palyrad), the CLI (palyra), the browser automation service (palyra-browserd), and the connector ecosystem.
Daemon Integration Surface
The daemon integration tests verify the HTTP and gRPC boundaries ofpalyrad. These tests typically involve spawning a live daemon process with dynamic ports and an isolated state root to ensure no side effects between test runs.
Admin and Console API Testing
Theadmin_surface.rs suite validates the security and functionality of the Axum-based HTTP router. It specifically tests:
- Authentication Requirements: Ensures that endpoints like
/admin/v1/statuscrates/palyra-daemon/src/transport/http/router.rs#19-19 and/admin/v1/journal/recentcrates/palyra-daemon/src/transport/http/router.rs#20-20 correctly reject requests missing theAuthorizationbearer token crates/palyra-daemon/tests/admin_surface.rs#42-43. - Context Validation: Verifies that requests must include mandatory headers such as
x-palyra-principalandx-palyra-device-idcrates/palyra-daemon/tests/admin_surface.rs#55-61. - Rate Limiting: Confirms that the
admin_rate_limit_middlewarecrates/palyra-daemon/src/transport/http/router.rs#151-154 correctly triggers a429 Too Many Requestsstatus after repeated failed authentication attempts crates/palyra-daemon/tests/admin_surface.rs#164-176.
Health and Diagnostics
Thehealth_endpoint.rs and console_diagnostics_handler crates/palyra-daemon/src/transport/http/handlers/console/diagnostics.rs#6-9 tests ensure the observability of the system. The diagnostics payload includes:
- Model Provider Status: Serialized state of the active LLM backend crates/palyra-daemon/src/transport/http/handlers/console/diagnostics.rs#22-27.
- Memory Usage: Current vector store and retention policy metrics crates/palyra-daemon/src/transport/http/handlers/console/diagnostics.rs#113-129.
- Subsystem Snapshots: Status of skills, plugins, and webhooks crates/palyra-daemon/src/transport/http/handlers/console/diagnostics.rs#38-48.
Daemon Integration Data Flow
The following diagram illustrates how the integration tests interact with the daemon’s internal components. Integration Test Boundary Sources: crates/palyra-daemon/tests/admin_surface.rs#30-71, crates/palyra-daemon/src/transport/http/router.rs#17-157, crates/palyra-daemon/src/transport/http/handlers/admin/core.rs#1-20 (implied by router).CLI Regression and Parity
CLI testing focuses on command-line argument parsing, profile management, and the bridge between the CLI and the daemon.Daemon Status and Connectivity
Thedaemon_status.rs suite verifies that the CLI can communicate with the daemon’s management endpoints. It tests the daemon status command against a live palyrad instance crates/palyra-cli/tests/daemon_status.rs#19-37.
- Isolated State: Tests use
TempDirto create a freshPALYRA_STATE_ROOTandPALYRA_GATEWAY_IDENTITY_STORE_DIRfor every run crates/palyra-cli/tests/daemon_status.rs#144-149. - Dynamic Port Allocation: To avoid port collisions in CI, tests reserve loopback ports before spawning the daemon crates/palyra-cli/tests/daemon_status.rs#143-143.
Workflow Regression Matrix
Theworkflow_regression_matrix.rs and associated scripts (run-workflow-regression.sh) execute end-to-end scenarios to ensure that complex agentic workflows remain functional across versions. These tests often use the “Simulator Harness” to mock external model providers or channel interactions.
CLI to Daemon Communication
Sources: crates/palyra-cli/tests/daemon_status.rs#19-70, crates/palyra-daemon/src/transport/http/router.rs#19-19.Browser Automation Tests
Thepalyra-browserd tests ensure that the headless Chromium engine and its gRPC service wrapper function correctly.
Session Lifecycle
Tests insupport/tests.rs cover the creation and management of browser sessions:
- Session Creation: Validates
create_sessioncrates/palyra-browserd/src/transport/grpc/service.rs#29-32 and ensures that principal names are mandatory crates/palyra-browserd/src/transport/grpc/service.rs#35-38. - Persistence: Verifies that
persistence_enabledcorrectly triggers the loading of snapshots from thePersistedStateStorecrates/palyra-browserd/src/transport/grpc/service.rs#75-88. - Budget Enforcement: Ensures that requested budgets (e.g.,
max_screenshot_bytes,max_navigation_timeout_ms) are clamped against the daemon’s configured defaults crates/palyra-browserd/src/transport/grpc/service.rs#107-161.
Redaction and Security
- Query Redaction: The
query_redaction_treats_oauth_code_and_state_as_sensitivetest crates/palyra-browserd/src/support/tests.rs#128-140 ensures that sensitive URL parameters likecodeandstateare stripped from logs. - State Directory Logic: Platform-specific tests verify that the browser state directory is correctly resolved on Windows (
AppData) crates/palyra-browserd/src/support/tests.rs#161-174 and macOS (Application Support) crates/palyra-browserd/src/support/tests.rs#178-180.
Simulator Harness for Connectors
Thesimulator_harness.rs provides a mock environment for testing ChannelPlatform implementations (e.g., Discord, Slack) without requiring live API tokens or network connectivity.
Key Features
- Message Injection: Allows tests to inject
InboundMessagepayloads directly into theConnectorSupervisor. - Outcome Verification: Captures outbound actions like
SendMessageorEditMessageto verify the daemon’s response logic. - State Mocking: Simulates connector health refreshes and queue draining operations crates/palyra-daemon/src/transport/http/router.rs#67-80.
Vault and Identity Persistence
Tests for thepalyra-vault and palyra-identity crates focus on data integrity and encryption.
Vault Backend Testing
Thebackend.rs logic is tested across multiple storage types:
- EncryptedFile: Verifies that the
EncryptedFileBackendcrates/palyra-vault/src/backend.rs#194-197 correctly manages theobjects.store.jsonindex and individual encrypted blobs. - Platform Specifics: Tests the selection logic crates/palyra-vault/src/backend.rs#135-158 that prefers
MacosKeychainBackend,LinuxSecretServiceBackend, orWindowsDpapiBackendwhen available.
Identity Store Security
TheFilesystemSecretStore tests crates/palyra-identity/src/store.rs#87-92 ensure:
- Permissions Hardening: On Unix, the root directory is set to
0o700crates/palyra-identity/src/store.rs#110-111. On Windows, ACLs are applied to ensure only the owner SID has access crates/palyra-identity/src/store.rs#101-101. - Atomic Writes: Secrets are written to temporary files and then renamed to their final destination to prevent corruption crates/palyra-identity/src/store.rs#177-195.
- Encryption at Rest: All secrets are encrypted using
CHACHA20_POLY1305crates/palyra-identity/src/store.rs#16-16 with a store-specific key crates/palyra-identity/src/store.rs#23-23.