How Dormouse is tested

Every promise on the label has an enforcer.

Dormouse makes three promises: it never silently misses (a change is caught on the next successful look, however long the gap), its record is tamper-evident (rewriting history breaks the chain), and gaps are findings (silence alerts instead of passing as health). Each promise is pinned by named regression tests in the suite: the outage test that changes a page mid-outage and demands the full diff on recovery, the chain tests that rewrite an entry and demand a detected break, the watchdog tests that demand an alert when a source goes dark. A claim without a test does not go on the label.

A release has to survive the gauntlet.

Every release passes the full suite, the race detector, cross-platform builds, and a linter that fails the build, then a live smoke test of the real binary against real pages, and finally pack check: every curated vendor source is live-fetched through the production stack, and one broken source fails the release.

When a defect is found, its fix lands with a regression test in the same change, so a fixed bug cannot quietly return. The suite is the memory of every mistake we have made.

Before v0.5.0, we hired an attack on our own product.

An independent adversarial review with one brief: break the promises. Forge the trail, drop an alert without a trace, make the coverage report say watching happened when it did not. It produced 28 findings across the coverage proof, delivery, cryptography, and operations. Every one was fixed and pinned by a test before the release was tagged. The ones that mattered most, worded by what you now hold:

Our outages show in your report. A daemon restart could previously heal the staleness anchors before the watchdog looked, and the report could slide its window past the downtime. Now the restart records the gap first, and the window never slides past an outage, ours included.

A queued alert cannot be deleted undelivered. A timing race between a slow send and a new change could drop the newer alert. Every delivery-state write now proves it still owns the row before it acts, and a per-channel ledger records what every channel received or gave up on.

An empty page cannot baseline as green. A JavaScript-rendered shell used to pass as a healthy watch of nothing. Dormouse now refuses to baseline a page that yields no real text, and tells you why instead of reporting perfect coverage of a blank.

A change cannot fall between two digests. Digest cursors moved from wall-clock time to commit-ordered ids, so a change committed while a digest composes is delivered by the next one instead of being skipped forever.

A weak signing key is refused. The chain key must be at least 32 random bytes. A guessable passphrase would have quietly weakened the forgery claim, so a short key is now an error at startup.

The parts that were attacked and did not move.

The audit also confirmed what survived attack: the cumulative-diff guarantee and the test that pins it, the keyed hash chain with constant-time comparison on every path, the atomicity of each observation commit, and the pinned-head verification that catches truncation even by whoever holds the database. A stress run of 640 concurrent audit writes produced zero dropped entries and zero chain breaks. Attacking first is what makes those sentences worth writing.

Read the whole thing, including the ugly parts.

The complete engineering write-up of the audit, mechanics and all, is public: The pre-launch audit. If we sell provable monitoring, the least we can do is prove ourselves the same way.