The suite ran on in-memory SQLite, an engine production never uses: it hid
column lengths, MySQL-only syntax and type coercion (the identity bug fixed in
the previous commit passed CI that way). SQLite is gone:
- TestDb connects only to MariaDB/MySQL (XCVM_TEST_DB_DSN/_USER/_PASS; root over
the local socket, else 127.0.0.1:3306). Each instance gets a throwaway
schema, dropped with it, in the installer's sql_mode, with an explicit
connect timeout (a boot under test can zero default_socket_timeout).
- InstallSchema and the tests take the production DDL as is: the SQLite
reducers, the keys they re-added, the faked information_schema and the
sqliteCreateFunction() stand-ins are removed; test DDL is MySQL DDL.
- ReplicaBootTest, DbConnectRefusalTest and LazyDatabaseHandlerTest reach the
test server instead of SQLite files; RecordingFinalizer no longer swallows
an information_schema failure "for tests on SQLite".
- `make test-db` starts a throwaway mariadb:11.4 (tmpfs) for a machine without
a server; the CI PHPUnit job gets the same as a service.
The suite also runs on a panel host with the bundled PHP and its own php.ini:
tests reach the code through MAIN_HOME, not `<repo>/src`; repository checks
and process-isolated tests (ionCube Loader + OPcache CLI segfault on a script
read from stdin) are in the skip-on-panel group; xcvm_test_child_php() starts
a child that fakes \XC_VM without the real extension; Redis-down tests use
RedisManager::useConnector() instead of an eval'd \XC_VM.
Stale opt-in tests fixed on the way: the real-agent provisioning test answers
the agent-started check, the extension integration test sends the typed starts
and reads the binary signature raw, a fake producer starts as PHP_BINARY, and
the certbot test waits for the line its background command writes.
Database::get_row()/get_rows() pass every value through clean_row(), whose
HTML escaping (< > to entities, \r to \n) and trim() corrupt binary data.
The cluster read its node keys, epoch records, sealed tokens, enrol-code
keys and MACs, and command payloads and signatures that way, so:
- about half of all commands reached the agent with a signature that no
longer verified ("refused: bad signature");
- an epoch record (up to 2 KB) almost always came back altered, so a node's
first token could not be opened (TOKEN_EXPIRED, RECORD:epoch_record);
- a node whose signing or box key held one of those bytes could never
authenticate or be sealed to.
Database gains get_raw_rows()/get_raw_row(), which return the rows as
stored, and every cluster read of a binary column or a signed document uses
them. The admin pages keep the escaped fetch.
TestDb now escapes like Database, so the tests see what production sees:
before this fix, 70 cluster tests failed under it.
- node.rpc and node.root carry action in the envelope, as the extension's
registry requires; enqueue() lifts it out of the caller's payload, and
cluster:exec, the root inbox and RootPin read it there.
- enqueue() checked nothing: Database::query() answers a refused INSERT
with false, so a duplicate seq or dedupe_key returned a cmd_id for a
row never stored and ClusterRoute reported success. It now checks the
write, retries with a fresh seq, and throws after ATTEMPTS tries;
ClusterRoute logs every command the channel does not take.
- tests/Support/cluster_commands.json is the extension's registry, pinned
by digest; CommandBusRegistryTest builds every type MAIN sends and checks
it against the file, and FakeClusterCrypto refuses what the extension
refuses instead of signing anything.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rdv7hXd8RWhLHoj5Ma2ZqY
babasado