# Adversarial fixtures for the red-team suite

Each fixture is a **deliberately malicious input** used by exactly one test in
`tests/test_red_team/`. These fixtures are NOT safe to execute directly — they
exist to prove the sanitization + gate + allowlist stack **rejects** them.

## Inventory

| File | Attack class | Attack # | Test file |
|------|--------------|----------|-----------|
| `shell_metachar_kernel.db` | prompt-injection | 9 | `test_inject_shell_metachars.py` |
| `path_traversal_metadata.db` | prompt-injection | 10 | `test_inject_path_traversal.py` |
| `symlink_escape.tar` | prompt-injection | 11 | `test_inject_symlink_escape.py` |
| `prompt_injection_kernel_name.db` | prompt-injection | covered by #9 sanitizer | (shared) |
| `malformed_patch.diff` | gate-evasion (compile) | 2 | `test_gate_evasion_malformed_patch.py` |
| `destructive_llm_output.txt` | prompt-injection | 12 | `test_inject_destructive_llm_output.py` |
| `disallowed_compiler_flag.txt` | prompt-injection | 13 | `test_inject_disallowed_compiler_flag.py` |
| `disallowed_rocprofv3_flag.txt` | prompt-injection | 14 | `test_inject_disallowed_rocprofv3_flag.py` |
| `fake_1000x_speedup.json` | gate-evasion (SOL) | 1 | `test_gate_evasion_sol_sanity.py` |
| `numerical_divergence_patch.diff` | gate-evasion (Bitwise) | 3 | `test_gate_evasion_numerical_divergence.py` |
| `silent_10pct_regression/*.db` | gate-evasion (regression) | 4 | `test_gate_evasion_silent_10pct_regression.py` |
| `tail_kernel_regression/*.db` | gate-evasion (weighted geomean) | 5 | `test_gate_evasion_silent_tail_regression.py` |
| `test_removal_patch.diff` | gate-evasion (test anchor) | 6 | `test_gate_evasion_test_anchor_removal.py` |
| `prompt_injection_via_private_provider.txt` | private-provider | R20/14 | `test_inject_disallowed_rocprofv3_flag.py` |

## Generation

Fixtures that are `.db` files are generated by Python helpers in
`tests/test_red_team/conftest.py` using the same UUID-based rocpd schema used
for synthetic tests elsewhere in the suite. This keeps the repo diffable
(fixtures are regenerated deterministically, not checked in as binary blobs
when we can avoid it). Where a binary is required (e.g. `symlink_escape.tar`),
the generator script is committed alongside.

## Safety

NEVER run `perfxpert analyze` or any production tool against these fixtures
outside the isolated test harness. The harness uses `tmp_path` sandboxes and
subprocess fencing (env-var whitelist, no shell, bounded timeout) to ensure
that even if a sanitizer bug exists, the blast radius is confined.