Skip to main content
The Production Readiness Audit is an enterprise-grade testing and verification infrastructure designed to certify the @nekzus/liop package under real-world conditions, including multi-tier security enclaves, cross-Atlantic latencies, and hostile mobile edge connections.
Production Audit Topology

​
Topology Overview

The audit harness simulates a 10-node enterprise deployment partitioned across three security tiers:

​
Traffic Shaping with Linux Traffic Control (tc)

Each container is orchestrated with Linux iproute2 and tc netem to simulate empirical network profiles:
  • lan: Native LAN mode (zero shaping, < 1ms latency, 0% packet loss).
  • cross-atlantic: Intercontinental link (85ms ± 15ms latency, normal jitter distribution).
  • hostile-3g: Degraded cellular / edge network (250ms ± 50ms latency, 2% packet loss).

​
Audit CLI Commands

The test harness is fully automated via three primary CLI commands configured in sdks/typescript/package.json:

​
Automated Verification Suites (Suites 00 to 10 + Plug-and-Play)

The audit harness executes 12 comprehensive Vitest suites (64 individual tests) inside the liop-audit-runner container:
  1. 00-npm-integrity: Verifies that the tarball created by npm pack contains only production binaries and valid TypeScript declarations without test or scratch pollution.
  2. 01-mesh-convergence: Validates Kademlia DHT peer discovery across all tiers, verifying routing table stabilization within 5 seconds.
  3. 02-pqc-wan: Tests ML-KEM-768 quantum-resistant handshakes and AES-256-GCM session key agreement over high-latency WAN links.
  4. 03-auth-apikey: Evaluates fail-closed RBAC enforcement, rejecting unauthenticated calls and validating OAuth 2.1 client credentials.
  5. 04-logic-wan: Dispatches in-situ logic queries across network boundaries (e.g. executing financial risk models over the Atlantic link).
  6. 05-security-shields: Adversarial test suite attempting PII exfiltration, prototype pollution, memory bombs, and side-channel inference (100% blocked).
  7. 06-resilience: Simulates node drops, circuit breaker recovery, and automated transport failover between gRPC and libp2p.
  8. 07-observability: Validates dynamic Prometheus metrics scrape handlers (/metrics) and OpenTelemetry token emission (gen_ai.client.token.usage).
  9. 08-lifecycle-traceability: Verifies deterministic cryptographic lifecycle hashes binding each request to origin execution.
  10. 09-pnet-tier-isolation: Certifies that Tier 1 Enclaves (Bank and Vault) reject connections from nodes lacking the private Swarm Key PSK, and confirms that cross-boundary traffic is securely routed via the Border LIO Gateway (BLG).
  11. 10-interceptors-jev-docker: Certifies perimeter L7 admission filtering on Nexus (blocking SQL injection and Path Traversal with code -32099 and HTTP 403), confirms enclaves evaluate The Shield directly without false positives, and verifies BLG enclave proxying.
  12. plug-and-play: End-to-end “plug-and-play” validation confirming that the SDK boots, discovers peers, executes logic injections, and returns cryptographically attested results without any manual configuration.

​
Empirical Stress Testing & Zero-Trust Validation

The audit infrastructure supports extended validation beyond the automated suites:
  • Bootstrap Monte Carlo Scaling: Sustained statistical inference workloads (30 to 40 bootstrap iterations with variance, covariance, and Pearson correlation) cause deterministic WASI fuel consumption to scale proportionally from 300 to 400 units to 700 to 900 units (+75% to +125%), captured live by the liop_fuel_consumed_total histogram.
  • Zero-Trust Interception: Hostile micro-modules attempting raw PII exfiltration (stolenRecords) or unauthorized global access (fetch) are intercepted at Layer 3 (Taint Analyzer AST / Preflight Policy) and Layer 1 (Guardian AST) before data is accessed.
  • Hardware Stability: Verified under WSL2 (memory=6GB, processors=4) with 0% swap usage and aggregate CPU at ~14% of 400% available, with zero thermal saturation or pipe lockups.