Stress Testing

The current V2 runner is a bounded HTTP response check for a local server or an explicitly allowed preview. It measures the public sign-in pages and, when a session cookie is supplied, the authenticated Reports, Pipeline, and Invoices pages. It does not simulate 1,000 users, measure production traffic, inspect queue health, or prove production capacity.

Run the V2 check

Run these commands from the application repository after starting the local web app. The first command prints the request plan and sends no traffic; pass --execute to run it.

$env:STRESS_BASE_URL = "http://127.0.0.1:3000"
pnpm ops:stress
pnpm ops:stress -- --execute | Tee-Object -FilePath .\stress-report.json

A preview target must use HTTPS and be listed as the exact same origin in STRESS_ALLOWED_ORIGINS. Loopback HTTP is allowed by default. The runner refuses production hosts and does not follow redirects; redirect responses are measured as responses. For example:

$env:STRESS_BASE_URL = "https://<branch-preview-host>"
$env:STRESS_ALLOWED_ORIGINS = "https://<branch-preview-host>"
$env:STRESS_MAX_REQUESTS = "60"
$env:STRESS_CONCURRENCY = "5"
# Optional: set a preview-session Cookie header in the current shell only.
$env:STRESS_SESSION_COOKIE = "<preview Cookie header>"
pnpm ops:stress -- --execute | Tee-Object -FilePath .\stress-report.json

Do not commit or share a real session cookie. Without STRESS_SESSION_COOKIE, the runner skips the authenticated routes; a passing result then covers only the public pages. The JSON plan or execution report is written to standard output; Tee-Object saves a local copy without adding an unsupported report-output option. The runner accepts 2xx and 3xx page responses as successful HTTP responses; a sign-in redirect is not proof that an authenticated page's content was served.

The supported paths are GET /, GET /sign-in, and, with a session cookie, GET /reports, GET /pipeline, and GET /invoices. The default request budget is 60, capped at 500, with concurrency defaulting to 5 and capped at

1. Each request times out after 15 seconds and is not retried. Set

STRESS_EXPECTED_UNAUTHORIZED_PATHS only for known route paths where a 401 or 403 is expected; other unsuccessful status responses count toward the error rate.

The starting thresholds are an overall error rate at or below 2%, public-page p95 latency at or below 800 ms, and authenticated-page p95 latency at or below 1,500 ms. These are operational check thresholds, not a measured SLO or a capacity guarantee. Record the target, time window, request budget, and JSON output when comparing runs.

Historical V1 load drill

The older V1 guide described a 1K-user profile, cookie pools, telemetry collection, /api/health, and queue-backlog checks. Those instructions do not match the current V2 runner and are not a V2 capability. Use the V2 check above for its limited page-response scope, and follow the separate current operations runbook for production telemetry and queue monitoring.

Related Docs

• Platform Reliability
• Operations Runbook
• Supabase Region Migration