Executing Distributed System Tests

Executing Distributed-System Tests

Pairs with designing-distributed-system-tests. That skill produces

a plan; this skill runs it. The two communicate only through

filesystem artifacts: the plan file in and a session directory

plus findings report out.

The most common failure mode this skill is built to avoid: a run

that produces a green checkmark without anyone having checked

that the workload, the fault, and the oracle each did their job.

The "green-but-broken" checks are not optional.

Process

1. Load the plan

If a plan file path was supplied, read it. If the user described

a plan in conversation, extract the scenario list. If the plan

is missing oracles or per-scenario budget tiers (Smoke / Hardening

/ Release, per the plan template's §7 scenario fields), halt — hand

back to the design skill rather than improvise. Improvising an

oracle in the moment is how green-but-broken results get produced.

2. Discover the SUT toolbox

Search the repo before writing any new code. Look for:

• tools/, scripts/, bin/ — drivers, workload generators,

cluster bring-up scripts

• tests/integration/, tests/stability/, tests/chaos/
• docs/runbooks/, docs/testing/, docs/stability-test-plan.md
• Makefile / justfile / cargo xtask targets that look like

cluster commands

• existing CI definitions that already wire fault-injection

Record what you found in the session log under "Toolbox

discovered". This is required before any scenario runs — it

prevents the skill from re-inventing tools that already exist.

2b. Probe environment capability and guide install if needed

Right after toolbox discovery, before running any scenario, check

that the host can actually run the toolbox you just catalogued.

If the plan has an "Environment requirements" section (the design

skill emits one), treat it as the spec; otherwise infer the list

from the selected techniques and the SUT toolbox.

Ask the user first; do not silently probe. Before running any

which / --version / docker ps checks, list the capabilities

the plan needs and ask the user: "what's available in your

environment, and what would you like me to skip?" Most operators

already know whether they have Docker, sudo for iptables, a Go

toolchain, etc. Asking up front saves a probe round, surfaces

substitution options the operator may know about (e.g. "I have

podman instead of Docker"), and respects their authority over

their own machine. After the user answers, verify with quick

probes and reconcile any gap between what they said and what's

actually present.

Probe categories:

• container runtime (docker / podman + compose)
• language toolchains at the version floors the plan declares
• backend services (Postgres, MinIO / S3-compatible, message brokers)
• fault-injection facilities (iptables, tc/netem, libfaketime,

dm-flakey, Toxiproxy)

• kernel features (network namespaces for asymmetric partition,

cgroups for IO throttling)

• observability stack referenced by the plan

For each capability, produce a row: requirement → present? → version

→ source. Record the full matrix in the session log; the findings

report cites it per scenario.

For missing capabilities, do not silently mark INCONCLUSIVE.

Two cases:

• Trivially installable (a package the user can apt-get install

/ brew install in seconds): surface the install command to the

user with a one-line explanation of what it enables, and offer to

proceed once they've installed (or to install for them if you

have permission and the change is low-blast-radius). Do not run

sudo or system-level installs without explicit user approval.

• Non-trivial to install (requires service setup, license,

admin access, or careful configuration): explain what's missing,

what scenarios depend on it, and what the user would gain by

adding it. Then ask whether to (a) wait while they set it up,

(b) proceed and mark dependent scenarios INCONCLUSIVE, or (c)

substitute a degraded approximation (and document the

substitution honestly in the findings).

Either way, INCONCLUSIVE is only the right verdict after the user

has been told what's missing and either declined to install it or

the install is genuinely out of reach. "Tried to run and silently

no-opped" remains forbidden.

3. Establish a session directory

Create:

{{session_root}}/{{plan_slug}}/{{UTC_timestamp}}/
├── logs/
├── metrics/
├── artifacts/
└── findings/

Default session_root is ./test-sessions/ in the SUT repo, or

./test-sessions/ in the current working directory if the user

prefers not to write into the SUT repo. If the caller specified an

output root in the request (e.g. "produce a session directory and

findings report under /path/X/"), honor that path instead of the

default — do not silently relocate output. Place a copy of assets/session-log-template.md at

session-log.md inside this directory and fill in the header.

3b. Author mode (opt-in)

By default the execute skill runs scenarios against the SUT's

existing test infrastructure plus an ephemeral sibling-package

harness under {{session_dir}}/artifacts/harness/. Nothing is

written into the SUT repo.

When the operator explicitly asks for author mode (typically

"author the tests" or "fill the skeletons" in the prompt, or

DIST_TEST_AUTHOR_MODE=1), the skill **writes the scenario

skeletons into the SUT repo** at the Target test file paths

declared in the plan's §7. This is the only sanctioned exception

to the project-autonomy rule.

In author mode:

• Pre-flight diff scan. For each scenario, check if its

Target test file already exists. If yes, show the operator

the existing file and ask whether to overwrite, skip, or

regenerate as a sibling (<path>.new.rs etc.). Never silently

overwrite operator-authored tests.

• Write the skeleton. Drop the Skeleton from the plan to

the Target test file path. Verify the AUTO-GENERATED

header is present; refuse to write a skeleton missing the

header. Run the SUT's formatter (cargo fmt, gofmt, black,

…) on the new file.

• Fill the TODOs. Expand the workload / faults / oracle

TODO regions from the plan's prose. Use the SUT's existing

test fixtures and patterns wherever possible — read at least

one sibling test file in the same directory before writing,

to match the codebase's idioms.

• Compile + run. Build the SUT's test binary (e.g.

cargo test --no-run -p <crate>) to catch compile errors

before running. Then run the test, capture verdict + oracle

execution evidence as usual.

• Stage, do not commit. The skill MUST NOT git commit

the generated tests. Surface the diff to the operator and let

them review + commit. Author mode produces candidate tests,

not approved tests.

• Provenance. Every auto-written file's header carries the

plan path, the scenario id, and the sha of the plan at

generation time. Reviewers can diff prose changes against

test changes; if the plan's prose drifts from the test, the

sha mismatch surfaces.

If a scenario has no Target test file or Skeleton in the

plan, author mode is impossible for it — surface that explicitly

to the operator and fall back to ephemeral-harness execution

for that scenario.

4. Run scenarios in plan order

Checkpoint discipline for long-running scenarios. Distributed

test runs routinely involve commands that stay silent for minutes

to hours: cold cargo builds, docker compose up, multi-node smoke

runs, sustained workload generators. Subagent harnesses and CI

runners commonly have watchdogs that kill a task after 5–10 minutes

of silence on its tool stream. To keep the watchdog fed and to

give the operator visible progress:

• Before starting any command expected to run longer than ~3 minutes,

append a one-line "starting" entry to session-log.md (scenario id,

command, expected duration). After it finishes, append the result

line with elapsed time.

• For commands that take >5 minutes, prefer Bash with

run_in_background: true plus periodic status pulls (tail the

output file, docker compose ps, curl a health endpoint) every

60–120 seconds rather than blocking on a single foreground call.

• Never let a single foreground command exceed the harness watchdog

budget. If a build or run genuinely needs that long, split it

(warm a cache first, then time the actual scenario).

• Each scenario writes its own per-scenario findings file as it

goes, not only at the end. Partial findings beat a missing report

when a scenario times out or the agent is killed mid-run.

For each scenario:

• Preconditions check. Cluster up cleanly, observability

live, baseline metric captured, fault plane responsive.

• Start workload using the discovered driver.
• Inject fault per the plan schedule.
• Capture evidence the fault landed. The plan's §7.M

Nemesis + landing evidence field declares which observable

signal proves the fault landed (counter, RPC timeout pattern,

log marker, partition-status metric). Capture *that* signal,

not a generic one. If the signal is absent or ambiguous, the

scenario verdict is INCONCLUSIVE-fault-not-proven (see

references/verdict-taxonomy.md) — never PASS.

For non-serious scenarios that did not declare §7.M (no gated

claim category), capture a best-effort generic landing signal

from the appropriate row of references/fault-injection-howto.md.

• Stop / quiesce and collect.
• Apply oracle — read references/oracle-patterns.md for

the right one if the plan didn't fully specify.

• Record the verdict with the actual oracle execution evidence.

The verdict is one of the ten states defined in

references/verdict-taxonomy.md: PASS-smoke, PASS-hardening,

FAIL-reproducible, FAIL-nondeterministic, INCONCLUSIVE-env,

INCONCLUSIVE-oracle-too-weak, INCONCLUSIVE-fault-not-proven,

PARTIAL-surface, PARTIAL-model, NOT-RUN. Apply the decision tree in

that file to assign the verdict; do not free-form. Record the verdict

together with the oracle execution evidence (op count consumed,

anomalies found) and the §7.M nemesis landing signal — both are

required for any PASS-hardening claim.

Per-arm execution for boundary and fairness scenarios. When the

plan's §7.M.S block declares scenario arms (e.g., S5/api,

S5/sdk, S5/export, S5/admin):

• Run each arm as a separate scenario, in plan order. Log entries

are tagged with the arm id, not the parent scenario id.

• Apply the 10-state decision tree per arm — each arm earns its own

verdict independently. Arms that the session never reaches earn

NOT-RUN (the 10th state added by this iteration; see

references/verdict-taxonomy.md).

• After all arms are scored, compute the scenario-level aggregate

verdict via the downgrade rule: any NOT-RUN or PARTIAL-* arm

caps the scenario-level verdict at PARTIAL-surface, regardless

of which arms passed.

• Record both the per-arm verdicts and the aggregate in the

findings report's Scenario results table and Surface coverage

table.

Budget-tier verdict gating. PASS-* verdicts require the run to

have actually met the corresponding budget tier declared in the

plan, not just produced a clean oracle output:

• Run met only the smoke budget → at best PASS-smoke, never

PASS-hardening.

• Run met the hardening budget → eligible for PASS-hardening.
• Run met the release budget → eligible for the release-tier

verdict (currently expressed as PASS-hardening with a release

annotation; a future iteration may introduce a dedicated state).

Record the budget tier actually met alongside the verdict in the

session log so the findings report can confirm the verdict is

defensible.

5. On failure: capture before moving on

Do not run the next scenario before recording:

• Reproducer (apply references/test-case-reduction.md).
• Reduction classification (SUT / harness / checker /

environment, per the "Classify blame before filing" section of

references/test-case-reduction.md). Required before filing.

"Unknown — pending re-run on alternative harness/host" is

acceptable as an interim value; a wrong guess is not.

• TaxDC classification (references/finding-classification.md,

bug type — orthogonal to the reduction classification above).

• Evidence (log excerpts, op history files, metric snapshots).
• Hypothesised root cause and owning subsystem.
• Suggested next action.

6. Apply green-but-broken checks AND the weak-oracle audit

Before declaring any scenario PASS, run both checklists in

references/green-but-broken-red-flags.md:

• The numbered "red-flag" checks (1–10) — guards against tests

that never ran.

• The "Weak oracles — do not trust these alone" section — guards

against tests that ran but whose oracle could not distinguish

PASS from FAIL.

Record the result of each check in the findings report's

green-but-broken section. A serious scenario (one with §7.M filled)

cannot be marked PASS-hardening if any weak-oracle check is

unchecked; downgrade to PARTIAL-surface or PARTIAL-model per

references/verdict-taxonomy.md.

7. Write the findings report

Copy assets/findings-report-template.md to

{{session_dir}}/findings/report.md (or to the caller's

specified location if they asked for one). Lead with the headline

result. Cover every plan hypothesis in the coverage section,

even the ones not exercised — those are gaps worth naming.

INCONCLUSIVE is a first-class verdict, not a soft failure.

Scenarios blocked by missing tooling, missing test-only plan

prerequisites (a flag the workload doesn't have, a span

attribute that hasn't been added, a proptest module that doesn't

exist yet), or environment limits get the INCONCLUSIVE label

with a single-line reason — never a silent PASS, never a

report-wide BLOCKED unless literally nothing ran.

A scenario can have multiple arms with different verdicts —

e.g. an in-process driver that PASSed and an external driver

that was INCONCLUSIVE. Record each arm on its own row in the

scenario table and split the finding accordingly.

The findings report must close the adequacy loop. The plan's

§7b ("Coverage adequacy argument") and §7d ("Confidence statement")

committed to specific claim→threat→scenario mappings and a

confidence verdict. The report must include:

• Surface coverage — for scenarios with §7.M.S arms in the plan,

list planned vs executed surfaces per arm with verdict and

downgrade reason. The aggregate row applies the downgrade rule:

any NOT-RUN or PARTIAL-* arm caps the scenario at

PARTIAL-surface. Render as "No boundary or fairness scenarios in

this plan" if §7.M.S was never declared.

• Release-budget disclosures — lift every "Release budget: not

provided — <reason>. Revisit when: <…>." declaration from the plan

verbatim. Surfaces production-readiness gaps the run cannot close

on its own. Render as "All scenarios declared a concrete release

budget" if none of the plan's scenarios used the "not provided"

template.

• Adequacy assessment vs plan — row per claim showing what

the plan argued for vs what actually ran. INCONCLUSIVE scenarios

shrink the adequacy of their claims; surface those gaps.

• Confidence delta — what should the reviewer believe MORE /

LESS / UNCHANGED after this run, compared to the plan's §7d.

Without these sections, the report tells the reviewer what passed

but not whether to ship. A list of verdicts is not a confidence

verdict.

Session-level verdict. Set the headline session verdict by

the strongest evidence found, not by counting. Every per-scenario

verdict maps into one of five session values:

• Any FAIL with a reproducer → session is FAIL (lead with the

finding, even if most scenarios were INCONCLUSIVE).

• No FAIL, at least one PASS-smoke/PASS-hardening with cited

evidence → session is DONE if every other scenario also PASSed

clean; DONE_WITH_CONCERNS if any scenario was INCONCLUSIVE-*,

PARTIAL-surface, PARTIAL-model, or NOT-RUN. Treat PARTIAL-* and

NOT-RUN as concerns, never as clean passes.

• No PASS and no FAIL, but at least one scenario produced signal

(INCONCLUSIVE-* or PARTIAL-*) → session is INCONCLUSIVE.

• Nothing ran at all — every scenario NOT-RUN, or couldn't load

the plan / reach the SUT → session is BLOCKED.

A high INCONCLUSIVE fraction is not by itself a problem if each

INCONCLUSIVE has an honest single-line reason; it just means the

plan needs an environment the operator didn't have.

Writing the report file. Some harnesses (subagent sandboxes

in various agent runtimes, restricted CI runners) block writing

arbitrary .md files under output directories. If your write is

refused, return the full report content as text and surface the

restriction explicitly so the caller can save it — do not skip

producing the artifact, and do not pretend it was written.

Project autonomy

This skill does not modify SUT source files in default mode.

It may create scripts inside the session directory and may add

a single new file docs/testing-plans/<slug>.md only if the

user explicitly asks the design skill to write there. Everything

else lives under {{session_root}}.

Author mode is the sanctioned exception. When the operator

explicitly opts into author mode (see step 3b), the skill may

write to the Target test file paths declared in the plan's §7

— and ONLY those paths. Any write outside a declared target

path is forbidden, in any mode. Author mode does not git commit;

all generated tests are staged for operator review.

Sibling-package harness is in bounds. When in-process tests

need to call into the SUT's libraries (a Rust integration test

against a SUT crate, a Go test importing a SUT module, a Python

test importing a SUT package), create a standalone package under

{{session_dir}}/artifacts/harness/ that depends on the SUT by

path. This is in bounds. What is NOT in bounds: adding files

under the SUT's own tests/ directory or modifying the SUT's

manifest (Cargo.toml, go.mod, package.json, pyproject.toml,

pom.xml, etc.). The distinction matters because the latter

would land in the SUT's repo if committed.

Reference files

• references/oracle-patterns.md — start here when an oracle

needs picking

• references/fault-injection-howto.md — concrete mechanisms per

fault type

• references/test-case-reduction.md — minimize a failing

reproducer

• references/finding-classification.md — TaxDC-derived labels
• references/green-but-broken-red-flags.md — non-optional

pre-PASS checklist

• references/verdict-taxonomy.md — the ten verdict states and the

decision tree for assigning one at run end

• references/boundary-and-isolation-testing.md (lives in the

design skill; named here for cross-reference) — surface catalogs

and the downgrade rule the execute skill applies to per-arm

verdicts for {boundary, fairness} scenarios

Assets

• assets/session-log-template.md
• assets/findings-report-template.md