diff --git a/commands/test/integration.sh b/commands/test/integration.sh
index d440c66..10c24bf 100644
--- a/commands/test/integration.sh
+++ b/commands/test/integration.sh
@@ -133,6 +133,7 @@ function cmd::test::run_all_integration_sections() {
   cmd::test::section_subnet
   cmd::test::section_identity
   cmd::test::section_activity
+  cmd::test::section_policy
   cmd::test::section_hosts
   cmd::test::section_peer_cmd
   cmd::test::section_group_purge
@@ -182,15 +183,21 @@ function cmd::test::section_rules() {
   cmd::test::run_cmd "rule show --name user"       "Description" rule show --name user
   cmd::test::run_cmd "rule show --name admin"      "Description" rule show --name admin
   cmd::test::run_cmd "rule list --json" '"rules":'               rule list --json
+  cmd::test::run_cmd "rule list --json"        '"rules":'        rule list --json
+  cmd::test::run_cmd "rule --json is_base"     '"is_base":'      rule list --json
+  cmd::test::run_cmd "rule --json extends"     '"extends":'      rule list --json
+  cmd::test::run_cmd "rule --json allows"      '"allows":'       rule list --json
   cmd::test::run_cmd_fails "rule show nonexistent"               rule show --name nonexistent
 }
 
 function cmd::test::section_groups() {
   test::section "Groups"
-  cmd::test::run_cmd "group list"               "Groups"  group list
-  cmd::test::run_cmd "group show --name family" "Peers:"  group show --name family
-  cmd::test::run_cmd "group list --json" '"groups":'      group list --json
-  cmd::test::run_cmd_fails "group show nonexistent"       group show --name nonexistent
+  cmd::test::run_cmd "group list"               "Groups"            group list
+  cmd::test::run_cmd "group show --name family" "Peers:"            group show --name family
+  cmd::test::run_cmd "group list --json" '"groups":'                group list --json
+  cmd::test::run_cmd "group list --json"          '"groups":'       group list --json
+  cmd::test::run_cmd "group --json peer_count"    '"peer_count":'   group list --json
+  cmd::test::run_cmd_fails "group show nonexistent"                 group show --name nonexistent
 }
 
 function cmd::test::section_audit() {
@@ -232,18 +239,20 @@ function cmd::test::section_net() {
   test::section "Net"
   "$WGCTL_BINARY" net rm --name test-svc --force > /dev/null 2>&1 || true
 
-  cmd::test::run_cmd "net add service"     "added"    net add --name test-svc --ip 10.0.0.99 --desc "Test service"
-  cmd::test::run_cmd "net add port"        "Added"    net add --name test-svc:web --port 9999:tcp
-  cmd::test::run_cmd "net list"            "test-svc" net list
-  cmd::test::run_cmd "net list --detailed" "web"      net list --detailed
-  cmd::test::run_cmd "net show"            "9999"     net show --name test-svc
-  cmd::test::run_cmd "net rm port"         "Removed"  net rm --name test-svc:web --force
-  cmd::test::run_cmd "net add port again"  "Added"    net add --name test-svc:web --port 9999:tcp
-  cmd::test::run_cmd "net rm all ports"    "Removed"  net rm --name test-svc:ports --force
-  cmd::test::run_cmd "net rm service"      "Removed"  net rm --name test-svc --force
-  cmd::test::run_cmd "net list --json" '"services":'  net list --json
-  cmd::test::run_cmd_fails "net show nonexistent"     net show --name nonexistent-svc
-  cmd::test::run_cmd_fails "net add port no service"  net add --name nonexistent:web --port 80:tcp
+  cmd::test::run_cmd "net add service"     "added"              net add --name test-svc --ip 10.0.0.99 --desc "Test service"
+  cmd::test::run_cmd "net add port"        "Added"              net add --name test-svc:web --port 9999:tcp
+  cmd::test::run_cmd "net list"            "test-svc"           net list
+  cmd::test::run_cmd "net list --detailed" "web"                net list --detailed
+  cmd::test::run_cmd "net show"            "9999"               net show --name test-svc
+  cmd::test::run_cmd "net rm port"         "Removed"            net rm --name test-svc:web --force
+  cmd::test::run_cmd "net add port again"  "Added"              net add --name test-svc:web --port 9999:tcp
+  cmd::test::run_cmd "net rm all ports"    "Removed"            net rm --name test-svc:ports --force
+  cmd::test::run_cmd "net rm service"      "Removed"            net rm --name test-svc --force
+  cmd::test::run_cmd "net list --json"          '"services":'   net list --json
+  cmd::test::run_cmd "net --json has tags"      '"tags":'       net list --json
+  cmd::test::run_cmd "net --json port_count"    '"port_count":' net list --json
+  cmd::test::run_cmd_fails "net show nonexistent"               net show --name nonexistent-svc
+  cmd::test::run_cmd_fails "net add port no service"            net add --name nonexistent:web --port 80:tcp
 }
 
 function cmd::test::section_subnet() {
@@ -251,36 +260,45 @@ function cmd::test::section_subnet() {
   "$WGCTL_BINARY" subnet rm --name test-subnet-2 > /dev/null 2>&1 || true
   "$WGCTL_BINARY" subnet rm --name test-subnet   > /dev/null 2>&1 || true
 
-  cmd::test::run_cmd "subnet list"              "desktop"  subnet list
-  cmd::test::run_cmd "subnet show desktop"      "tunnel:"  subnet show --name desktop
-  cmd::test::run_cmd "subnet show guests group" "guests"    subnet show --name guests
-  cmd::test::run_cmd_fails "subnet show nonexistent"       subnet show --name nonexistent
-
-  cmd::test::run_cmd "subnet add" "added" \
-    subnet add --name test-subnet --subnet 10.1.250.0/24 --type iot --desc "Test"
-  cmd::test::run_cmd "subnet list shows new" "test-subnet" \
-    subnet list
-  cmd::test::run_cmd_fails "subnet rename in-use (desktop)" \
-    subnet rename --name desktop --new-name workstation
-  cmd::test::run_cmd "subnet rename unused" "renamed" \
-    subnet rename --name test-subnet --new-name test-subnet-2
-  cmd::test::run_cmd "subnet rm" "removed" \
-    subnet rm --name test-subnet-2
-  cmd::test::run_cmd_fails "subnet rm nonexistent" \
-    subnet rm --name nonexistent-subnet
+  cmd::test::run_cmd "subnet list"              "desktop"         subnet list
+  cmd::test::run_cmd "subnet show desktop"      "tunnel:"         subnet show --name desktop
+  cmd::test::run_cmd "subnet show guests group" "guests"          subnet show --name guests
+  cmd::test::run_cmd_fails "subnet show nonexistent"              subnet show --name nonexistent
+  cmd::test::run_cmd "subnet add" "added"                         subnet add --name test-subnet --subnet 10.1.250.0/24 --type iot --desc "Test"
+  cmd::test::run_cmd "subnet list shows new" "test-subnet"        subnet list
+  cmd::test::run_cmd_fails "subnet rename in-use (desktop)"       subnet rename --name desktop --new-name workstation
+  cmd::test::run_cmd "subnet rename unused" "renamed"             subnet rename --name test-subnet --new-name test-subnet-2
+  cmd::test::run_cmd "subnet rm" "removed"                        subnet rm --name test-subnet-2
+  cmd::test::run_cmd "subnet list --json"       '"subnets":'      subnet list --json
+  cmd::test::run_cmd "subnet --json has cidr"   '"cidr":'         subnet list --json
+  cmd::test::run_cmd "subnet --json is_group"   '"is_group":'     subnet list --json
+  cmd::test::run_cmd_fails "subnet rm nonexistent"                subnet rm --name nonexistent-subnet
 }
 
 function cmd::test::section_identity() {
   test::section "Identity"
-  cmd::test::run_cmd "identity list"              ""        identity list
-  cmd::test::run_cmd "identity migrate --dry-run" "Dry run" identity migrate --dry-run
-  cmd::test::run_cmd "identity show nuno"         "nuno"    identity show --name nuno
-  cmd::test::run_cmd "identity list --json" '"identities":' identity list --json
-  cmd::test::run_cmd_fails "identity show nonexistent"      identity show --name nonexistent
+  cmd::test::run_cmd "identity list"              ""              identity list
+  cmd::test::run_cmd "identity migrate --dry-run" "Dry run"       identity migrate --dry-run
+  cmd::test::run_cmd "identity show nuno"         "nuno"          identity show --name nuno
+  cmd::test::run_cmd "identity list --json"       '"identities":' identity list --json
+  cmd::test::run_cmd "identity --json types array" '"types":['    identity list --json
+  cmd::test::run_cmd "identity --json rules array" '"rules":['    identity list --json
+  cmd::test::run_cmd_fails "identity show nonexistent"            identity show --name nonexistent
 }
 
 function cmd::test::section_activity() {
-  cmd::test::run_cmd "activity --json" '"peers":' activity --json
+  test::section "Activity"
+  cmd::test::run_cmd "activity"        "Activity"   activity
+  cmd::test::run_cmd "activity --json" '"peers":'   activity --json
+  cmd::test::run_cmd "activity --json services" '"services":' activity --json
+  cmd::test::run_cmd "activity --json rx"      '"rx":'        activity --json
+}
+
+function cmd::test::section_policy() {
+  test::section "Policy"
+  cmd::test::run_cmd "policy list --json"            '"policies":'          policy list --json
+  cmd::test::run_cmd "policy --json has tunnel_mode" '"tunnel_mode":'       policy list --json
+  cmd::test::run_cmd "policy --json strict_rule bool" '"strict_rule":false' policy list --json
 }
 
 function cmd::test::section_hosts() {
@@ -290,16 +308,19 @@ function cmd::test::section_hosts() {
   "$WGCTL_BINARY" hosts rm --ip 192.0.2.1 --force > /dev/null 2>&1 || true
   "$WGCTL_BINARY" hosts rm --port 9999    --force > /dev/null 2>&1 || true
  
-  cmd::test::run_cmd "hosts list"                   "Hosts"    hosts list
-  cmd::test::run_cmd "hosts add --ip"               "Added"    hosts add --ip 192.0.2.1 --name test-host --desc "Test" --tags test,unit
+  cmd::test::run_cmd "hosts list"                   "Hosts"     hosts list
+  cmd::test::run_cmd "hosts add --ip"               "Added"     hosts add --ip 192.0.2.1 --name test-host --desc "Test" --tags test,unit
   cmd::test::run_cmd "hosts list shows new"         "test-host" hosts list
-  cmd::test::run_cmd "hosts show --ip"              "Name"     hosts show --ip 192.0.2.1
-  cmd::test::run_cmd "hosts add --port"             "Added"    hosts add --port 9999 --name test-port
+  cmd::test::run_cmd "hosts show --ip"              "Name"      hosts show --ip 192.0.2.1
+  cmd::test::run_cmd "hosts add --port"             "Added"     hosts add --port 9999 --name test-port
   cmd::test::run_cmd "hosts list shows port"        "test-port" hosts list
-  cmd::test::run_cmd "hosts rm --ip"                "Removed"  hosts rm --ip 192.0.2.1 --force
-  cmd::test::run_cmd "hosts rm --port"              "Removed"  hosts rm --port 9999 --force
-  cmd::test::run_cmd_fails "hosts show nonexistent"            hosts show --ip 192.0.2.99
-  cmd::test::run_cmd_fails "hosts add missing --name"          hosts add --ip 192.0.2.1
+  cmd::test::run_cmd "hosts rm --ip"                "Removed"   hosts rm --ip 192.0.2.1 --force
+  cmd::test::run_cmd "hosts rm --port"              "Removed"   hosts rm --port 9999 --force
+  cmd::test::run_cmd "hosts list --json"     '"hosts":'         hosts list --json
+  cmd::test::run_cmd "hosts --json has type" '"type":'          hosts list --json
+  cmd::test::run_cmd "hosts --json has tags" '"tags":'          hosts list --json
+  cmd::test::run_cmd_fails "hosts show nonexistent"             hosts show --ip 192.0.2.99
+  cmd::test::run_cmd_fails "hosts add missing --name"           hosts add --ip 192.0.2.1
 }
  
 function cmd::test::section_peer_cmd() {
diff --git a/commands/test/unit.sh b/commands/test/unit.sh
index e53463c..bc52335 100644
--- a/commands/test/unit.sh
+++ b/commands/test/unit.sh
@@ -232,6 +232,11 @@ function cmd::test::unit_json_output() {
   cmd::test::assert "envelope command field" "$(echo "$result" | grep -o '"command":"list"')" '"command":"list"'
   cmd::test::assert "envelope meta field"    "$(echo "$result" | grep -o '"meta":')"    '"meta":'
   cmd::test::assert "envelope count field"   "$(echo "$result" | grep -o '"count":0')"  '"count":0'
+
+  # command::mixin registration
+  load_command list
+  cmd::test::assert_true "json_output mixin registered" "declare -f command::mixin::json_output::register >/dev/null 2>&1"
+  cmd::test::assert_true "command::json accessor exists" "declare -f command::json >/dev/null 2>&1"
  
   # json::error_envelope
   local err_result