Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Connect anonymously
Use /ws and preserve the HTTP upgrade request and first connected frame. Record URL, Origin, headers, cookies, and selected subprotocol.
Connect as an identity
Select User A through stored identity state, not a placeholder Authorization header. Verify the connected frame names user_a.
Test Origin policy
Use /ws-secure with the allowed lab origin and then a foreign origin. Compare /ws-insecure. Keep every other handshake field identical.
Set lifecycle limits
Configure a short connection timeout, bounded event queue, explicit cancel, no infinite retry, and a capped reconnect count. Confirm Cancel closes the worker activity.
Inspect WSS separately
On an authorized WSS target, verify TLS chain and hostname with the TLS module. The defensive CLI does not provide a separate WSS certificate validator.
Prove it before moving on.
The connection record explains authentication, Origin, TLS, subprotocol, timeout, cancel, and reconnect behavior independently.