Files
sanderling/internal/trace/writer_test.go
T
pj 76dce1a75e experiment instrumentation: step budgets, arm labels, campaign runner (#72)
* feat(cli): add --max-steps for step-bounded runs

runner.Options.MaxSteps already worked but was unreachable from the command
line. A step budget is what makes two generators comparable: one making a
model call per step and one drawing from a PRNG are not comparable per second.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* feat(trace): record arm membership and host in meta.json

meta.json recorded the seed but not which picker ran, how it was configured,
what budget it was given, or which machine produced it. A directory of runs
cannot be attributed to an experiment cell without those, which makes any
factorial computed from such a directory unanalysable after the fact.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* feat(cli): add --arm and populate run meta from it

Model and instructions are recorded only when the LLM picker is the one that
will actually run, so a spec declaring generator = llm() that is run under the
seeded picker does not label its trace with a model it never called.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* feat(campaign): sweep seeds for one experiment cell

campaign.json lists the seeds a sweep intended to run and is written before
the first run, so a host that dropped runs shows up as missing seeds rather
than as a smaller sample. Seed 0 is rejected: sanderling test reads it as
"derive a seed from the clock", which is why conformance/gates.sh controls
nothing today.

Each run contributes one runs.jsonl line carrying steps to first violation by
origin step, the step that armed the failed obligation, so the survival
analysis never reopens a trace.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* fix(runner): no silent generator fallback, and llm on web

--generator llm against a spec declaring no generator = llm(...) logged a
warning and ran the seeded picker. For a comparison campaign that is silent
arm corruption: the run completes, the directory looks correct, and the wrong
policy drove it. It is now fatal.

pickSources also returned the V8 source for both action and extractor on web
before it looked at the generator, so the llm policy was unreachable there.
The two axes are now independent: the driver picks the extractor source, the
flag picks the action source, and llmSource composes with either because the
runner populates the candidate list and screenshot on every platform.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* fix(chrome): make the hierarchy dump agree with the web runtime

Three facts differed between the dump the goja host reads and the DOM the V8
host reads, so the two enumerated different candidates on one page.

scrollable was never emitted, and worker.go reads exactly that attribute while
targets.ts requires it for scrolls, so the goja host could not offer a single
web scroll. clickable tested el.onclick, which React assigns to its root
container for event delegation, making the whole viewport a tap target here and
in no other enumeration. Both now resolve through the selector sets in
pkg/spec/src/web-runtime.ts.

The dump also rooted at body while collectTargets walks querySelectorAll("*"),
so the goja host never saw html, where page-level scrolling lives. It now roots
at documentElement and skips the head subtree, which is all zero-bounds and
would otherwise carry script and title text into the trace.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* fix(conformance): give the gate reproducible seeds

SEED defaulted to 0 and sanderling test reads --seed 0 as "derive a seed from
the clock", so the tunable controlled nothing and a gate failure could not be
re-run. SEEDS now takes one explicit non-zero seed per run, recorded in the
results table so a failing row names its stream.

The five runs stay on five different streams: a gate that scored one path five
times would catch less than one that scores five.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* fix(chrome): emit editable as a plain boolean

editable was emitted as `isEditable || null`, and an absent field sends
internal/hierarchy into the native fallback, which reads any class name
containing "EditText" as an Android text widget. On web that is just a CSS
class, so a page styling a div with it was editable to the goja host and not to
the web runtime, and the model policy could be offered typing into a div.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* fix(spec): leave the head subtree out of the web target walk

collectTargets walked querySelectorAll("*") while the hierarchy dump skips head,
so the two hosts enumerated different element sets on every page with a <head>.
No candidate changes: builtinCandidates pushes only for targets acceptsTarget
admits, and head elements have no positive bounds, so the list the draw ranges
over is untouched. What changes is that targetIndex now means the same thing on
both hosts.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* test(chrome): compare the facts both hosts derive from one DOM

The existing parity harness hand-authors the facts on both sides, so it proves
that given identical facts both hosts select identical candidates, and says
nothing about the two code paths that derive those facts from a real page. Four
divergences lived in that blind spot and it passed throughout.

This drives one real page and compares clickable, enabled, editable, scrollable
and positiveBounds element by element, plus the element sets themselves, which
is what catches a host that omits html or includes head. Reverting any of the
four fixes makes it fail naming the element and the fact.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* chore(make): run the browser packages one at a time

Both launch Chrome and launching two at once has failed with "Launch: context
canceled".

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* style: remove every em-dash and en-dash

Eighteen occurrences across fourteen files. Each sentence was repunctuated to
suit what the dash was doing rather than swapped for a hyphen, which produces
comma splices. The minus sign in folio-web's ledger is a minus sign and stays.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* fix(chrome): honor the caller context in Launch

Launch and clearState ran against d.tabCtx, so a target that accepts the
connection and never answers wedged the process past its own --duration and
through SIGTERM, needing SIGKILL. Unattended that is a campaign worker lost for
the rest of the sweep with no diagnostic.

The browser is still allocated against d.tabCtx first, because chromedp starts
Chrome under whichever context calls Run first and allocating under a caller
deadline would kill the browser when Launch returns. Everything after
allocation goes through runCtx.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* fix(sidecarassets): publish the extracted jar through a rename

Extract wrote a 96 MB jar with a plain WriteFile into a temp path every
sanderling process on the host shares. On a cold host several concurrent
workers all miss the checksum and all write the same path, and O_TRUNC lets one
spawn a JVM against another's half-written archive. A fresh experiment host is
exactly a cold host.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* feat(campaign): kill a run that outlives --run-timeout

A wedged run holds its worker for the rest of the sweep, and on an unattended
host nothing else will send it a signal. Defaults to three times --duration and
must exceed it. A killed run is recorded as timed_out rather than as a generic
failure, so the analysis can tell a lost cell from a real crash.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

* style(test): gofmt browser_test.go

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX
2026-08-12 22:20:31 +05:30

495 lines
14 KiB
Go

package trace
import (
"bufio"
"encoding/json"
"os"
"path/filepath"
"strings"
"sync"
"testing"
"time"
"github.com/priyanshujain/sanderling/internal/hierarchy"
)
func TestWriteMeta_RoundTrip(t *testing.T) {
directory := t.TempDir()
writer, err := NewWriter(directory)
if err != nil {
t.Fatal(err)
}
defer writer.Close()
meta := Meta{
Seed: 42,
SpecPath: "spec.ts",
BundleSHA256: "deadbeef",
Platform: "android",
BundleID: "in.okcredit.merchant",
StartedAt: time.Date(2026, 4, 17, 22, 30, 0, 0, time.UTC),
SanderlingVersion: "0.0.1",
}
if err := writer.WriteMeta(meta); err != nil {
t.Fatal(err)
}
body, err := os.ReadFile(filepath.Join(directory, "meta.json"))
if err != nil {
t.Fatal(err)
}
var got Meta
if err := json.Unmarshal(body, &got); err != nil {
t.Fatalf("meta.json is not valid JSON: %v\n%s", err, body)
}
if got != meta {
t.Errorf("meta round-trip mismatch:\n got: %+v\nwant: %+v", got, meta)
}
}
func TestWriteMeta_EndedAtRoundTrip(t *testing.T) {
directory := t.TempDir()
writer, err := NewWriter(directory)
if err != nil {
t.Fatal(err)
}
defer writer.Close()
endedAt := time.Date(2026, 4, 17, 22, 31, 0, 0, time.UTC)
meta := Meta{
Seed: 7,
SpecPath: "spec.ts",
Platform: "android",
BundleID: "in.test",
StartedAt: time.Date(2026, 4, 17, 22, 30, 0, 0, time.UTC),
EndedAt: &endedAt,
SanderlingVersion: "0.0.1",
}
if err := writer.WriteMeta(meta); err != nil {
t.Fatal(err)
}
body, err := os.ReadFile(filepath.Join(directory, "meta.json"))
if err != nil {
t.Fatal(err)
}
if !strings.Contains(string(body), `"ended_at": "2026-04-17T22:31:00Z"`) {
t.Errorf("ended_at not in meta.json: %s", body)
}
var got Meta
if err := json.Unmarshal(body, &got); err != nil {
t.Fatal(err)
}
if got.EndedAt == nil || !got.EndedAt.Equal(endedAt) {
t.Errorf("EndedAt round-trip wrong: %v", got.EndedAt)
}
}
func TestWriteMeta_OmitsEndedAtWhenNil(t *testing.T) {
directory := t.TempDir()
writer, _ := NewWriter(directory)
defer writer.Close()
if err := writer.WriteMeta(Meta{StartedAt: time.Now().UTC()}); err != nil {
t.Fatal(err)
}
body, _ := os.ReadFile(filepath.Join(directory, "meta.json"))
if strings.Contains(string(body), "ended_at") {
t.Errorf("ended_at should be omitted when nil: %s", body)
}
}
func TestWriteStep_HierarchyAndResidualsRoundTrip(t *testing.T) {
directory := t.TempDir()
writer, _ := NewWriter(directory)
defer writer.Close()
tree, err := hierarchy.Parse(`{"attributes":{"resource-id":"root"},"children":[
{"attributes":{"resource-id":"child","text":"hi"},"children":[]}]}`)
if err != nil {
t.Fatal(err)
}
step := Step{
Index: 1,
Timestamp: time.Now().UTC(),
NextAction: &Action{
Kind: "tap",
Selector: "id:next",
ResolvedBounds: &BoundsRecord{X: 10, Y: 20, Width: 100, Height: 50},
TapPoint: &PointRecord{X: 60, Y: 45},
},
Hierarchy: tree,
Residuals: map[string]json.RawMessage{
"prop1": json.RawMessage(`{"op":"true"}`),
},
}
if err := writer.WriteStep(step); err != nil {
t.Fatal(err)
}
body, _ := os.ReadFile(filepath.Join(directory, "trace.jsonl"))
var got Step
if err := json.Unmarshal(body, &got); err != nil {
t.Fatalf("bad jsonl: %v\n%s", err, body)
}
if got.NextAction.Selector != "id:next" {
t.Errorf("selector = %q", got.NextAction.Selector)
}
if got.NextAction.ResolvedBounds == nil || got.NextAction.ResolvedBounds.Width != 100 {
t.Errorf("resolved_bounds round-trip wrong: %+v", got.NextAction.ResolvedBounds)
}
if got.NextAction.TapPoint == nil || got.NextAction.TapPoint.X != 60 {
t.Errorf("tap_point round-trip wrong: %+v", got.NextAction.TapPoint)
}
if string(got.Residuals["prop1"]) != `{"op":"true"}` {
t.Errorf("residuals round-trip wrong: %s", got.Residuals["prop1"])
}
// Intentionally-lossy contract: Tree marshals only Elements (Root and
// Node.Children are json:"-"). The flat element list survives; tree
// structure does not. Lock both halves so a regression that drops the
// element list, or one that silently starts persisting structure the
// replay UI would then depend on, is caught.
if got.Hierarchy == nil {
t.Fatal("hierarchy dropped from trace")
}
if len(got.Hierarchy.Elements) != 2 {
t.Fatalf("hierarchy elements not preserved: got %d", len(got.Hierarchy.Elements))
}
if got.Hierarchy.Elements[1].Text != "hi" {
t.Errorf("element field lost: %+v", got.Hierarchy.Elements[1])
}
if got.Hierarchy.Root != nil {
t.Errorf("Root is json:\"-\" and must decode nil, got %+v", got.Hierarchy.Root)
}
}
func TestWriteStep_OmitsEmptyHierarchyAndResiduals(t *testing.T) {
directory := t.TempDir()
writer, _ := NewWriter(directory)
defer writer.Close()
if err := writer.WriteStep(Step{Index: 1}); err != nil {
t.Fatal(err)
}
body, _ := os.ReadFile(filepath.Join(directory, "trace.jsonl"))
if strings.Contains(string(body), "hierarchy") || strings.Contains(string(body), "residuals") {
t.Errorf("empty hierarchy/residuals must omit: %s", body)
}
}
func TestWriteStep_AppendsOneJsonLine(t *testing.T) {
directory := t.TempDir()
writer, err := NewWriter(directory)
if err != nil {
t.Fatal(err)
}
defer writer.Close()
step := Step{
Index: 1,
Timestamp: time.Now().UTC(),
Screen: "customer_ledger",
Snapshots: map[string]json.RawMessage{
"ledger.balance": json.RawMessage(`1500`),
},
NextAction: &Action{Kind: "tap", X: 100, Y: 200},
Violations: []string{"ledgerBalanceMatchesTxns"},
}
if err := writer.WriteStep(step); err != nil {
t.Fatal(err)
}
lines := readLines(t, filepath.Join(directory, "trace.jsonl"))
if len(lines) != 1 {
t.Fatalf("expected 1 line, got %d", len(lines))
}
var got Step
if err := json.Unmarshal([]byte(lines[0]), &got); err != nil {
t.Fatalf("invalid JSONL line: %v\n%s", err, lines[0])
}
if got.Index != 1 || got.Screen != "customer_ledger" || got.NextAction.X != 100 || got.Violations[0] != "ledgerBalanceMatchesTxns" {
t.Errorf("step round-trip wrong: %+v", got)
}
}
// Bug class: a property that first violates at step 0 carries Witness.Step==0,
// which omitempty drops from JSON. Decode must still yield Step 0 (the true
// origin) rather than confusing it with a later step. Also pins that the
// Witnesses/ExtractorChanges/Metrics/Exceptions sidecars survive the round-trip
// rather than silently vanishing on decode.
func TestWriteStep_DiagnosticsRoundTrip(t *testing.T) {
directory := t.TempDir()
writer, _ := NewWriter(directory)
defer writer.Close()
step := Step{
Index: 4,
Witnesses: map[string]Witness{
"balanceNonNegative": {
Reason: "balance went negative",
IsError: true,
Step: 0,
Extractors: map[string]json.RawMessage{
"balance": json.RawMessage(`-5`),
},
},
},
ExtractorChanges: map[string]ExtractorChange{
"balance": {Prev: json.RawMessage(`10`), Curr: json.RawMessage(`-5`)},
},
Metrics: &Metrics{CPUPercent: 12.5, HeapBytes: 4096},
Exceptions: []Exception{{Class: "NullPointerException", Message: "boom"}},
}
if err := writer.WriteStep(step); err != nil {
t.Fatal(err)
}
body, _ := os.ReadFile(filepath.Join(directory, "trace.jsonl"))
if strings.Contains(string(body), `"step":0`) {
t.Errorf("Witness.Step==0 should be omitted from JSON, got: %s", body)
}
var got Step
if err := json.Unmarshal(body, &got); err != nil {
t.Fatalf("bad jsonl: %v\n%s", err, body)
}
w, ok := got.Witnesses["balanceNonNegative"]
if !ok {
t.Fatal("step-0 witness vanished on decode")
}
if w.Step != 0 || w.Reason != "balance went negative" || !w.IsError {
t.Errorf("witness round-trip wrong: %+v", w)
}
if string(w.Extractors["balance"]) != `-5` {
t.Errorf("witness extractors lost: %s", w.Extractors["balance"])
}
if c := got.ExtractorChanges["balance"]; string(c.Prev) != `10` || string(c.Curr) != `-5` {
t.Errorf("extractor change round-trip wrong: %+v", c)
}
if got.Metrics == nil || got.Metrics.CPUPercent != 12.5 || got.Metrics.HeapBytes != 4096 {
t.Errorf("metrics round-trip wrong: %+v", got.Metrics)
}
if len(got.Exceptions) != 1 || got.Exceptions[0].Class != "NullPointerException" {
t.Errorf("exceptions round-trip wrong: %+v", got.Exceptions)
}
}
func TestWriteStep_MultipleStepsAppend(t *testing.T) {
directory := t.TempDir()
writer, err := NewWriter(directory)
if err != nil {
t.Fatal(err)
}
defer writer.Close()
for index := 1; index <= 3; index++ {
if err := writer.WriteStep(Step{Index: index, Screen: "s"}); err != nil {
t.Fatal(err)
}
}
lines := readLines(t, filepath.Join(directory, "trace.jsonl"))
if len(lines) != 3 {
t.Fatalf("expected 3 lines, got %d", len(lines))
}
}
// Bug class: dropping the writer mutex unsynchronizes the w.file field that
// WriteStep reads and Close nils out. Run under -race with WriteStep racing
// Close: a missing mutex is a reported data race on w.file, and any step that
// survives Close must still be a complete, parseable JSONL line.
func TestWriteStep_RacesCloseSafely(t *testing.T) {
directory := t.TempDir()
writer, err := NewWriter(directory)
if err != nil {
t.Fatal(err)
}
const n = 50
var wg sync.WaitGroup
for index := 0; index < n; index++ {
wg.Add(1)
go func(index int) {
defer wg.Done()
// Tolerate "writer is closed": the contract under test is that the
// w.file access is synchronized, not that every write lands.
_ = writer.WriteStep(Step{Index: index, Screen: "s"})
}(index)
}
if err := writer.Close(); err != nil {
t.Fatalf("Close: %v", err)
}
wg.Wait()
for _, line := range readLines(t, filepath.Join(directory, "trace.jsonl")) {
var got Step
if err := json.Unmarshal([]byte(line), &got); err != nil {
t.Fatalf("torn JSONL line: %v\n%s", err, line)
}
}
}
// Grep contract (intentional substring assertion, not a JSON round-trip):
// operators and CI scripts locate failing steps by grepping raw trace.jsonl for
// `"violations":["<prop>"]` without a JSON parser. Bug class: a serialization
// change (whitespace from indenting, renamed/reordered field, pointer slice)
// that keeps the Step parseable but breaks that exact on-disk byte shape would
// silently blind every grep-based tool.
func TestWriteStep_ViolationsAreGreppable(t *testing.T) {
directory := t.TempDir()
writer, _ := NewWriter(directory)
defer writer.Close()
_ = writer.WriteStep(Step{Index: 1})
_ = writer.WriteStep(Step{Index: 2, Violations: []string{"prop1"}})
_ = writer.WriteStep(Step{Index: 3})
body, err := os.ReadFile(filepath.Join(directory, "trace.jsonl"))
if err != nil {
t.Fatal(err)
}
if !strings.Contains(string(body), `"violations":["prop1"]`) {
t.Errorf("violations not in expected JSON shape: %s", body)
}
}
func TestWriteScreenshot_CreatesPaddedFilenames(t *testing.T) {
directory := t.TempDir()
writer, _ := NewWriter(directory)
defer writer.Close()
pngBytes := []byte{0x89, 0x50, 0x4e, 0x47}
if err := writer.WriteScreenshot(7, pngBytes); err != nil {
t.Fatal(err)
}
if err := writer.WriteScreenshot(2024, pngBytes); err != nil {
t.Fatal(err)
}
got, err := os.ReadFile(filepath.Join(directory, "screenshots", "step-00007.png"))
if err != nil {
t.Fatalf("step-00007 missing: %v", err)
}
if string(got) != string(pngBytes) {
t.Errorf("screenshot bytes wrong")
}
if _, err := os.Stat(filepath.Join(directory, "screenshots", "step-02024.png")); err != nil {
t.Errorf("step-02024 missing: %v", err)
}
}
func TestWriteScreenshot_EmptyByteSliceIsNoop(t *testing.T) {
directory := t.TempDir()
writer, _ := NewWriter(directory)
defer writer.Close()
if err := writer.WriteScreenshot(1, nil); err != nil {
t.Fatal(err)
}
if _, err := os.Stat(filepath.Join(directory, "screenshots")); !os.IsNotExist(err) {
t.Errorf("screenshots dir should not exist after empty write")
}
}
func TestWriteAfterClose_Errors(t *testing.T) {
directory := t.TempDir()
writer, _ := NewWriter(directory)
if err := writer.Close(); err != nil {
t.Fatal(err)
}
err := writer.WriteStep(Step{Index: 1})
if err == nil || !strings.Contains(err.Error(), "closed") {
t.Errorf("expected closed-writer error, got %v", err)
}
}
func TestNewWriter_CreatesNestedDirectory(t *testing.T) {
parent := t.TempDir()
target := filepath.Join(parent, "runs", "2026-04-17T22-30-00")
writer, err := NewWriter(target)
if err != nil {
t.Fatal(err)
}
defer writer.Close()
if _, err := os.Stat(target); err != nil {
t.Errorf("nested directory was not created: %v", err)
}
}
func readLines(t *testing.T, path string) []string {
t.Helper()
file, err := os.Open(path)
if err != nil {
t.Fatal(err)
}
defer file.Close()
var lines []string
scanner := bufio.NewScanner(file)
for scanner.Scan() {
lines = append(lines, scanner.Text())
}
if err := scanner.Err(); err != nil {
t.Fatal(err)
}
return lines
}
func TestWriteMeta_ArmMembershipRoundTrip(t *testing.T) {
directory := t.TempDir()
writer, err := NewWriter(directory)
if err != nil {
t.Fatal(err)
}
defer writer.Close()
meta := Meta{
Seed: 7,
SpecPath: "spec.ts",
BundleSHA256: "deadbeef",
Platform: "android",
BundleID: "com.example",
StartedAt: time.Date(2026, 8, 12, 10, 0, 0, 0, time.UTC),
SanderlingVersion: "0.0.1",
Arm: "llm-visible-text",
Generator: "llm",
Model: "claude-sonnet-5",
Instructions: "exercise the outbox",
MaxSteps: 300,
DurationMillis: 180000,
Host: "emulator-farm-01",
}
if err := writer.WriteMeta(meta); err != nil {
t.Fatal(err)
}
body, err := os.ReadFile(filepath.Join(directory, "meta.json"))
if err != nil {
t.Fatal(err)
}
var got Meta
if err := json.Unmarshal(body, &got); err != nil {
t.Fatalf("meta.json is not valid JSON: %v\n%s", err, body)
}
if got != meta {
t.Errorf("meta round-trip mismatch:\n got: %+v\nwant: %+v", got, meta)
}
}
func TestWriteMeta_OmitsArmMembershipWhenUnset(t *testing.T) {
directory := t.TempDir()
writer, err := NewWriter(directory)
if err != nil {
t.Fatal(err)
}
defer writer.Close()
if err := writer.WriteMeta(Meta{Seed: 1, Platform: "web"}); err != nil {
t.Fatal(err)
}
body, err := os.ReadFile(filepath.Join(directory, "meta.json"))
if err != nil {
t.Fatal(err)
}
for _, key := range []string{"arm", "generator", "model", "instructions", "max_steps", "duration_millis", "host"} {
if strings.Contains(string(body), `"`+key+`"`) {
t.Errorf("meta.json carries %q when unset:\n%s", key, body)
}
}
}