v0.9.3 — soak validation + test coverage (72→79.6%) (#1)

* test: cover all 14 SNI provider mappings + no-SNI case

Classifier (the LLM-detection core) only tested 6/14 providers; add Gemini/Cohere/XAi/Groq/
Together/Perplexity/Fireworks/OpenRouter + the None-SNI path. traits.rs classify fully covered;
lib total 78->79.6%.

* release: v0.9.3 — soak validation + test coverage; add README Tested section

0.9.2 -> 0.9.3 (test/docs only, no runtime change). CHANGELOG records the 15-case soak suite
(observe + intervene) and the 72->79.6% lib coverage; README gains a Tested section.

---------

Co-authored-by: RoyLin <roylin@RoyLindeMacBook-Pro.local>

Author: ZhiXiao-Lin

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to a3s-observer will be documented in this file.
 
+## [0.9.3] — soak validation + test coverage (no runtime change)
+
+### Tested
+
+- Full-stack soak validation — 15 cases, leak-free and correct under load on a prod host + an
+  isolated VM. Observe: steady 20 min, edge-input, a real a3s-code agent, throughput (110k ev/60s),
+  memory-bound (256 Mi), restart ×8, idle + heartbeat, SIGTERM, concurrent collectors,
+  backpressure, connection-churn. Intervene: egress, file/exec, and SSL-content guards — plus all
+  three running alongside the collector.
+- Lib line coverage 72% → **79.6%** (`cargo llvm-cov`): adversarial SNI/DNS parser tests, the
+  cgroup→pod parser, the full 14-provider SNI classifier, and the v0.9.2 writer-thread path.
+
 ## [0.9.2] — fix: output backpressure no longer stalls the event loop
 
 ### Fixed

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer"
-version = "0.9.2"
+version = "0.9.3"
 edition = "2021"
 license = "MIT"
 description = "General-purpose, language-agnostic eBPF observability for AI agents (LLM calls, tools, files, network egress)."

Cargo.toml

@@ -194,6 +194,19 @@ a3s-observer  →  NDJSON  →  OTel Collector (filelog → OTLP)  →  your bac
 
 Rust + [Aya](https://aya-rs.dev). Validated on Linux 6.8.
 
+## Tested
+
+Soak-tested under sustained load — observe on a production host, intervene in an isolated VM:
+
+| path | cases (all leak-free + correct under load) |
+|---|---|
+| **observe** | steady 20 min · edge-input · **a real a3s-code agent** · throughput 110k ev/60s · memory-bound (256 Mi) · restart ×8 · idle + heartbeat · SIGTERM · concurrent collectors · backpressure · connection-churn |
+| **intervene** | egress · file/exec · SSL-content guards — and all three running alongside the collector |
+
+Two robustness bugs surfaced and were fixed this way: NDJSON stdout pollution (v0.9.1) and an
+output-backpressure event-loop stall (v0.9.2). Lib line coverage **79.6%** (`cargo llvm-cov`) —
+the untrusted SNI / DNS / cgroup parsers and the full 14-provider classifier are unit-tested.
+
 ## Security
 
 Privileged component — see [SECURITY.md](SECURITY.md) for the disclosure policy and how to

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-collector"
-version = "0.9.2"
+version = "0.9.3"
 edition = "2021"
 license = "MIT"
 description = "a3s-observer collector: loads the eBPF probes and exports enriched events."

a3s-observer-collector/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-common"
-version = "0.9.2"
+version = "0.9.3"
 edition = "2021"
 license = "MIT"
 description = "Shared no_std types crossing the eBPF <-> userspace boundary for a3s-observer."

a3s-observer-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-ebpf"
-version = "0.9.2"
+version = "0.9.3"
 edition = "2021"
 license = "MIT"
 publish = false

a3s-observer-ebpf/Cargo.toml

@@ -276,6 +276,33 @@ mod tests {
             c.classify(Some("bedrock-runtime.us-east-1.amazonaws.com"), ip),
             Some(Provider::Bedrock)
         );
+        assert_eq!(
+            c.classify(Some("generativelanguage.googleapis.com"), ip),
+            Some(Provider::Gemini)
+        );
+        assert_eq!(
+            c.classify(Some("api.cohere.ai"), ip),
+            Some(Provider::Cohere)
+        );
+        assert_eq!(c.classify(Some("api.x.ai"), ip), Some(Provider::XAi));
+        assert_eq!(c.classify(Some("api.groq.com"), ip), Some(Provider::Groq));
+        assert_eq!(
+            c.classify(Some("api.together.xyz"), ip),
+            Some(Provider::Together)
+        );
+        assert_eq!(
+            c.classify(Some("api.perplexity.ai"), ip),
+            Some(Provider::Perplexity)
+        );
+        assert_eq!(
+            c.classify(Some("api.fireworks.ai"), ip),
+            Some(Provider::Fireworks)
+        );
+        assert_eq!(
+            c.classify(Some("openrouter.ai"), ip),
+            Some(Provider::OpenRouter)
+        );
+        assert_eq!(c.classify(None, ip), None); // no SNI → unclassified
         assert_eq!(c.classify(Some("example.com"), ip), None);
     }