Add integration tests for control plane (workerd runtime)

[ColeMurray]

Summary

• Adds 14 integration tests that run inside the real workerd runtime via @cloudflare/vitest-pool-workers
• Tests validate Worker boot, routing, HMAC auth, D1 database operations, and Durable Objects with SQLite storage
• Everything runs offline — miniflare provides local D1 (SQLite), KV, and DO implementations
• Existing 279 unit tests remain unchanged and still pass

Test coverage

File	Tests	What it proves
worker-fetch.test.ts	4	Worker boots, routes 404, CORS preflight, correlation headers
auth.test.ts	4	HMAC rejection (missing/invalid/expired), valid token acceptance
d1-session-index.test.ts	3	D1 migrations applied, SessionIndexStore CRUD with filters
durable-object.test.ts	3	DO boots with SQLite, init + state round-trip, schema tables exist

Notable decisions

• isolatedStorage: false: Required because SQLite-backed DOs create .sqlite-shm/.sqlite-wal files that break the framework's storage snapshot assertions (workers-sdk#11031, still open, we're on the latest version 0.12.10). D1 isolation is achieved via beforeEach cleanup instead.
• singleWorker: true: Simpler for Phase 1, sufficient for 14 tests running in ~800ms.
• warmSandbox() throws in tests: handleInit fires ctx.waitUntil(warmSandbox()) which fails without MODAL_API_SECRET/MODAL_WORKSPACE. This is expected — it's fire-and-forget via waitUntil and doesn't affect the 200 response.

Files

New (10 files):

• wrangler.jsonc — test-only wrangler config (DO bindings, D1, KV)
• vitest.integration.config.ts — workerd pool config with D1 migrations
• test/integration/ — setup, types, tsconfig, 4 test files
• Dockerfile.test — optional container for CI-matching local runs

Modified (3 files):

• package.json — test:integration script, @cloudflare/vitest-pool-workers devDep
• ci.yml — libc++1 install + integration test step
• package-lock.json — lockfile

Test plan

• npm test -w @open-inspect/control-plane — 279 unit tests pass
• npm run test:integration -w @open-inspect/control-plane — 14 integration tests pass
• CI passes on this branch

[github-actions]

Terraform Validation Results

Step	Status
Format	⚠️
Init	✅
Validate	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request

[greptile-apps]

Greptile Overview

Greptile Summary

• Adds a vitest.integration.config.ts that runs test/integration/**/*.test.ts inside the real workerd runtime via @cloudflare/vitest-pool-workers, wiring up Miniflare bindings and D1 migrations.
• Introduces a test-only wrangler.jsonc to define local DO/D1/KV bindings used by the integration suite.
• Adds 4 integration test files covering fetch routing/headers, HMAC auth behavior, D1-backed session index CRUD, and Durable Object SQLite state.
• Updates CI to install libc++1 and run the new test:integration script for @open-inspect/control-plane.
• Adds an optional Dockerfile.test for running the integration tests in a CI-like container.

[greptile-apps]

_{2 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[github-actions]

Terraform Validation Results

Step	Status
Format	⚠️
Init	✅
Validate	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request

[github-actions]

Terraform Validation Results

Step	Status
Format	⚠️
Init	✅
Validate	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request