tep 0.11.3 → 0.11.5

data/lib/tep.rb

@@ -36,7 +36,7 @@ if defined?(RUBY_ENGINE)
 end
 
 require_relative "tep/version"
-require_relative "tep/url"
+require_relative "spinel_kit/url"
 require_relative "tep/multipart"
 require_relative "tep/net"
 require_relative "tep/agent_delegation"
@@ -59,7 +59,7 @@ require_relative "tep/router"
 require_relative "tep/app"
 # Auth provider classes land after App so Tep::AuthFilter < Tep::Filter
 # resolves and the install! helper can reach Tep::APP. References to
-# Tep::Jwt / Tep::Json inside their method bodies resolve at runtime.
+# Tep::Jwt / SpinelKit::Json inside their method bodies resolve at runtime.
 require_relative "tep/auth_bearer_token"
 require_relative "tep/auth_session_cookie"
 require_relative "tep/auth_oauth2"
@@ -70,10 +70,14 @@ require_relative "tep/live_view"
 require_relative "tep/server"
 require_relative "tep/server_scheduled"
 require_relative "tep/sqlite"
-require_relative "tep/pg"
-require_relative "tep/json"
+# tep/pg is OPT-IN (#216): NOT required here. An app that needs
+# PostgreSQL does `require "tep/pg"`, which bin/tep splices in at build
+# time (and the test suite requires explicitly). Keeping it out of the
+# core require tree is what lets a non-PG app DCE the libpq closure.
+require_relative "spinel_kit/json"
+require_relative "spinel_kit/json_decoder"
 require_relative "tep/mcp"
-require_relative "tep/logger"
+require_relative "spinel_kit/log"
 require_relative "tep/jwt"
 require_relative "tep/password"
 require_relative "tep/security"
@@ -212,13 +216,7 @@ module Tep
   APP.set_after(Filter.new)
   APP.set_auth_filter(Filter.new)
   APP.set_auth_bearer_secret("")
-  # Broadcast PG-backend setter seeds. enable_pg_backend reaches
-  # these via set_broadcast_pg_conn / _channel / _enabled when a
-  # connect succeeds; the empty-conninfo seed below short-circuits
-  # before getting there, so we exercise the setters directly.
-  APP.set_broadcast_pg_enabled(0)
-  APP.set_broadcast_pg_channel("")
-  APP.set_broadcast_pg_conn(PG::Connection.new(""))
+  # (broadcast_pg setter seeds relocated to lib/tep/pg.rb -- #216)
   APP.set_not_found(Handler.new)
   # Type-seeding: methods that may not be called by a given user app
   # would otherwise default their param C types to mrb_int and
@@ -274,19 +272,10 @@ module Tep
   Tep::Broadcast.subscriber_count
   Tep::Broadcast.clear
 
-  # Broadcast PG-backend seeds. enable_pg_backend("", "") tries to
-  # open a PG connection -- empty conninfo behaves the same as the
-  # PG::Connection.new("") seed above: connect fails, returns -1.
-  # The point is to pin parameter types on every cmeth.
-  Tep::Broadcast.enable_pg_backend("", "")
-  Tep::Broadcast.poll_pg_once(0)
-  Tep::Broadcast.disable_pg_backend
-  Tep::Broadcast.encode_wire("", "")
-  Tep::Broadcast.deliver_wire_local("0:")
   Tep::Broadcast.publish_local_only("_seed", "")
-  # The new PG::Connection LISTEN/NOTIFY method seeds live further
-  # down with the rest of the PG seeds, where _tep_seed_pg_conn is
-  # already defined.
+  # (Broadcast PG-backend seeds -- enable_pg_backend / poll_pg_once /
+  # disable_pg_backend / encode_wire / deliver_wire_local -- relocated
+  # to lib/tep/pg.rb, #216.)
 
   # Presence type-seeding. Same pattern as Broadcast: pin every
   # cmeth's param C types so compile units that don't otherwise
@@ -316,25 +305,10 @@ module Tep
   Tep::Presence.encode_diff("join", _tep_seed_presence_entry)
   Tep::Presence.publish_diff("join", _tep_seed_presence_entry)
   Tep::Presence.sweep_expired_status
-  # PG mirror seeds (chunk 3.3). enable_pg_mirror("") fails the
-  # connect cleanly (-1) but still pins param types.
-  Tep::Presence.enable_pg_mirror("")
-  Tep::Presence.schema_sql
-  Tep::Presence.mirror_insert(_tep_seed_presence_entry)
-  Tep::Presence.mirror_delete("_seed", -1)
-  Tep::Presence.mirror_status("_seed", -1, :available, "", 0)
-  Tep::Presence.list_global("_seed")
-  Tep::Presence.count_global("_seed")
-  Tep::Presence.worker_schema_sql
-  Tep::Presence.heartbeat
-  Tep::Presence.prune_stale_workers(90)
-  Tep::Presence.disable_pg_mirror
-  # Same APP-setter-via-constant pattern as the broadcast_pg_conn
-  # seed: PG::Connection.new can't run inside App#initialize
-  # (Tep::APP is mid-construction; sched_current read segfaults).
-  APP.set_presence_pg_enabled(0)
-  APP.set_presence_pg_worker_id("")
-  APP.set_presence_pg_conn(PG::Connection.new(""))
+  # (Presence PG mirror seeds + presence_pg setter seeds relocated to
+  # lib/tep/pg.rb -- #216. The core mirror_insert/delete/status no-op
+  # stubs are already seeded by the track/set_status/untrack calls
+  # above.)
 
   # LiveView type-seeding (chunk 4.1). The render_page + dispatch_event
   # cmeths get pinned via top-level calls; the base-class mount /
@@ -386,94 +360,31 @@ module Tep
     _tep_seed_db.close
   end
 
-  # PG type-seeding. PG::Connection.new("") returns a connection-
-  # failed instance (@pgh=-1) rather than raising, so this is safe
-  # at module load regardless of whether libpq has a reachable
-  # server. The point is to pin parameter / return types on every
-  # public Connection / Result method so apps that don't exercise
-  # one method still compile cleanly.
-  _tep_seed_pg_conn = PG::Connection.new("")
-  _tep_seed_pg_conn.connected?
-  _tep_seed_pg_conn.status
-  _tep_seed_pg_conn.transaction_status
-  _tep_seed_pg_conn.server_version
-  _tep_seed_pg_conn.error_message
-  _tep_seed_pg_conn.escape_string("")
-  _tep_seed_pg_conn.escape_identifier("")
-  _tep_seed_pg_conn.escape_literal("")
-  _tep_seed_pg_conn.last_sqlstate = ""
-  _tep_seed_pg_conn.last_error_message = ""
-  _tep_seed_pg_conn.last_result_rh = -1
-  # Async surface seed -- calling these on a failed-conn instance
-  # is harmless (the C shim short-circuits on conn slot < 1).
-  _tep_seed_pg_conn.async_exec("")
-  _tep_seed_pg_seed_arr = [""]
-  _tep_seed_pg_seed_arr.delete_at(0)
-  _tep_seed_pg_conn.async_exec_params("", _tep_seed_pg_seed_arr)
-  # Async connect cmeth. Returns -1 for empty conninfo from a
-  # non-scheduled context (the shim's PQconnectStart-then-FAILED
-  # path), which is type-equivalent to the success path.
-  PG::Connection.async_connect("")
-  # LISTEN / NOTIFY surface (Tep::Broadcast PG backend lands here).
-  _tep_seed_pg_conn.listen("_seed")
-  _tep_seed_pg_conn.unlisten("_seed")
-  _tep_seed_pg_conn.notify("_seed", "")
-  _tep_seed_pg_conn.poll_notification(0)
-  _tep_seed_pg_conn.last_notify_channel
-  _tep_seed_pg_conn.last_notify_payload
-  _tep_seed_pg_res = PG::Result.new(-1)
-  _tep_seed_pg_res.ntuples
-  _tep_seed_pg_res.nfields
-  _tep_seed_pg_res.fname(0)
-  _tep_seed_pg_res.fnumber("")
-  _tep_seed_pg_res.ftype(0)
-  _tep_seed_pg_res.fformat(0)
-  _tep_seed_pg_res.fmod(0)
-  _tep_seed_pg_res.getvalue(0, 0)
-  _tep_seed_pg_res.getisnull(0, 0)
-  _tep_seed_pg_res.getlength(0, 0)
-  _tep_seed_pg_res.value(0, 0)
-  _tep_seed_pg_res.error_field(67)
-  _tep_seed_pg_res.cmd_status
-  _tep_seed_pg_res.cmd_tuples
-  _tep_seed_pg_res.error_message
-  _tep_seed_pg_res.sql_state
-  _tep_seed_pg_res.fields
-  _tep_seed_pg_res.values
-  _tep_seed_pg_res.column_values(0)
-  _tep_seed_pg_res.clear
-  _tep_seed_pg_conn.close
-  # Pool seed -- size 0 so we don't try to open real conns at load.
-  _tep_seed_pg_pool = PG::Pool.new("", 0)
-  _tep_seed_pg_pool.healthy?
-  _tep_seed_pg_pool.available
-  _tep_seed_pg_pool.size
-  _tep_seed_pg_pool.set_checkout_timeout_ms(0)
-  _tep_seed_pg_pool.close_all
-  # NB: don't checkout/checkin against the size-0 seed pool; it'd
-  # spin until timeout. The seed has @free.length=0 forever.
-
-  # Tep::Json type-seeding. Pin every public method's parameter
+  # (PG::Connection / Result / Pool type-seeding relocated to
+  # lib/tep/pg.rb -- #216. PG.Connection.new("") is a failed-conn
+  # instance, not a raise, so the seeds stay safe at module load.)
+
+  # SpinelKit::Json type-seeding. Pin every public method's parameter
   # types so an app that uses one method but not another still
   # compiles cleanly. Calls have no side effects beyond producing
   # discardable strings.
-  Tep::Json.escape("")
-  Tep::Json.quote("")
-  Tep::Json.encode_pair_str("", "")
-  Tep::Json.encode_pair_int("", 0)
+  SpinelKit::Json.escape("")
+  SpinelKit::Json.quote("")
+  SpinelKit::Json.encode_pair_str("", "")
+  SpinelKit::Json.encode_pair_int("", 0)
   _tep_seed_str_h = Tep.str_hash
   _tep_seed_str_h["k"] = "v"
-  Tep::Json.from_str_hash(_tep_seed_str_h)
+  SpinelKit::Json.from_str_hash(_tep_seed_str_h)
   _tep_seed_int_h = {"" => 0}
   _tep_seed_int_h.delete("")
   _tep_seed_int_h["k"] = 1
-  Tep::Json.from_int_hash(_tep_seed_int_h)
+  SpinelKit::Json.from_int_hash(_tep_seed_int_h)
 
-  # Tep::Logger seed -- pin parameter types for every method even
+  # SpinelKit::Log seed -- pin parameter types for every method even
   # when an app uses one but not another. The level-name string
   # ("info") and the messages ("") pin the :str shape; the file-
   # path setter pins to_file's :str arg.
-  _tep_seed_logger = Tep::Logger.new
+  _tep_seed_logger = SpinelKit::Log.new
   _tep_seed_logger.set_level("info")
   _tep_seed_logger.to_file("")
   _tep_seed_logger.to_stderr
@@ -481,7 +392,7 @@ module Tep
   _tep_seed_logger.info("")
   _tep_seed_logger.warn("")
   _tep_seed_logger.error("")
-  Tep::Logger.level_value("info")
+  SpinelKit::Log.level_value("info")
 
   # Tep::Jwt seed -- pin every method's :str arg types. The
   # secret + payload are blank but the call shapes pin the FFI
@@ -538,13 +449,22 @@ module Tep
   Tep::Scheduler.clear
 
   # Tep::Shell seed -- pin :str args at the FFI boundary.
+  #
+  # These run at MODULE LOAD, so the paths must be readable in EVERY
+  # deploy environment, not just gx10. `/etc/hostname` is absent in a
+  # bare container (e.g. Upsun); under the engine's now-correct
+  # ENOENT-raising File.read it threw at boot and 502'd the native
+  # serve_bin (tep#199 boot-hazard report). `/dev/null` exists on every
+  # POSIX target (Linux containers, macOS) and reads as empty, so it
+  # pins the same :str param type without the missing-file crash. The
+  # full fix -- no boot-time seed I/O at all -- is tep#199 (--rbs sig).
   Tep::Shell.run(":")
   Tep::Shell.run_limited(":", 1)
-  Tep::Shell.read("/etc/hostname")
-  Tep::Shell.read_limited("/etc/hostname", 64)
+  Tep::Shell.read("/dev/null")
+  Tep::Shell.read_limited("/dev/null", 64)
 
-  # Tep::Url seed -- the new split_url has to land at compile time.
-  Tep::Url.split_url("http://x/")
+  # SpinelKit::Url seed -- the new split_url has to land at compile time.
+  SpinelKit::Url.split_url("http://x/")
 
   # Tep::Http seed -- every public method gets one canonical call so
   # spinel pins the param types. The URL "http://127.0.0.1:1/" won't
@@ -623,10 +543,10 @@ module Tep
   # Pin Sock.sphttp_sleep_ms's :int param so the backoff call site
   # resolves (called from Tep::Proxy#handle).
   Sock.sphttp_sleep_ms(0)
-  # Tep::Json.get_float seed (#133). Pin the (String, String) -> Float
+  # SpinelKit::Json.get_float seed (#133). Pin the (String, String) -> Float
   # surface so callers (CompletionsHandler temperature/top_p,
   # backends that parse their own bodies) resolve cleanly.
-  Tep::Json.get_float("{\"temperature\":0.7}", "temperature")
+  SpinelKit::Json.get_float("{\"temperature\":0.7}", "temperature")
   _tep_seed_retry_policy.backoff_for(0)
   _tep_seed_retry_policy.retriable?(502)
   _tep_seed_proxy.retry_policy(_tep_seed_proxy_req)
@@ -679,13 +599,13 @@ module Tep
   _tep_seed_oai_models = Tep::Llm::OpenAI::ModelsHandler.new
   _tep_seed_oai_models.handle(_tep_seed_proxy_req, _tep_seed_proxy_res)
   # 7.1b /v1/completions surface.
-  Tep::Json.get_int_array("{}", "prompt")
+  SpinelKit::Json.get_int_array("{}", "prompt")
   _tep_seed_oai_sampling = Tep::Llm::OpenAI::Sampling.new
   _tep_seed_oai_sampling.max_tokens  = 0
   _tep_seed_oai_sampling.temperature = 1.0
   _tep_seed_oai_sampling.top_p       = 1.0
   _tep_seed_oai_comp = Tep::Llm::OpenAI::Completion.new
-  _tep_seed_oai_backend.generate_from_tokens("m", Tep::Json.get_int_array("{}", "prompt"), _tep_seed_oai_sampling)
+  _tep_seed_oai_backend.generate_from_tokens("m", SpinelKit::Json.get_int_array("{}", "prompt"), _tep_seed_oai_sampling)
   _tep_seed_oai_completions = Tep::Llm::OpenAI::CompletionsHandler.new
   _tep_seed_oai_completions.handle(_tep_seed_proxy_req, _tep_seed_proxy_res)
   # Chat completions skeleton (POST /v1/chat/completions). Default
@@ -717,10 +637,10 @@ module Tep
   # makes the underlying sphttp_write_chunk a harmless EBADF at boot.
   _tep_seed_oai_sink.emit_token("seed")
   _tep_seed_oai_backend.generate_stream_from_tokens(
-    "m", Tep::Json.get_int_array("{}", "prompt"), _tep_seed_oai_sampling, _tep_seed_oai_sink)
+    "m", SpinelKit::Json.get_int_array("{}", "prompt"), _tep_seed_oai_sampling, _tep_seed_oai_sink)
   _tep_seed_oai_cstreamer = Tep::Llm::OpenAI::CompletionsStreamer.new
   _tep_seed_oai_cstreamer.model         = "m"
-  _tep_seed_oai_cstreamer.token_ids     = Tep::Json.get_int_array("{}", "prompt")
+  _tep_seed_oai_cstreamer.token_ids     = SpinelKit::Json.get_int_array("{}", "prompt")
   _tep_seed_oai_cstreamer.sampling      = _tep_seed_oai_sampling
   _tep_seed_oai_cstreamer.prompt_tokens = 0
   _tep_seed_oai_cstreamer.t0            = 0
@@ -774,13 +694,13 @@ module Tep
   Tep::Job.mark_failed(":memory:", 0)
   _tep_seed_str_arr = [""]
   _tep_seed_str_arr.delete_at(0)
-  Tep::Json.from_str_array(_tep_seed_str_arr)
+  SpinelKit::Json.from_str_array(_tep_seed_str_arr)
   _tep_seed_int_arr = [0]
   _tep_seed_int_arr.delete_at(0)
-  Tep::Json.from_int_array(_tep_seed_int_arr)
-  Tep::Json.get_str("{}", "")
-  Tep::Json.get_int("{}", "")
-  Tep::Json.has_key?("{}", "")
+  SpinelKit::Json.from_int_array(_tep_seed_int_arr)
+  SpinelKit::Json.get_str("{}", "")
+  SpinelKit::Json.get_int("{}", "")
+  SpinelKit::Json.has_key?("{}", "")
 
   # Tep::MCP seeds (chunk 5.1). Tools register at compile time via
   # bin/tep's mcp_tool DSL; the runtime helpers below are the
@@ -810,7 +730,7 @@ module Tep
 
   # Tep::Llm seeds. attr_accessor return types default to mrb_int
   # if spinel sees no concrete callsite -- and Tep::Llm.build_request_body
-  # passes msg.role / msg.content into Tep::Json.quote(String) which
+  # passes msg.role / msg.content into SpinelKit::Json.quote(String) which
   # then mismatches. Pin Message + Response attrs to String, and
   # run one full encode + parse round-trip so the static analyzer
   # sees every public method called with concrete types.
@@ -846,7 +766,7 @@ module Tep
   Tep::Llm.dechunk_leftover("")
   Tep::Llm.dechunk_pass("")
   Tep::Llm.drain_sse_buf("", _tep_seed_llm_stream, "")
-  Tep::Llm.hex_to_int("")
+  SpinelKit::Hex.to_int("")
 
   # Tep::WebSocket seeds. Pins frame/handshake/driver/connection
   # surfaces to concrete typed callsites so the analyzer doesn't

data/spinel-ext.json

@@ -5,6 +5,12 @@
     "source": "lib/tep/sphttp.c",
     "cflags": ["-O2"]
   },
+  {
+    "name": "sphttp",
+    "placeholder": "@TEP_SPHTTP_CFLAGS@",
+    "pkg_config": "openssl",
+    "pkg_config_fallback": "-lssl -lcrypto"
+  },
   {
     "name": "sqlite",
     "placeholder": "@TEP_SQLITE_O@",

data/test/helper.rb

@@ -30,10 +30,51 @@ module TepHarness
     attr_reader :port
   end
 
+  # Hand out the next port that's actually bindable, skipping any that's
+  # already held -- a squatter (stray server from an earlier run) or an orphan
+  # the reap missed. Without this, a class boots on a squatted port, its own
+  # bind fails, and wait_for_port connects to the SQUATTER instead -> requests
+  # routed to the wrong app (cross-talk). Probing closes the TOCTOU window to
+  # nearly nothing: under the parallel runner each worker owns a DISJOINT port
+  # range (PORT_BASE_START + idx*STEP), so no two workers probe the same port,
+  # and the range sits below the OS ephemeral range so client source ports
+  # can't race it either. Stays well within the per-file headroom (STEP=50,
+  # <=9 classes).
   def self.next_port
-    p = @port
-    @port += 1
-    p
+    loop do
+      p = @port
+      @port += 1
+      begin
+        TCPServer.new("127.0.0.1", p).close
+        return p
+      rescue Errno::EADDRINUSE, Errno::EACCES
+        next
+      end
+    end
+  end
+
+  # Run a compile, retrying once on a non-success exit that produced NO
+  # compiler diagnostic -- i.e. the toolchain was killed/crashed rather than
+  # rejecting the source. Under the parallel runner, N concurrent Spinel
+  # compiles can transiently exhaust a resource and one gets reaped mid-build
+  # (empty error, nonzero exit); a real codegen error is deterministic and
+  # surfaces on the retry too, so this never hides genuine breakage. Also
+  # helps the serial suite shrug off a one-off hiccup.
+  def self.build_with_retry(cmd, what, tries: 2)
+    out = ""
+    tries.times do |i|
+      out = `#{cmd} 2>&1`
+      return out if $?.success?
+      # Only retry a diagnostic-free (killed/crashed) failure. A genuine
+      # rejection carries an "error:" (cc) or "undefined reference" (link).
+      # The inlined lib's "cannot resolve ... (emitting 0)" lines are
+      # "warning:" only, so they don't trip this -- otherwise every build
+      # (they all emit those) would look like a real error and never retry.
+      real_error = out.match?(/\berror:|fatal error|undefined reference/i)
+      break if real_error || i == tries - 1
+      sleep 0.5
+    end
+    raise "#{what} failed:\n#{out}"
   end
 
   # Compile `source` (Sinatra-classic by default) and return the bound
@@ -47,11 +88,9 @@ module TepHarness
     bin  = File.join(tmp, "app")
     case mode
     when :sinatra
-      out = `#{TEP_BIN} build #{src} -o #{bin} 2>&1`
-      raise "tep build failed:\n#{out}" unless $?.success?
+      build_with_retry("#{TEP_BIN} build #{src} -o #{bin}", "tep build")
     when :direct
-      out = `#{SPINEL} #{src} -o #{bin} 2>&1`
-      raise "spinel failed:\n#{out}" unless $?.success?
+      build_with_retry("#{SPINEL} #{src} -o #{bin}", "spinel")
     else
       raise "unknown mode: #{mode}"
     end
@@ -87,6 +126,39 @@ module TepHarness
     @running.delete(s)
   end
 
+  # Like terminate, but RETURNS the Process::Status of the SIGTERM'd
+  # process (or nil if not found) so a test can assert on how it exited
+  # -- e.g. that a no-events server doesn't SIGSEGV on shutdown (the #186
+  # regression: termsig == SEGV => exit 139). Bounded: escalates to
+  # SIGKILL after `timeout` so a wedged server can't hang the suite.
+  def self.terminate_status(port, timeout: 5.0)
+    s = find_by_port(port)
+    return nil unless s
+    pid = s[:pid]
+    signal_group(pid, "TERM")
+    deadline = Time.now + timeout
+    status = nil
+    loop do
+      begin
+        got, st = Process.waitpid2(pid, Process::WNOHANG)
+        if got
+          status = st
+          break
+        end
+      rescue Errno::ECHILD
+        break
+      end
+      if Time.now > deadline
+        signal_group(pid, "KILL")
+        _, status = (Process.waitpid2(pid) rescue [nil, nil])
+        break
+      end
+      sleep 0.02
+    end
+    @running.delete(s)
+    status
+  end
+
   def self.kill_all
     @running.each do |s|
       reap(s[:pid])
@@ -174,7 +246,12 @@ Minitest.after_run { TepHarness.kill_all }
 
 # Kill any zombie tep test processes leaking from previous runs.
 # Skip on hosts that don't ship `pgrep` (some slim containers don't).
-if system("which pgrep >/dev/null 2>&1")
+# Skip under the parallel runner (TEP_PARALLEL): sibling workers each run
+# their own tep-test binaries concurrently, so a global pgrep-kill here
+# would tear down another worker's live servers. The parallel runner does
+# one stale-proc sweep up front instead, and each worker reaps only its
+# own via Minitest.after_run.
+if !ENV["TEP_PARALLEL"] && system("which pgrep >/dev/null 2>&1")
   `pgrep -f tep-test 2>/dev/null`.split.each do |pid|
     Process.kill("TERM", pid.to_i) rescue nil
   end
@@ -242,6 +319,16 @@ class TepTest < Minitest::Test
       r = klass.new(uri)
       r.body = body if body && %i[post put patch].include?(method)
       headers.each { |k, v| r[k] = v }
+      # Ruby <= 3.x's Net::HTTP auto-set Content-Type:
+      # application/x-www-form-urlencoded whenever request.body was
+      # assigned; Ruby 4.0 dropped that default, so a bodied POST goes
+      # out with no Content-Type and tep (correctly) doesn't parse it as
+      # form params. Restore the historical default for bodied requests
+      # unless a test set its own Content-Type -- matches what real form
+      # clients send and keeps the suite Ruby-version-agnostic.
+      if r.body && !r["content-type"]
+        r["Content-Type"] = "application/x-www-form-urlencoded"
+      end
       http.request(r)
     end
   end

data/test/run_parallel.rb

@@ -22,18 +22,51 @@ require "shellwords"
 
 ROOT  = File.expand_path("..", __dir__)
 TESTS = Dir[File.join(ROOT, "test", "test_*.rb")].sort
-PROCS = (ENV["TEP_TEST_PROCS"] || Etc.nprocessors.to_s).to_i
+# Default below core count: each worker's Spinel compile is CPU-bound, and the
+# booted test servers + their HTTP clients also need cycles -- saturating every
+# core just trades compile parallelism for boot-timeout/build-kill flakes (the
+# build retry absorbs those, but at the cost of a re-compile). ~60% of cores is
+# the sweet spot here (12 on a 20-core box: 0F/0E, ~7.6min vs ~30min serial).
+PROCS = (ENV["TEP_TEST_PROCS"] || [Etc.nprocessors * 3 / 5, 2].max.to_s).to_i
 
-# Each test class boots its own app on a port from the harness's
-# next_port counter; spacing 100 per file is comfy headroom (test
-# files have at most a couple of classes).
-PORT_BASE_STEP = 100
-PORT_BASE_START = (ENV["TEP_TEST_PORT_BASE"] || "4900").to_i
+# Each test class boots its own app on a port = PORT_BASE_START + idx*STEP
+# (+1 per extra class in the file). Files have at most ~9 classes, so STEP=50
+# is ample disjoint headroom per file. With 64 files the window spans
+# 10000..13200 -- chosen to sit BELOW the OS ephemeral range
+# (/proc/sys/net/ipv4/ip_local_port_range, 32768+ here): a server bound in the
+# ephemeral range collides with another test's *outbound* HTTP client source
+# port (EADDRINUSE bind failures). It's also clear of the legacy 4900 base.
+#
+# Cross-run safety (a server can outlive its worker -- tep #188 leaks one under
+# load, and tep binds prefork listeners SO_REUSEPORT, so a surviving orphan on
+# a reused port would be silently shared / connected-to instead of this run's
+# server -> cross-talk) is handled by SIGKILL reaping (reap_tep_test_procs),
+# up-front and at end, not by moving the window: SIGKILL can't be ignored, so
+# the prior run's orphans are gone before this run binds.
+PORT_BASE_STEP  = 50
+PORT_BASE_START = (ENV["TEP_TEST_PORT_BASE"] || "10000").to_i
 
 queue   = TESTS.each_with_index.to_a
 mutex   = Mutex.new
 results = []
 
+# Reap stray tep-test servers by PID with SIGKILL (SIGTERM is unreliable here,
+# tep #188). pgrep/Process.kill, not `pkill -f tep-test` -- the latter spawns a
+# shell whose own cmdline contains the pattern and self-matches. run_parallel's
+# cmdline ("ruby test/run_parallel.rb") doesn't contain "tep-test", so it's
+# never a target.
+def reap_tep_test_procs
+  `pgrep -f tep-test 2>/dev/null`.split.map(&:to_i).each do |pid|
+    Process.kill("KILL", pid) rescue nil
+  end
+end
+
+# Up-front: clear orphans from a previous run. Workers set TEP_PARALLEL so their
+# helper.rb skips its own global pgrep-kill (which would TERM sibling workers'
+# live servers). Per-worker cleanup still runs via Minitest.after_run; this
+# reap is the backstop for what #188 leaks.
+reap_tep_test_procs
+
 workers = PROCS.times.map do
   Thread.new do
     loop do
@@ -41,7 +74,7 @@ workers = PROCS.times.map do
       break unless job
       path, idx = job
       port_base = PORT_BASE_START + idx * PORT_BASE_STEP
-      env = { "TEP_TEST_PORT_BASE" => port_base.to_s }
+      env = { "TEP_TEST_PORT_BASE" => port_base.to_s, "TEP_PARALLEL" => "1" }
       # Honor TEP_SKIP_SPINEL_FRESH if the caller set it (Makefile
       # handles the freshness check once; per-process would be wasteful).
       ["TEP_SKIP_SPINEL_FRESH", "SPINEL", "TEP_KEEP_TMP"].each do |k|
@@ -60,6 +93,10 @@ workers = PROCS.times.map do
 end
 workers.each(&:join)
 
+# Reap any servers a worker leaked (tep #188) so they don't accumulate across
+# runs or hold the random window's ports.
+reap_tep_test_procs
+
 # Sort so the printed order is deterministic (queue order), not
 # completion order.
 results.sort_by! { |r| TESTS.index(r[:path]) }

data/test/test_auth.rb

@@ -14,46 +14,46 @@ class TestAuth < TepTest
     Tep::Auth.install!
 
     # ---- mint endpoints (test harness uses these to get tokens) ----
-    # The payload is Tep::Json-friendly flat JSON: sub, exp, caps
+    # The payload is SpinelKit::Json-friendly flat JSON: sub, exp, caps
     # (comma-separated), and optionally delegate (pipe-encoded).
 
     post '/mint_human' do
       res.headers["Content-Type"] = "text/plain"
-      sub = Tep::Json.get_str(req.raw_body, "sub")
-      caps = Tep::Json.get_str(req.raw_body, "caps")
+      sub = SpinelKit::Json.get_str(req.raw_body, "sub")
+      caps = SpinelKit::Json.get_str(req.raw_body, "caps")
       exp = Time.now.to_i + 600
       payload = "{" +
-        Tep::Json.encode_pair_str("sub", sub) + "," +
-        Tep::Json.encode_pair_int("exp", exp) + "," +
-        Tep::Json.encode_pair_str("caps", caps) +
+        SpinelKit::Json.encode_pair_str("sub", sub) + "," +
+        SpinelKit::Json.encode_pair_int("exp", exp) + "," +
+        SpinelKit::Json.encode_pair_str("caps", caps) +
       "}"
       Tep::Jwt.encode_hs256(payload, SECRET)
     end
 
     post '/mint_agent' do
       res.headers["Content-Type"] = "text/plain"
-      sub = Tep::Json.get_str(req.raw_body, "sub")
-      caps = Tep::Json.get_str(req.raw_body, "caps")
-      delegate = Tep::Json.get_str(req.raw_body, "delegate")
+      sub = SpinelKit::Json.get_str(req.raw_body, "sub")
+      caps = SpinelKit::Json.get_str(req.raw_body, "caps")
+      delegate = SpinelKit::Json.get_str(req.raw_body, "delegate")
       exp = Time.now.to_i + 600
       payload = "{" +
-        Tep::Json.encode_pair_str("sub", sub) + "," +
-        Tep::Json.encode_pair_int("exp", exp) + "," +
-        Tep::Json.encode_pair_str("caps", caps) + "," +
-        Tep::Json.encode_pair_str("delegate", delegate) +
+        SpinelKit::Json.encode_pair_str("sub", sub) + "," +
+        SpinelKit::Json.encode_pair_int("exp", exp) + "," +
+        SpinelKit::Json.encode_pair_str("caps", caps) + "," +
+        SpinelKit::Json.encode_pair_str("delegate", delegate) +
       "}"
       Tep::Jwt.encode_hs256(payload, SECRET)
     end
 
     post '/mint_expired' do
       res.headers["Content-Type"] = "text/plain"
-      sub = Tep::Json.get_str(req.raw_body, "sub")
+      sub = SpinelKit::Json.get_str(req.raw_body, "sub")
       # Issued in the past, expired in the past.
       exp = Time.now.to_i - 60
       payload = "{" +
-        Tep::Json.encode_pair_str("sub", sub) + "," +
-        Tep::Json.encode_pair_int("exp", exp) + "," +
-        Tep::Json.encode_pair_str("caps", "read") +
+        SpinelKit::Json.encode_pair_str("sub", sub) + "," +
+        SpinelKit::Json.encode_pair_int("exp", exp) + "," +
+        SpinelKit::Json.encode_pair_str("caps", "read") +
       "}"
       Tep::Jwt.encode_hs256(payload, SECRET)
     end

data/test/test_auth_oauth2.rb

@@ -30,17 +30,17 @@ class TestAuthOAuth2 < TepTest
     # only reach here on user-approve. The test stub skips the UI.
 
     post '/consent' do
-      principal_id = Tep::Json.get_str(req.raw_body, "principal_id")
-      client_id    = Tep::Json.get_str(req.raw_body, "client_id")
-      caps_str     = Tep::Json.get_str(req.raw_body, "caps")
+      principal_id = SpinelKit::Json.get_str(req.raw_body, "principal_id")
+      client_id    = SpinelKit::Json.get_str(req.raw_body, "client_id")
+      caps_str     = SpinelKit::Json.get_str(req.raw_body, "caps")
       Tep::AuthOAuth2.issue_code(principal_id, client_id, caps_str, 0)
     end
 
     # ---- token-exchange endpoint: bot redeems code for JWT.
 
     post '/token' do
-      code      = Tep::Json.get_str(req.raw_body, "code")
-      client_id = Tep::Json.get_str(req.raw_body, "client_id")
+      code      = SpinelKit::Json.get_str(req.raw_body, "code")
+      client_id = SpinelKit::Json.get_str(req.raw_body, "client_id")
       Tep::AuthOAuth2.exchange_code(code, client_id, 0)
     end
 

data/test/test_broadcast_pg.rb

@@ -18,6 +18,7 @@ class TestBroadcastPg < TepTest
 
   app_source <<~RB
     require 'sinatra'
+    require "tep/pg"          # opt-in PG backend (#216)
 
     PG_URL  = "#{PG_URL}"
     CHANNEL = "#{CHANNEL}"