Connectivity & app configuration repair
Repair broken network settings, app preferences and default behaviors to restore a working state.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- Network settings · app preferences
- Class GUI-need label
HY· Hybrid
Digital-employee context
Project class assignments, not demonstrated employee capability or imported benchmark coverage. Acceptance criteria and value metrics are proposals; no ROI has been measured.
Related roles
- IT and software delivery · Separate deliverables cover service tickets, restored configuration, identity records, repository fixes, passing CI and release packages.
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R01.07.01.02-T01 Fix adapter DNS so an intranet name resolves again
Original instruction
On the Windows VM, `intranet.test` no longer resolves; it should resolve to 10.0.0.8 through the lab DNS server 10.0.0.53. Find the misconfiguration in Settings > Network & internet (or the adapter's IPv4 properties) and fix it. Do not add a hosts-file entry.
- Platforms
win· Windows- Applications
- Network settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
Resolve-DnsName intranet.test returns 10.0.0.8 from 10.0.0.53; Get-DnsClientServerAddress on 'Ethernet' lists 10.0.0.53 first; hosts file hash unchanged; other adapter settings (IP, gateway) unchanged.
Proposed partial credit
50% correct DNS server on the right adapter; 30% name resolves; 20% hosts and IP untouched
R01.07.01.02-T02 Remove a bogus web proxy that breaks browsing on macOS
Original instruction
Wi-Fi shows connected but no site loads in Safari. A seeded manual web proxy and an auto-proxy PAC URL on the Wi-Fi service point to a dead host. Restore direct access in System Settings > Network > Wi-Fi > Details > Proxies, keeping the existing bypass list for `*.corp.test`.
- Platforms
mac· macOS- Applications
- System Settings · Safari
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
`networksetup -getwebproxy Wi-Fi` and -getsecurewebproxy Enabled: No; -getautoproxyurl Enabled: No; bypass domains still include *.corp.test; curl http://check.lab.test returns 200 via the Wi-Fi service.
Proposed partial credit
40% web and secure proxy off; 30% PAC off; 30% bypass list preserved and connectivity verified
R01.07.01.02-T03 Configure a manual proxy with bypass rules for both browsers and system services
Original instruction
Corporate policy: user traffic and WinHTTP-based services must use proxy 10.0.0.5:3128, bypassing `*.local`, `10.*` and local addresses. Configure the user proxy in Settings > Network & internet > Proxy and make the WinHTTP proxy match. Verify that `portal.local` loads directly and `example.test` goes through the proxy.
- Platforms
win· Windows- Applications
- Network settings · netsh
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formscode· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
HKCU Internet Settings ProxyEnable=1, ProxyServer=10.0.0.5:3128, ProxyOverride contains *.local;10.*;<local>; `netsh winhttp show proxy` matches; proxy access log shows example.test and no portal.local request.
Proposed partial credit
40% user proxy+bypass; 30% WinHTTP matches; 30% traffic routing verified in proxy log
R01.07.01.02-T04 Reset default apps and file-type handlers on a Mac
Original instruction
After a migration, links open in the wrong browser and files open in the wrong apps. Make Firefox the default web browser, open `.csv` with Numbers, `.md` with TextEdit, and `.log` with Console. Use System Settings and Finder's Get Info > Open with > Change All.
- Platforms
mac· macOS- Applications
- System Settings · Finder
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
LaunchServices handlers (lsregister dump / com.apple.launchservices.secure.plist) map http/https to org.mozilla.firefox and the three UTIs to com.apple.iWork.Numbers, com.apple.TextEdit, com.apple.Console; the browser-change confirmation dialog was accepted (LSHandlers entry present). duti is not installed and eslogger exec events detect defaults, plutil, osascript or swift runs by the agent (scripted LaunchServices changes), which void the task.
Proposed partial credit
40% default browser; 20% .csv handler; 20% .md handler; 20% .log handler
R01.07.01.02-T05 Restore PDF and browser defaults on Windows 11 where the registry hash blocks edits
Original instruction
PDFs open in a seeded test viewer and `.htm` files in Notepad. Set Microsoft Edge as the default for `.pdf`, `.htm`, `.html` and the http/https protocols, and set Notepad as default for `.log`, using Settings > Apps > Default apps. Registry edits will not stick because of the UserChoice hash.
- Platforms
win· Windows- Applications
- Default apps settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G3· GUI-only- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scrolltype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
HKCU ...\FileExts\.pdf\UserChoice ProgId=MSEdgePDF with a valid Hash (verified by opening a test file and checking the launched process), same for the other 5 associations. Direct reg edits leave an invalid hash that Windows resets, and Sysmon registry events detect UserChoice writes by reg.exe, PowerShell or hash-forging scripts; those associations fail.
Proposed partial credit
30% .pdf; 30% .htm/.html; 20% http/https; 20% .log
R01.07.01.02-T06 Repair outgoing mail settings in Outlook against a sandbox server
Original instruction
In classic Outlook on Windows, the IMAP account `ops@sandbox.test` receives mail but every send fails. The sandbox server requires SMTP on port 587 with STARTTLS and authentication using the same credentials as incoming. Fix the account settings in Outlook and send a test message with subject `SMTP-OK` to `check@sandbox.test`.
- Platforms
win· Windows- Applications
- Outlook
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
licensed· Licensed pro app- Proposed difficulty
- 3 / 5
Proposed verifier
Sandbox SMTP log shows an authenticated STARTTLS session on 587 from ops@sandbox.test delivering subject SMTP-OK; Outlook profile registry for the account shows SMTP Port 587 and encryption type STARTTLS; incoming settings unchanged. Outlook COM/VBA automation is disabled by policy, the agent never sees the account password, and Sysmon detects reg.exe/PowerShell writes to the profile keys or scripted SMTP clients; such runs fail.
Proposed partial credit
30% port; 30% encryption+auth; 40% test mail delivered
R01.07.01.02-T07 Make a Terminal profile and window size persist across restarts
Original instruction
Terminal windows on the Mac keep opening at 80x24 with the Basic profile. Make the `Pro` profile the default and startup profile, set its window to 132 columns x 43 rows, font Menlo 13, 'Use Option as Meta key' on, and shell exits closing the window if it exited cleanly. Settings must persist after quitting Terminal.
- Platforms
mac· macOS- Applications
- Terminal
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
After Terminal relaunch: com.apple.Terminal 'Default Window Settings' and 'Startup Window Settings' = Pro; Pro dict has columnCount 132, rowCount 43, useOptionAsMetaKey true, shellExitAction 1, Font archive decodes to Menlo 13; new window AX size reports 132x43. eslogger exec events detect defaults, plutil, PlistBuddy or osascript runs touching com.apple.Terminal (e.g. typed into Terminal itself); any such run voids the task.
Proposed partial credit
30% Pro as default+startup; 30% size; 20% font; 20% meta key and exit action
R01.07.01.02-T08 Import a WireGuard VPN with split tunnelling on Ubuntu
Original instruction
Import `~/input/wg-office.conf` as a WireGuard connection named `Office` using GNOME Settings > Network (or nmcli). Only 10.20.0.0/16 must route through the tunnel; everything else goes out the normal gateway. Use the DNS 10.20.0.53 only for the `corp.test` domain. Bring it up and confirm.
- Platforms
lin· Linux- Applications
- GNOME Settings · nmcli
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formscode· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
`nmcli connection show Office` type wireguard; ipv4.never-default yes; routes include 10.20.0.0/16 via wg; `ip route get 1.1.1.1` uses the LAN gateway; resolvectl shows 10.20.0.53 with ~corp.test routing domain; handshake to sandbox peer < 2 min old.
Proposed partial credit
30% imported and up; 40% split routing correct; 30% split DNS correct
R01.07.01.02-T09 Enable split tunnelling on a Windows built-in VPN profile
Original instruction
The built-in VPN profile `LabVPN` (IKEv2 to the sandbox gateway) sends all traffic through the tunnel. Change it so only 10.50.0.0/16 uses the VPN: in the adapter's IPv4 Advanced TCP/IP settings uncheck 'Use default gateway on remote network' and add the route. Connect with the provided test account and verify routing.
- Platforms
win· Windows- Applications
- Network settings · Network Connections
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Get-VpnConnection LabVPN SplitTunneling True; Get-VpnConnectionRoute lists 10.50.0.0/16; while connected, Find-NetRoute to 1.1.1.1 uses the LAN interface and to 10.50.1.1 uses the VPN interface; sandbox gateway log shows auth for the test account.
Proposed partial credit
40% split tunnelling enabled; 30% route added; 30% connected and routing verified
R01.07.01.02-T10 Fix network service order so Ethernet wins over a captive Wi-Fi
Original instruction
The Mac is on both Ethernet and a captive-portal guest Wi-Fi, and traffic goes to Wi-Fi. In System Settings > Network, put Ethernet above Wi-Fi in the service order, turn off Auto-Join for `Guest-Captive` while keeping it remembered, and set `Lab-5G` as the top preferred network.
- Platforms
mac· macOS- Applications
- System Settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clickdrag· Drag & dropnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
`networksetup -listnetworkserviceorder` has Ethernet before Wi-Fi; Guest-Captive remains in known networks with autojoin disabled (airport preferences plist); Lab-5G is first in the preferred order; `route get default` uses en0 Ethernet. eslogger exec events detect agent-run networksetup, scutil or defaults commands (which can reorder services or Wi-Fi), voiding the task.
Proposed partial credit
40% service order; 30% auto-join off but network kept; 30% preferred order
R01.07.01.02-T11 Restore hijacked Chrome search, startup and extension settings
Original instruction
In a sandbox Chrome profile, a rogue extension changed the default search engine to `search-hub.test`, set startup pages to an ad site, and enabled a proxy. Remove only that extension (the other three are legitimate), set the default search engine to DuckDuckGo, set startup to 'Open the New Tab page', and keep all bookmarks.
- Platforms
mac· macOSwin· Windowsweb· Any OS (web)- Applications
- Chrome
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Profile Preferences/Secure Preferences: rogue extension id absent, the 3 others present and enabled; default_search_provider keyword duckduckgo.com; session.restore_on_startup=5; proxy mode direct; Bookmarks file hash unchanged. Editing Preferences directly invalidates the MAC and is detected.
Proposed partial credit
30% rogue extension removed only; 25% search engine; 25% startup; 20% bookmarks and other extensions intact
R01.07.01.02-T12 Restore connectivity on an Android phone with a bad Private DNS setting
Original instruction
On the Android emulator, apps report 'No internet' even on Wi-Fi. Private DNS is set to a dead hostname and the phone keeps joining `Guest`. Set Private DNS to `dns.sandbox.test`, forget `Guest`, join `Lab-5G` with the WPA2 password in `/sdcard/Download/wifi.txt`, and turn off mobile data.
- Platforms
and· Android- Applications
- Android Settings
- Interfaces
mob· Mobile touch- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
touch· Touch gesturestype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
adb: settings get global private_dns_mode hostname and private_dns_specifier dns.sandbox.test; wpa_supplicant/WifiConfigStore lacks Guest; connected SSID Lab-5G; mobile_data 0; HTTP probe to check.lab.test 200. `adb shell settings put` from the agent's host is unavailable (adb not exposed).
Proposed partial credit
30% Private DNS; 20% Guest forgotten; 30% joined Lab-5G; 20% mobile data off
R01.07.01.02-T13 Bring a Mail.app account back online after server-path and SMTP errors
Original instruction
Apple Mail shows the `team@sandbox.test` IMAP account offline with a warning triangle. The sandbox IMAP server needs path prefix `INBOX`, port 993 SSL, and SMTP 587 with password auth; the seeded account has wrong values in three places. Fix the account in Mail > Settings > Accounts and send a message with subject `MAIL-OK` to `check@sandbox.test`.
- Platforms
mac· macOS- Applications
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Sandbox IMAP log shows LOGIN success and folder listing; SMTP log shows authenticated delivery of MAIL-OK; Accounts plist has IMAPPathPrefix INBOX, PortNumber 993, SSL true; Mail shows no account error (AX tree has no 'offline' badge). TCC denies AppleScript/JXA Automation of Mail, the agent never sees the account password (Keychain only), and eslogger detects direct writes to the Accounts store; such runs fail.
Proposed partial credit
30% IMAP path/port; 30% SMTP auth; 40% test mail delivered
R01.07.01.02-T14 Open a firewall path for a local dev server on Private networks only
Original instruction
A colleague's PC on the lab LAN cannot reach the demo app `C:\Demo\DemoServer.exe` (port 8443). Using Windows Defender Firewall with Advanced Security, add an inbound rule scoped to that program and TCP 8443, enabled only for the Private profile and the 192.168.50.0/24 subnet. Do not disable the firewall.
- Platforms
win· Windows- Applications
- Windows Defender Firewall
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Get-NetFirewallRule with Program filter = DemoServer.exe, LocalPort 8443, Profile Private, RemoteAddress 192.168.50.0/24, Action Allow; firewall enabled for all profiles; probe VM in the subnet connects, probe outside it and with the NIC set Public is refused.
Proposed partial credit
40% rule exists with program+port; 30% profile and scope correct; 30% probes pass
R01.07.01.02-T15 Remove a stale DNS configuration profile overriding resolution on macOS
Original instruction
Sites under `corp.test` resolve to an old IP on this Mac even though the network DNS is correct. A leftover configuration profile with a DNS Settings payload is the cause. Find and remove that profile in System Settings > General > Device Management (keep the Wi-Fi profile), then verify `wiki.corp.test` resolves to 10.30.0.12.
- Platforms
mac· macOS- Applications
- System Settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
hidden· Hidden/stale state- Proposed difficulty
- 4 / 5
Proposed verifier
`profiles list` lacks com.example.dns-legacy and still has com.example.wifi; `scutil --dns` has no encrypted resolver for corp.test; dscacheutil -q host wiki.corp.test returns 10.30.0.12; /etc/hosts unchanged. eslogger exec events detect agent-run `profiles remove`/`profiles -R` commands, which void the removal milestone.
Proposed partial credit
40% correct profile removed; 30% other profile kept; 30% resolution verified
R01.07.01.02-T16 Fix a line-of-business app that fails while Edge works
Original instruction
On the Windows VM, Edge browses fine but the `ClaimsClient` app (uses WinHTTP and TLS 1.2) cannot reach `api.claims.test`. Two seeded faults exist: a stale WinHTTP proxy and TLS 1.2 disabled in Internet Options > Advanced. Fix both so the app's 'Test connection' button succeeds; write the faults you found to `C:\triage\faults.txt`.
- Platforms
win· Windows- Applications
- Internet Options · netsh · ClaimsClient
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G3· GUI-only- Interaction primitives
click· Point & clickcode· Code & commandsvis· Visual judgment- Work product
WP08· App/system state- Conditions
hidden· Hidden/stale state- Proposed difficulty
- 4 / 5
Proposed verifier
`netsh winhttp show proxy` Direct access; HKCU SecureProtocols includes 0x800 (TLS 1.2); ClaimsClient test writes 'OK' to its log and the mock server logs a TLS1.2 handshake; faults.txt mentions both 'proxy' and 'TLS'.
Proposed partial credit
35% WinHTTP fixed; 35% TLS fixed; 20% app test passes; 10% faults listed
R01.07.01.02-T17 Set one adapter to DHCP and configure a second lab adapter statically
Original instruction
Ethernet was misconfigured with a static IP in the wrong subnet. Set `Ethernet` back to DHCP for both IP and DNS. Configure adapter `Lab` with IPv4 192.168.77.20/24, no default gateway, DNS 192.168.77.1, and interface metric 50 so it never wins the default route.
- Platforms
win· Windows- Applications
- Network settings · Network Connections
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
Get-NetIPInterface Ethernet Dhcp Enabled; Get-NetIPAddress Lab 192.168.77.20 prefix 24 manual; no 0.0.0.0/0 route on Lab; DNS on Lab 192.168.77.1; Lab InterfaceMetric 50; default route via Ethernet.
Proposed partial credit
30% Ethernet DHCP; 40% Lab static IP/DNS; 30% no gateway and metric
R01.07.01.02-T18 Repair a broken VS Code setup so the project's test task runs
Original instruction
After a dotfiles sync, VS Code on this machine fails: the integrated terminal exits immediately (bad shell path in user settings) and the Python extension points to a deleted interpreter. Fix user settings and the workspace interpreter selection so the workspace task `Run tests` runs in the integrated terminal and passes. Leave other settings unchanged.
- Platforms
mac· macOSwin· Windows- Applications
- VS Code
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
User settings.json terminal profile path exists and is a valid shell; the workspace's selected interpreter (Python extension state DB) is the project .venv; task log shows pytest exit 0 from the integrated terminal; diff of settings.json touches only the 2 broken keys.
Proposed partial credit
35% terminal profile fixed; 35% interpreter fixed; 20% task passes; 10% minimal diff
R01.07.01.02-T19 Diagnose and fix three stacked network faults on a Mac with a fault report
Original instruction
The Mac has no usable internet on Ethernet. Three seeded faults are stacked: a manual IPv4 with the wrong router, an unreachable DNS server, and an invalid PAC URL. Restore working connectivity using System Settings > Network and Network Utility-style checks, then write `~/Desktop/faults.json` listing each fault and the setting you changed.
- Platforms
mac· macOS- Applications
- System Settings · Terminal
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsvis· Visual judgment- Work product
WP08· App/system state- Conditions
hidden· Hidden/stale state- Proposed difficulty
- 5 / 5
Proposed verifier
`networksetup -getinfo Ethernet` router equals 192.168.60.1 (or DHCP with that lease); DNS servers answer; auto proxy off or PAC URL valid; curl to http://check.lab.test 200 and https://ok.lab.test 200; faults.json names all three fault types.
Proposed partial credit
25% router; 25% DNS; 25% PAC; 25% faults.json complete and connectivity verified
R01.07.01.02-T20 Clean up network tampering on Windows while preserving legitimate overrides
Original instruction
After malware removal, the Windows VM still misroutes traffic: a policy-set proxy, a Winsock LSP entry, a wrong DNS suffix search list, and hosts entries redirecting `bank.sandbox.test`. The hosts file also has 4 legitimate lab entries that must stay. Restore clean networking and document every change in `C:\triage\cleanup.md`.
- Platforms
win· Windows- Applications
- Network settings · Registry Editor · netsh
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clickcode· Code & commandsvis· Visual judgment- Work product
WP08· App/system state- Conditions
hidden· Hidden/stale statelong· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
HKCU/HKLM Policies Internet Settings proxy keys removed; `netsh winsock show catalog` lacks the seeded LSP; DNS suffix list equals corp.test only; hosts has the 4 legit lines and no bank.sandbox.test; bank.sandbox.test resolves via DNS; cleanup.md mentions all 4 faults.
Proposed partial credit
40% proxy policy and LSP removed; 20% suffix list; 25% hosts cleaned with legit kept; 15% report
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.