diff --git a/tests/unit/build-iso_comprehensive_test.bats b/tests/unit/build-iso_comprehensive_test.bats
index e87213c..982e771 100644
--- a/tests/unit/build-iso_comprehensive_test.bats
+++ b/tests/unit/build-iso_comprehensive_test.bats
@@ -1,6 +1,293 @@
 #!/usr/bin/env bats
-# Minimal unit test
+# KNEL-Football Unit Tests - ISO Build Process
+# Reference: PRD.md FR-010 (ISO Build Process)
+# Copyright © 2026 Known Element Enterprises LLC
+# License: GNU Affero General Public License v3.0 only
 
-@test "test file is working" {
-    true
+# =============================================================================
+# Build Script Existence
+# =============================================================================
+
+@test "run.sh exists for ISO build" {
+    [ -f "/workspace/run.sh" ]
+}
+
+@test "run.sh is executable" {
+    [ -x "/workspace/run.sh" ]
+}
+
+@test "Dockerfile exists for build environment" {
+    [ -f "/workspace/Dockerfile" ]
+}
+
+# =============================================================================
+# Docker Build Environment
+# =============================================================================
+
+@test "Dockerfile uses Debian base" {
+    grep -q "FROM debian" /workspace/Dockerfile
+}
+
+@test "Dockerfile installs live-build" {
+    grep -q "live-build" /workspace/Dockerfile
+}
+
+@test "Dockerfile installs debootstrap" {
+    grep -q "debootstrap" /workspace/Dockerfile
+}
+
+@test "Dockerfile installs xorriso for ISO creation" {
+    grep -q "xorriso" /workspace/Dockerfile
+}
+
+@test "Dockerfile installs grub for UEFI support" {
+    grep -q "grub-efi" /workspace/Dockerfile || grep -q "grub-pc" /workspace/Dockerfile
+}
+
+@test "Dockerfile installs bats for testing" {
+    grep -q "bats" /workspace/Dockerfile
+}
+
+@test "Dockerfile installs shellcheck for linting" {
+    grep -q "shellcheck" /workspace/Dockerfile
+}
+
+@test "Dockerfile creates workspace directory" {
+    grep -q "/workspace" /workspace/Dockerfile
+}
+
+@test "Dockerfile creates build directory" {
+    grep -q "/build" /workspace/Dockerfile
+}
+
+@test "Dockerfile creates output directory" {
+    grep -q "/output" /workspace/Dockerfile
+}
+
+# =============================================================================
+# Live-Build Configuration (run.sh iso command)
+# =============================================================================
+
+@test "run.sh configures Debian testing distribution" {
+    grep -q "\-\-distribution testing" /workspace/run.sh
+}
+
+@test "run.sh configures AMD64 architecture" {
+    grep -q "\-\-architectures amd64" /workspace/run.sh
+}
+
+@test "run.sh configures main contrib non-free archives" {
+    grep -q "\-\-archive-areas.*main.*contrib.*non-free" /workspace/run.sh
+}
+
+@test "run.sh configures Debian mode" {
+    grep -q "\-\-mode debian" /workspace/run.sh
+}
+
+@test "run.sh configures squashfs chroot filesystem" {
+    grep -q "\-\-chroot-filesystem squashfs" /workspace/run.sh
+}
+
+@test "run.sh configures ISO hybrid binary image" {
+    grep -q "\-\-binary-images iso-hybrid" /workspace/run.sh
+}
+
+@test "run.sh sets ISO application name" {
+    grep -q "\-\-iso-application" /workspace/run.sh
+}
+
+@test "run.sh sets ISO publisher" {
+    grep -q "\-\-iso-publisher" /workspace/run.sh
+}
+
+@test "run.sh sets ISO volume name" {
+    grep -q "\-\-iso-volume" /workspace/run.sh
+}
+
+@test "run.sh enables netinst Debian installer" {
+    grep -q "\-\-debian-installer netinst" /workspace/run.sh
+}
+
+@test "run.sh enables Debian installer GUI" {
+    grep -q "\-\-debian-installer-gui true" /workspace/run.sh
+}
+
+@test "run.sh disables source packages" {
+    grep -q "\-\-source false" /workspace/run.sh
+}
+
+@test "run.sh disables apt indices" {
+    grep -q "\-\-apt-indices false" /workspace/run.sh
+}
+
+@test "run.sh disables apt source archives" {
+    grep -q "\-\-apt-source-archives false" /workspace/run.sh
+}
+
+# =============================================================================
+# Configuration Copying
+# =============================================================================
+
+@test "run.sh copies config directory to build" {
+    grep -q "cp -r.*config" /workspace/run.sh
+}
+
+@test "config directory exists" {
+    [ -d "/workspace/config" ]
+}
+
+@test "config/preseed.cfg exists" {
+    [ -f "/workspace/config/preseed.cfg" ]
+}
+
+@test "config/hooks directory exists" {
+    [ -d "/workspace/config/hooks" ]
+}
+
+@test "config/hooks/live directory exists" {
+    [ -d "/workspace/config/hooks/live" ]
+}
+
+@test "config/hooks/installed directory exists" {
+    [ -d "/workspace/config/hooks/installed" ]
+}
+
+@test "config/package-lists directory exists" {
+    [ -d "/workspace/config/package-lists" ]
+}
+
+# =============================================================================
+# Build Timeout and Safety
+# =============================================================================
+
+@test "run.sh has build timeout" {
+    grep -q "timeout" /workspace/run.sh
+}
+
+@test "run.sh build timeout is reasonable (1 hour max)" {
+    grep -q "timeout 3600" /workspace/run.sh
+}
+
+# =============================================================================
+# Checksum Generation
+# =============================================================================
+
+@test "run.sh generates SHA256 checksum" {
+    grep -q "sha256sum" /workspace/run.sh
+}
+
+@test "run.sh generates MD5 checksum" {
+    grep -q "md5sum" /workspace/run.sh
+}
+
+@test "run.sh creates .sha256 file" {
+    grep -q "\.sha256" /workspace/run.sh
+}
+
+@test "run.sh creates .md5 file" {
+    grep -q "\.md5" /workspace/run.sh
+}
+
+# =============================================================================
+# Output Handling
+# =============================================================================
+
+@test "run.sh defines output directory" {
+    grep -q "OUTPUT_DIR=" /workspace/run.sh
+}
+
+@test "run.sh names final ISO knel-football-secure.iso" {
+    grep -q "knel-football-secure.iso" /workspace/run.sh
+}
+
+@test "run.sh copies ISO to output directory" {
+    grep -q "cp.*output" /workspace/run.sh
+}
+
+@test "run.sh sets correct ownership on output files" {
+    grep -q "chown" /workspace/run.sh
+}
+
+# =============================================================================
+# Build Logging
+# =============================================================================
+
+@test "run.sh defines build log path" {
+    grep -q "BUILD_LOG=" /workspace/run.sh
+}
+
+@test "run.sh logs build output to file" {
+    grep -q "tee.*BUILD_LOG" /workspace/run.sh
+}
+
+@test "run.sh has monitor command" {
+    grep -q "monitor_build" /workspace/run.sh
+}
+
+@test "monitor function checks for build completion" {
+    grep -q "ISO build completed" /workspace/run.sh
+}
+
+@test "monitor function checks for build failure" {
+    grep -q "ISO build failed" /workspace/run.sh
+}
+
+# =============================================================================
+# Docker Integration for Build
+# =============================================================================
+
+@test "run.sh iso uses docker run" {
+    grep -A 100 'iso)' /workspace/run.sh | grep -q "docker run"
+}
+
+@test "run.sh iso runs as root in container" {
+    grep -A 100 'iso)' /workspace/run.sh | grep -q "\-\-user root"
+}
+
+@test "run.sh iso uses privileged mode for loop devices" {
+    grep -A 100 'iso)' /workspace/run.sh | grep -q "\-\-privileged"
+}
+
+@test "run.sh iso mounts workspace read-only" {
+    grep -A 100 'iso)' /workspace/run.sh | grep -q "/workspace:ro"
+}
+
+@test "run.sh iso mounts output directory" {
+    grep -A 100 'iso)' /workspace/run.sh | grep -q "/output"
+}
+
+@test "run.sh iso sets timezone" {
+    grep -A 100 'iso)' /workspace/run.sh | grep -q "TZ="
+}
+
+@test "run.sh iso sets noninteractive frontend" {
+    grep -A 100 'iso)' /workspace/run.sh | grep -q "DEBIAN_FRONTEND"
+}
+
+# =============================================================================
+# Error Handling
+# =============================================================================
+
+@test "run.sh checks for ISO creation success" {
+    grep -q "ISO_FILE=" /workspace/run.sh
+}
+
+@test "run.sh handles ISO creation failure" {
+    grep -q "exit 1" /workspace/run.sh
+}
+
+@test "run.sh lists output on success" {
+    grep -q "ls -lh.*output" /workspace/run.sh
+}
+
+# =============================================================================
+# Host FDE Requirement (FR-011)
+# =============================================================================
+
+@test "run.sh iso checks host FDE before building" {
+    grep -B 2 'iso)' /workspace/run.sh | grep -A 10 'iso)' /workspace/run.sh | grep -q "check_host_fde"
+}
+
+@test "run.sh exits if host FDE check fails" {
+    grep -q "check_host_fde || exit 1" /workspace/run.sh
 }
diff --git a/tests/unit/firewall_test.bats b/tests/unit/firewall_test.bats
index e835a48..b75da97 100644
--- a/tests/unit/firewall_test.bats
+++ b/tests/unit/firewall_test.bats
@@ -1,10 +1,139 @@
 #!/usr/bin/env bats
-# Unit tests for firewall-setup.sh (legacy symlink)
-# Reference: PRD.md FR-005 (Firewall)
+# KNEL-Football Unit Tests - Firewall Setup
+# Reference: PRD.md FR-004 (Network Isolation)
+# Copyright © 2026 Known Element Enterprises LLC
+# License: GNU Affero General Public License v3.0 only
 
-# This file tests the same as firewall-setup_test.bats
-# Both firewall-setup.sh and firewall-setup.sh should exist
+# =============================================================================
+# File Existence and Properties
+# =============================================================================
 
 @test "firewall-setup.sh exists" {
     [ -f "/workspace/src/firewall-setup.sh" ]
 }
+
+@test "firewall-setup.sh is executable" {
+    [ -x "/workspace/src/firewall-setup.sh" ]
+}
+
+@test "firewall-setup.sh is a valid bash script" {
+    run bash -n /workspace/src/firewall-setup.sh
+    [ "$status" -eq 0 ]
+}
+
+@test "firewall-setup.sh uses strict mode" {
+    grep -q "set -euo pipefail" /workspace/src/firewall-setup.sh
+}
+
+# =============================================================================
+# WireGuard Endpoint Parsing
+# =============================================================================
+
+@test "firewall-setup.sh has parse_wg_endpoint function" {
+    grep -q "parse_wg_endpoint()" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh parses Endpoint from WireGuard config" {
+    grep -q "Endpoint" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh handles missing WireGuard config" {
+    grep -q "WireGuard config not found" /workspace/src/firewall-setup.sh
+}
+
+# =============================================================================
+# nftables Rule Generation
+# =============================================================================
+
+@test "firewall-setup.sh has generate_nftables_rules function" {
+    grep -q "generate_nftables_rules()" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh generates nftables rules" {
+    grep -q "nft" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh creates inet filter table" {
+    grep -q "table inet filter" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh sets default drop policy on input" {
+    grep -q "chain input" /workspace/src/firewall-setup.sh
+    grep -A 5 "chain input" /workspace/src/firewall-setup.sh | grep -q "policy drop"
+}
+
+@test "firewall-setup.sh sets default drop policy on forward" {
+    grep -q "chain forward" /workspace/src/firewall-setup.sh
+    grep -A 3 "chain forward" /workspace/src/firewall-setup.sh | grep -q "policy drop"
+}
+
+@test "firewall-setup.sh sets default drop policy on output" {
+    grep -q "chain output" /workspace/src/firewall-setup.sh
+    grep -A 5 "chain output" /workspace/src/firewall-setup.sh | grep -q "policy drop"
+}
+
+@test "firewall-setup.sh accepts loopback traffic" {
+    grep -q "iif lo accept" /workspace/src/firewall-setup.sh
+    grep -q "oif lo accept" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh accepts ICMP ping" {
+    grep -q "icmp type echo-request accept" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh allows WireGuard traffic" {
+    grep -q "udp dport" /workspace/src/firewall-setup.sh
+    grep -q "WireGuard" /workspace/src/firewall-setup.sh
+}
+
+# =============================================================================
+# Apply Firewall Function
+# =============================================================================
+
+@test "firewall-setup.sh has apply_firewall function" {
+    grep -q "apply_firewall()" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh writes to /etc/nftables.conf" {
+    grep -q "/etc/nftables.conf" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh enables nftables service" {
+    grep -q "systemctl enable nftables" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh restarts nftables service" {
+    grep -q "systemctl restart nftables" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh handles missing endpoint gracefully" {
+    grep -q "default deny policy" /workspace/src/firewall-setup.sh
+}
+
+# =============================================================================
+# Main Function
+# =============================================================================
+
+@test "firewall-setup.sh has main function" {
+    grep -q "main()" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh calls main when executed directly" {
+    grep -q 'BASH_SOURCE\[0\]' /workspace/src/firewall-setup.sh
+}
+
+# =============================================================================
+# Security Properties
+# =============================================================================
+
+@test "firewall-setup.sh flushes existing ruleset" {
+    grep -q "flush ruleset" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh uses WireGuard endpoint IP for allow rule" {
+    grep -q "ip daddr" /workspace/src/firewall-setup.sh
+}
+
+@test "firewall-setup.sh uses WireGuard endpoint port for allow rule" {
+    grep -q "udp dport" /workspace/src/firewall-setup.sh
+}
diff --git a/tests/unit/run_test.bats b/tests/unit/run_test.bats
index d0a4eaf..0bf5a45 100644
--- a/tests/unit/run_test.bats
+++ b/tests/unit/run_test.bats
@@ -1,12 +1,140 @@
 #!/usr/bin/env bats
-# Unit tests for run.sh main entry point
+# KNEL-Football Unit Tests - run.sh Basic Tests
+# Reference: PRD.md FR-010 (ISO Build Process)
+# Copyright © 2026 Known Element Enterprises LLC
+# License: GNU Affero General Public License v3.0 only
 
-@test "run.sh exists and is executable" {
+# =============================================================================
+# File Existence and Properties
+# =============================================================================
+
+@test "run.sh exists" {
     [ -f "/workspace/run.sh" ]
+}
+
+@test "run.sh is executable" {
     [ -x "/workspace/run.sh" ]
 }
 
-@test "run.sh help command runs" {
-    run bash /workspace/run.sh help || true
-    [ "$?" -le 1 ]
+@test "run.sh is a valid bash script" {
+    run bash -n /workspace/run.sh
+    [ "$status" -eq 0 ]
+}
+
+@test "run.sh uses strict mode" {
+    grep -q "set -euo pipefail" /workspace/run.sh
+}
+
+# =============================================================================
+# Basic Commands
+# =============================================================================
+
+@test "run.sh help command shows usage" {
+    run bash /workspace/run.sh help
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"Usage"* ]] || [[ "$output" == *"Commands"* ]]
+}
+
+@test "run.sh help mentions build" {
+    run bash /workspace/run.sh help
+    [[ "$output" == *"build"* ]]
+}
+
+@test "run.sh help mentions test" {
+    run bash /workspace/run.sh help
+    [[ "$output" == *"test"* ]]
+}
+
+@test "run.sh help mentions iso" {
+    run bash /workspace/run.sh help
+    [[ "$output" == *"iso"* ]]
+}
+
+@test "run.sh without arguments shows usage" {
+    run bash /workspace/run.sh
+    [ "$status" -eq 1 ]
+}
+
+# =============================================================================
+# Docker Integration
+# =============================================================================
+
+@test "run.sh uses Docker image knel-football-dev" {
+    grep -q "knel-football-dev" /workspace/run.sh
+}
+
+@test "run.sh mounts workspace in Docker" {
+    grep -q "/workspace" /workspace/run.sh
+}
+
+@test "run.sh mounts output directory in Docker" {
+    grep -q "/output" /workspace/run.sh
+}
+
+# =============================================================================
+# Test Commands
+# =============================================================================
+
+@test "run.sh has test:unit command" {
+    grep -q "test:unit)" /workspace/run.sh
+}
+
+@test "run.sh has test:integration command" {
+    grep -q "test:integration)" /workspace/run.sh
+}
+
+@test "run.sh has test:security command" {
+    grep -q "test:security)" /workspace/run.sh
+}
+
+@test "run.sh has test:system command" {
+    grep -q "test:system)" /workspace/run.sh
+}
+
+@test "run.sh has lint command" {
+    grep -q "lint)" /workspace/run.sh
+}
+
+# =============================================================================
+# VM Test Commands
+# =============================================================================
+
+@test "run.sh has test:iso command" {
+    grep -q "test:iso)" /workspace/run.sh
+}
+
+@test "run.sh test:iso checks prerequisites" {
+    grep -q "vm_check_prerequisites" /workspace/run.sh
+}
+
+@test "run.sh has VM create command" {
+    grep -q "vm_create" /workspace/run.sh
+}
+
+@test "run.sh has VM destroy command" {
+    grep -q "vm_destroy" /workspace/run.sh
+}
+
+@test "run.sh has VM console command" {
+    grep -q "vm_console" /workspace/run.sh
+}
+
+@test "run.sh has VM status command" {
+    grep -q "vm_status" /workspace/run.sh
+}
+
+# =============================================================================
+# Security Requirements
+# =============================================================================
+
+@test "run.sh has host FDE check" {
+    grep -q "check_host_fde" /workspace/run.sh
+}
+
+@test "run.sh enforces host FDE for iso command" {
+    grep -A 5 "iso)" /workspace/run.sh | grep -q "check_host_fde"
+}
+
+@test "run.sh enforces host FDE for test:iso command" {
+    grep -A 5 "test:iso)" /workspace/run.sh | grep -q "check_host_fde"
 }