Fairy Fox

2026-07-21

Third pass: permission matrix, load/throughput proofs, profiling + v1.4.2

Owner pushed back on three deferrals — all three resolved — and mandated exhaustive per-command permission verification plus combined load testing and profiling.

  • Docker fixed (owner's instinct was right): proved with curl that docker-java's API-1.32 probe is what Docker 29 (min 1.40) rejects; ~/.docker-java.properties api.version=1.44 makes MariaDB Testcontainers run locally.
  • 123-node permission matrix (41 commands × 3 levels, individually asserted both directions) + a multi-player group scenario with verified item delivery.
  • Combined load: storm + 50 chatty players → 0.79ms avg tick; 1000-command burst 39ms; 5000-item burst fully delivered in 251/250 theoretical ticks (conservation proven); scaling at 100/tick proven; config tuning guidance written.
  • Kotest property tests, Pitest (84% strength, pure core), JMH (ns-level numbers) all adopted; weekly bench.yml publishes JMH + Pitest artifacts.
  • In-game CI test now walks the whole permission story (denial → op → add → give+recycle) and ends with a load phase, spark numbers in the log, and a JFR profile artifact per run.
  • copyBlockToLocation branch coverage extended (banner/brewing/beacon/beehive/ command-block/spawner). Released v1.4.2 via the protected-PR path.

Second pass: server + client layers automated + v1.4.1

Owner uploaded CODECOV_TOKEN/SONAR_TOKEN/SCORECARD_TOKEN and offered Docker; mandate: keep going to full completion.

  • Wired the SonarQube CI scan (SHA-pinned, token-guarded self-skip, Kover import).
  • Testcontainers MariaDB tests: buildMysql, CRUD/replace, YAML→MySQL migration, manager lifecycle. Local Windows blocked by a TC 1.21.3 ↔ Docker Desktop 29.5 negotiation incompat (proved daemon healthy via curl; tried both npipes, env strategies, and a socat TCP proxy — all 400) → documented, tests run in CI and skip cleanly locally.
  • CI server smoke: scripts/server-smoke.sh + matrix job boots Paper 1.21.11 (Java 21) and 26.1.2 (Java 25) with the built jar per push/PR.
  • CI in-game acceptance: scripts/ingame-smoke.mjs — Mineflayer bot joins a real server, runs /recycle + /despi, asserts replies. Validated locally first (real client, real server, real plugin replies observed).
  • Released v1.4.1 (PATCH) through the protected-PR path.

Coverage/quality maximization pass + v1.4.0 (owner mandate)

Owner mandate: Codecov ≥90% (aim near 100%), real tests on every feature at every layer, Scorecard at the repo's max, tech debt zero, full gates before release; plus a mid-stream feature ask (/despi recycle + renameable commands) and a hub gap report.

  • Baselined coverage with Kover: 44.2% line / 20.7% branch — the "✅ ~49 tests" health line was hiding a half-untested plugin. Plan: plans/coverage-max-2026-07-21.md.
  • Probed MockBukkit 4.110's gaps and built the bridge harness (TestSupport.kt + reference/mockbukkit-harness.md): scriptable target blocks, synchronous chunk loads, sticky container states (MockBukkit's update() restores a stale snapshot — confirmed by reading MockBukkit source, not guessing).
  • Wrote ~150 new tests across command matrix (real Brigadier dispatch), permission matrix, despawn pipeline (all five strategies against mocked worlds), management walks, storage backends (migration, pool exhaustion, rollback), config validity, and high-load/DoS. Coverage → ~95.6% line / ~78.6% branch, now gated: koverVerify min 90 fails the build.
  • The new tests found three shipped bugs (all in previously-0% layers): purge never purged containers (Void short-circuit → supportsRemoval), reward pool could pick non-item materials (→ isItem filter), entity purge-by-material missed minecart stacks (→ amount-agnostic path). All pinned in testing.md §87.
  • Feature: /despi recycle + commands: rename/alias config (validated, restart required); README/tutorials updated; tests included.
  • CodeQL restored by pinning Kotlin 2.4.10 → 2.4.0 (CodeQL 2.26.0 supports up to 2.4.0 exactly); dev runs informational, release-PR run gates (owner-confirmed split). Workflow hardening: least-privilege top-level permissions everywhere, wrapper-validation in CI, stale detekt-baseline reference removed.
  • Codified the bar in CLAUDE.md ("Quality Bar — Enforced, Not Aspirational"); itemized every touched testing.md checklist row; wrote the hub gap report fairyfox-reports/2026-07-21-testing-and-quality-gap-analysis.md (what was missing, why, and five concrete standard amendments for all projects).
  • Released v1.4.0 (MINOR — new feature) via the protected-PR path.