[Phase 0.2.3] Create adversarial test framework

[richard-devbot]

Closes #9

What was implemented

tests/adversarial/ directory structure

• __init__.py — package marker
• conftest.py — three pytest fixtures:
  • injection_payloads — parametrized fixture loading all 55 prompt injection patterns from prompt_injection.yaml (one test invocation per pattern, keyed by ID)
  • mock_llm_with_injection — builds a MagicMock LLM client whose .complete() / .acomplete() return the current injection payload as response content, simulating a compromised or adversarially-controlled model
  • attack_scenario — parametrized fixture over 5 multi-step attack chains (roleplay escalation, tool-chain exfiltration, indirect web injection, authority escalation, context poisoning via memory)

Payload library (tests/adversarial/payloads/)

File	Patterns	Categories
prompt_injection.yaml	55	instruction override, data exfiltration, jailbreak, prompt leakage, context poisoning, obfuscation, multi-turn, tool abuse, social engineering, nested injection
indirect_injection.yaml	33	web content, document (PDF/CSV/JSON/YAML), email, API response, database, code repository, calendar, search results, media metadata, cross-context
resource_exhaustion.yaml	28	context flood, recursive prompts, tool call abuse, memory exhaustion, computation abuse, malformed input, rate/session abuse

Test file (test_adversarial.py)

• TestPromptInjectionPayloads — 5 parametrized test methods run against every injection payload (schema validation, null byte stripping, INST delimiter removal, <system> tag stripping, mock LLM response sanitization)
• TestAttackScenarios — 5 test methods validate each attack scenario's schema and ordering invariants
• 5 @given hypothesis tests: sanitizer never crashes on arbitrary text, sanitizer is idempotent, handles control/surrogate characters, response safety check handles any dict, injection delimiters stripped in all contexts

Dev dependencies added

• hypothesis>=6.100.0
• pyyaml>=6.0.0

Test count

With 55 injection payloads × 5 test methods + 5 scenarios × 5 test methods + 5 hypothesis tests = 305+ test invocations from this framework.