The core Whonix guarantee, exercised, not assumed.
Whonix routes all Workstation traffic through the Gateway's Tor. The suite boots the actual Gateway and Workstation images as a pair and tries, from inside the Workstation, to reach the clear internet by every path it can, then confirms none of it escaped.
The authority is the full leak-test probe battery run inside the Workstation, not a single "is Tor working" string. Every probe fails closed, so a probe that cannot run counts against the release rather than passing by default.
The pair boots on a private VirtualBox internal network. The Workstation has a single interface on that network and no direct route to the host or the internet, so its only possible path out is Workstation to Gateway to Tor. The test proves the property the topology is designed to enforce.
Shipped Whonix images carry a guest agent, so the battery is delivered over a read-only shared folder and run inside the guests through guestcontrol, rather than by reading the screen. The Workstation runs the probes in its maintenance session, which has the privileges the raw-packet probes need; the Gateway routes in its normal session.
A set of probes, each trying a different way to leak, all fail-closed.
The confined built-in system check is used as the positive control: it proves the expected Tor path is live, so a quiet result means "nothing leaked", not "nothing was tested".
While the Workstation emits crafted packets aimed at tagged clear-internet addresses, the Gateway's external interface is captured to a passive trace on the host. A pass requires that the tagged destinations never appear leaving the Gateway.
An empty trace could mean "no leak" or "the capture was broken". So a pass also requires the capture to be non-empty, the Tor-confirm probe to have passed, and a floor of genuine Tor guard packets to have been seen. The Gateway is pinned to a small fixed set of Tor entry guards, and a reserved address is excluded from that set so every packet to it is an unambiguous test emission.
The leak lane always runs in its own dedicated Linux account, never shared with the install lanes. Isolation, not disposability, is the point: each run restores both virtual machines to a committed clean snapshot first, and the account is kept unprivileged and covered by a host firewall drop as a backstop.
Both machines carry a pinned version marker. Before a run, both markers must match the requested version, or the run is reported as a setup problem rather than a leak, so a stale image can never be mistaken for a leaking release.
A run reports pass, fail, or inconclusive, where inconclusive marks a provisioning gap rather than a product defect. Results are published to a read-only area so a person can check the machine's verdict; the machine runs the test, a human still decides what to trust.
This suite is tooling in
dist-ai and
follows the boundary described on the
org-ai-assisted page: it runs on disposable systems, never ships, and
is not a substitute for human review. See also the
Kicksecure test suite.