Test that what should happen, does happen
Test that what should not happen, doesn't
All public APIs
All protected APIs
Anything that is promised not to change
All generated artifacts: file formats, object serialization, network communication, etc.
All acceptable inputs: files, serialized objects, network connections, etc.
Unacceptable inputs