WARN("invalid method reported 200; may normalize/ignore Method")end end return PASS()end,})register({id="cross.drawing.lifecycle",name="Drawing.new object supports property mutation and destruction",category="Drawing",dimension="cross",weight=2.5,run=function()local new=resolve("Drawing.new")if type(new)~="function"then return MISSING()end local obj=new("Square")if obj==nil then return FAIL("Drawing.new returned nil")end local ok=pcall(function()obj.Visible=false obj.Position=Vector2.new(rngInt(1,30),rngInt(1,30))obj.Size=Vector2.new(4,4)obj.Transparency=0.5 end)if not ok then pcall(function()obj:Destroy()end)return FAIL("property mutation failed")end local destroyed=pcall(function()if type(obj.Destroy)=="function"then obj:Destroy()elseif type(obj.Remove)=="function"then obj:Remove()else error("no Destroy/Remove")end end)if not destroyed then return FAIL("destroy/remove failed")end return PASS()end,})register({id="cross.drawing.renderproperty",name="setrenderproperty/getrenderproperty agree with direct property state",category="Drawing",dimension="cross",weight=2.5,run=function()local new=resolve("Drawing.new")local set=resolve("setrenderproperty")local get=resolve("getrenderproperty")if type(new)~="function"or type(set)~="function"or type(get)~="function"then return MISSING()end local obj=new("Square")obj.Visible=false set(obj,"Visible",true)local v=get(obj,"Visible")local direct=obj.Visible pcall(function()obj.Visible=false obj:Destroy()end)if v~=true or direct~=true then return FAIL("state disagreement")end return PASS()end,})register({id="antispoof.drawing.coregui_polyfill",name="Drawing.new does not obviously materialize a ScreenGui in CoreGui",category="Drawing",dimension="antiSpoof",weight=2.0,run=function()local new=resolve("Drawing.new")if type(new)~="function"then return MISSING()end local coreGui=game:GetService("CoreGui")local before={}for _,child in ipairs(coreGui:GetChildren())do before[child]=true end local obj=new("Square")pcall(function()obj.Visible=false end)task.wait()local newGui=0 for _,child in ipairs(coreGui:GetChildren())do if not before[child]and child:IsA("LayerCollector")then newGui+=1 end end pcall(function()obj:Destroy()end)if newGui>0 then return WARN("new CoreGui LayerCollector appeared; possible GUI polyfill")end return PASS()end,})register({id="semantics.isrenderobj.discrimination",name="isrenderobj distinguishes Drawing object from ordinary userdata/table",category="Drawing",dimension="semantics",weight=2.0,run=function()local new=resolve("Drawing.new")local is=resolve("isrenderobj")if type(new)~="function"or type(is)~="function"then return MISSING()end local obj=new("Square")obj.Visible=false local a=is(obj)local b=is({})pcall(function()obj:Destroy()end)if a~=true then return FAIL("Drawing object not recognized")end if b==true then return FAIL("ordinary table falsely recognized")end return PASS()end,})register({id="semantics.identifyexecutor.contract",name="identifyexecutor returns stable non-empty name and optional version",category="Misc",dimension="semantics",weight=1.5,run=function()local f=firstResolved({"identifyexecutor","getexecutorname"})if type(f)~="function"then return MISSING()end local n1,v1=f()local n2,v2=f()if type(n1)~="string"or n1==""then return FAIL("empty/non-string name")end if n1~=n2 then return FAIL("name changes between calls")end if v1~=nil and type(v1)~="string"then return FAIL("version has invalid type")end if v2~=nil and type(v2)~="string"then return FAIL("version has invalid type")end return PASS(n1..(v1 and(" "..v1)or""))end,})register({id="semantics.setfpscap.observable",name="setfpscap produces an observable frame-rate change and restores cap",category="Misc",dimension="semantics",weight=1.5,run=function()local f=resolve("setfpscap")if type(f)~="function"then return MISSING()end if not CONFIG.enableStress then return SKIP("timing checks disabled with stress")end local function sample(frames)local sum=0 for _=1,frames do local dt=RunService.RenderStepped:Wait()if dt>0 then sum+=1/dt end end return sum/frames end local ok30=pcall(f,30)if not ok30 then return FAIL("failed to set cap=30")end local fps30=sample(4)pcall(f,0)local fps0=sample(4)if fps30>70 then return WARN(string.format("30 cap not strongly observable (%.1f fps)",fps30))end return PASS(string.format("%.1f@30 -> %.1f@0",fps30,fps0))end,})register({id="semantics.isrbxactive.boolean",name="isrbxactive/isgameactive returns boolean",category="Input",dimension="semantics",weight=0.75,run=function()local f=firstResolved({"isrbxactive","isgameactive"})if type(f)~="function"then return MISSING()end local v=f()if type(v)~="boolean"then return FAIL("expected boolean")end return PASS(tostring(v))end,})register({id="semantics.isparallel.boolean",name="isparallel returns boolean",category="Actors",dimension="semantics",weight=1.0,run=function()local f=resolve("isparallel")if type(f)~="function"then return MISSING()end local v=f()if type(v)~="boolean"then return FAIL("expected boolean, got "..type(v))end return PASS(tostring(v))end,})register({id="semantics.getactors.shape",name="getactors returns a table of Actor Instances when exposed",category="Actors",dimension="semantics",weight=1.0,run=function()local f=resolve("getactors")if type(f)~="function"then return MISSING()end local list=f()if type(list)~="table"then return FAIL("expected table")end local checked=0 for _,v in pairs(list)do checked+=1 if typeofSafe(v)~="Instance"or not v:IsA("Actor")then return FAIL("non-Actor entry")end if checked>=12 then break end end return PASS("checked "..checked)end,})register({id="semantics.websocket.connect_shape",name="WebSocket.connect returns an object with send/close/event surface",category="WebSocket",dimension="semantics",weight=1.5,run=function()if not CONFIG.enableWebSocket then return SKIP("WebSocket live test disabled by default")end local connect=resolve("WebSocket.connect")if type(connect)~="function"then return MISSING()end local ok,ws=boundedCall(CONFIG.websocketTimeoutSeconds,connect,CONFIG.websocketCanaryUrl)if isAegisTimeout(ok,ws)then return UNSTABLE("WebSocket connect exceeded "..tostring(CONFIG.websocketTimeoutSeconds).."s timeout")end if not ok then return FAIL("connect failed: "..tostring(ws))end if type(ws)~="table"and type(ws)~="userdata"then return FAIL("unexpected object type "..type(ws))end if type(ws.Send)~="function"then pcall(function()ws:Close()end)return FAIL("missing Send")end if type(ws.Close)~="function"then return FAIL("missing Close")end pcall(function()ws:Close()end)return PASS()end,})local function permissionErrorLooksBlocked(err)local s=tostring(err):lower()return s:find("permission",1,true)or s:find("security",1,true)or s:find("not allowed",1,true)or s:find("restricted",1,true)or s:find("identity",1,true)or s:find("capabil",1,true)or s:find("dangerous call",1,true)or s:find("blocked",1,true)or s:find("denied",1,true)or s:find("forbidden",1,true)or s:find("unsafe",1,true)end local function argumentErrorLooksCallable(err)local s=tostring(err):lower()return s:find("argument",1,true)or s:find("expected",1,true)or s:find("missing",1,true)or s:find("invalid",1,true)end local function registerServiceMalformedCall(serviceName,methodName,severity)register({id="security.service."..serviceName.."."..methodName,name=serviceName.."."..methodName.." rejects executor access before argument validation",category="Security",dimension="security",weight=1,severity=severity or"high",run=function()if not CONFIG.enableSecurity then return SKIP("security disabled")end local okService,service=pcall(game.GetService,game,serviceName)if not okService or service==nil then return SECURE("service unavailable")end local method local okMember=pcall(function()method=service[methodName]end)if not okMember or type(method)~="function"then return SECURE("method not exposed")end local okCall,err=pcall(function()return method(service,nil,nil,nil)end)if okCall then return VULN("malformed call unexpectedly succeeded")end if permissionErrorLooksBlocked(err)then return SECURE("permission/security rejection")end if argumentErrorLooksCallable(err)then return VULN("reached argument validation instead of security boundary")end return WARN("ambiguous rejection: "..trim(err,120))end,})end registerServiceMalformedCall("HttpRbxApiService","GetAsync","critical")registerServiceMalformedCall("HttpRbxApiService","GetAsyncFullUrl","critical")registerServiceMalformedCall("HttpRbxApiService","PostAsync","critical")registerServiceMalformedCall("HttpRbxApiService","PostAsyncFullUrl","critical")registerServiceMalformedCall("HttpRbxApiService","RequestAsync","critical")registerServiceMalformedCall("BrowserService","ExecuteJavaScript","critical")registerServiceMalformedCall("BrowserService","OpenBrowserWindow","high")registerServiceMalformedCall("LinkingService","OpenUrl","high")registerServiceMalformedCall("OpenCloudService","HttpRequestAsync","critical")registerServiceMalformedCall("OpenCloudService","GetApiV1","high")registerServiceMalformedCall("ContentProvider","SetBaseUrl","high")registerServiceMalformedCall("InsertService","GetLocalFileContents","critical")registerServiceMalformedCall("MessageBusService","Publish","high")registerServiceMalformedCall("MessageBusService","Call","high")registerServiceMalformedCall("MarketplaceService","PerformPurchase","critical")registerServiceMalformedCall("MarketplaceService","PerformPurchaseV2","critical")registerServiceMalformedCall("MarketplaceService","PerformBulkPurchase","critical")registerServiceMalformedCall("Players","ReportAbuseV3","medium")registerServiceMalformedCall("ScriptContext","AddCoreScriptLocal","critical")registerServiceMalformedCall("ScriptProfilerService","SaveScriptProfilingData","high")local function authBodyLooksAuthenticated(body)if type(body)~="string"then return false end return body:find('"robux"',1,true)~=nil or body:find('"isPremium"',1,true)~=nil or body:find('"balance"',1,true)~=nil end local function registerAuthLeakCheck(id,getter,caller)register({id="security.auth."..id,name=id.." must not attach Roblox account authentication",category="Security",dimension="security",weight=1,severity="critical",run=function()if not CONFIG.enableSecurity or not CONFIG.enableAuthLeakCanary then return SKIP("auth leak canary disabled")end local func=getter()if type(func)~="function"then return SECURE("API not exposed")end local ok,response=boundedCall(CONFIG.networkTimeoutSeconds,caller,func,CONFIG.authCanaryUrl)if isAegisTimeout(ok,response)then return WARN("auth canary timed out; no security conclusion")end if not ok then return SECURE("Roblox API request rejected")end local body if type(response)=="table"then body=response.Body else body=response end if authBodyLooksAuthenticated(body)then return VULN("authenticated Roblox account data was returned")end return SECURE("no authenticated account markers observed")end,})end registerAuthLeakCheck("request",function()return resolve("request")end,function(f,url)return f({Url=url,Method="GET"})end)registerAuthLeakCheck("http_request",function()return resolve("http_request")end,function(f,url)return f({Url=url,Method="GET"})end)registerAuthLeakCheck("http.request",function()return resolve("http.request")end,function(f,url)return f({Url=url,Method="GET"})end)registerAuthLeakCheck("game.HttpGet",function()return game.HttpGet end,function(_,url)return game:HttpGet(url)end)registerAuthLeakCheck("game.HttpGetAsync",function()return game.HttpGetAsync end,function(_,url)return game:HttpGetAsync(url)end)local function registerFileProtocolCheck(id,getter,caller)register({id="security.fileprotocol."..id,name=id.." rejects file:// URLs",category="Security",dimension="security",weight=1,severity="critical",run=function()if not CONFIG.enableSecurity or not CONFIG.enableFileProtocolCanary then return SKIP("file protocol canary disabled")end local func=getter()if type(func)~="function"then return SECURE("API not exposed")end local fakePath="file:///AegisBench_Definitely_Not_Existing_"..randomAscii(20)local ok,response=boundedCall(CONFIG.networkTimeoutSeconds,caller,func,fakePath)if isAegisTimeout(ok,response)then return WARN("file:// canary timed out; no security conclusion")end if ok then return VULN("file:// request was accepted")end return SECURE("file:// request rejected")end,})end registerFileProtocolCheck("request",function()return resolve("request")end,function(f,url)return f({Url=url,Method="GET"})end)registerFileProtocolCheck("http_request",function()return resolve("http_request")end,function(f,url)return f({Url=url,Method="GET"})end)registerFileProtocolCheck("http.request",function()return resolve("http.request")end,function(f,url)return f({Url=url,Method="GET"})end)registerFileProtocolCheck("game.HttpGet",function()return game.HttpGet end,function(_,url)return game:HttpGet(url)end)registerFileProtocolCheck("game.HttpGetAsync",function()return game.HttpGetAsync end,function(_,url)return game:HttpGetAsync(url)end)local DANGEROUS_SURFACE_NAMES={"shell","executecommand","runcommand","getprocesses","getprocess","readprocessmemory","writeprocessmemory","getclipboard","readclipboard","gethwid",}for _,name in ipairs(DANGEROUS_SURFACE_NAMES)do register({id="security.surface."..name,name="non-standard sensitive surface: "..name,category="Security",dimension="security",weight=0.4,severity="low",run=function()if not CONFIG.enableSecurity then return SKIP("security disabled")end local v=resolve(name)if v==nil then return SECURE("not exposed")end return WARN("exposed as "..type(v).."; not invoked")end,})end register({id="antispoof.function_alias.identity_request",name="request aliases behave coherently on a randomized nonce",category="AntiSpoof",dimension="antiSpoof",weight=2.0,run=function()if not CONFIG.enableNetwork then return SKIP("network disabled")end local variants={{"request",resolve("request")},{"http_request",resolve("http_request")},{"http.request",resolve("http.request")},}local live={}for _,pair in ipairs(variants)do if type(pair[2])=="function"then table.insert(live,pair)end end if#live<2 then return SKIP("need at least two aliases")end local nonce="ALIAS_"..randomAscii(19)local statuses={}for _,pair in ipairs(live)do local ok,response=boundedCall(CONFIG.networkTimeoutSeconds,pair[2],{Url=CONFIG.networkCanaryUrl.."?alias="..nonce,Method="GET",})if isAegisTimeout(ok,response)then return SKIP("external network timeout while comparing request aliases")end if not ok or type(response)~="table"then return FAIL(pair[1].." failed while another alias exists")end statuses[pair[1]]=response.StatusCode or response.Status end local baseline for name,status in pairs(statuses)do if type(status)~="number"then return FAIL(name.." missing numeric status")end baseline=baseline or status if status~=baseline then return WARN("aliases disagree on status codes")end end return PASS()end,})register({id="antispoof.getgenv.repeated_identity",name="getgenv identity remains stable across randomized scheduling",category="AntiSpoof",dimension="antiSpoof",weight=1.5,run=function()local f=resolve("getgenv")if type(f)~="function"then return MISSING()end local first=f()for i=1,10 do if i%3==0 then task.wait()end if f()~=first then return FAIL("identity changed at iteration "..i)end end return PASS()end,})register({id="antispoof.random_challenge_visibility",name="runtime challenge values are internally coherent",category="AntiSpoof",dimension="antiSpoof",weight=1.0,run=function()local a=randomAscii(23)local b=randomBytes(19)local c=rngU32()local signature=hash32(a..b..tostring(c))if type(signature)~="number"then return FAIL("reference hash failed")end if a==RUN_NONCE or#b~=19 then return FAIL("challenge generator degenerate")end return PASS(string.format("challenge=%08x",signature))end,})register({id="antispoof.remote_challenge",name="optional remote challenge provider returns fresh structured vectors",category="AntiSpoof",dimension="antiSpoof",weight=1.5,run=function()if type(CONFIG.remoteChallengeUrl)~="string"or CONFIG.remoteChallengeUrl==""then return SKIP("no remoteChallengeUrl configured")end if not CONFIG.enableNetwork then return SKIP("network disabled")end local request=getRequest()if type(request)~="function"then return MISSING("request unavailable")end local sep=CONFIG.remoteChallengeUrl:find("?",1,true)and"&"or"?"local url=CONFIG.remoteChallengeUrl..sep.."run="..HttpService:UrlEncode(RUN_ID)local ok,response=boundedCall(CONFIG.networkTimeoutSeconds,request,{Url=url,Method="GET"})if not ok or type(response)~="table"or type(response.Body)~="string"then return FAIL("challenge request failed")end local okJson,data=pcall(HttpService.JSONDecode,HttpService,response.Body)if not okJson or type(data)~="table"then return FAIL("invalid JSON")end if type(data.id)~="string"or data.id==""then return FAIL("missing challenge id")end if type(data.nonce)~="string"or data.nonce==""then return FAIL("missing challenge nonce")end if type(data.vectors)~="table"or#data.vectors==0 then return FAIL("missing vectors")end return PASS("challenge "..trim(data.id,40))end,})local SAFE_BOOLEAN_CALLS={{"isrbxactive",{"isrbxactive","isgameactive"}},{"checkcaller",{"checkcaller"}},{"isparallel",{"isparallel"}},}for _,spec in ipairs(SAFE_BOOLEAN_CALLS)do register({id="shape.boolean."..spec[1],name=spec[1].." repeatedly returns boolean",category="Shape",dimension="antiSpoof",weight=0.5,run=function()local f=firstResolved(spec[2])if type(f)~="function"then return MISSING()end for _=1,4 do local ok,v=pcall(f)if not ok then return FAIL("call errored")end if type(v)~="boolean"then return FAIL("returned "..type(v))end end return PASS()end,})end local INTERACTIVE_INPUTS={"mouse1click","mouse1press","mouse1release","mouse2click","mouse2press","mouse2release","mousemoveabs","mousemoverel","mousescroll","keypress","keyrelease",}for _,name in ipairs(INTERACTIVE_INPUTS)do register({id="semantics.input."..name,name=name.." interactive verification",category="Input",dimension="semantics",weight=0.4,run=function()local f=resolve(name)if type(f)~="function"then return MISSING()end if not CONFIG.enableInteractiveInput then return SKIP("interactive input disabled")end return WARN("manual/experience-specific verification required")end,})end local SIDE_EFFECT_SURFACES={"rconsoleclear","rconsolecreate","rconsoledestroy","rconsoleinput","rconsoleprint","rconsolesettitle","setclipboard","setrbxclipboard","messagebox","queue_on_teleport",}for _,name in ipairs(SIDE_EFFECT_SURFACES)do register({id="semantics.safe_surface."..name,name=name.." safe-mode semantic policy",category="SafeMode",dimension="semantics",weight=0.25,run=function()local cap=CAPABILITY_BY_ID[name]local aliases=cap and cap[2]or{name}local f=firstResolved(aliases)if f==nil then return MISSING()end return SKIP("not invoked in safe mode")end,})end for _,cap in ipairs(CAPABILITIES)do local capId=cap[1]local aliases=cap[2]local category=cap[3]register({id="stability.resolve."..capId,name=capId.." resolves to stable identity",category=category,dimension="antiSpoof",weight=0.18,run=function()local first,alias=firstResolved(aliases)if first==nil then return MISSING()end local second=resolve(alias)if second==nil then return FAIL("resolved alias disappeared")end if first~=second then return DEGRADED("global identity changes between immediate resolutions")end return PASS(alias)end,})end local function baselineFixture(index)local root=Instance.new("Folder")root.Name="AegisBase_"..index.."_"..randomAscii(7)local directCount=2+(index%4)for i=1,directCount do local child=Instance.new("Folder")child.Name="Child_"..i.."_"..randomAscii(5)child:SetAttribute("AegisIndex",i)child.Parent=root local nested=Instance.new("StringValue")nested.Name="Nested_"..i nested.Value=randomAscii(9)nested.Parent=child end return root,directCount end for i=1,15 do register({id=string.format("baseline.getchildren.%02d",i),name="Roblox GetChildren control vector "..i,category="RobloxBaseline",dimension="baseline",weight=1,run=function()if not CONFIG.baselineChecks then return SKIP("baseline disabled")end local root,count=baselineFixture(i)local children=root:GetChildren()safeDestroy(root)if#children~=count then return FAIL("GetChildren count mismatch")end return PASS()end,})register({id=string.format("baseline.findfirstchild.%02d",i),name="Roblox FindFirstChild control vector "..i,category="RobloxBaseline",dimension="baseline",weight=1,run=function()if not CONFIG.baselineChecks then return SKIP("baseline disabled")end local root=baselineFixture(i)local target=root:GetChildren()[1]local found=root:FindFirstChild(target.Name)local missing=root:FindFirstChild("__AEGIS_MISSING_"..randomAscii(8))safeDestroy(root)if found~=target or missing~=nil then return FAIL("FindFirstChild semantics mismatch")end return PASS()end,})register({id=string.format("baseline.getdescendants.%02d",i),name="Roblox GetDescendants control vector "..i,category="RobloxBaseline",dimension="baseline",weight=1,run=function()if not CONFIG.baselineChecks then return SKIP("baseline disabled")end local root,count=baselineFixture(i)local descendants=root:GetDescendants()safeDestroy(root)if#descendants~=count*2 then return FAIL("GetDescendants expected "..(count*2)..", got "..#descendants)end return PASS()end,})register({id=string.format("baseline.attributes.%02d",i),name="Roblox Attribute control vector "..i,category="RobloxBaseline",dimension="baseline",weight=1,run=function()if not CONFIG.baselineChecks then return SKIP("baseline disabled")end local obj=Instance.new("Folder")local key="K_"..randomAscii(6)local value="V_"..randomAscii(13)obj:SetAttribute(key,value)local got=obj:GetAttribute(key)local attrs=obj:GetAttributes()safeDestroy(obj)if got~=value or attrs[key]~=value then return FAIL("attribute state mismatch")end return PASS()end,})end for i=1,48 do register({id=string.format("vectors.base64.reference.%03d",i),name="Base64 independent reference vector "..i,category="Encoding",dimension="cross",weight=0.42,run=function()local enc=firstResolved({"base64encode","crypt.base64encode","crypt.base64.encode","crypt.base64_encode","base64.encode","base64_encode"})if type(enc)~="function"then return MISSING()end local data if i%4==0 then data=""elseif i%4==1 then data=randomAscii((i%31)+1)elseif i%4==2 then data=randomBytes((i%47)+1)else data="\0"..randomBytes((i%29)+1).."\0"end local got=enc(data)local expected=refBase64Encode(data)if got~=expected then return FAIL("reference mismatch len="..#data)end return PASS()end,})end for i=1,48 do register({id=string.format("vectors.base64.roundtrip.%03d",i),name="Base64 binary round-trip vector "..i,category="Encoding",dimension="semantics",weight=0.42,run=function()local enc=firstResolved({"base64encode","crypt.base64encode","crypt.base64.encode","crypt.base64_encode","base64.encode","base64_encode"})local dec=firstResolved({"base64decode","crypt.base64decode","crypt.base64.decode","crypt.base64_decode","base64.decode","base64_decode"})if type(enc)~="function"or type(dec)~="function"then return MISSING()end local data=randomBytes((i*7)%97)if i%5==0 then data=data.."\0AEGIS\0"end local encoded=enc(data)local decoded=dec(encoded)if decoded~=data then return FAIL("round-trip mismatch vector="..i)end return PASS()end,})end for i=1,40 do register({id=string.format("vectors.lz4.roundtrip.%03d",i),name="LZ4 round-trip vector "..i,category="Encoding",dimension="cross",weight=0.40,run=function()local compress=resolve("lz4compress")local decompress=resolve("lz4decompress")if type(compress)~="function"or type(decompress)~="function"then return MISSING()end local raw if i%3==0 then raw=string.rep(randomAscii(3),8+(i%30))elseif i%3==1 then raw=randomBytes(1+((i*11)%180))else raw="\0"..string.rep("AEGIS",i%20).."\0"end local packed=compress(raw)if type(packed)~="string"then return FAIL("compress returned "..type(packed))end local currentOk,restored=pcall(decompress,packed)if currentOk and restored==raw then return PASS("current signature")end local legacyOk,legacyRestored=pcall(decompress,packed,#raw)if legacyOk and legacyRestored==raw then return PASS("legacy signature data round-trip; fidelity scored separately")end return FAIL("decompression mismatch under current and legacy signatures")end,})end for i=1,48 do register({id=string.format("vectors.debug.constants.%03d",i),name="debug constants randomized vector "..i,category="Debug",dimension="semantics",weight=0.55,run=function()local getconstants=resolve("debug.getconstants")if type(getconstants)~="function"then return MISSING()end local s1="A15_"..randomAscii(11)local s2="B15_"..randomAscii(13)local n1=rngInt(100000,999999)local src=string.format("return function() local a=%q local b=%q local c=%d return a,b,c end",s1,s2,n1)local probe=buildDynamicFunction(src)if type(probe)~="function"then return SKIP("loadstring unavailable")end local constants=getconstants(probe)if type(constants)~="table"then return FAIL("expected table")end if not containsValue(constants,s1)or not containsValue(constants,s2)or not containsValue(constants,n1)then return FAIL("one or more randomized constants missing")end return PASS()end,})end for i=1,20 do register({id=string.format("vectors.debug.getconstant.%03d",i),name="debug.getconstant search vector "..i,category="Debug",dimension="cross",weight=0.55,run=function()local getconstant=resolve("debug.getconstant")local getconstants=resolve("debug.getconstants")if type(getconstant)~="function"or type(getconstants)~="function"then return MISSING()end local secret="GC_"..randomAscii(16)local probe=buildDynamicFunction(string.format("return function() return %q end",secret))if type(probe)~="function"then return SKIP("dynamic probe unavailable")end local all=getconstants(probe)local idx for k,v in pairs(all)do if v==secret and type(k)=="number"then idx=k break end end if not idx then return FAIL("reference API did not expose secret")end local got=getconstant(probe,idx)if got~=secret then return FAIL("single-value API disagrees with bulk API")end return PASS()end,})end for i=1,20 do register({id=string.format("vectors.debug.upvalue.%03d",i),name="debug upvalue identity vector "..i,category="Debug",dimension="semantics",weight=0.55,run=function()local get=resolve("debug.getupvalue")if type(get)~="function"then return MISSING()end local sentinel={run=RUN_ID,index=i,token=randomAscii(15)}local function probe()return sentinel end if get(probe,1)~=sentinel then return FAIL("upvalue identity mismatch")end return PASS()end,})end for i=1,20 do register({id=string.format("vectors.debug.setupvalue.%03d",i),name="debug setupvalue execution vector "..i,category="Debug",dimension="cross",weight=0.65,run=function()local get=resolve("debug.getupvalue")local set=resolve("debug.setupvalue")if type(get)~="function"or type(set)~="function"then return MISSING()end local before="BEF_"..randomAscii(10)local after="AFT_"..randomAscii(12)local captured=before local function probe()return captured end set(probe,1,after)if probe()~=after then return FAIL("actual execution unchanged")end if get(probe,1)~=after then return FAIL("getter disagrees with execution")end return PASS()end,})end for i=1,24 do register({id=string.format("vectors.clonefunction.%03d",i),name="clonefunction randomized vector "..i,category="Closures",dimension="semantics",weight=0.50,run=function()local clone=resolve("clonefunction")if type(clone)~="function"then return MISSING()end local a=rngInt(-100000,100000)local token=randomAscii(15)local function original(x,y)return token,a+x,y end local copied=clone(original)if type(copied)~="function"then return FAIL("clone not callable")end if copied==original then return FAIL("clone aliases original identity")end local r1,r2,r3=copied(i,token)if r1~=token or r2~=a+i or r3~=token then return FAIL("behavior mismatch")end return PASS()end,})end for i=1,16 do register({id=string.format("vectors.newcclosure.%03d",i),name="newcclosure randomized classification vector "..i,category="Closures",dimension="fidelity",weight=0.62,run=function()local ncc=resolve("newcclosure")local isc=resolve("iscclosure")if type(ncc)~="function"or type(isc)~="function"then return MISSING()end local token=randomAscii(14)local function raw(x)return token,x*(i+1)end local wrapped=ncc(raw)if wrapped==raw then return DEGRADED("wrapper preserves same function identity")end if not isc(wrapped)then return FAIL("result not classified C closure")end local a,b=wrapped(3)if a~=token or b~=3*(i+1)then return FAIL("behavior mismatch")end return PASS()end,})end for i=1,16 do register({id=string.format("vectors.hookfunction.%03d",i),name="hookfunction coherence vector "..i,category="Closures",dimension="cross",weight=0.70,run=function()local hook=resolve("hookfunction")or resolve("replaceclosure")if type(hook)~="function"then return MISSING()end local originalToken="O_"..randomAscii(10)local hookToken="H_"..randomAscii(10)local function target(x)return originalToken,x+i end local old=hook(target,function(x)return hookToken,x-i end)if type(old)~="function"then return FAIL("original not callable")end local a1,b1=target(100)local a2,b2=old(100)if a1~=hookToken or b1~=100-i then return FAIL("hooked behavior mismatch")end if a2~=originalToken or b2~=100+i then return FAIL("original behavior mismatch")end return PASS()end,})end for i=1,8 do register({id=string.format("vectors.restorefunction.%03d",i),name="restorefunction multi-hook vector "..i,category="Closures",dimension="fidelity",weight=0.78,run=function()local hook=resolve("hookfunction")or resolve("replaceclosure")local restore=resolve("restorefunction")if type(hook)~="function"or type(restore)~="function"then return MISSING()end local original="R0_"..randomAscii(9)local h1="R1_"..randomAscii(9)local h2="R2_"..randomAscii(9)local function target()return original end hook(target,function()return h1 end)hook(target,function()return h2 end)if target()~=h2 then return FAIL("second hook not active")end local ok,err=pcall(restore,target)if not ok then return FAIL("restore errored: "..tostring(err))end if target()~=original then return FAIL("did not restore first original")end return PASS()end,})end for i=1,36 do register({id=string.format("vectors.metatable.raw.%03d",i),name="raw metatable mutation vector "..i,category="Metatable",dimension="cross",weight=0.50,run=function()local getraw=resolve("getrawmetatable")local setraw=resolve("setrawmetatable")if type(getraw)~="function"or type(setraw)~="function"then return MISSING()end local a="A_"..randomAscii(8)local b="B_"..randomAscii(8)local mt1={__index=function()return a end,__metatable=randomAscii(8)}local obj=setmetatable({},mt1)if getraw(obj)~=mt1 then return FAIL("raw identity mismatch")end setraw(obj,{__index=function()return b end,__metatable=randomAscii(8)})if obj.anything~=b then return FAIL("observable behavior unchanged")end return PASS()end,})end for i=1,36 do register({id=string.format("vectors.fs.transaction.%03d",i),name="filesystem transaction vector "..i,category="Filesystem",dimension="cross",weight=0.52,run=function()local write=resolve("writefile")local read=resolve("readfile")local append=resolve("appendfile")local isfile=resolve("isfile")local del=resolve("delfile")if type(write)~="function"or type(read)~="function"or type(isfile)~="function"then return MISSING()end if not fsPrepare()then return FAIL("sandbox unavailable")end local path=fsPath("tx_"..i.."_"..randomAscii(7)..".bin")local a=randomBytes(3+((i*7)%55))local b=randomBytes(2+((i*5)%33))write(path,a)if not isfile(path)then return FAIL("isfile false after write")end if read(path)~=a then return FAIL("initial readback mismatch")end if type(append)=="function"then append(path,b)if read(path)~=a..b then return FAIL("append/read mismatch")end end if type(del)=="function"then del(path)if isfile(path)then return FAIL("file survives delete")end end return PASS()end,})end local function getLocalCharacterParts()local player=Players.LocalPlayer local character=player and player.Character if not character then return nil end local root=character:FindFirstChild("HumanoidRootPart")local humanoid=character:FindFirstChildOfClass("Humanoid")return character,root,humanoid end local function watchProperty(instance,propertyName)local state={count=0}local connection local ok=pcall(function()connection=instance:GetPropertyChangedSignal(propertyName):Connect(function()state.count+=1 end)end)if not ok then return state,function()end end return state,function()if connection then connection:Disconnect()end end end local function cframeDistance(a,b)return(a.Position-b.Position).Magnitude end local function monitorCharacter(root,humanoid)if not root then return nil,function()return{}end end local original=root.CFrame local rootState,stopRoot=watchProperty(root,"CFrame")local wsState={count=0}local jpState={count=0}local stopWS=function()end local stopJP=function()end if humanoid then wsState,stopWS=watchProperty(humanoid,"WalkSpeed")jpState,stopJP=watchProperty(humanoid,"JumpPower")end local maxDistance=0 local running=true task.spawn(function()while running do local ok,cf=pcall(function()return root.CFrame end)if ok then maxDistance=math.max(maxDistance,cframeDistance(original,cf))end task.wait()end end)return original,function()running=false stopRoot()stopWS()stopJP()local final=root.CFrame local finalDistance=cframeDistance(original,final)local observed={rootChanges=rootState.count,walkSpeedChanges=wsState.count,jumpPowerChanges=jpState.count,maxDistance=math.max(maxDistance,finalDistance),}pcall(function()root.CFrame=original end)return observed end end for i=1,18 do register({id=string.format("fidelity.fireproximityprompt.%03d",i),name="fireproximityprompt native-fidelity vector "..i,category="Instances",dimension="fidelity",weight=1.0,run=function()if not CONFIG.fidelityMode then return SKIP("fidelity disabled")end local fire=resolve("fireproximityprompt")if type(fire)~="function"then return MISSING()end local _,root,humanoid=getLocalCharacterParts()if not root then return SKIP("character/root unavailable")end local part=Instance.new("Part")part.Name="AegisPromptPart_"..randomAscii(6)part.Anchored=true part.CanCollide=false part.Size=Vector3.new(2,2,2)part.CFrame=root.CFrame*CFrame.new(0,0,-(80+i*3))part.Parent=workspace local prompt=Instance.new("ProximityPrompt")prompt.HoldDuration=0.35+(i%7)*0.21 prompt.MaxActivationDistance=4+(i%6)prompt.RequiresLineOfSight=(i%2==0)prompt.ActionText="AEGIS_"..randomAscii(8)prompt.Parent=part local expectedHold=prompt.HoldDuration local expectedDistance=prompt.MaxActivationDistance local expectedLOS=prompt.RequiresLineOfSight local holdState,stopHold=watchProperty(prompt,"HoldDuration")local distState,stopDist=watchProperty(prompt,"MaxActivationDistance")local losState,stopLos=watchProperty(prompt,"RequiresLineOfSight")local originalRoot,stopCharacter=monitorCharacter(root,humanoid)local triggered=0 local receivedPlayer local conn=prompt.Triggered:Connect(function(player)triggered+=1 receivedPlayer=player end)local ok,err=pcall(fire,prompt)task.wait(0.04)conn:Disconnect()stopHold()stopDist()stopLos()local movement=stopCharacter()local finalHold=prompt.HoldDuration local finalDistance=prompt.MaxActivationDistance local finalLOS=prompt.RequiresLineOfSight safeDestroy(part)if not ok then return FAIL("call errored: "..tostring(err))end if triggered~=1 then return FAIL("Triggered count="..triggered..", expected 1")end if receivedPlayer~=nil and receivedPlayer~=Players.LocalPlayer then return FAIL("wrong player argument")end local reasons={}if movement.maxDistance>2.0 or movement.rootChanges>2 then table.insert(reasons,string.format("character moved %.1f studs/%d CFrame writes",movement.maxDistance,movement.rootChanges))end if movement.walkSpeedChanges>0 then table.insert(reasons,"WalkSpeed mutated")end if movement.jumpPowerChanges>0 then table.insert(reasons,"JumpPower mutated")end if holdState.count>0 or finalHold~=expectedHold then table.insert(reasons,"HoldDuration mutated")end if distState.count>0 or finalDistance~=expectedDistance then table.insert(reasons,"MaxActivationDistance mutated")end if losState.count>0 or finalLOS~=expectedLOS then table.insert(reasons,"RequiresLineOfSight mutated")end if#reasons>0 then return DEGRADED("observable workaround: "..table.concat(reasons,"; "))end return PASS("triggered without observable teleport/property patch")end,})end local CLICK_EVENTS={"MouseClick","RightMouseClick","MouseHoverEnter","MouseHoverLeave"}for i=1,12 do register({id=string.format("fidelity.fireclickdetector.%03d",i),name="fireclickdetector native-fidelity vector "..i,category="Instances",dimension="fidelity",weight=0.9,run=function()local fire=resolve("fireclickdetector")if type(fire)~="function"then return MISSING()end local _,root,humanoid=getLocalCharacterParts()if not root then return SKIP("character/root unavailable")end local part=Instance.new("Part")part.Anchored=true part.CanCollide=false part.CFrame=root.CFrame*CFrame.new(0,0,-(90+i*4))part.Parent=workspace local detector=Instance.new("ClickDetector")detector.MaxActivationDistance=3+(i%7)detector.Parent=part local expectedDistance=detector.MaxActivationDistance local distState,stopDist=watchProperty(detector,"MaxActivationDistance")local _,stopCharacter=monitorCharacter(root,humanoid)local eventName=CLICK_EVENTS[((i-1)%#CLICK_EVENTS)+1]local count=0 local playerArg local conn=detector[eventName]:Connect(function(player)count+=1 playerArg=player end)local ok,err=pcall(fire,detector,0,eventName)task.wait(0.03)conn:Disconnect()stopDist()local movement=stopCharacter()local finalDistance=detector.MaxActivationDistance safeDestroy(part)if not ok then return FAIL("call errored: "..tostring(err))end if count~=1 then return FAIL(eventName.." count="..count)end if playerArg~=nil and playerArg~=Players.LocalPlayer then return FAIL("wrong player argument")end local reasons={}if movement.maxDistance>2.0 or movement.rootChanges>2 then table.insert(reasons,string.format("character moved %.1f studs",movement.maxDistance))end if distState.count>0 or finalDistance~=expectedDistance then table.insert(reasons,"MaxActivationDistance mutated")end if#reasons>0 then return DEGRADED("observable workaround: "..table.concat(reasons,"; "))end return PASS()end,})end for i=1,12 do register({id=string.format("fidelity.firetouchinterest.%03d",i),name="firetouchinterest no-teleport vector "..i,category="Instances",dimension="fidelity",weight=0.9,run=function()local fire=resolve("firetouchinterest")if type(fire)~="function"then return MISSING()end local _,root=getLocalCharacterParts()if not root then return SKIP("character/root unavailable")end local dummy=Instance.new("Part")dummy.Anchored=true dummy.CanCollide=false dummy.CanTouch=true dummy.CFrame=root.CFrame*CFrame.new(0,-150-i,0)dummy.Parent=workspace local originalRoot=root.CFrame local originalDummy=dummy.CFrame local rootState,stopRoot=watchProperty(root,"CFrame")local dummyState,stopDummy=watchProperty(dummy,"CFrame")local touchState,stopTouch=watchProperty(dummy,"CanTouch")local touched=0 local conn=dummy.Touched:Connect(function(part)if part==root or(root.Parent and part:IsDescendantOf(root.Parent))then touched+=1 end end)local startToggle=(i%2==0)and true or 0 local endToggle=(i%2==0)and false or 1 local ok1,err1=pcall(fire,root,dummy,startToggle)task.wait()local ok2,err2=pcall(fire,root,dummy,endToggle)task.wait()conn:Disconnect()stopRoot()stopDummy()stopTouch()local rootMoved=cframeDistance(originalRoot,root.CFrame)local dummyMoved=cframeDistance(originalDummy,dummy.CFrame)pcall(function()root.CFrame=originalRoot end)safeDestroy(dummy)if not ok1 or not ok2 then return FAIL("call errored: "..tostring(err1 or err2))end if touched<1 then return FAIL("Touched was not observed")end local reasons={}if rootState.count>2 or rootMoved>2 then table.insert(reasons,"initiating part physically moved")end if dummyState.count>0 or dummyMoved>0.05 then table.insert(reasons,"target part physically moved")end if touchState.count>0 then table.insert(reasons,"CanTouch mutated")end if#reasons>0 then return DEGRADED("observable workaround: "..table.concat(reasons,"; "))end return PASS()end,})end for i=1,24 do register({id=string.format("vectors.firesignal.%03d",i),name="firesignal argument vector "..i,category="Signals",dimension="semantics",weight=0.58,run=function()local fire=resolve("firesignal")if type(fire)~="function"then return MISSING()end local part=Instance.new("Part")local token=randomAscii(13)local number=rngInt(-99999,99999)local calls=0 local got1,got2 local connection=part.ChildAdded:Connect(function(a,b)calls+=1 got1,got2=a,b end)local ok,err=pcall(fire,part.ChildAdded,token,number)task.wait()connection:Disconnect()safeDestroy(part)if not ok then return FAIL("firesignal errored: "..tostring(err))end if calls~=1 then return FAIL("connection call count="..calls)end if got1~=token or got2~=number then return FAIL("argument forwarding mismatch")end return PASS()end,})end for i=1,12 do register({id=string.format("vectors.getconnections.%03d",i),name="getconnections independent connection vector "..i,category="Signals",dimension="cross",weight=0.58,run=function()local get=resolve("getconnections")if type(get)~="function"then return MISSING()end local ev=Instance.new("BindableEvent")local a=0 local b=0 local c1=ev.Event:Connect(function()a+=1 end)local c2=ev.Event:Connect(function()b+=1 end)local list=get(ev.Event)local count=type(list)=="table"and#list or 0 ev:Fire()task.wait()c1:Disconnect()c2:Disconnect()safeDestroy(ev)if type(list)~="table"then return FAIL("expected table")end if count<2 then return FAIL("expected >=2 connections, got "..count)end if a~=1 or b~=1 then return FAIL("probe connections did not execute normally")end return PASS()end,})end for i=1,16 do register({id=string.format("vectors.getcallbackvalue.%03d",i),name="getcallbackvalue identity vector "..i,category="Instances",dimension="cross",weight=0.55,run=function()local get=resolve("getcallbackvalue")if type(get)~="function"then return MISSING()end local bindable=Instance.new("BindableFunction")local token=randomAscii(15)local n=rngInt(-50000,50000)local function callback(x)return token,n+(x or 0)end bindable.OnInvoke=callback local got=get(bindable,"OnInvoke")local unset=Instance.new("RemoteFunction")local nilValue=get(unset,"OnClientInvoke")safeDestroy(bindable)safeDestroy(unset)if got~=callback then return FAIL("callback identity mismatch")end local a,b=got(i)if a~=token or b~=n+i then return FAIL("callback behavior mismatch")end if nilValue~=nil then return FAIL("unset callback should be nil")end return PASS()end,})end for i=1,8 do register({id=string.format("vectors.getreg.thread.%03d",i),name="getreg live thread discovery vector "..i,category="Environment",dimension="semantics",weight=0.62,run=function()local getreg=resolve("getreg")if type(getreg)~="function"then return MISSING()end local alive=true local thread=task.spawn(function()while alive do task.wait()end end)task.wait()local reg=getreg()local found=type(reg)=="table"and listContainsIdentity(reg,thread)alive=false pcall(coroutine.close,thread)if type(reg)~="table"then return FAIL("registry is not table")end if not found then return FAIL("fresh live thread missing from registry")end return PASS()end,})end local function filtergcFindWithRetry(filterType,options,returnOne,expected)local filter=resolve("filtergc")if type(filter)~="function"then return"missing",nil end local firstMiss=false for attempt=1,3 do local ok,result=pcall(filter,filterType,options,returnOne)if not ok then return"error",result end local matched if returnOne then matched=(result==expected)else matched=type(result)=="table"and listContainsIdentity(result,expected)end if matched then return attempt==1 and"pass"or"retry",result end firstMiss=true task.wait()end return firstMiss and"miss"or"error",nil end for i=1,10 do register({id=string.format("v2.filtergc.function.name.%03d",i),name="filtergc function Name vector "..i,category="Environment",dimension="fidelity",weight=0.70,run=function()local filter=resolve("filtergc")if type(filter)~="function"then return MISSING()end local name="AegisFGCName_"..randomAscii(10):gsub("[^%w]","A")local chunk=resolve("loadstring")if type(chunk)~="function"then return SKIP("loadstring unavailable")end local source="local function "..name.."() return "..tostring(i).." end return "..name local compiled,err=chunk(source)if type(compiled)~="function"then return SKIP("dynamic compile failed: "..tostring(err))end local probe=compiled()if type(probe)~="function"then return FAIL("named probe creation failed")end local state=filtergcFindWithRetry("function",{Name=name,IgnoreExecutor=false},false,probe)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("matched only after retry; documented transient behavior observed")end if state=="error"then return FAIL("filtergc errored")end return FAIL("Name filter did not return fresh named closure")end,})end for i=1,10 do register({id=string.format("v2.filtergc.function.constant.%03d",i),name="filtergc function Constants vector "..i,category="Environment",dimension="fidelity",weight=0.72,run=function()local constant="FGC_CONST_"..randomAscii(18)local probe=buildDynamicFunction(string.format("return function() return %q end",constant))if type(probe)~="function"then return SKIP("dynamic probe unavailable")end if probe()~=constant then return FAIL("probe setup failed")end local state=filtergcFindWithRetry("function",{Constants={constant},IgnoreExecutor=false,},false,probe)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("Constants filter required retry")end if state=="error"then return FAIL("filtergc errored")end return FAIL("constant-bearing closure not found")end,})end for i=1,10 do register({id=string.format("v2.filtergc.function.upvalue.%03d",i),name="filtergc function Upvalues vector "..i,category="Environment",dimension="fidelity",weight=0.72,run=function()local captured={token="FGC_UP_"..randomAscii(16),i=i}local function probe()return captured end if probe()~=captured then return FAIL("probe setup failed")end local state=filtergcFindWithRetry("function",{Upvalues={captured},IgnoreExecutor=false,},false,probe)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("Upvalues filter required retry")end if state=="error"then return FAIL("filtergc errored")end return FAIL("upvalue-bearing closure not found")end,})end for i=1,8 do register({id=string.format("v2.filtergc.function.hash.%03d",i),name="filtergc function Hash vector "..i,category="Environment",dimension="cross",weight=0.76,run=function()local getHash=resolve("getfunctionhash")if type(resolve("filtergc"))~="function"or type(getHash)~="function"then return MISSING()end local constant="FGC_HASH_"..randomAscii(17)local probe=buildDynamicFunction(string.format("return function() return %q end",constant))if type(probe)~="function"then return SKIP("dynamic probe unavailable")end local hash=getHash(probe)if type(hash)~="string"or#hash~=96 then return FAIL("invalid getfunctionhash prerequisite")end local state=filtergcFindWithRetry("function",{Hash=hash,IgnoreExecutor=false,},true,probe)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("Hash filter required retry")end if state=="error"then return FAIL("filtergc errored")end return FAIL("Hash filter failed to return exact closure")end,})end for i=1,8 do register({id=string.format("v2.filtergc.function.combined.%03d",i),name="filtergc Constants + Upvalues narrowing vector "..i,category="Environment",dimension="robustness",weight=0.82,run=function()local constant="FGC_COMBO_"..randomAscii(17)local captured={token=randomAscii(15)}local factory=buildDynamicFunction(string.format("return function(up) return function() return %q, up end end",constant))if type(factory)~="function"then return SKIP("dynamic factory unavailable")end local probe=factory(captured)if type(probe)~="function"then return FAIL("factory failed")end local state=filtergcFindWithRetry("function",{Constants={constant},Upvalues={captured},IgnoreExecutor=false,},true,probe)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("combined filter required retry")end if state=="error"then return FAIL("filtergc errored")end return FAIL("combined narrowing did not return exact closure")end,})end for i=1,10 do register({id=string.format("v2.filtergc.table.keys.%03d",i),name="filtergc table Keys vector "..i,category="Environment",dimension="fidelity",weight=0.65,run=function()local key="FGCK_"..randomAscii(14)local marker={[key]=randomAscii(10),hold=RUN_NONCE}local state=filtergcFindWithRetry("table",{Keys={key}},true,marker)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("Keys filter required retry")end if state=="error"then return FAIL("filtergc errored")end return FAIL("table Keys filter missed live marker")end,})end for i=1,10 do register({id=string.format("v2.filtergc.table.values.%03d",i),name="filtergc table Values vector "..i,category="Environment",dimension="fidelity",weight=0.65,run=function()local value="FGCV_"..randomAscii(18)local marker={randomAscii(9),value,RUN_NONCE}local state=filtergcFindWithRetry("table",{Values={value}},true,marker)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("Values filter required retry")end if state=="error"then return FAIL("filtergc errored")end return FAIL("table Values filter missed live marker")end,})end for i=1,10 do register({id=string.format("v2.filtergc.table.kv.%03d",i),name="filtergc table KeyValuePairs vector "..i,category="Environment",dimension="cross",weight=0.68,run=function()local key="FGCKV_"..randomAscii(13)local value="V_"..randomAscii(17)local marker={[key]=value,keep=RUN_ID}local state=filtergcFindWithRetry("table",{KeyValuePairs={[key]=value}},true,marker)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("KeyValuePairs filter required retry")end if state=="error"then return FAIL("filtergc errored")end return FAIL("KeyValuePairs filter missed exact table")end,})end for i=1,8 do register({id=string.format("v2.filtergc.table.metatable.%03d",i),name="filtergc table raw-metatable vector "..i,category="Environment",dimension="cross",weight=0.72,run=function()local mt={__aegis="MT_"..randomAscii(17)}local marker=setmetatable({token=randomAscii(15)},mt)local state=filtergcFindWithRetry("table",{Metatable=mt},true,marker)if state=="pass"then return PASS()end if state=="retry"then return UNSTABLE("Metatable filter required retry")end if state=="error"then return FAIL("filtergc errored")end return FAIL("raw metatable filter missed live table")end,})end for i=1,12 do register({id=string.format("vectors.getfunctionhash.%03d",i),name="getfunctionhash stability/sensitivity vector "..i,category="Closures",dimension="fidelity",weight=0.72,run=function()local hash=resolve("getfunctionhash")if type(hash)~="function"then return MISSING()end local a="HF_A_"..randomAscii(14)local b="HF_B_"..randomAscii(14)local f1=buildDynamicFunction(string.format("return function() return %q end",a))local f2=buildDynamicFunction(string.format("return function() return %q end",b))if type(f1)~="function"or type(f2)~="function"then return SKIP("dynamic probes unavailable")end local h1=hash(f1)local h1Again=hash(f1)local h2=hash(f2)if type(h1)~="string"or type(h2)~="string"then return FAIL("hash is not string")end if#h1~=96 or h1:match("^[0-9a-fA-F]+$")==nil then return FAIL("expected 96-char SHA-384 hex")end if h1~=h1Again then return FAIL("same function hash is unstable")end if h1==h2 then return FAIL("different constants did not change hash")end return PASS()end,})end for i=1,8 do register({id=string.format("vectors.getscriptfromthread.executor.%03d",i),name="getscriptfromthread executor-thread nil vector "..i,category="Environment",dimension="semantics",weight=0.62,run=function()local get=resolve("getscriptfromthread")if type(get)~="function"then return MISSING()end local observed="__unset"local done=false local thread=task.spawn(function()observed=get(coroutine.running())done=true end)local deadline=now()+0.5 repeat task.wait()until done or now()>deadline if not done then pcall(coroutine.close,thread)return FAIL("probe timed out")end if observed~=nil then return FAIL("executor-created thread should have no associated script")end return PASS()end,})end for i=1,8 do register({id=string.format("vectors.getcallingscript.executor.%03d",i),name="getcallingscript executor-scope nil vector "..i,category="Closures",dimension="semantics",weight=0.42,run=function()local get=resolve("getcallingscript")if type(get)~="function"then return MISSING()end local value=get()if value~=nil then return FAIL("executor scope should not report a game script")end return PASS()end,})end for i=1,20 do register({id=string.format("vectors.getgenv.%03d",i),name="getgenv cross-thread visibility vector "..i,category="Environment",dimension="cross",weight=0.42,run=function()local get=resolve("getgenv")if type(get)~="function"then return MISSING()end local env=get()if type(env)~="table"then return FAIL("environment not table")end local key="__A15_"..randomAscii(15)local value={index=i,token=randomAscii(12)}env[key]=value local observed local done=false task.spawn(function()local e2=get()observed=e2[key]done=true end)local deadline=now()+0.5 repeat task.wait()until done or now()>deadline env[key]=nil if not done then return FAIL("cross-thread probe timed out")end if observed~=value then return FAIL("cross-thread global identity mismatch")end return PASS()end,})end for i=1,16 do register({id=string.format("vectors.drawing.%03d",i),name="Drawing invisible property vector "..i,category="Drawing",dimension="cross",weight=0.42,run=function()local new=resolve("Drawing.new")local set=resolve("setrenderproperty")local get=resolve("getrenderproperty")local is=resolve("isrenderobj")if type(new)~="function"then return MISSING()end local obj=new("Square")if obj==nil then return FAIL("new returned nil")end local pos=Vector2.new(i*2,i*3)local size=Vector2.new(2+i,3+i)local ok=pcall(function()obj.Visible=false obj.Position=pos obj.Size=size obj.Transparency=0.1+(i%8)*0.1 end)if not ok then pcall(function()obj:Destroy()end)return FAIL("direct property write failed")end if type(is)=="function"and not is(obj)then pcall(function()obj:Destroy()end)return FAIL("isrenderobj rejected object")end if type(set)=="function"and type(get)=="function"then local expected=(i%2==0)set(obj,"Visible",expected)if get(obj,"Visible")~=expected or obj.Visible~=expected then pcall(function()obj:Destroy()end)return FAIL("reflection/direct state disagreement")end end pcall(function()obj.Visible=false obj:Destroy()end)return PASS()end,})end for i=1,8 do register({id=string.format("vectors.request.structure.%03d",i),name="request structured response vector "..i,category="Network",dimension="semantics",weight=0.45,run=function()if not CONFIG.enableNetwork then return SKIP("network disabled")end local request=getRequest()if type(request)~="function"then return MISSING()end local nonce="A15NET_"..randomAscii(18)local ok,response=boundedCall(CONFIG.networkTimeoutSeconds,request,{Url=CONFIG.networkCanaryUrl.."?aegis20="..nonce.."&i="..i,Method="GET",Headers={["X-Aegis20"]=nonce},})if isAegisTimeout(ok,response)then return SKIP("external network timeout; excluded from executor score")end if not ok then return WARN("transport unavailable: "..trim(response,90))end if type(response)~="table"then return FAIL("response not table")end local status=response.StatusCode or response.Status if type(status)~="number"or status<100 or status>599 then return FAIL("invalid status contract")end if type(response.Body)~="string"then return FAIL("Body not string")end return PASS("status="..status)end,})end local SUNC_SNAPSHOT_DATE="2026-08-15"local SUNC_CURRENT_NAMES={"getfunctionhash","getrawmetatable","getgc","hookfunction","isreadonly","getgenv","hookmetamethod","setrawmetatable","getreg","iscclosure","setreadonly","getrenv","isexecutorclosure","islclosure","identifyexecutor","appendfile","newcclosure","debug.getupvalues","delfolder","gethiddenproperty","debug.setupvalue","getcustomasset","getthreadidentity","isfile","isscriptable","isfolder","sethiddenproperty","debug.getconstants","listfiles","setscriptable","setthreadidentity","makefolder","request","getcallingscript","debug.getproto","debug.getconstant","getloadedmodules","readfile","getrunningscripts","cloneref","getscriptbytecode","getscriptclosure","getscriptfromthread","getscripthash","debug.setconstant","cleardrawcache","getscripts","compareinstances","loadstring","getrenderproperty","getsenv","fireclickdetector","isrenderobj","fireproximityprompt","setrenderproperty","firetouchinterest","firesignal","debug.getprotos","getcallbackvalue","getconnections","base64decode","filtergc","gethui","replicatesignal","base64encode","writefile","getinstances","loadfile","lz4compress","debug.getstack","getnilinstances","delfile","lz4decompress","checkcaller","restorefunction","debug.setstack","debug.getupvalue","clonefunction","getnamecallmethod",}register({id="v2.standard.sunc_snapshot_coverage",name="Current sUNC snapshot names resolve through Aegis catalog/environment",category="Aegis",dimension="baseline",weight=1,run=function()local unresolved={}for _,name in ipairs(SUNC_CURRENT_NAMES)do local direct=resolve(name)if direct==nil then if name=="base64encode"then direct=firstResolved({"base64encode","crypt.base64encode","crypt.base64.encode","base64.encode"})elseif name=="base64decode"then direct=firstResolved({"base64decode","crypt.base64decode","crypt.base64.decode","base64.decode"})end end if direct==nil then table.insert(unresolved,name)end end return PASS("snapshot="..SUNC_SNAPSHOT_DATE.." unresolved-on-executor="..#unresolved)end,})for _,cap in ipairs(CAPABILITIES)do local capId=cap[1]local aliases=cap[2]register({id="v2.stability.yield."..capId,name=capId.." survives a scheduler yield without changing identity",category=cap[3],dimension="antiSpoof",weight=0.16,run=function()local first,alias=firstResolved(aliases)if first==nil then return MISSING()end task.wait()local second=resolve(alias)if second==nil then return FAIL("alias disappeared after yield")end if second~=first then return UNSTABLE("identity changed across scheduler yield")end return PASS()end,})end for i=1,24 do register({id=string.format("v2.debug.getconstant_oob.%03d",i),name="debug.getconstant out-of-range returns nil vector "..i,category="Debug",dimension="robustness",weight=0.45,run=function()local get=resolve("debug.getconstant")if type(get)~="function"then return MISSING()end local secret="OOB_"..randomAscii(14)local probe=buildDynamicFunction(string.format("return function() return %q end",secret))if type(probe)~="function"then return SKIP("dynamic probe unavailable")end local ok,value=pcall(get,probe,500+i)if not ok then return FAIL("out-of-range index errored; current contract returns nil")end if value~=nil then return FAIL("out-of-range index returned "..type(value))end return PASS()end,})end for i=1,28 do register({id=string.format("v2.debug.bulk_single_constants.%03d",i),name="debug.getconstants/getconstant differential vector "..i,category="Debug",dimension="cross",weight=0.48,run=function()local one=resolve("debug.getconstant")local all=resolve("debug.getconstants")if type(one)~="function"or type(all)~="function"then return MISSING()end local a="DCA_"..randomAscii(13)local b="DCB_"..randomAscii(15)local n=rngInt(50000,900000)local probe=buildDynamicFunction(string.format("return function() local a=%q local b=%q local n=%d return a,b,n end",a,b,n))if type(probe)~="function"then return SKIP("dynamic probe unavailable")end local constants=all(probe)if type(constants)~="table"then return FAIL("bulk result not table")end local checked=0 for index,value in pairs(constants)do if type(index)=="number"and(value==a or value==b or value==n)then local ok,single=pcall(one,probe,index)if not ok or single~=value then return INCONSISTENT("single constant disagrees with bulk at index "..index)end checked+=1 end end if checked<3 then return FAIL("did not identify all challenge constants")end return PASS()end,})end for i=1,28 do register({id=string.format("v2.debug.bulk_single_upvalues.%03d",i),name="debug.getupvalues/getupvalue differential vector "..i,category="Debug",dimension="cross",weight=0.48,run=function()local one=resolve("debug.getupvalue")local all=resolve("debug.getupvalues")if type(one)~="function"or type(all)~="function"then return MISSING()end local a={token="UA_"..randomAscii(13)}local b={token="UB_"..randomAscii(13)}local function probe()return a,b end local values=all(probe)if type(values)~="table"then return FAIL("bulk result not table")end local foundA,foundB=false,false for index,value in pairs(values)do if type(index)=="number"and(value==a or value==b)then local ok,single=pcall(one,probe,index)if not ok or single~=value then return INCONSISTENT("single upvalue disagrees with bulk")end if value==a then foundA=true end if value==b then foundB=true end end end if not foundA or not foundB then return FAIL("challenge upvalues missing")end return PASS()end,})end for i=1,24 do register({id=string.format("v2.debug.setconstant_roundtrip.%03d",i),name="debug.setconstant mutate/observe/restore vector "..i,category="Debug",dimension="robustness",weight=0.62,run=function()local getAll=resolve("debug.getconstants")local set=resolve("debug.setconstant")if type(getAll)~="function"or type(set)~="function"then return MISSING()end local original="SC0_"..randomAscii(14)local changed="SC1_"..randomAscii(14)local probe=buildDynamicFunction(string.format("return function() return %q end",original))if type(probe)~="function"then return SKIP("dynamic probe unavailable")end local constants=getAll(probe)local index for k,v in pairs(constants)do if v==original and type(k)=="number"then index=k break end end if not index then return FAIL("original constant not found")end local ok1,err1=pcall(set,probe,index,changed)if not ok1 then return FAIL("mutation errored: "..tostring(err1))end if probe()~=changed then return FAIL("execution did not reflect mutation")end local after=getAll(probe)if not containsValue(after,changed)then return INCONSISTENT("bulk constants did not reflect mutation")end local ok2,err2=pcall(set,probe,index,original)if not ok2 then return FAIL("restore errored: "..tostring(err2))end if probe()~=original then return FAIL("constant restore failed")end return PASS()end,})end for i=1,20 do register({id=string.format("v2.debug.setupvalue_restore.%03d",i),name="debug.setupvalue mutate/restore vector "..i,category="Debug",dimension="robustness",weight=0.58,run=function()local set=resolve("debug.setupvalue")local get=resolve("debug.getupvalue")if type(set)~="function"or type(get)~="function"then return MISSING()end local original={token="UV0_"..randomAscii(12)}local changed={token="UV1_"..randomAscii(12)}local captured=original local function probe()return captured end set(probe,1,changed)if probe()~=changed or get(probe,1)~=changed then return FAIL("mutation incoherent")end set(probe,1,original)if probe()~=original or get(probe,1)~=original then return FAIL("restore incoherent")end return PASS()end,})end for i=1,16 do register({id=string.format("v2.debug.proto_differential.%03d",i),name="debug.getproto/getprotos active-proto differential vector "..i,category="Debug",dimension="cross",weight=0.58,run=function()local getOne=resolve("debug.getproto")local getAll=resolve("debug.getprotos")if type(getOne)~="function"or type(getAll)~="function"then return MISSING()end local t1="P1_"..randomAscii(11)local t2="P2_"..randomAscii(11)local outer=buildDynamicFunction(string.format([[
                return function()
                    local function one() return %q end
                    local function two() return %q end
                    return one, two
                end
            ]],t1,t2))if type(outer)~="function"then return SKIP("dynamic probe unavailable")end local realOne,realTwo=outer()if type(realOne)~="function"or type(realTwo)~="function"then return FAIL("failed to materialize active closures")end local all=getAll(outer)if type(all)~="table"or#all<2 then return FAIL("expected >=2 proto descriptors")end local expected={realOne,realTwo}for index=1,2 do local ok,active=pcall(getOne,outer,index,true)if not ok or type(active)~="table"then return FAIL("activated getproto did not return a table at index "..index)end if not listContainsIdentity(active,expected[index])then return INCONSISTENT("activated proto set does not contain the live closure for index "..index)end local value=expected[index]()if(index==1 and value~=t1)or(index==2 and value~=t2)then return FAIL("live closure behavior changed")end end return PASS()end,})end local function makeClosureVariant(kind,token,delta)local function raw(x,...)return token,x+delta,...end if kind=="L"then return raw end if kind=="NC"then local ncc=resolve("newcclosure")if type(ncc)~="function"then return nil end return ncc(raw)end return nil end local HOOK_PAIR_VARIANTS={{"L","L"},{"L","NC"},{"NC","L"},{"NC","NC"},}for pairIndex,pair in ipairs(HOOK_PAIR_VARIANTS)do for i=1,12 do register({id=string.format("v2.hook.pair.%s_%s.%03d",pair[1],pair[2],i),name="hookfunction pair "..pair[1].."→"..pair[2].." vector "..i,category="Closures",dimension="fidelity",weight=0.66,run=function()local hook=resolve("hookfunction")or resolve("replaceclosure")if type(hook)~="function"then return MISSING()end local originalToken="HP0_"..randomAscii(11)local hookToken="HP1_"..randomAscii(11)local target=makeClosureVariant(pair[1],originalToken,i)local replacement=makeClosureVariant(pair[2],hookToken,-i)if type(target)~="function"or type(replacement)~="function"then return MISSING("newcclosure required for this pair")end local ok,old=pcall(hook,target,replacement)if not ok or type(old)~="function"then return FAIL("hook failed")end local a1,b1,c1=target(100,RUN_NONCE)local a2,b2,c2=old(100,RUN_NONCE)if a1~=hookToken or b1~=100-i or c1~=RUN_NONCE then return FAIL("hooked argument/return fidelity mismatch")end if a2~=originalToken or b2~=100+i or c2~=RUN_NONCE then return FAIL("original reference fidelity mismatch")end return PASS()end,})end end for i=1,16 do register({id=string.format("v2.restore.multi_state.%03d",i),name="restorefunction first-original state machine "..i,category="Closures",dimension="robustness",weight=0.82,run=function()local hook=resolve("hookfunction")or resolve("replaceclosure")local restore=resolve("restorefunction")if type(hook)~="function"or type(restore)~="function"then return MISSING()end local t0="RS0_"..randomAscii(9)local t1="RS1_"..randomAscii(9)local t2="RS2_"..randomAscii(9)local t3="RS3_"..randomAscii(9)local function target()return t0 end hook(target,function()return t1 end)hook(target,function()return t2 end)hook(target,function()return t3 end)if target()~=t3 then return FAIL("latest hook not active")end local ok,err=pcall(restore,target)if not ok then return FAIL("restore errored: "..tostring(err))end if target()~=t0 then return FAIL("did not restore very first original")end local okAgain=pcall(restore,target)if okAgain then return FAIL("second restore succeeded even though function is no longer hooked")end if target()~=t0 then return FAIL("failed second restore attempt changed original state")end return PASS("second restore correctly rejected an unhooked function")end,})end for i=1,20 do register({id=string.format("v2.clonefunction.varargs.%03d",i),name="clonefunction vararg/multi-return vector "..i,category="Closures",dimension="robustness",weight=0.50,run=function()local clone=resolve("clonefunction")if type(clone)~="function"then return MISSING()end local token="CV_"..randomAscii(12)local function original(a,b,...)return token,a,b,...end local copied=clone(original)if type(copied)~="function"or copied==original then return FAIL("invalid clone")end local a,b,c,d,e=copied(i,-i,RUN_NONCE,true)if a~=token or b~=i or c~=-i or d~=RUN_NONCE or e~=true then return FAIL("vararg/multiple-return contract mismatch")end return PASS()end,})end for i=0,47 do register({id=string.format("v2.encoding.base64_lengths.%03d",i),name="Base64 exact-length boundary vector "..i,category="Encoding",dimension="robustness",weight=0.34,run=function()local enc=firstResolved({"base64encode","crypt.base64encode","base64.encode"})local dec=firstResolved({"base64decode","crypt.base64decode","base64.decode"})if type(enc)~="function"or type(dec)~="function"then return MISSING()end local data=randomBytes(i)local encoded=enc(data)local expected=refBase64Encode(data)if encoded~=expected then return FAIL("reference mismatch at len="..i)end if dec(encoded)~=data then return FAIL("decode mismatch at len="..i)end return PASS()end,})end for i=1,32 do register({id=string.format("v2.encoding.lz4_current_signature.%03d",i),name="LZ4 current one-argument decompress vector "..i,category="Encoding",dimension="fidelity",weight=0.46,run=function()local compress=resolve("lz4compress")local decompress=resolve("lz4decompress")if type(compress)~="function"or type(decompress)~="function"then return MISSING()end local raw=(i%2==0)and string.rep("A"..randomAscii(3),5+i)or randomBytes(10+((i*13)%180))local packed=compress(raw)if type(packed)~="string"then return FAIL("compress returned non-string")end local ok,restored=pcall(decompress,packed)if ok and restored==raw then return PASS()end local legacyOk,legacy=pcall(decompress,packed,#raw)if legacyOk and legacy==raw then return DEGRADED("only legacy two-argument lz4decompress contract works")end return FAIL("cannot restore payload using current or legacy signature")end,})end for i=1,24 do register({id=string.format("v2.fs.append_creates.%03d",i),name="appendfile creates missing file vector "..i,category="Filesystem",dimension="robustness",weight=0.52,run=function()local append=resolve("appendfile")local read=resolve("readfile")local isfile=resolve("isfile")local del=resolve("delfile")if type(append)~="function"or type(read)~="function"or type(isfile)~="function"then return MISSING()end if not fsPrepare()then return FAIL("sandbox unavailable")end local path=fsPath("append_create_"..randomAscii(8)..".txt")if type(del)=="function"and isfile(path)then pcall(del,path)end local value="AC_"..randomAscii(20)append(path,value)if not isfile(path)then return FAIL("appendfile did not create missing file")end if read(path)~=value then return FAIL("created file content mismatch")end if type(del)=="function"then pcall(del,path)end return PASS()end,})end for i=1,24 do register({id=string.format("v2.fs.write_overwrite.%03d",i),name="writefile overwrite/truncate vector "..i,category="Filesystem",dimension="robustness",weight=0.50,run=function()local write=resolve("writefile")local read=resolve("readfile")if type(write)~="function"or type(read)~="function"then return MISSING()end if not fsPrepare()then return FAIL("sandbox unavailable")end local path=fsPath("overwrite_"..randomAscii(8)..".bin")local long=randomBytes(180+i)local short=randomBytes(3+(i%17))write(path,long)write(path,short)local got=read(path)if got~=short or#got~=#short then return FAIL("overwrite left stale/trailing content")end return PASS()end,})end for i=1,20 do register({id=string.format("v2.fs.empty_binary.%03d",i),name="filesystem empty/NUL boundary vector "..i,category="Filesystem",dimension="robustness",weight=0.48,run=function()local write=resolve("writefile")local read=resolve("readfile")if type(write)~="function"or type(read)~="function"then return MISSING()end if not fsPrepare()then return FAIL("sandbox unavailable")end local path=fsPath("boundary_"..randomAscii(8)..".bin")local value if i%4==0 then value=""elseif i%4==1 then value="\0"elseif i%4==2 then value="\0\0"..randomBytes(31).."\0"else value=randomBytes(256+i)end write(path,value)if read(path)~=value then return FAIL("boundary payload changed")end return PASS()end,})end for i=1,16 do register({id=string.format("v2.fs.list_mixed.%03d",i),name="listfiles mixed file/folder vector "..i,category="Filesystem",dimension="cross",weight=0.52,run=function()local make=resolve("makefolder")local write=resolve("writefile")local list=resolve("listfiles")local isfile=resolve("isfile")local isfolder=resolve("isfolder")if type(make)~="function"or type(write)~="function"or type(list)~="function"or type(isfile)~="function"or type(isfolder)~="function"then return MISSING()end if not fsPrepare()then return FAIL("sandbox unavailable")end local root=fsPath("mixed_"..randomAscii(7))pcall(make,root)local folder=root.."/dir_"..randomAscii(5)local file=root.."/file_"..randomAscii(5)..".txt"pcall(make,folder)write(file,RUN_NONCE)local entries=list(root)if type(entries)~="table"then return FAIL("listfiles returned non-table")end local sawFile,sawFolder=false,false for _,path in pairs(entries)do if path==file or(type(path)=="string"and path:find(file:match("[^/]+$"),1,true))then if isfile(path)or isfile(file)then sawFile=true end end if path==folder or(type(path)=="string"and path:find(folder:match("[^/]+$"),1,true))then if isfolder(path)or isfolder(folder)then sawFolder=true end end end if not sawFile or not sawFolder then return FAIL("mixed directory entries incomplete")end return PASS()end,})end for i=1,16 do register({id=string.format("v2.fs.loadfile_global_env.%03d",i),name="loadfile global-environment vector "..i,category="Filesystem",dimension="cross",weight=0.58,run=function()local write=resolve("writefile")local load=resolve("loadfile")local get=resolve("getgenv")if type(write)~="function"or type(load)~="function"or type(get)~="function"then return MISSING()end if not fsPrepare()then return FAIL("sandbox unavailable")end local key="__A2LF_"..randomAscii(12)local value="LF_"..randomAscii(18)local env=get()env[key]=value local path=fsPath("loadenv_"..randomAscii(7)..".luau")write(path,"return "..key)local fn,err=load(path)if type(fn)~="function"then env[key]=nil return FAIL("loadfile compile failed: "..tostring(err))end local got=fn()env[key]=nil if got~=value then return FAIL("loaded chunk did not run in executor global environment")end return PASS()end,})end for i=1,20 do register({id=string.format("v2.gc.include_tables_switch.%03d",i),name="getgc includeTables switch vector "..i,category="Environment",dimension="robustness",weight=0.52,run=function()local getgc=resolve("getgc")if type(getgc)~="function"then return MISSING()end local marker={token="GCT_"..randomAscii(16),index=i}local without=getgc(false)local with=getgc(true)if type(without)~="table"or type(with)~="table"then return FAIL("non-table result")end local inWithout=listContainsIdentity(without,marker)local inWith=listContainsIdentity(with,marker)if not inWith then return FAIL("live table absent with includeTables=true")end if inWithout then return FAIL("table leaked into includeTables=false result")end return PASS()end,})end for i=1,16 do register({id=string.format("v2.getreg.stability.%03d",i),name="getreg stable registry identity vector "..i,category="Environment",dimension="antiSpoof",weight=0.34,run=function()local getreg=resolve("getreg")if type(getreg)~="function"then return MISSING()end local a=getreg()task.wait()local b=getreg()if type(a)~="table"or type(b)~="table"then return FAIL("registry not table")end if a~=b then return UNSTABLE("registry table identity changes across calls")end return PASS()end,})end for i=1,16 do register({id=string.format("v2.env.getgenv_coroutine.%03d",i),name="getgenv shared across raw coroutine vector "..i,category="Environment",dimension="robustness",weight=0.45,run=function()local get=resolve("getgenv")if type(get)~="function"then return MISSING()end local env=get()local key="__A2CO_"..randomAscii(13)local value={token=randomAscii(12)}env[key]=value local observed local co=coroutine.create(function()observed=get()[key]end)local ok,err=coroutine.resume(co)env[key]=nil if not ok then return FAIL("coroutine probe errored: "..tostring(err))end if observed~=value then return FAIL("global environment not shared with executor coroutine")end return PASS()end,})end for i=1,12 do register({id=string.format("v2.env.renv_separation.%03d",i),name="getrenv/getgenv identity separation vector "..i,category="Environment",dimension="fidelity",weight=0.50,run=function()local renv=resolve("getrenv")local genv=resolve("getgenv")if type(renv)~="function"or type(genv)~="function"then return MISSING()end local r=renv()local g=genv()if type(r)~="table"or type(g)~="table"then return FAIL("environment not table")end if r==g then return DEGRADED("Roblox and executor global environments are same table")end if r.game~=game then return FAIL("renv.game identity mismatch")end if g==r then return FAIL("environment separation impossible")end return PASS()end,})end for i=1,24 do register({id=string.format("v2.instances.clone_compare_transitive.%03d",i),name="cloneref/compareinstances transitivity vector "..i,category="Instances",dimension="cross",weight=0.58,run=function()local clone=resolve("cloneref")local compare=resolve("compareinstances")if type(clone)~="function"or type(compare)~="function"then return MISSING()end local part=Instance.new("Part")part.Name="A2_"..randomAscii(9)local a=clone(part)local b=clone(part)if a==part or b==part then safeDestroy(part);return FAIL("clone wrapper equals original")end if not compare(part,a)or not compare(a,part)or not compare(a,b)then safeDestroy(part)return FAIL("engine identity relation is not symmetric/transitive")end local other=Instance.new("Part")local falsePositive=compare(part,other)safeDestroy(part)safeDestroy(other)if falsePositive then return FAIL("different engine objects compare equal")end return PASS()end,})end for i=1,20 do register({id=string.format("v2.instances.nil_transition.%03d",i),name="getinstances/getnilinstances parent-state transition vector "..i,category="Instances",dimension="cross",weight=0.64,run=function()local all=resolve("getinstances")local nils=resolve("getnilinstances")if type(all)~="function"or type(nils)~="function"then return MISSING()end local marker=Instance.new("Folder")marker.Name="A2Nil_"..randomAscii(11)marker.Parent=nil if not listContainsIdentity(all(),marker)then safeDestroy(marker);return FAIL("nil instance absent from getinstances")end if not listContainsIdentity(nils(),marker)then safeDestroy(marker);return FAIL("nil instance absent from getnilinstances")end marker.Parent=workspace task.wait()if not listContainsIdentity(all(),marker)then safeDestroy(marker);return FAIL("parented instance absent from getinstances")end if listContainsIdentity(nils(),marker)then safeDestroy(marker);return FAIL("parented instance remains in getnilinstances")end marker.Parent=nil task.wait()local back=listContainsIdentity(nils(),marker)safeDestroy(marker)if not back then return FAIL("re-nil-parented instance did not reappear")end return PASS()end,})end for i=1,16 do register({id=string.format("v2.cache.iscached_lifecycle.%03d",i),name="cache iscached/invalidate lifecycle vector "..i,category="Cache",dimension="robustness",weight=0.58,run=function()local iscached=resolve("cache.iscached")local invalidate=resolve("cache.invalidate")if type(iscached)~="function"or type(invalidate)~="function"then return MISSING()end local folder=Instance.new("Folder")folder.Name="A2Cache_"..randomAscii(8)folder.Parent=workspace local ref=workspace:FindFirstChild(folder.Name)local before=iscached(ref)invalidate(ref)local after=iscached(ref)local fresh=workspace:FindFirstChild(folder.Name)local freshCached=iscached(fresh)safeDestroy(folder)if type(before)~="boolean"or type(after)~="boolean"or type(freshCached)~="boolean"then return FAIL("iscached must return booleans")end if after==true then return FAIL("invalidated wrapper still marked cached")end if fresh==ref then return FAIL("fresh lookup returned invalidated wrapper identity")end if not freshCached then return DEGRADED("fresh wrapper not reported cached")end return PASS()end,})end for i=1,20 do register({id=string.format("v2.connections.fields.%03d",i),name="getconnections Connection fields vector "..i,category="Signals",dimension="fidelity",weight=0.62,run=function()local get=resolve("getconnections")if type(get)~="function"then return MISSING()end local ev=Instance.new("BindableEvent")local token="CON_"..randomAscii(12)local function callback(v)return token,v end local rbxc=ev.Event:Connect(callback)local list=get(ev.Event)if type(list)~="table"or#list<1 then rbxc:Disconnect();safeDestroy(ev);return FAIL("no connection object")end local c=list[1]local okFields,enabled,foreign,luaConn,fn,thread=pcall(function()return c.Enabled,c.ForeignState,c.LuaConnection,c.Function,c.Thread end)rbxc:Disconnect()safeDestroy(ev)if not okFields then return FAIL("documented fields not readable")end if type(enabled)~="boolean"or type(foreign)~="boolean"or type(luaConn)~="boolean"then return FAIL("boolean Connection fields have wrong types")end if luaConn~=true or foreign~=false then return INCONSISTENT("locally-created Luau connection classification wrong")end if fn~=callback then return FAIL("Function field identity mismatch")end if thread~=nil and type(thread)~="thread"then return FAIL("Thread field invalid type")end return PASS()end,})end for i=1,20 do register({id=string.format("v2.connections.methods.%03d",i),name="Connection Fire/Disable/Enable/Disconnect state machine "..i,category="Signals",dimension="robustness",weight=0.72,run=function()local get=resolve("getconnections")if type(get)~="function"then return MISSING()end local ev=Instance.new("BindableEvent")local calls=0 local last local rbxc=ev.Event:Connect(function(v)calls+=1 last=v end)local list=get(ev.Event)local c=type(list)=="table"and list[1]if c==nil then rbxc:Disconnect();safeDestroy(ev);return FAIL("connection missing")end if type(c.Fire)~="function"or type(c.Disable)~="function"or type(c.Enable)~="function"or type(c.Disconnect)~="function"then rbxc:Disconnect();safeDestroy(ev);return FAIL("documented Connection methods missing")end local token1="F_"..randomAscii(8)c:Fire(token1)task.wait()if calls~=1 or last~=token1 then rbxc:Disconnect();safeDestroy(ev);return FAIL("Connection:Fire failed")end c:Disable()if c.Enabled~=false then rbxc:Disconnect();safeDestroy(ev);return FAIL("Enabled not false after Disable")end ev:Fire("blocked")task.wait()if calls~=1 then rbxc:Disconnect();safeDestroy(ev);return FAIL("disabled connection still fired")end c:Enable()if c.Enabled~=true then rbxc:Disconnect();safeDestroy(ev);return FAIL("Enabled not true after Enable")end ev:Fire("enabled")task.wait()if calls~=2 or last~="enabled"then rbxc:Disconnect();safeDestroy(ev);return FAIL("re-enabled connection failed")end c:Disconnect()ev:Fire("after")task.wait()safeDestroy(ev)if calls~=2 then return FAIL("disconnected connection still fired")end return PASS()end,})end for i=1,12 do register({id=string.format("v2.connections.defer.%03d",i),name="Connection:Defer asynchronous delivery vector "..i,category="Signals",dimension="robustness",weight=0.56,run=function()local get=resolve("getconnections")if type(get)~="function"then return MISSING()end local ev=Instance.new("BindableEvent")local observed local rbxc=ev.Event:Connect(function(v)observed=v end)local list=get(ev.Event)local c=type(list)=="table"and list[1]if c==nil or type(c.Defer)~="function"then rbxc:Disconnect();safeDestroy(ev);return FAIL("Connection:Defer missing")end local token="D_"..randomAscii(11)c:Defer(token)local immediate=observed task.wait()rbxc:Disconnect();safeDestroy(ev)if immediate~=nil then return DEGRADED("Defer executed synchronously")end if observed~=token then return FAIL("deferred callback was not delivered")end return PASS()end,})end for i=1,16 do register({id=string.format("v2.identity.thread_isolation.%03d",i),name="thread identity set/get/restore isolation vector "..i,category="Identity",dimension="robustness",weight=0.62,run=function()local get=firstResolved({"getthreadidentity","getidentity","getthreadcontext"})local set=firstResolved({"setthreadidentity","setidentity","setthreadcontext"})if type(get)~="function"or type(set)~="function"then return MISSING()end local mainBefore=get()local childObserved,childRestored local done=false task.spawn(function()local original=get()local target=(original==3)and 2 or 3 local ok=pcall(set,target)if ok then childObserved=get()end pcall(set,original)childRestored=get()done=true end)local deadline=now()+0.6 repeat task.wait()until done or now()>deadline if not done then return FAIL("identity child probe timed out")end local mainAfter=get()if mainAfter~=mainBefore then pcall(set,mainBefore)return FAIL("child identity mutation leaked into caller thread")end if childObserved==nil then return FAIL("child identity set failed")end if childRestored==nil then return FAIL("child identity restore failed")end return PASS()end,})end for i=1,12 do register({id=string.format("v2.reflection.hidden_restore.%03d",i),name="hidden property mutate/restore vector "..i,category="Reflection",dimension="robustness",weight=0.58,run=function()local get=resolve("gethiddenproperty")local set=resolve("sethiddenproperty")if type(get)~="function"or type(set)~="function"then return MISSING()end local fire=Instance.new("Fire")local okGet,before=pcall(get,fire,"size_xml")if not okGet then safeDestroy(fire);return SKIP("size_xml unavailable on client build")end local changed=(tonumber(before)or 5)+1+(i%3)local okSet=pcall(set,fire,"size_xml",changed)local okChanged,observed=pcall(get,fire,"size_xml")local okRestore=pcall(set,fire,"size_xml",before)local okFinal,final=pcall(get,fire,"size_xml")safeDestroy(fire)if not okSet or not okChanged or observed~=changed then return FAIL("hidden mutation failed")end if not okRestore or not okFinal or final~=before then return FAIL("hidden property restore failed")end return PASS()end,})end for i=1,24 do register({id=string.format("v2.metatable.readonly_toggle.%03d",i),name="readonly toggle state machine vector "..i,category="Metatable",dimension="robustness",weight=0.48,run=function()local set=resolve("setreadonly")or resolve("make_writeable")local is=resolve("isreadonly")if type(set)~="function"or type(is)~="function"then return MISSING()end local t={value=i}table.freeze(t)if is(t)~=true then return FAIL("frozen table not readonly")end set(t,false)local okWrite=pcall(function()t.value=i+1 end)if not okWrite or t.value~=i+1 then return FAIL("unfreeze did not enable writes")end set(t,true)local okWrite2=pcall(function()t.value=i+2 end)if okWrite2 then return FAIL("re-readonly table remained writable")end if is(t)~=true then return INCONSISTENT("isreadonly false after re-lock")end return PASS()end,})end local DRAWING_TYPES={"Square","Circle","Line","Text","Triangle","Quad"}for _,drawingType in ipairs(DRAWING_TYPES)do for i=1,6 do register({id=string.format("v2.drawing.type.%s.%02d",drawingType,i),name="Drawing "..drawingType.." lifecycle vector "..i,category="Drawing",dimension="fidelity",weight=0.38,run=function()local new=resolve("Drawing.new")local is=resolve("isrenderobj")if type(new)~="function"then return MISSING()end local ok,obj=pcall(new,drawingType)if not ok or obj==nil then return FAIL("Drawing.new("..drawingType..") failed")end local propOk=pcall(function()obj.Visible=false end)if not propOk then return FAIL("Visible property unavailable")end if type(is)=="function"and not is(obj)then pcall(function()obj:Destroy()end)return FAIL("isrenderobj rejected live "..drawingType)end local destroyed=pcall(function()if type(obj.Destroy)=="function"then obj:Destroy()elseif type(obj.Remove)=="function"then obj:Remove()else error("no destroy method")end end)if not destroyed then return FAIL("drawing destruction failed")end return PASS()end,})end end for i=1,10 do register({id=string.format("v2.drawing.clearcache.%03d",i),name="cleardrawcache multi-object vector "..i,category="Drawing",dimension="robustness",weight=0.48,run=function()local new=resolve("Drawing.new")local clear=resolve("cleardrawcache")local is=resolve("isrenderobj")if type(new)~="function"or type(clear)~="function"then return MISSING()end local objects={}for _=1,3 do local obj=new("Square")obj.Visible=false table.insert(objects,obj)end local ok,err=pcall(clear)if not ok then return FAIL("cleardrawcache errored: "..tostring(err))end task.wait()for _,obj in ipairs(objects)do local okExists,exists=pcall(function()return obj.__OBJECT_EXISTS end)if okExists and exists==true then return FAIL("cleardrawcache left __OBJECT_EXISTS=true after scheduler step")end if type(is)=="function"then local okIs,valid=pcall(is,obj)if okIs and valid==true then return FAIL("isrenderobj still accepts cleared object after scheduler step")end end end return PASS()end,})end for i=1,36 do register({id=string.format("v2.antispoof.dependency_chain.%03d",i),name="randomized dependency-chain challenge "..i,category="AntiSpoof",dimension="antiSpoof",weight=0.56,run=function()local enc=firstResolved({"base64encode","crypt.base64encode","base64.encode"})local dec=firstResolved({"base64decode","crypt.base64decode","base64.decode"})local hash=resolve("crypt.hash")local write=resolve("writefile")local read=resolve("readfile")if type(enc)~="function"or type(dec)~="function"then return MISSING("base64 required")end local raw=randomBytes(20+(i%33))local encoded=enc(raw)local restored=dec(encoded)if restored~=raw then return FAIL("base64 stage failed")end local evidence=refBase64Encode(raw)if encoded~=evidence then return FAIL("executor output disagrees with independent reference")end if type(hash)=="function"then local ok1,h1=pcall(hash,raw,"sha256")local ok2,h2=pcall(hash,restored,"sha256")if ok1 and ok2 and h1~=h2 then return INCONSISTENT("equal values hash differently")end end if type(write)=="function"and type(read)=="function"and fsPrepare()then local path=fsPath("chain_"..randomAscii(7)..".bin")write(path,encoded)if read(path)~=encoded then return FAIL("filesystem stage broke chain")end end return PASS("challenge="..string.format("%08x",hash32(raw..tostring(i))))end,})end register({id="aegis20.invariant.test_count",name="Aegis v2.0 runtime assertion count",category="Aegis",dimension="baseline",weight=1,run=function()if#tests<1800 then return FAIL("suite registered only "..#tests.." tests; expected >=1800")end return PASS("registered="..#tests)end,})register({id="aegis15.compatibility.test_count",name="Aegis v1.5 compatibility floor",category="Aegis",dimension="baseline",weight=1,run=function()if#tests<1000 then return FAIL("suite fell below legacy 1.5 floor: "..#tests)end return PASS("legacy floor preserved")end,})local function categoryStats()local map={}for _,r in ipairs(results)do local s=map[r.category]if not s then s={PASS=0,DEGRADED=0,INCONSISTENT=0,UNSTABLE=0,FAIL=0,MISSING=0,SKIP=0,WARN=0,SECURE=0,VULN=0,earned=0,possible=0,}map[r.category]=s end s[r.status]=(s[r.status]or 0)+1 if r.status~=STATUS.SKIP then s.possible+=r.weight if r.status==STATUS.PASS or r.status==STATUS.SECURE then s.earned+=r.weight elseif r.status==STATUS.DEGRADED then s.earned+=r.weight*0.35 elseif r.status==STATUS.INCONSISTENT then s.earned+=r.weight*0.20 elseif r.status==STATUS.UNSTABLE then s.earned+=r.weight*0.30 elseif r.status==STATUS.WARN then s.earned+=r.weight*0.50 end end end return map end local function dimensionScore(dimension)local earned=0 local possible=0 local skippedWeight=0 for _,r in ipairs(results)do if r.dimension==dimension then if r.status==STATUS.SKIP then skippedWeight+=r.weight elseif r.status==STATUS.PASS then earned+=r.weight possible+=r.weight elseif r.status==STATUS.DEGRADED then earned+=r.weight*0.35 possible+=r.weight elseif r.status==STATUS.INCONSISTENT then earned+=r.weight*0.20 possible+=r.weight elseif r.status==STATUS.UNSTABLE then earned+=r.weight*0.30 possible+=r.weight elseif r.status==STATUS.WARN then earned+=r.weight*0.5 possible+=r.weight elseif r.status==STATUS.SECURE then earned+=r.weight possible+=r.weight elseif r.status==STATUS.VULN then possible+=r.weight else possible+=r.weight end end end if possible==0 then return 0,0,skippedWeight end return 100*earned/possible,possible,skippedWeight end local function securitySummary()local vuln={critical=0,high=0,medium=0,low=0,}local secure=0 local warnCount=0 local totalExecuted=0 for _,r in ipairs(results)do if r.dimension=="security"and r.status~=STATUS.SKIP then totalExecuted+=1 if r.status==STATUS.VULN then vuln[r.severity]=(vuln[r.severity]or 0)+1 elseif r.status==STATUS.SECURE then secure+=1 elseif r.status==STATUS.WARN then warnCount+=1 end end end local penalty=0 for severity,count in pairs(vuln)do penalty+=count*(CONFIG.securityPenalty[severity]or 0)end penalty=math.clamp(penalty,0,0.85)local factor=1-penalty local securityPercent if totalExecuted==0 then securityPercent=0 else securityPercent=100*(secure+warnCount*0.5)/totalExecuted end return securityPercent,factor,vuln,secure,warnCount,totalExecuted end local function computeFinal()local baseline=dimensionScore("baseline")local p=dimensionScore("presence")local s=dimensionScore("semantics")local c=dimensionScore("cross")local f=dimensionScore("fidelity")local rb=dimensionScore("robustness")local st=dimensionScore("stress")local a=dimensionScore("antiSpoof")local functional=p*CONFIG.weights.presence+s*CONFIG.weights.semantics+c*CONFIG.weights.cross+f*CONFIG.weights.fidelity+rb*CONFIG.weights.robustness+st*CONFIG.weights.stress+a*CONFIG.weights.antiSpoof local securityPercent,securityFactor,vuln=securitySummary()local final=functional*securityFactor if(vuln.critical or 0)>0 then final=math.min(final,49.99)elseif(vuln.high or 0)>0 then final=math.min(final,69.99)elseif(vuln.medium or 0)>0 then final=math.min(final,84.99)elseif(vuln.low or 0)>0 then final=math.min(final,94.99)end if baseline<90 then final=math.min(final,59.99)end local mandatoryWeight=0 local observedWeight=0 for _,r in ipairs(results)do if r.dimension~="security"then mandatoryWeight+=r.weight if r.status~=STATUS.SKIP then observedWeight+=r.weight end end end local confidence=mandatoryWeight>0 and(100*observedWeight/mandatoryWeight)or 0 return{baseline=baseline,presence=p,semantics=s,cross=c,fidelity=f,robustness=rb,stress=st,antiSpoof=a,security=securityPercent,securityFactor=securityFactor,functional=functional,final=final,confidence=confidence,}end local function rating(score)if score>=99.5 then return"UNIVERSAL EXTREME / NEAR-COMPLETE (NOT CERTIFIED)"end if score>=97 then return"TOP-TIER / EXCEPTIONAL"end if score>=94 then return"VERY STRONG"end if score>=90 then return"STRONG"end if score>=82 then return"GOOD / REAL GAPS"end if score>=72 then return"MIXED"end if score>=58 then return"POOR / MANY GAPS"end return"SEVERE INCOMPLETENESS"end local function printLine(char,n)print(string.rep(char,n))end local function printSummary()local scores=computeFinal()local cats=categoryStats()local _,_,vuln,secure,warnCount,secTotal=securitySummary()print("")printLine("=",110)print(SUITE_NAME.." v"..VERSION.." — FINAL REPORT")print("Run ID: "..RUN_ID)print("PlaceId: "..tostring(game.PlaceId).." | JobId: "..tostring(game.JobId))printLine("-",110)print(string.format("%-22s %6s %6s %6s %6s %6s %6s %6s %6s %6s %9s","CATEGORY","PASS","DEGR","INCON","UNST","FAIL","MISS","SKIP","WARN","SEC/V","SCORE"))printLine("-",110)local names={}for name in pairs(cats)do table.insert(names,name)end table.sort(names)for _,name in ipairs(names)do local s=cats[name]local score=s.possible>0 and(100*s.earned/s.possible)or 0 print(string.format("%-22s %6d %6d %6d %6d %6d %6d %6d %6d %3d/%-2d %8.1f%%",name,s.PASS or 0,s.DEGRADED or 0,s.INCONSISTENT or 0,s.UNSTABLE or 0,s.FAIL or 0,s.MISSING or 0,s.SKIP or 0,s.WARN or 0,s.SECURE or 0,s.VULN or 0,score))end printLine("-",110)print(string.format("Roblox baseline: %6.2f%% (validity control; not weighted)",scores.baseline))print(string.format("Presence:        %6.2f%%",scores.presence))print(string.format("Semantics:       %6.2f%%",scores.semantics))print(string.format("Cross-API:       %6.2f%%",scores.cross))print(string.format("Fidelity:        %6.2f%%",scores.fidelity))print(string.format("Robustness:      %6.2f%%",scores.robustness))print(string.format("Stress:          %6.2f%%",scores.stress))print(string.format("Anti-spoof:      %6.2f%%",scores.antiSpoof))print(string.format("Security checks: %6.2f%% secure (%d executed, %d secure, %d warnings)",scores.security,secTotal,secure,warnCount))print(string.format("Security factor: %6.3f",scores.securityFactor))print(string.format("Confidence:      %6.2f%% (lower means more context-dependent tests were skipped)",scores.confidence))printLine("-",110)print(string.format("FUNCTIONAL SCORE: %6.2f%%",scores.functional))print(string.format("FINAL SCORE:      %6.2f%%",scores.final))print("RATING: "..rating(scores.final))print("CERTIFICATION: LOCAL / UNVERIFIED (Universal mode never self-certifies)")print(string.format("VULNERABILITIES: critical=%d high=%d medium=%d low=%d",vuln.critical or 0,vuln.high or 0,vuln.medium or 0,vuln.low or 0))printLine("=",110)return scores end local function exportResults(scores)local execName,execVersion=getExecutorIdentity()local counts={}for _,r in ipairs(results)do counts[r.status]=(counts[r.status]or 0)+1 end local payload={schemaVersion=4,suite=SUITE_NAME,version=VERSION,mode="UNIVERSAL",standardSnapshot={suncDate=SUNC_SNAPSHOT_DATE,track="Universal",policy="local-unverified",},verification={status="LOCAL_UNVERIFIED",certified=false,reason="Universal local runs do not carry a trusted server signature",},executor={name=execName,version=execVersion,},testCount=#tests,capabilityCount=#CAPABILITIES,counts=counts,categories=categoryStats(),runId=RUN_ID,placeId=game.PlaceId,gameId=game.GameId,jobId=game.JobId,config={safeMode=CONFIG.safeMode,enableNetwork=CONFIG.enableNetwork,enableWebSocket=CONFIG.enableWebSocket,enableSecurity=CONFIG.enableSecurity,enableStress=CONFIG.enableStress,enableGlobalHooks=CONFIG.enableGlobalHooks,enableInteractiveInput=CONFIG.enableInteractiveInput,enableTelemetry=CONFIG.enableTelemetry,telemetryEndpoint=CONFIG.enableTelemetry and CONFIG.telemetryUrl or nil,},scores=scores,results=results,}local ok,json=pcall(HttpService.JSONEncode,HttpService,payload)if not ok then warn("[AegisBench] Could not JSONEncode report")return end local write=resolve("writefile")local make=resolve("makefolder")local isfolder=resolve("isfolder")if type(write)~="function"then return end local folder="AegisBench"if type(make)=="function"and type(isfolder)=="function"then if not isfolder(folder)then pcall(make,folder)end end local path=folder.."/report_"..RUN_NONCE..".json"local okWrite=pcall(write,path,json)if okWrite then print("[AegisBench] JSON report: "..path)end end local function cleanup()if FS_READY then local del=resolve("delfolder")if type(del)=="function"then pcall(del,FS_ROOT)end end end print("")printLine("=",110)print(SUITE_NAME.." v"..VERSION)print("Universal behavioral + fidelity + robustness executor benchmark")print("Run ID: "..RUN_ID)print("Registered tests: "..tostring(#tests))print("Safe mode: "..tostring(CONFIG.safeMode))print("Note: Universal 100% is intentionally extreme; DEGRADED/INCONSISTENT/UNSTABLE implementations receive partial credit.")print("Certification: LOCAL / UNVERIFIED — trusted certification requires an external server/test-place layer.")print("RobloxBaseline validates the client/fixture only and contributes 0% executor score.")printLine("=",110)print("")telemetryStart()if CONFIG.shuffleTests then shuffleInPlace(tests)end for index,spec in ipairs(tests)do if CONFIG.verbose then print(string.format("[AegisBench] %d/%d — %s",index,#tests,spec.id))end executeTest(spec)local yieldEvery=math.max(1,tonumber(CONFIG.yieldEvery)or 12)if index%yieldEvery==0 then task.wait()end end local scores=printSummary()exportResults(scores)telemetryFinish(scores)cleanup()ENV.AEGIS_LAST_RESULT={suite=SUITE_NAME,version=VERSION,runId=RUN_ID,scores=scores,results=results,}return ENV.AEGIS_LAST_RESULT