Audit and align v1 runtime design

1 files changed, 9 insertions, 4 deletions

diff --git a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
index 10415ce..7489dad 100644
--- a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
+++ b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
@@ -457,7 +457,7 @@ public sealed class SecurityPolicyTests
         {
             string auditPath = Path.Combine(directory.Path, "crash-audit.jsonl");
             using JsonDocument audit = JsonDocument.Parse(File.ReadLines(auditPath).Single(line => line.Contains("process.start", StringComparison.Ordinal)));
-            int sandboxPid = int.Parse(audit.RootElement.GetProperty("Data").GetProperty("pid").GetString()!,
+            int sandboxPid = int.Parse(audit.RootElement.GetProperty("data").GetProperty("pid").GetString()!,
                 System.Globalization.CultureInfo.InvariantCulture);
             Assert.True(SpinWait.SpinUntil(() => !ProcessExists(sandboxPid), TimeSpan.FromSeconds(5)), $"Orphan sandbox PID {sandboxPid} survived broker crash.");
         }
@@ -562,7 +562,8 @@ public sealed class SecurityPolicyTests
             16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
         var backend = new WindowsToolBackend(settings, audit);
         Guid taskId = Guid.NewGuid();
-        await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
+        Guid sessionId = Guid.NewGuid();
+        await backend.BeginTaskAsync(taskId, sessionId, TestContext.Current.CancellationToken);
         using JsonDocument edit = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(target)}},"operation":"overwrite","content":"after"}""");
 
         ToolExecutionResult result = await backend.ExecuteAsync(taskId, "file_edit", edit.RootElement, TestContext.Current.CancellationToken);
@@ -576,7 +577,11 @@ public sealed class SecurityPolicyTests
         Assert.Empty(Directory.EnumerateFiles(Path.Combine(directory.Path, "journals")));
         string backups = Path.Combine(directory.Path, "backups");
         Assert.True(!Directory.Exists(backups) || !Directory.EnumerateFileSystemEntries(backups).Any());
-        Assert.Contains(audit.Events, item => item.Event == "wfp.remove" && item.Data["residual_filters"] == "0");
+        Assert.Contains(audit.Events, item => item.Event == "network.rule.remove" && item.Data["residual_filters"] == "0");
+        Assert.Contains(audit.Events, item => item.Event == "task.start" && item.SessionId == sessionId);
+        Assert.Contains(audit.Events, item => item.Event == "tool.call" && item.SessionId == sessionId);
+        Assert.Contains(audit.Events, item => item.Event == "file.write" && item.SessionId == sessionId);
+        Assert.Contains(audit.Events, item => item.Event == "task.end" && item.SessionId == sessionId);
         Assert.Single(audit.Events, item => item.Event == "acl.apply");
         Assert.Single(audit.Events, item => item.Event == "acl.restore");
     }
@@ -925,7 +930,7 @@ public sealed class SecurityPolicyTests
             Assert.False(deniedPort.Accepted);
         }
         allowJournal.CompleteAndDelete();
-        Assert.Contains(audit.Events, item => item.Event == "wfp.remove" && item.Data["residual_filters"] == "0");
+        Assert.Contains(audit.Events, item => item.Event == "network.rule.remove" && item.Data["residual_filters"] == "0");
     }
 
     private static RestrictedProcessResult Curl(RestrictedProcessLauncher launcher, Guid taskId, string curl, string url, string cwd) =>