At first, you can only do black-box tests (since, as you point out, there's no code yet). There's certainly room for white-box testing in XP, but it would come later. After all, since your team designed it, coded it, and wrote the tests, tests added after some code has been written can't help but be anything but white-box!

I think a lot of the distinction between white-box and black-box testing assumes that people writing/performing tests will be different than the people designing/coding. With XP, of course, it's the same people making and running the unit tests.

Coverage analysis would help to find what you've missed tests for. It's hard to err by having too many tests.

In XP, you keep adding tests for new features/behavior before you add the new features themselves. At that time, you could add more tests for boundary cases in the code you just wrote if you think it's going to be a problem.