Contract Fuzz And Soak Testing

Prod-SC4.5 and Prod-SC4.6 add two production-hardening test layers for smart contracts:

• deterministic fuzz/property tests for protocol-facing parsers, host payloads, call graphs, migration transforms, and snapshot restore inputs;
• an opt-in long-running contract soak that repeats production rehearsal slices across multi-validator, C2C, migration, deactivation, backup, sidecar, and replay coverage.

Deterministic Fuzz Tests

Run all contract fuzz/property tests:

npm run test:contract-fuzz

Run one fuzz suite:

npm run test:contract-fuzz-abi
npm run test:contract-fuzz-manifest
npm run test:contract-fuzz-host-imports
npm run test:contract-fuzz-c2c-graphs
npm run test:contract-fuzz-migrations
npm run test:contract-fuzz-snapshot-restore

The fuzz helper is deterministic. To replay or expand coverage:

NOOS_CONTRACT_FUZZ_SEED=release-candidate-2026-06-01 npm run test:contract-fuzz
NOOS_CONTRACT_FUZZ_CASES=500 npm run test:contract-fuzz-manifest

On Windows PowerShell:

$env:NOOS_CONTRACT_FUZZ_SEED = "release-candidate-2026-06-01"
$env:NOOS_CONTRACT_FUZZ_CASES = "500"
npm run test:contract-fuzz

Coverage:

• ABI decoding/projection: valid nested schemas, invalid value types, canonical projection stability, and manifest-hash stability.
• Manifest parsing: randomized valid manifests plus mutated invalid envelopes.
• Host import payloads: storage, events, return values, invalid JSON, invalid memory ranges, and fatal host error preservation.
• C2C call graphs: declared edges, undeclared targets, bucket requirement mismatches, depth overflow modeling, and cycle modeling.
• Migration transforms: schema parsing, deterministic writes, sorted output, delete ordering, and invalid transform rejection.
• Snapshot restore inputs: malformed restore payloads never throw and return stable verifier issue codes.

Contract Soak

Run the quick smoke soak:

npm run soak:contracts:smoke

Run the long soak:

npm run soak:contracts

The runner writes:

test-results/contracts/contract-soak-report.json

Useful options:

npm run soak:contracts -- --duration-ms 7200000 --validators 4 --calls-per-round 25 --seed rc-1
npm run soak:contracts -- --backup-interval-rounds 5 --migration-interval-rounds 6
npm run soak:contracts -- --deactivation-interval-rounds 8 --sidecar-restart-interval-rounds 4

Environment variables are also supported:

NOOS_CONTRACT_SOAK_DURATION_MS
NOOS_CONTRACT_SOAK_VALIDATORS
NOOS_CONTRACT_SOAK_CALLS_PER_ROUND
NOOS_CONTRACT_SOAK_BACKUP_INTERVAL_ROUNDS
NOOS_CONTRACT_SOAK_MIGRATION_INTERVAL_ROUNDS
NOOS_CONTRACT_SOAK_DEACTIVATION_INTERVAL_ROUNDS
NOOS_CONTRACT_SOAK_SIDECAR_RESTART_INTERVAL_ROUNDS
NOOS_CONTRACT_SOAK_SEED
NOOS_CONTRACT_SOAK_REPORT

The soak composes existing production-grade suites per round:

• multi-node production rehearsal;
• direct and adversarial contract-to-contract calls;
• event query and structured return behavior;
• backup/disaster-recovery drills;
• migration job execution;
• deactivation dependency inspection;
• Wasmtime sidecar lifecycle and restart behavior;
• replay verification.

The soak is intentionally opt-in and is not part of normal test:ci, because it can rebuild sidecars and run expensive multi-node fixtures repeatedly.