How Tokening 0.1 Was Tested

Tokening makes one claim that matters more than the rest: a one-use grant allows one call. So that’s where most of the testing went, along with the boring work of making sure every build that ships actually runs.

The race

The key test starts two callers against a fresh one-use grant, through separate database connections, and checks that exactly one wins. It does that a thousand times. In the v0.1.1 release it ran on every platform the release ships for: Linux and macOS on Intel and ARM, and Windows on Intel. Each one recorded 1,000 allowed calls, 1,000 refusals and zero uses left. The counts come straight from the test logs into the release results. Nobody typed them in.

When things go wrong

Other tests kill the process just before and just after a use is committed, make a commit fail on purpose, reload the policy while grants are live and revoke a grant while a call is in flight. They check the same line each time: a call is either refused, or it was allowed and its use is gone. Nothing in between, and nothing comes back.

The demo as a test

The WordPress demo runs in CI on every change. It uses real containers and a real WordPress, then reads the stored posts afterwards: two writes, no deletes, post 3 untouched, exactly one winner in the race. The agent’s network is checked too. It can reach Tokening and nothing else. Inside the demo walks through it.

A browser check opens the replay and the live admin panel at desktop and phone widths, steps through the replay, and makes sure the page sends no network requests and renders injected markup as plain text.

Before anything ships

Every archive is built and tested on its own platform, then unpacked and run: version, help, policy check, key generation, server start, grant issue and inspect, a refused call, revocation and audit export. If any platform fails, nothing is published.

Each release also gets a source review by a separate agent that didn’t write the change. It’s a project review, not an outside security audit, and it has caught real problems. The first release run found a Windows test using a file name Windows doesn’t allow, and a startup lock on Intel Macs. Both were fixed and every check ran again before 0.1.0 went out.

All of it is in the open: the workflows, the release notes and the decision records from the recorded demo.