---
id: w6/m9/t008
title: "Test coverage — meaningful tests for each fix's real behavior"
worker: worker6
status: done
estimate: 30m
depends_on: [w6/m9/t006]
---

## Objective

Add or confirm meaningful tests for each of the five fixes, asserting real behavior and failure modes.

## Steps

1. PKCE: test that an authorization_code client without PKCE is rejected.
2. Constant-time comparisons: test both keys still authenticate correctly (behavior-preserving, not a timing test).
3. GitHub error collapse: test a simulated 5xx no longer leaks its body.
4. CRD validation: test a malformed hand-applied CR is rejected.
5. Autoscaling: the fixed tests from t005 themselves count as the regression coverage.

## Acceptance criteria

- [ ] Each fix has a test asserting its real behavior, not just "doesn't crash."
