nonnative 3.19.0 → 3.22.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 011e40916b32666c33c2a0374ee97c3e96d563cf950f5c68e12b8afa7c18e986
-  data.tar.gz: 7b21a33ad8fc14077751e679b66a14523c79c0783004934f55fa61ea5608e477
+  metadata.gz: 6fa10a31c57c45551a417924990d2d870e137d7561c1581577a6e965099472cc
+  data.tar.gz: dcd07b46e9ce599562c9c0f517ff7b6f46b529dfcf70c8f462cef3fd548704eb
 SHA512:
-  metadata.gz: 0e24fea055ed0e972507bfcb8ebbdf2c604d41e1a6908333a1863f1ba44dd356ea518936d3d6076f73fb37d0c3a9f593b6321ef1392d51d6d1cdf4c145b5ad6d
-  data.tar.gz: ec70302587120b093bb506d5d324821e880b10e406974822f44e1efa7c3fdee29465847eb8f71466ab3806ddd0eb328f2e0788bca28196066c6b3636ce0edb83
+  metadata.gz: cb3cf0ffe148327fb056ad6a16851156b060373d69a06dc13b615197bb6a3aec5cb70faf412c4f31a68f8e92ce297646201fd3151c068758cc22017f5c1a745f
+  data.tar.gz: 8caa697ae5eb5c0b005da119b5ff518f68407c52cf876ca065a522147bc98d3064fff7899e54da1897408b9b963b87124ba1f62fd729913c073e3e1de8016dab

data/README.md

@@ -211,6 +211,15 @@ Nonnative::Token.http_audience('GET', '/v1/things')        # => "GET /v1/things"
 Nonnative::Token.grpc_audience('/health.v1.Health/Check')  # => "/health.v1.Health/Check"
 ```
 
+By default the time claims are pinned to the current time (`iat`/`nbf` at now, `exp` at `now + expiration`). To write negative auth tests, `generate` accepts optional absolute `Time` overrides — `issued_at`, `not_before`, and `expires_at` — for minting not-yet-valid or clock-skewed tokens:
+
+```ruby
+# a token that is not valid until an hour from now
+token.generate(aud: 'GET /v1/things', sub: 'user-1', not_before: Time.now + 3600)
+```
+
+`ssh` tokens have no `nbf` claim, so passing `not_before` for the `ssh` kind raises `ArgumentError`.
+
 ### 🔁 Lifecycle strategies (Cucumber integration)
 
 Nonnative ships Cucumber hooks (when loaded) that support these tags/strategies:
@@ -789,9 +798,10 @@ Clients connect to the service `host`/`port`, while the proxy forwards traffic t
 
 - `close_all` - Closes the socket as soon as it connects.
 - `reset_peer` - Resets the socket as soon as it connects, so clients observe a TCP reset (`Errno::ECONNRESET`) rather than the graceful close performed by `close_all`.
-- `delay` - Delays traffic on the connection. Defaults to 2 seconds and can be configured through options.
+- `delay` - Delays traffic on the connection. Defaults to 2 seconds and can be configured through `options.delay`. An optional `options.jitter` (seconds) adds a random offset in `-jitter..jitter` to each delay (a negative value uses its magnitude), so clients see variable, tail-latency-like timing instead of a flat value.
 - `timeout` - Accepts the connection and stalls traffic until reset or stop closes the connection, so clients exercise their own read timeout behavior.
 - `invalid_data` - Forwards client requests unchanged, then corrupts upstream responses before they reach the client.
+- `bandwidth` - Throttles forwarded throughput to `options.rate` kilobytes per second (1 KB = 1024 bytes) by sleeping in proportion to the bytes read, in both directions, so clients see a slow-but-alive dependency. When `rate` is absent or not positive, traffic forwards at full speed.
 
 ###### 🧩 Fault Injection Services
 

data/lib/nonnative/bandwidth_socket_pair.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Nonnative
+  # Socket-pair variant used by the fault-injection proxy to simulate a bandwidth-limited link.
+  #
+  # When active, each forwarded read is throttled so throughput does not exceed
+  # `proxy.options[:rate]` kilobytes per second (1 KB = 1024 bytes), by sleeping in proportion to the
+  # bytes read. Both directions are throttled, so a client under test sees a slow-but-alive
+  # dependency. When `rate` is absent or not positive the connection forwards at full speed.
+  #
+  # This behavior is enabled by calling {Nonnative::FaultInjectionProxy#bandwidth}.
+  #
+  # @see Nonnative::FaultInjectionProxy
+  # @see Nonnative::SocketPairFactory
+  # @see Nonnative::SocketPair
+  class BandwidthSocketPair < SocketPair
+    # One kilobyte in bytes; `proxy.options[:rate]` is expressed in KB/s.
+    KILOBYTE = 1024
+
+    # Reads from the socket, then sleeps so the forwarded throughput stays within the configured rate.
+    #
+    # @param socket [IO] the socket to read from
+    # @return [String] the bytes read from the socket
+    def read(socket)
+      super.tap { |data| throttle(data.bytesize) }
+    end
+
+    private
+
+    # Sleeps in proportion to the bytes read so throughput does not exceed `rate` KB/s. A missing or
+    # non-positive rate (or an empty read) forwards at full speed.
+    #
+    # @param bytes [Integer] the number of bytes just read
+    # @return [void]
+    def throttle(bytes)
+      rate = proxy.options[:rate]
+      return if rate.nil? || rate <= 0 || bytes.zero?
+
+      sleep(bytes / (rate * KILOBYTE.to_f))
+    end
+  end
+end

data/lib/nonnative/cucumber.rb

@@ -59,6 +59,7 @@ module Nonnative
         'delay' => :delay,
         'timeout' => :timeout,
         'invalid_data' => :invalid_data,
+        'bandwidth' => :bandwidth,
         'reset' => :reset
       }.freeze
 

data/lib/nonnative/delay_socket_pair.rb

@@ -5,7 +5,11 @@ module Nonnative
   #
   # When active, reads from the socket are delayed by a configured duration before being forwarded.
   #
-  # The delay duration is controlled by `proxy.options[:delay]` and defaults to 2 seconds.
+  # The delay duration is controlled by `proxy.options[:delay]` and defaults to 2 seconds. An
+  # optional `proxy.options[:jitter]` (seconds) adds a random offset in `-jitter..jitter` to each
+  # delay so clients see variable, tail-latency-like timing instead of a flat value; a negative
+  # jitter uses its magnitude and the resulting delay is never negative. When `jitter` is absent the
+  # delay is the flat duration.
   #
   # This behavior is enabled by calling {Nonnative::FaultInjectionProxy#delay}.
   #
@@ -20,10 +24,22 @@ module Nonnative
     def read(socket)
       Nonnative.logger.info "delaying socket '#{socket.inspect}' for 'delay' pair"
 
-      duration = proxy.options[:delay] || 2
-      sleep duration
+      sleep delay_duration
 
       super
     end
+
+    private
+
+    # The delay applied before a read, optionally jittered by `proxy.options[:jitter]`.
+    #
+    # @return [Numeric] seconds to sleep (never negative)
+    def delay_duration
+      duration = proxy.options[:delay] || 2
+      jitter = proxy.options[:jitter]&.abs
+      return duration unless jitter
+
+      [duration + rand(-jitter..jitter), 0].max
+    end
   end
 end

data/lib/nonnative/fault_injection_proxy.rb

@@ -14,6 +14,7 @@ module Nonnative
   # - {#delay}: delay reads by a configured duration (default: 2 seconds)
   # - {#timeout}: accept connections and keep them silent until clients time out
   # - {#invalid_data}: forward requests unchanged and mutate upstream responses before they reach clients
+  # - {#bandwidth}: throttle forwarded throughput to a configured rate (KB/s)
   # - {#reset}: return to healthy pass-through behavior
   #
   # State changes terminate any active connections so new connections observe the new behavior.
@@ -33,6 +34,8 @@ module Nonnative
   # - `wait`: sleep interval (seconds) applied after state changes
   # - `options`:
   #   - `delay`: delay duration in seconds used by {#delay}
+  #   - `jitter`: optional random offset (seconds) added in `-jitter..jitter` to each `delay` (a
+  #     negative value uses its magnitude), so clients see variable latency instead of a flat value
   #
   # @see Nonnative::Proxy
   # @see Nonnative::SocketPairFactory
@@ -137,6 +140,16 @@ module Nonnative
       apply_state :invalid_data
     end
 
+    # Throttles forwarded throughput to a configured rate.
+    #
+    # The rate is controlled by `service.proxy.options[:rate]` (kilobytes per second); when it is
+    # absent or not positive the connection forwards at full speed.
+    #
+    # @return [void]
+    def bandwidth
+      apply_state :bandwidth
+    end
+
     # Resets the proxy back to healthy pass-through behavior.
     #
     # @return [void]

data/lib/nonnative/jwt_token.rb

@@ -27,16 +27,19 @@ module Nonnative
     #
     # @param aud [String] the `aud` claim (for example `"GET /v1/things"` or a gRPC full method)
     # @param sub [String] the `sub` claim
+    # @param issued_at [Time, nil] overrides the `iat` claim (default: now)
+    # @param not_before [Time, nil] overrides the `nbf` claim (default: `issued_at`)
+    # @param expires_at [Time, nil] overrides the `exp` claim (default: `issued_at` plus `expiration`)
     # @return [String] the signed JWT
-    def generate(aud:, sub:)
-      now = Time.now.to_i
+    def generate(aud:, sub:, issued_at: nil, not_before: nil, expires_at: nil)
+      now = issued_at || Time.now
       payload = {
         iss: @issuer,
         aud: aud,
         sub: sub,
-        iat: now,
-        nbf: now,
-        exp: now + @expiration,
+        iat: now.to_i,
+        nbf: (not_before || now).to_i,
+        exp: (expires_at || (now + @expiration)).to_i,
         jti: SecureRandom.uuid
       }
 

data/lib/nonnative/paseto_token.rb

@@ -28,18 +28,21 @@ module Nonnative
     #
     # @param aud [String] the `aud` claim (for example `"GET /v1/things"` or a gRPC full method)
     # @param sub [String] the `sub` claim
+    # @param issued_at [Time, nil] overrides the `iat` claim (default: now)
+    # @param not_before [Time, nil] overrides the `nbf` claim (default: `issued_at`)
+    # @param expires_at [Time, nil] overrides the `exp` claim (default: `issued_at` plus `expiration`)
     # @return [String] the signed PASETO token
-    def generate(aud:, sub:)
+    def generate(aud:, sub:, issued_at: nil, not_before: nil, expires_at: nil)
       load_dependencies!
 
-      now = Time.now.utc
+      now = (issued_at || Time.now).utc
       claims = {
         'iss' => @issuer,
         'aud' => aud,
         'sub' => sub,
         'iat' => now.iso8601,
-        'nbf' => now.iso8601,
-        'exp' => (now + @expiration).iso8601,
+        'nbf' => (not_before || now).utc.iso8601,
+        'exp' => (expires_at || (now + @expiration)).utc.iso8601,
         'jti' => SecureRandom.uuid
       }
 

data/lib/nonnative/socket_pair_factory.rb

@@ -13,6 +13,7 @@ module Nonnative
   # - `:delay` -> {Nonnative::DelaySocketPair}
   # - `:timeout` -> {Nonnative::TimeoutSocketPair}
   # - `:invalid_data` -> {Nonnative::InvalidDataSocketPair}
+  # - `:bandwidth` -> {Nonnative::BandwidthSocketPair}
   #
   # @see Nonnative::FaultInjectionProxy
   # @see Nonnative::SocketPair
@@ -21,11 +22,12 @@ module Nonnative
   # @see Nonnative::DelaySocketPair
   # @see Nonnative::TimeoutSocketPair
   # @see Nonnative::InvalidDataSocketPair
+  # @see Nonnative::BandwidthSocketPair
   class SocketPairFactory
     class << self
       # Creates a socket-pair instance for the given proxy state.
       #
-      # @param kind [Symbol] proxy state (e.g. `:none`, `:close_all`, `:reset_peer`, `:delay`, `:timeout`, `:invalid_data`)
+      # @param kind [Symbol] proxy state (e.g. `:none`, `:close_all`, `:reset_peer`, `:delay`, `:timeout`, `:invalid_data`, `:bandwidth`)
       # @param proxy [Nonnative::ConfigurationProxy] proxy configuration (host/port/options)
       # @return [Nonnative::SocketPair] a socket-pair implementation instance
       def create(kind, proxy)
@@ -40,6 +42,8 @@ module Nonnative
                  TimeoutSocketPair
                when :invalid_data
                  InvalidDataSocketPair
+               when :bandwidth
+                 BandwidthSocketPair
                else
                  SocketPair
                end

data/lib/nonnative/ssh_token.rb

@@ -30,18 +30,25 @@ module Nonnative
 
     # Generates a signed SSH token.
     #
+    # SSH tokens carry only `iat`/`exp` (in Unix nanoseconds); there is no `nbf` claim, so
+    # `not_before` is rejected.
+    #
     # @param aud [String] the `aud` claim (for example `"GET /v1/things"` or a gRPC full method)
+    # @param issued_at [Time, nil] overrides the `iat` claim (default: now)
+    # @param expires_at [Time, nil] overrides the `exp` claim (default: `issued_at` plus `expiration`)
+    # @raise [ArgumentError] if `not_before` is given (SSH tokens have no `nbf` claim)
     # @return [String] the token, `"<base64(claims)>.<base64(signature)>"`
-    def generate(aud:, **)
-      now = Time.now
-      issued_at = (now.to_i * 1_000_000_000) + now.nsec
+    def generate(aud:, issued_at: nil, expires_at: nil, not_before: nil, **)
+      raise ArgumentError, "ssh tokens do not support 'not_before' (no nbf claim)" unless not_before.nil?
+
+      iat = nanoseconds(issued_at || Time.now)
       claims = {
         ver: TOKEN_VERSION,
         kid: @key,
         sub: @key,
         aud: aud,
-        iat: issued_at,
-        exp: issued_at + (@expiration * 1_000_000_000)
+        iat: iat,
+        exp: expires_at ? nanoseconds(expires_at) : iat + (@expiration * 1_000_000_000)
       }.to_json
 
       signature = Ed25519::SigningKey.new(seed).sign(claims)
@@ -51,6 +58,10 @@ module Nonnative
 
     private
 
+    def nanoseconds(time)
+      (time.to_i * 1_000_000_000) + time.nsec
+    end
+
     def seed
       SSHData::PrivateKey.parse_openssh(File.read(@private_key)).first.sk[0, 32]
     end

data/lib/nonnative/token.rb

@@ -54,11 +54,20 @@ module Nonnative
 
     # Generates a signed token.
     #
+    # The optional time claims default to the current time (and the constructor `expiration`), so
+    # omitting them reproduces the token's normal claims. Supply them to mint tokens with specific
+    # time claims for negative auth tests, such as a not-yet-valid (future `not_before`) or
+    # clock-skewed token. Times are absolute; the `ssh` kind has no `nbf` claim and rejects
+    # `not_before`.
+    #
     # @param aud [String] the `aud` claim
     # @param sub [String] the `sub` claim
+    # @param issued_at [Time, nil] overrides the `iat` claim (default: now)
+    # @param not_before [Time, nil] overrides the `nbf` claim (default: `issued_at`); unsupported by `ssh`
+    # @param expires_at [Time, nil] overrides the `exp` claim (default: `issued_at` plus `expiration`)
     # @return [String] the signed token
-    def generate(aud:, sub:)
-      @token.generate(aud: aud, sub: sub)
+    def generate(aud:, sub:, issued_at: nil, not_before: nil, expires_at: nil)
+      @token.generate(aud: aud, sub: sub, issued_at: issued_at, not_before: not_before, expires_at: expires_at)
     end
   end
 end

data/lib/nonnative/version.rb

@@ -4,5 +4,5 @@ module Nonnative
   # The current gem version.
   #
   # @return [String]
-  VERSION = '3.19.0'
+  VERSION = '3.22.0'
 end

data/lib/nonnative.rb

@@ -115,6 +115,7 @@ require 'nonnative/reset_peer_socket_pair'
 require 'nonnative/delay_socket_pair'
 require 'nonnative/timeout_socket_pair'
 require 'nonnative/invalid_data_socket_pair'
+require 'nonnative/bandwidth_socket_pair'
 require 'nonnative/socket_pair_factory'
 require 'nonnative/go_executable'
 require 'nonnative/cucumber'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nonnative
 version: !ruby/object:Gem::Version
-  version: 3.19.0
+  version: 3.22.0
 platform: ruby
 authors:
 - Alejandro Falkowski
@@ -391,24 +391,10 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".circleci/config.yml"
-- ".claude/skills"
-- ".codecov.yml"
-- ".config/cucumber.yml"
-- ".editorconfig"
-- ".github/dependabot.yml"
-- ".gitignore"
-- ".gitmodules"
-- ".goreleaser.yml"
-- ".rubocop.yml"
-- AGENTS.md
-- CLAUDE.md
-- Gemfile
-- Gemfile.lock
 - LICENSE
-- Makefile
 - README.md
 - lib/nonnative.rb
+- lib/nonnative/bandwidth_socket_pair.rb
 - lib/nonnative/close_all_socket_pair.rb
 - lib/nonnative/configuration.rb
 - lib/nonnative/configuration_file.rb
@@ -461,7 +447,6 @@ files:
 - lib/nonnative/timeout_socket_pair.rb
 - lib/nonnative/token.rb
 - lib/nonnative/version.rb
-- nonnative.gemspec
 homepage: https://github.com/alexfalkowski/nonnative
 licenses:
 - MIT

data/.circleci/config.yml

@@ -1,97 +0,0 @@
-version: 2.1
-
-commands:
-  sync-submodules:
-    steps:
-      - run: git submodule sync
-      - run: git submodule update --init
-  checkout-submodules:
-    steps:
-      - checkout:
-          method: blobless
-      - sync-submodules
-
-executors:
-  ruby:
-    docker:
-      - image: alexfalkowski/ruby:3.20
-  release:
-    docker:
-      - image: alexfalkowski/release:8.22
-  alpine:
-    docker:
-      - image: alpine:latest
-
-jobs:
-  build:
-    executor: ruby
-    working_directory: ~/nonnative
-    steps:
-      - checkout-submodules
-      - run: make source-key
-      - restore_cache:
-          name: restore deps
-          keys:
-            - nonnative-ruby-cache-{{ checksum "Gemfile.lock" }}-{{ checksum "~/.ruby-version" }}
-            - nonnative-ruby-cache-
-      - run: make dep
-      - run: make clean-dep
-      - save_cache:
-          name: save deps
-          key: nonnative-ruby-cache-{{ checksum "Gemfile.lock" }}-{{ checksum "~/.ruby-version" }}
-          paths:
-            - vendor
-      - run: make lint
-      - run: make sec
-      - run: make features
-      - run: make benchmarks
-      - store_test_results:
-          path: test/reports
-      - store_artifacts:
-          path: test/reports
-      - run: make codecov-upload
-    resource_class: arm.large
-  sync:
-    executor: release
-    working_directory: ~/nonnative
-    steps:
-      - checkout-submodules
-      - run: make sync push
-    resource_class: arm.large
-  version:
-    executor: release
-    working_directory: ~/nonnative
-    steps:
-      - checkout-submodules
-      - run: version
-      - run: package
-    resource_class: arm.large
-  wait-all:
-    executor: alpine
-    resource_class: small
-    steps:
-      - run: echo "all applicable jobs finished"
-
-workflows:
-  nonnative:
-    jobs:
-      - build
-      - sync:
-          requires:
-            - build
-          filters:
-            branches:
-              ignore: master
-      - version:
-          context: gh
-          serial-group: << pipeline.project.slug >>/version
-          requires:
-            - build
-          filters:
-            branches:
-              only: master
-      - wait-all:
-          requires:
-            - build
-            - sync
-            - version

data/.claude/skills

@@ -1 +0,0 @@
-../bin/skills

data/.codecov.yml

@@ -1,6 +0,0 @@
-coverage:
-  precision: 2
-  round: down
-  range: "80...100"
-  status:
-    patch: false

data/.config/cucumber.yml

@@ -1 +0,0 @@
-report: --format junit --out test/reports --format html --out test/reports/index.html --format pretty --publish-quiet

data/.editorconfig

@@ -1,13 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-indent_style = space
-indent_size = 2
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[Makefile]
-indent_style = tab
-indent_size = 8

data/.github/dependabot.yml

@@ -1,20 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "bundler"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    commit-message:
-      prefix: "test"
-      prefix-development: "build"
-      include: "scope"
-  - package-ecosystem: "gitsubmodule"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    commit-message:
-      prefix: "build"
-      prefix-development: "build"
-      include: "scope"
-    allow:
-      - dependency-name: "bin"

data/.gitignore

@@ -1,18 +0,0 @@
-/.bundle/
-.crush/
-.ruby-lsp/
-.source-key
-/.yardoc
-/_yardoc/
-/doc/
-/pkg/
-ISSUES.md
-TESTS.md
-DOCS.md
-FEATURES.md
-PROJECTS.md
-RELIABILITY.md
-test/reports/*
-!test/reports/.keep
-/tmp/
-vendor/

data/.gitmodules

@@ -1,3 +0,0 @@
-[submodule "bin"]
-	path = bin
-	url = git@github.com:alexfalkowski/bin.git

data/.goreleaser.yml

@@ -1,17 +0,0 @@
-version: 2
-
-builds:
-  - skip: true
-
-changelog:
-  sort: asc
-  filters:
-    exclude:
-      - "^chore"
-
-release:
-  footer: >-
-
-    ---
-
-    Released by [GoReleaser](https://github.com/goreleaser/goreleaser).

data/.rubocop.yml

@@ -1,35 +0,0 @@
-AllCops:
-  TargetRubyVersion: 4.0
-  DisplayCopNames: true
-  NewCops: enable
-  Exclude:
-    - "bin/**/*"
-    - "vendor/**/*"
-    - "test/grpc/**/*"
-
-Layout/LineLength:
-  Max: 150
-
-Lint/HashCompareByIdentity:
-  Enabled: false
-
-Metrics/MethodLength:
-  Max: 20
-
-Metrics/BlockLength:
-  Max: 90
-
-Metrics/AbcSize:
-  Max: 25
-
-Metrics/ClassLength:
-  Max: 150
-
-Style/Documentation:
-  Enabled: false
-
-Style/NumericPredicate:
-  Enabled: false
-
-Style/FileOpen:
-  Enabled: false

data/AGENTS.md

@@ -1,208 +0,0 @@
-# AGENTS.md
-
-## Shared guidance
-
-Use `bin/AGENTS.md` for shared skills and cross-repository defaults.
-
-`nonnative` is a Ruby gem for end-to-end testing systems implemented in other
-languages. It starts processes, in-process servers, and proxy-only services,
-waits on TCP readiness/shutdown, and can place fault-injection proxies in front
-of dependencies.
-
-## Map And Commands
-
-- Library: `lib/nonnative/**/*.rb`
-- Cucumber features/support: `features/**/*.feature`, `features/support/**/*.rb`, `features/step_definitions/**/*.rb`
-- Generated gRPC test stubs: `test/grpc/**/*`
-- Test protos: `test/nonnative/v1/*.proto`
-- Build wiring: root `Makefile` includes `bin/build/make/*.mak`
-- Required submodule: `bin/`; missing submodule setup breaks `make`
-- Install deps: `make dep`
-- Lint: `make lint`
-- Security checks: `make sec`
-- Features: `make features`
-- Benchmarks only: `make benchmarks`
-- Cleanup: `make clean-dep`, `make clean-reports`
-
-## Intentional Design Choices
-
-- The configured HTTP proxy feature intentionally uses the external
-  `www.afalkowski.com` host through `features/support/http_proxy_server.rb`.
-  Do not flag this external dependency as a code issue unless the task is
-  explicitly about making HTTP proxy fixtures fully hermetic.
-- `test/Makefile` intentionally consumes the shared Buf make fragment as-is.
-  Do not flag its inherited `breaking` target's `subdir=api` comparison as a
-  code issue unless the task is explicitly about changing test proto breaking
-  checks.
-- `nonnative` is a test-support gem used across many downstream projects.
-  Do not flag the absence of an isolated gem build/install smoke test as a
-  test gap unless the task is explicitly about release packaging or gem
-  publication validation.
-- The Cucumber `@startup` lifecycle tag is exercised by downstream projects
-  that use this gem. Do not flag missing in-repository `@startup` acceptance
-  coverage as a test gap unless the task is explicitly about changing
-  Cucumber startup hook behavior.
-- `Nonnative.go_argv` and `Nonnative.go_command` flag combinations are checked
-  by external/downstream usage. Do not flag missing in-repository exhaustive
-  `-test.*` flag or tool-filtering assertions as a test gap unless the task is
-  explicitly about changing Go command generation.
-- Generated gRPC test stubs under `test/grpc/` are updated on demand when the
-  test proto changes. Do not flag the absence of an automatic generated-stub
-  freshness check as a test gap unless the task is explicitly about changing
-  test proto generation or generated-file validation.
-- Generated gRPC test stubs may carry manual require-path adjustments after
-  generation. Do not treat `make -C test stale` as a required validation target
-  unless the task is explicitly about changing test proto generation; verify
-  the generated Ruby loads before accepting generator-only rewrites.
-- Buf linting for the test-only proto module is intentionally not part of the
-  required local validation surface. Do not flag missing root-level validation
-  for `test/buf.yaml` as a test gap unless the task is explicitly about test
-  proto linting or Buf validation.
-- The public proxy reset Cucumber steps and `@reset` hook are tested by
-  external/downstream suites. Do not flag missing in-repository direct proxy
-  reset step coverage as a test gap unless the task is explicitly about
-  changing proxy reset behavior.
-- `Nonnative.clear` configuration and pool reset behavior is covered by
-  external/downstream suites. Do not flag missing in-repository assertions for
-  configuration or pool clearing as a test gap unless the task is explicitly
-  about changing clear/reset lifecycle behavior.
-- Full repository validation is expected to run both regular features and
-  benchmark-tagged lifecycle scenarios. Do not flag rollback/timeout lifecycle
-  coverage living under `features/benchmark.feature` as a test gap unless the
-  task is explicitly about changing validation target composition.
-- Service proxy round-trip behavior is validated by downstream projects that
-  use `nonnative` against real dependencies. Do not flag the in-repository
-  service proxy success scenario's connection-only assertion as a test gap
-  unless the task is explicitly about changing service proxy forwarding.
-- `Nonnative::FaultInjectionProxy` owns its listener thread and stops it by
-  closing the owned `TCPServer`, which wakes the accept loop before joining the
-  thread. Do not flag the listener `join` as an unbounded reliability gap unless
-  the task is explicitly about proxy shutdown behavior or there is a normal-use
-  reproducer, failing CI evidence, or platform-specific hang evidence.
-- Service readiness is intentionally TCP-only for externally managed
-  dependencies. Do not flag missing HTTP/gRPC service readiness as a feature gap
-  unless the task is explicitly about changing the `Nonnative::Service`
-  readiness model. HTTP/gRPC readiness belongs to managed processes, where the
-  user explicitly models the application health endpoints.
-- Process runners intentionally inherit the parent working directory. Nonnative
-  is normally run from the test folder that owns `test/nonnative.yml`, relative
-  config paths, logs, and reports. Do not flag missing process cwd/chdir support
-  as a feature gap unless the task is explicitly about changing process working
-  directory behavior.
-- Message-specific start/stop assertions and attempted-stop success assertions
-  in `features/step_definitions/lifecycle_steps.rb` are repository-local
-  Cucumber helpers. Do not flag their absence from `lib/nonnative/cucumber.rb`
-  as a feature gap unless downstream usage evidence exists or the task is
-  explicitly about expanding public lifecycle assertion steps.
-- Liveness, readiness, and metrics endpoint assertion steps in
-  `features/step_definitions/servers_steps.rb` are repository-local Cucumber
-  helpers for testing nonnative's own framework assumptions. Do not flag their
-  absence from `lib/nonnative/cucumber.rb` as a feature gap unless downstream
-  usage evidence exists or the task is explicitly about expanding public
-  observability assertion steps.
-- `Nonnative::Configuration` intentionally exposes `process_by_name` without
-  matching `server_by_name` or `service_by_name` helpers. Do not flag missing
-  server/service configuration lookup helpers as a feature gap unless downstream
-  usage evidence exists or the task is explicitly about changing the
-  pre-start configuration lookup API.
-
-## Runtime Model
-
-Public entry point: `lib/nonnative.rb`.
-
-Main API: `configure`, `start`, `stop`, `clear`, `reset`, `pool`,
-`go_argv`, `go_command`, `token`.
-
-Configuration is `Nonnative::Configuration`, built with
-`config.process`, `config.server`, `config.service`, or
-`config.load_file(...)`.
-
-Runners:
-
-- `Nonnative::Process`: OS process
-- `Nonnative::Server`: in-process Ruby server thread
-- `Nonnative::Service`: proxy lifecycle for an externally managed dependency
-
-`Nonnative::Pool` starts services first, then servers/processes, and stops in
-reverse. Readiness and shutdown checks are TCP-only via
-`Nonnative::Port#open?` and `#closed?`.
-
-Token generation: `Nonnative.token(kind:, issuer:, key:, private_key:, expiration:)`
-returns a `Nonnative::Token` whose `generate(aud:, sub:)` produces a signed token for
-authenticating against services under test; it feeds `Nonnative::Header.auth_bearer`.
-Kinds are `jwt` (EdDSA, `kid` header), `paseto` (v4.public, `kid` footer), and `ssh`
-(go-service style raw-Ed25519 `base64(claims).base64(signature)`). All Ed25519 and
-generation-only. `jwt`/`paseto` take a PKCS#8 PEM key; `ssh` takes an OpenSSH-format
-key. PASETO needs system libsodium (via `rbnacl`), required lazily so `require
-'nonnative'` works without it until a PASETO token is generated.
-`Nonnative::Token.http_audience` / `grpc_audience` build the endpoint-scoped `aud`.
-
-## Cucumber Surface
-
-`lib/nonnative/cucumber.rb` is public compatibility surface. Do not remove or
-rename hooks/step text unless the user explicitly requests a breaking change.
-
-Lifecycle tags:
-
-- `@startup`: start before scenario, stop after scenario
-- `@manual`: scenario starts manually, stop after scenario
-- `@clear`: call `Nonnative.clear` before scenario
-- `@reset`: reset proxies after scenario
-
-Suite taxonomy tags: `@acceptance`, `@contract`, `@proxy`, `@config`,
-`@service`, `@benchmark`, `@slow`. `make features` excludes `@benchmark`;
-`make benchmarks` runs only `@benchmark`.
-
-`Nonnative.clear` clears configuration, logger, observability client, and pool.
-`require 'nonnative'` loads Cucumber integration lazily and is safe outside a
-booted Cucumber runtime. For start-once-per-test-run, use
-`require 'nonnative/startup'`.
-
-## Proxy And Config Gotchas
-
-Proxy wiring is the easiest mistake:
-
-- Runner `host` / `port` are client-facing and used for readiness/shutdown
-- For `fault_injection`, nested `proxy.host` / `proxy.port` are the upstream target
-- Clients connect to runner `host` / `port` when a proxy is enabled
-
-Proxy kinds: `none`, `fault_injection`.
-Fault-injection states: `none`, `close_all`, `delay`, `invalid_data`.
-
-Config rules:
-
-- YAML config is loaded as data only via `Nonnative::ConfigurationFile`; ERB is not evaluated and arbitrary Ruby object tags are rejected
-- Runner `host` and nested `proxy.host` default to `127.0.0.1`; use explicit `0.0.0.0` only when external access is intended
-- Process `command` can be a legacy shell string or an argv array; prefer argv arrays for new config, and `go:` config builds argv internally with `Nonnative.go_argv`
-- Use `Nonnative.go_argv` for no-shell Go executable argv entries and `Nonnative.go_command` only when a caller needs Ruby shell-style command string spawning
-- YAML services belong under `services:`, not `processes:`
-- There is no top-level `config.wait`; `wait` is per runner
-- Programmatic service config uses `config.service do |s| ... end`, so use `s.host` / `s.port`
-- Proxy examples need both endpoint sides: runner `host` / `port` for the proxy, nested `proxy.host` / `proxy.port` for upstream
-
-## Fixtures And Limitations
-
-Useful fixtures:
-
-- Process: `features/support/bin/start`
-- HTTP: `features/support/http_server.rb`, `features/support/http_proxy_server.rb`
-- TCP: `features/support/tcp_server.rb`
-- gRPC: `features/support/grpc_server.rb`, generated stubs in `test/grpc/`
-
-Limitations:
-
-- The `grpc` Ruby library uses a global logger; per-server gRPC loggers are not really supported
-- Local Ruby/Bundler mismatches can break native extensions on macOS
-- Coverage and Cucumber reports go under `test/reports`
-- Port checks can be flaky if tests reuse ports unexpectedly
-
-## Look First
-
-- Lifecycle: `lib/nonnative.rb`, `lib/nonnative/pool.rb`
-- Readiness/timeouts: `lib/nonnative/port.rb`, `lib/nonnative/timeout.rb`
-- Process lifecycle: `lib/nonnative/process.rb`
-- Go executable command/argv building: `lib/nonnative/go_executable.rb`
-- Token generation: `lib/nonnative/token.rb`, `lib/nonnative/jwt_token.rb`, `lib/nonnative/paseto_token.rb`, `lib/nonnative/ssh_token.rb`, `lib/nonnative/ed25519_key.rb`
-- Proxies: `lib/nonnative/fault_injection_proxy.rb`, `lib/nonnative/socket_pair_factory.rb`
-- Cucumber: `lib/nonnative/cucumber.rb`, `lib/nonnative/startup.rb`, `features/support/env.rb`
-- Config loading: `lib/nonnative/configuration.rb`, `lib/nonnative/configuration_file.rb`, `lib/nonnative/configuration_runner.rb`, `lib/nonnative/configuration_proxy.rb`

data/CLAUDE.md

@@ -1,4 +0,0 @@
-<!-- BEGIN bin claude-init -->
-@AGENTS.md
-@bin/AGENTS.md
-<!-- END bin claude-init -->

data/Gemfile

@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-source 'https://rubygems.org'
-
-git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
-
-# Specify your gem's dependencies in nonnative.gemspec
-gemspec
-
-gem 'bundler'
-gem 'rubocop'
-gem 'ruby-lsp'
-gem 'simplecov'
-gem 'simplecov-cobertura'

data/Gemfile.lock

@@ -1,232 +0,0 @@
-PATH
-  remote: .
-  specs:
-    nonnative (3.19.0)
-      concurrent-ruby (>= 1, < 2)
-      config (>= 5, < 6)
-      cucumber (>= 7, < 12)
-      cucumber-cucumber-expressions (< 19)
-      ed25519 (>= 1, < 2)
-      get_process_mem (>= 1, < 2)
-      grpc (>= 1, < 2)
-      jwt (>= 3, < 4)
-      jwt-eddsa (>= 0, < 1)
-      puma (>= 7, < 8)
-      rbnacl (>= 7, < 8)
-      rest-client (>= 2, < 3)
-      retriable (>= 3, < 4)
-      rspec-benchmark (>= 0, < 1)
-      rspec-expectations (>= 3, < 4)
-      rspec-wait (>= 1, < 2)
-      ruby-paseto (>= 0, < 1)
-      sinatra (>= 4, < 5)
-      ssh_data (>= 1, < 2)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    ast (2.4.3)
-    base64 (0.3.0)
-    benchmark-malloc (0.2.0)
-    benchmark-perf (0.6.0)
-    benchmark-trend (0.4.0)
-    bigdecimal (4.1.2)
-    builder (3.3.0)
-    concurrent-ruby (1.3.7)
-    config (5.6.1)
-      deep_merge (~> 1.2, >= 1.2.1)
-      ostruct
-    cucumber (11.1.1)
-      base64 (~> 0.2)
-      builder (~> 3.2)
-      cucumber-ci-environment (> 9, < 12)
-      cucumber-core (>= 16.2.0, < 17)
-      cucumber-cucumber-expressions (> 17, < 20)
-      cucumber-html-formatter (> 21, < 24)
-      diff-lcs (~> 1.5)
-      logger (~> 1.6)
-      mini_mime (~> 1.1)
-      multi_test (~> 1.1)
-      sys-uname (~> 1.5)
-    cucumber-ci-environment (11.0.0)
-    cucumber-core (16.2.0)
-      cucumber-gherkin (> 36, < 40)
-      cucumber-messages (> 31, < 33)
-      cucumber-tag-expressions (> 6, < 9)
-    cucumber-cucumber-expressions (18.1.0)
-      bigdecimal
-    cucumber-gherkin (39.1.0)
-      cucumber-messages (>= 31, < 33)
-    cucumber-html-formatter (23.1.0)
-      cucumber-messages (> 23, < 33)
-    cucumber-messages (32.3.1)
-    cucumber-tag-expressions (8.1.0)
-    deep_merge (1.2.2)
-    diff-lcs (1.6.2)
-    docile (1.4.1)
-    domain_name (0.6.20240107)
-    ed25519 (1.4.0)
-    ffi (1.17.4-x86_64-darwin)
-    ffi (1.17.4-x86_64-linux-gnu)
-    get_process_mem (1.0.0)
-      bigdecimal (>= 2.0)
-      ffi (~> 1.0)
-    google-protobuf (4.35.1-x86_64-darwin)
-      bigdecimal
-      rake (~> 13.3)
-    google-protobuf (4.35.1-x86_64-linux-gnu)
-      bigdecimal
-      rake (~> 13.3)
-    googleapis-common-protos-types (1.23.0)
-      google-protobuf (~> 4.26)
-    grpc (1.82.0-x86_64-darwin)
-      google-protobuf (>= 3.25, < 5.0)
-      googleapis-common-protos-types (~> 1.0)
-    grpc (1.82.0-x86_64-linux-gnu)
-      google-protobuf (>= 3.25, < 5.0)
-      googleapis-common-protos-types (~> 1.0)
-    http-accept (1.7.0)
-    http-cookie (1.1.6)
-      domain_name (~> 0.5)
-    json (2.20.0)
-    jwt (3.2.0)
-      base64
-    jwt-eddsa (0.9.0)
-      base64
-      ed25519
-      jwt (>= 2.9.0)
-    language_server-protocol (3.17.0.6)
-    lint_roller (1.1.0)
-    logger (1.7.0)
-    memoist3 (1.0.0)
-    mime-types (3.7.0)
-      logger
-      mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2026.0701)
-    mini_mime (1.1.5)
-    multi_json (1.15.0)
-    multi_test (1.1.0)
-    mustermann (3.1.1)
-    netrc (0.11.0)
-    nio4r (2.7.5)
-    openssl (3.3.3)
-    ostruct (0.6.3)
-    parallel (2.1.0)
-    parser (3.3.11.1)
-      ast (~> 2.4.1)
-      racc
-    prism (1.9.0)
-    puma (7.2.1)
-      nio4r (~> 2.0)
-    racc (1.8.1)
-    rack (3.2.6)
-    rack-protection (4.2.1)
-      base64 (>= 0.1.0)
-      logger (>= 1.6.0)
-      rack (>= 3.0.0, < 4)
-    rack-session (2.1.2)
-      base64 (>= 0.1.0)
-      rack (>= 3.0.0)
-    rainbow (3.1.1)
-    rake (13.4.2)
-    rbnacl (7.1.2)
-      ffi (~> 1)
-    rbs (4.0.3)
-      logger
-      prism (>= 1.6.0)
-      tsort
-    regexp_parser (2.12.0)
-    rest-client (2.1.0)
-      http-accept (>= 1.7.0, < 2.0)
-      http-cookie (>= 1.0.2, < 2.0)
-      mime-types (>= 1.16, < 4.0)
-      netrc (~> 0.8)
-    retriable (3.8.0)
-    rexml (3.4.4)
-    rspec (3.13.2)
-      rspec-core (~> 3.13.0)
-      rspec-expectations (~> 3.13.0)
-      rspec-mocks (~> 3.13.0)
-    rspec-benchmark (0.6.0)
-      benchmark-malloc (~> 0.2)
-      benchmark-perf (~> 0.6)
-      benchmark-trend (~> 0.4)
-      rspec (>= 3.0)
-    rspec-core (3.13.6)
-      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.8)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-support (3.13.7)
-    rspec-wait (1.0.2)
-      rspec (>= 3.4)
-    rubocop (1.88.1)
-      json (~> 2.3)
-      language_server-protocol (~> 3.17.0.2)
-      lint_roller (~> 1.1.0)
-      parallel (>= 1.10)
-      parser (>= 3.3.0.2)
-      rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.49.0, < 2.0)
-      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.50.0)
-      parser (>= 3.3.7.2)
-      prism (~> 1.7)
-    ruby-lsp (0.26.9)
-      language_server-protocol (~> 3.17.0)
-      prism (>= 1.2, < 2.0)
-      rbs (>= 3, < 5)
-    ruby-paseto (0.2.0)
-      multi_json (~> 1.15.0)
-      openssl (~> 3.3)
-      sorbet-runtime
-      zeitwerk
-    ruby-progressbar (1.13.0)
-    simplecov (0.22.0)
-      docile (~> 1.1)
-      simplecov-html (~> 0.11)
-      simplecov_json_formatter (~> 0.1)
-    simplecov-cobertura (3.2.0)
-      rexml
-      simplecov (~> 0.19)
-    simplecov-html (0.13.2)
-    simplecov_json_formatter (0.1.4)
-    sinatra (4.2.1)
-      logger (>= 1.6.0)
-      mustermann (~> 3.0)
-      rack (>= 3.0.0, < 4)
-      rack-protection (= 4.2.1)
-      rack-session (>= 2.0.0, < 3)
-      tilt (~> 2.0)
-    sorbet-runtime (0.6.13323)
-    ssh_data (1.3.0)
-    sys-uname (1.5.1)
-      ffi (~> 1.1)
-      memoist3 (~> 1.0.0)
-    tilt (2.8.0)
-    tsort (0.2.0)
-    unicode-display_width (3.2.0)
-      unicode-emoji (~> 4.1)
-    unicode-emoji (4.2.0)
-    zeitwerk (2.8.2)
-
-PLATFORMS
-  x86_64-darwin-21
-  x86_64-darwin-23
-  x86_64-linux
-
-DEPENDENCIES
-  bundler
-  nonnative!
-  rubocop
-  ruby-lsp
-  simplecov
-  simplecov-cobertura
-
-BUNDLED WITH
-  4.0.11

data/Makefile

@@ -1,4 +0,0 @@
-include bin/build/make/help.mak
-include bin/build/make/ruby.mak
-include bin/build/make/git.mak
-include bin/build/make/claude.mak

data/nonnative.gemspec

@@ -1,46 +0,0 @@
-# frozen_string_literal: true
-
-lib = File.expand_path('lib', __dir__)
-$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-
-require 'nonnative/version'
-
-Gem::Specification.new do |spec|
-  spec.name          = 'nonnative'
-  spec.version       = Nonnative::VERSION
-  spec.authors       = ['Alejandro Falkowski']
-  spec.email         = ['alexrfalkowski@gmail.com']
-
-  spec.summary       = 'Ruby-first end-to-end harness for testing systems implemented in other languages'
-  spec.description   = 'Starts OS processes, in-process Ruby servers, and proxy-only services with TCP readiness checks and fault-injection proxies.'
-  spec.homepage      = 'https://github.com/alexfalkowski/nonnative'
-  spec.license       = 'MIT'
-  spec.files         = Dir.chdir(File.expand_path(__dir__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
-  end
-  spec.bindir        = 'exe'
-  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
-  spec.require_paths = ['lib']
-  spec.required_ruby_version = ['>= 4.0.0', '< 5.0.0']
-  spec.metadata['rubygems_mfa_required'] = 'true'
-
-  spec.add_dependency 'concurrent-ruby', '>= 1', '< 2'
-  spec.add_dependency 'config', '>= 5', '< 6'
-  spec.add_dependency 'cucumber', '>= 7', '< 12'
-  spec.add_dependency 'cucumber-cucumber-expressions', '< 19'
-  spec.add_dependency 'ed25519', '>= 1', '< 2'
-  spec.add_dependency 'get_process_mem', '>= 1', '< 2'
-  spec.add_dependency 'grpc', '>= 1', '< 2'
-  spec.add_dependency 'jwt', '>= 3', '< 4'
-  spec.add_dependency 'jwt-eddsa', '>= 0', '< 1'
-  spec.add_dependency 'puma', '>= 7', '< 8'
-  spec.add_dependency 'rbnacl', '>= 7', '< 8'
-  spec.add_dependency 'rest-client', '>= 2', '< 3'
-  spec.add_dependency 'retriable', '>= 3', '< 4'
-  spec.add_dependency 'rspec-benchmark', '>= 0', '< 1'
-  spec.add_dependency 'rspec-expectations', '>= 3', '< 4'
-  spec.add_dependency 'rspec-wait', '>= 1', '< 2'
-  spec.add_dependency 'ruby-paseto', '>= 0', '< 1'
-  spec.add_dependency 'sinatra', '>= 4', '< 5'
-  spec.add_dependency 'ssh_data', '>= 1', '< 2'
-end