TEST 095

TEST-095

Stimulus

Place a canary secret in the dispatching context but not in the declaration. Declare a second canary and have the workload write its value into a declared output. Declare a secret name that the dispatching context does not provide. Leave the dispatching job's own token undeclared, and inspect the probe environment and the base image for the declared secret.

Required observation

The undeclared canary and the undeclared dispatching token are not observable in the guest environment or in any evidence byte, and the declared secret is not observable to the probe or in the base image. The run whose output contains the declared canary's value fails instead of retaining that output. The missing name fails before any VM mutation, never as a silently empty value. The evidence record lists the forwarded names, no values, and states that encoded forms are not detected.