Repository navigation
test(credential-sources): close mutation gaps in refresh, gateway db migration and adopt - #2023
Conversation
…cases A mutation sweep over #2016, #1749 (OCC side), #1986 and #1987 left 34 of 73 hand-written mutants alive on main. These cases kill 29 of them: - credential sources: failure audits for static updates, a gateway that lost a refresh source, a static-type rotate refusal and an unwritable failure event; refresh status only for ready refresh sources; static deletes skip removeRefresh; pending and unknown first mints; deletion racing a refresh registration; the 70 s registration fence boundary; name-based registration request IDs; the refresh capability contract and Backend membership. - OpenShell catalog: only oauth2-refresh-token.refresh_token is issuer-rotated. - Gateway state migration helper: unreadable databases, Doctor spawn errors, signal exits and SIGINT. - split-layout adopt: each writer is compared with its own recorded images.
…ocker unexpected-error exit The shared-helper refactor on main moved the #1986 migration step into runtime-startup.ts. Re-run against it, a flipped Kubernetes guard (length >= 0) died only by 600 s timeouts in kubernetes-compute and plugin-compute, and the Docker program's exit on an unexpected migration error survived. The include check now covers the guard condition, and a Docker case fails the post-Doctor re-read outside the per-database check.
Add a positive control before the incomplete refresh Driver refusals, tie each delete call to its source, assert the racing deletion deferred on the fence, and reword three comments.
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P3
|
Codex review: needs maintainer review before merge. What this changesThis PR strengthens existing tests for credential refresh, Gateway database migration, and split-layout adoption without changing production code. Example: A credential registration times out, leaving a record that needs cleanup.
Review scores
ProductKind: Test only · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open for maintainer triage: it adds useful coverage for existing contracts, and no actionable introduced correctness or security defect was found. Priority: P3 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherThe tests exercise OCC credential lifecycle and audit decisions, generated Gateway startup programs, and the adoption script using controlled Driver, process, and Kubernetes fixtures. flowchart TD
T[Regression tests] --> O[OCC controller]
O --> C[Credential Drivers]
O --> S[Lifecycle and audit state]
T --> G[Gateway startup programs]
G --> D[SQLite and Doctor fixture]
T --> A[Adoption script]
A --> K[Kubernetes fixture]
Technical reviewBest possible solution: Retain the focused coverage and land it after the existing required checks pass. Do we have a high-confidence way to reproduce the issue? This PR addresses coverage gaps rather than a current runtime failure; its mutation results are author-reported and were not rerun. Is this the best way to solve the issue? Extending existing suites is proportionate, and the assertions generally follow documented contracts through real production owners with explicitly controlled dependencies. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 7570e26d8d94. Provenance checked
TestingProof path: in-process harness. SecurityNone. EvidenceWhat I checked:
Likely related people:
Review metrics
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 9, 2026, 9:57 PM ET / October 10, 2026, 01:57 UTC. |
Problem
A mutation sweep over four recent changes left 34 of 73 hand-written mutants alive on main (6ae2814). The changes were:
runtime-startup.tshelperEach surviving mutant is a behavior that no test pins, for example:
pendingcounts as minted.issuerRotatedfromrefresh_token.Change
Tests only, all in existing files and helpers:
credential-source-occCREDENTIAL_GATEWAY_UPDATE_FAILED), including when the gateway throws.removeRefresh.pendingfirst mint fails registration and removes the record. An unknown mint keeps the recorddeletinguntil DELETE.advanceClock.registerDriverrefuses a refresh Driver that lacks one of its four operations.credential_refreshID and requires the selected refresh Driver to be a member.sandbox-driver-startup: onlyoauth2-refresh-token.refresh_tokenis issuer-rotated in the OpenShell catalog.runtime-gateway-state-migrationerror-ENOENT, and a Doctor killed by a signal is named by that signal.length > 0condition.split-layout-adopt: only the worker is upgraded, so apply refuses and names the worker. After a rollback, apply continues, and the API and worker images still differ.Verification
node --test, full kill sets, against each target's own test files): 39 of 73 mutants killed on main 6ae2814, and 68 of 73 on this branch.--test-name-pattern): 30 of 30 killed. That is the 29 new kills plus C15, which now dies in 1 s instead of by timeout. Each of those tests passes without its mutant.OPENCLAW_STATE_DIR: both Compute Drivers set it.taskset 0,1), with load under 10.prettier --check(verified it can fail: it flagged two files before--write) andeslint --max-warnings 0on the touched files.git merge-treeshows the same conflicted files against this branch as against main. fix(credentials): release refresh bootstrap references and preserve resend protection #1952 has 2 conflict hunks incredential-source-occeither way.Risks
Low. Test-only. The fence boundary case pins the documented 70 s constant (2 x the 30 s gateway timeout + 10 s), so changing that constant now requires a test update. The Kubernetes guard check is a source-text check, like the existing one it extends.