# WG Paid — multi-protocol test standard V1

## Static/fixture

- protocol catalog and renderer validation;
- no selector ownership in VM121;
- quota race tests per protocol;
- 1/10/100 profiles across WG and AWG;
- common selector balancing;
- exhausted selector exclusion;
- enable/disable rollback;
- idempotency;
- secret scan.

## WireGuard E2E

invite -> magic link -> WG profile -> VM100 peer/selector -> RU Direct -> foreign VPN -> revoke.

## AmneziaWG E2E

invite -> magic link -> AWG profile -> public UDP VM101 -> `awg_paid` VM100 -> selector -> VPN -> revoke.

## Cross-protocol quota

For a grant with WG=3 and AWG=3:

- fourth WG profile blocked;
- fourth AWG profile blocked;
- three WG plus three AWG accepted;
- no global concurrent-session assertion.

## Security

- config/private material absent from public report;
- QR no-store;
- auth isolation;
- token expiry/one-time use;
- admin protection;
- backup/restore decrypt proof.