Module self_test 

Positive + per-category negative request driver against a live server.

Issue #79 round 13 (4) — Srikanth’s (e) ask: a way to test both positive and negative compliance scenarios separately, where the positive cases should pass and the negative cases should be rejected.

This module sits alongside the existing conformance executor (which drives k6 / native checks on a single positive call per operation). The self-test driver synthesises per-category deliberately-bad requests and asserts that the server actually rejects them with a 4xx — useful when verifying that validate_request_with_all is wired correctly for the user’s spec (the exact gap that round-13 (3) fixed).

Scope of the initial MVP: covers the highest-signal negatives — empty body when one is required, missing required query/header params, and wrong-type path params. Doesn’t try to mutate every field of a JSON-Schema-validated body; that’s a follow-up.

Structs

AcceptedOwaspProbe

Round 59 (#79) — a single OWASP injection probe the target ACCEPTED, for the conformance-owasp-accepted.json sidecar so a WAF tester can grep which URLs let which payloads through (matching their proxy’s own logs).

CaseCapture

Round 23 (c-iii) — one captured request/response pair, one per probe (positive or negative). Serialised as a JSON line in conformance-self-test-requests.jsonl. Headers are kept as BTreeMap for stable ordering. Bodies are truncated to CAPTURE_BODY_CAP_BYTES; *_truncated flags whether more was dropped.

CaseOutcome

Outcome of a single test case (positive or negative).

DefiniteIssue

Round 58 (#79) — an unambiguous, no-analysis-needed problem surfaced by the self-test. Srikanth on 0.3.205: “Is it possible to give another option … that should say for sure this is an issue. Currently both caught and missed needs manual intervention and deep analysis … very time consuming.”

NetworkEvent

Round 47 (#79) — wire-level network event captured by the self-test driver. Same shape as the native executor’s NetworkEvent so downstream tooling can consume one file across executor variants.

OperationResult

All cases run against one annotated operation.

SecurityProbeStat

Round 59 (#79) — per-injection-type tally of OWASP probes. Srikanth on 0.3.206 was testing a WAF (waaptest.net targets): “owasp: 0 caught / 8127 missed” but “Definite issues: none”, and asked whether real issues were being hidden. They are not hidden from the CONTRACT view (an SQLi string in a string field is spec-valid, so it is correctly not a schema violation), but for a WAF each ACCEPTED injection payload is one it did not block. This surfaces that count so a security tester sees it without eyeballing rows.

SelfTestConfig

Configuration for a self-test run.

SelfTestReport

Summary report rolled up across all operations.

Functions

default_geo_source_headers

Default forwarded-IP header set. Covers the three conventions a real GEODB front-end is likely to read in this order of preference: Cloudflare (CF-Connecting-IP), Akamai/CloudFront (True-Client-IP), then the de-facto standard X-Forwarded-For. Override via --geo-source-header to test a specific stack.

run_self_test

Execute the self-test plan against config.target_url for every AnnotatedOperation. Returns the aggregated report; callers decide how to display it (e.g. via render_summary or by writing the JSON serialisation to disk).

run_self_test_with_deadline

Round 49 (#79) — Srikanth on 0.3.193: --conformance-self-test- duration 5m ran 5:46 because the outer iteration loop in command.rs only checks the deadline AFTER a full matrix pass completes. For long iterations this can overshoot by minutes, which breaks automation that relies on a fixed wall-clock budget. New optional deadline parameter lets the runner break out mid-iteration once the deadline elapses; returns the partial report with whatever operations finished before the deadline.