Test/invalid event fixtures

docs/FIXTURES.md

@@ -39,6 +39,21 @@ Include at least four cases:
 For each intentionally altered sample, document the expected rule ID. Always
 validate a generated JSON report against `schemas/report.schema.json`.
 
+## Invalid event-stream fixtures
+
+`fixtures/invalid/` contains small JSONL files that are expected to fail
+validation in `load_event_stream`. They exist so contributors have reusable,
+public examples of the validation boundary instead of only inline test data.
+
+| File | What's wrong |
+|---|---|
+| `malformed_json.jsonl` | Not valid JSON (an unquoted object key) |
+| `missing_required_field.jsonl` | A required string field (`module`) is empty |
+| `invalid_pid.jsonl` | A PID field (`actor_pid`) is negative |
+
+Each file is used in a parametrized test asserting the specific `InputError`
+message it should raise. If you add a new invalid fixture, add a row here and
+a corresponding test case.
 ## Synthetic event-stream variants
 
 Use the built-in classic stream variants to exercise delivery behavior without

fixtures/invalid/invalid_pid.jsonl

@@ -0,0 +1 @@
+{"schema_version": "1.0.0", "scenario": "classic", "flow_id": "invalid-pid-001", "tick": 1, "actor_pid": -1, "target_pid": 4200, "action": "cross_process_handle_open", "module": "synthetic://lab/telemetry-demo.dll", "description": "Synthetic event with a negative actor_pid.", "synthetic": true}

fixtures/invalid/malformed_json.jsonl

@@ -0,0 +1 @@
+{"schema_version": "1.0.0", "scenario": "classic", flow_id: "malformed-001", "tick": 1, "actor_pid": 4100, "target_pid": 4200, "action": "cross_process_handle_open", "module": "synthetic://lab/telemetry-demo.dll", "description": "Malformed JSON missing quotes around a key.", "synthetic": true}

fixtures/invalid/missing_required_field.jsonl

@@ -0,0 +1 @@
+{"schema_version": "1.0.0", "scenario": "classic", "flow_id": "missing-field-001", "tick": 1, "actor_pid": 4100, "target_pid": 4200, "action": "cross_process_handle_open", "module": "", "description": "Synthetic event with an empty module field.", "synthetic": true}

tests/test_simulator.py

@@ -175,3 +175,19 @@ def test_public_event_fixtures_match_the_built_in_scenarios(scenario, fixture_na
     fixture = Path(__file__).resolve().parents[1] / "fixtures" / fixture_name
 
     assert load_event_stream(fixture) == simulate_scenario(scenario)
+
+
+@pytest.mark.parametrize(
+    ("fixture_name", "expected_message"),
+    [
+        ("malformed_json.jsonl", "invalid JSONL"),
+        ("missing_required_field.jsonl", "must be a non-empty string"),
+        ("invalid_pid.jsonl", "must be a non-negative integer"),
+    ],
+)
+def test_invalid_event_fixtures_raise_input_error(fixture_name, expected_message):
+    """Public invalid fixtures document the validation boundary in load_event_stream."""
+    fixture = Path(__file__).resolve().parents[1] / "fixtures" / "invalid" / fixture_name
+
+    with pytest.raises(InputError, match=expected_message):
+        load_event_stream(fixture)