Phase 0 conformance harness, and close the query-concurrency gap

[mo4islona]

Builds Phase 0 of the conformance program from spec/13's build order — the harness stubs, the structural validators, deterministic seeding, and one end-to-end smoke — then uses it to close the first P0 gap in the register.

Follows #63, which landed the spec suite itself.

Phase 0 harness

tests/harness/ implements HC-1/2/3/5/8/12:

HC-1 scheduler.rs	Network-state JSON + gzipped FlatBuffers assignment over HTTP, built with the real sqd-assignments builder (crypto-box headers included)
HC-2 origin.rs	Chunk files over HTTP with a byte ledger + injectors (delay, stall, status, corrupt, truncate)
HC-3 portal.rs	Seeded keys, genuinely signed queries, per-field deviation knobs
HC-8 registry.rs	Programmable sqd_contract_client::Client — epoch advance, allocation change, read failure
HC-5 validators.rs	Query-response, log-page and status validators
HC-12 seed.rs + corpus.rs	Labelled RNG streams off one root seed, printed on panic; chunks generated, not checked in

Test binaries are one per subject: e2e (assign → download → query → verify → logs pull), query_surface (RP-10/RP-20/RP-1 outcomes), query_concurrency (separate by necessity — the OB signals are process-global, so a gauge assertion can't share a process with other query-running tests).

The crate gains a library target: an integration tier can't reach a binary-only crate, and MG-4 wants the conformance subset timed as its own CI job rather than buried in the unit-test run.

What it does not cover

The input side (IB-40/41/42/43/44) is genuinely black-box over HTTP, but the query side enters below the transport at p2p::{validate_query, execute, build_delivery, build_log}. So IB-1/2 and the P2PController intake — queue capacity, reject fan-out, the assignment pending queue — are not under test. That's recorded in harness::UNCOVERED and in a new "SUT boundary, as built" note in spec/13, and declared_gaps_cite_the_spec enforces that every such declaration names a real spec identifier.

GAP-1 closed

run_query bound its scopeguard to _, so the guard dropped at the end of its own let statement rather than at the end of the function. The slot was released before the query ran: max_parallel_queries was unenforced (the real ceiling was the transport's message-handler product) and the running-query gauge fell back to zero as fast as it rose, so overload was invisible in metrics as well as unbounded in fact.

Test landed first and was checked both ways — fails on the defect, passes on the fix, and stable over 10 consecutive runs. The register row is gone; RP-4, REQ-22, INV-31 and PF-1 no longer carry the exception, and P-Q-PAR reads observed-enforced in spec/15.

Two incidental fixes

• src/cli.rs — sentry_is_enabled is declared positional (like its env-only siblings) but a bare bool defaults to a flag action, which clap rejects for positionals. Every debug-build invocation aborted, --help included. Release compiled the assert out, which is why it survived.
• .gitattributes — the repo never had one. LFS was configured and the index held correct pointers, but nothing routed *.parquet through the filter, so git compared 356 MB of smudged content against 131-byte pointers and called tests/data permanently modified — one git add -A from inlining all of it. Stored oids match the working tree exactly, so declaring the filter reconciles the tree without touching the data.

Also included

The freshness-attribution spec work: a rejection whose reference input is the worker's own clock is a worker fault, not a client one (ADR-20, INV-26, FM-55, GAP-33).

Verification

47 tests across 4 binaries, zero ignored. cargo test --all-features, cargo fmt --check, clippy at the CI deny level, and spec/tools/check_spec.py all clean.

Next

GAP-2 (externally supplied content can terminate the process) and GAP-3 (no reconciliation deletion floor) remain open at P0. Their HC-1 fault knobs — UnparseableFileUrl, NoChunksForWorker — exist, but no tests drive them yet.

🤖 Generated with Claude Code