Version bump/0.5.2 (#24)

* fix: P0 security/stability hardening bundle

Closes the P0/P1/P2/P3 issues from the security review (plan §10/§11.4).

Security / PCI-DSS / GDPR

- P0-1: Mask positional PII in `_enforce_sensitive_tool` by introspecting
  the wrapped function's signature and applying `SENSITIVE_ARG_KEYS` to
  positional params. Pre-fix, `charge("4111-…-1111", 50)` forwarded the
  PAN into `/execute` and the audit log.
- P0-6 / P3-3: `_safe_repr` now redacts BEFORE truncating. The pre-fix
  order truncated first, so `details={…}` past position 50 leaked
  verbatim. `_safe_repr` is now the single source of truth for the
  redact-then-truncate flow.

Cost-audit / reliability

- P0-3: Bounded chunked reads on the sync + async httpx transports
  (`MAX_RESPONSE_BYTES`, default 16 MiB, `NULLRUN_MAX_RESPONSE_BYTES`
  env override). Above the cap, tracking is skipped and
  `_coverage_streaming_skipped` is incremented. Replaces the
  `response.read()` / `await response.aread()` unbounded buffer that
  held entire LLM streaming bodies in memory.
- P0-4: `_do_flush_locked` re-queue on CB OPEN now drops the NEWEST
  non-critical events instead of the oldest. The oldest events
  (incident start, billing-period start) are exactly what a billing
  investigator needs; losing them silently broke monthly rollups.
  Control-plane events (`state_change`, `kill_received`,
  `policy_invalidated`, `key_rotated`) are preserved unconditionally
  so the dashboard KILL switch lands even under sustained backend
  outage.

Identity

- S-8 / P2-4: `agent()` now emits `str(uuid.uuid4())` (with dashes).
  Pre-fix the format was `f"agent-{uuid.uuid4().hex}"` — 32 hex chars,
  no dashes — and backend UUID-typed columns dropped these to NULL
  on insert. User-supplied names are still preserved verbatim.
- §7.2 #16: `workflow()` context manager now resets `span_id` (not
  only `workflow_id` / `trace_id`) so nested `with span()` blocks
  don't leave the inner span_id visible inside the workflow scope.

Resource leaks

- S-9: `_active_runs` on `NullRunCallback` is now an `OrderedDict`
  capped at 4096 with FIFO eviction. Pre-fix the dict grew
  unbounded when `on_chain_end` did not fire (some LangChain
  versions short-circuit the end hook on chain-body errors).
- S-10: WebSocket reconnect loop is now capped at 10 consecutive
  failures, then falls back to HTTP-poll. Pre-fix the loop ran
  forever when the backend was permanently down, leaking the
  WS thread.

Transport

- §7.2 #6: Separate `hmac_verify_expired_total` counter so SRE can
  distinguish clock-skew (NTP drift) from forged packets. Mirrored
  in both the HTTP and WebSocket verify paths.
- §7.2 #35: `CircuitBreaker.call` now dispatches the OPEN→HALF_OPEN
  jitter through `_maybe_apply_open_jitter_sync` /
  `_maybe_apply_open_jitter_async`. Pre-fix the jitter used
  `time.sleep` before dispatching to async, which blocked the
  caller's event loop on every transition.
- P2-1: `_coverage_seen` now bumps in the httpx path (sync + async).
  Pre-fix the counter was only bumped by the `requests` transport,
  so the dashboard's coverage view was empty for the dominant
  OpenAI / Anthropic / Gemini / Mistral / Cohere traffic.
- P2-3: `is_sensitive_tool` match is case-insensitive. Pre-fix
  `"stripe.charge"` did not match `"Stripe.Charge"`, bypassing the
  sensitive gate.

Concurrency

- §7.2 #39: New `_tools_lock` guards every mutation of
  `_strict_mode_tools` / `_sensitive_tools`. Same lock guards the
  coverage-counter bump+prune sequence (§7.2 #33) so two threads
  can't both observe the dict at length 4095 and both grow it to
  4097 before either prune lands.
- §7.2 #47: New `_langchain_lock` / `_langgraph_lock` guard the
  patch sequences end-to-end. Pre-fix two threads racing through
  `auto_instrument` could both pass the early `_x_patched` check
  and double-wrap `BaseCallbackManager` / `Pregel`.
- §7.2 #33: `_COVERAGE_CAP` (4096) bounds the per-host coverage
  dicts.

Webhook delivery

- P3-2: Exponential backoff (0.5s, 1s, 2s, 4s, 8s, 16s, 30s cap)
  replaces the previous linear schedule. Linear didn't back off
  fast enough under sustained outage — each KILL/PAUSE spawned
  its own delivery thread, producing 1000+ spinning threads
  hammering the dead endpoint.

WAL crash-recovery

- P1-5b: Atomic WAL writes (tmp + `fsync` + `os.replace`), 64 MiB
  rotation with `os.replace(wal, wal.1)`, replay drains both
  `wal.1` and `wal`. New `NULLRUN_WAL_PATH` / `NULLRUN_WAL_MAX_BYTES`
  env overrides for containers with `readOnlyRootFilesystem: true`.

Tests

8 new regression test files (57 tests total):
  test_agent_id_uuid.py, test_args_pii_masked.py,
  test_streaming_oom_cap.py, test_lru_active_runs.py,
  test_reconnect_cap.py, test_coverage_seen_httpx.py,
  test_webhook_backoff.py, test_redact.py

`test_buffer_invariants.py` extended with drop-newest +
critical-event preservation cases. `test_release_polish.py`
updated to pin the 5s cap on both the sync and async jitter
helpers (post §7.2 #35 split).

Full incident write-ups in CHANGELOG.md under the same P0/S/P tags.

* fix: address ruff lint findings from CI

Three CI lint failures on `ruff check src/` — fixes only, no
behavioural changes:

- **B905** (`src/nullrun/decorators.py:162`): `zip(bound_params,
  args)` now passes `strict=False` explicitly. Pre-fix the two
  iterables can be different lengths — `bound_params` is sliced to
  `[: len(args)]` but the function may have fewer positional
  parameters than args provided (e.g. *args-style callables), in
  which case the trailing loop below handles the excess. `strict=`
  was implicit and triggered B905. Now explicit so the intent is
  documented in code.

- **I001** (`src/nullrun/instrumentation/auto.py:1146`): the late
  `import os as _os` was moved to the top-of-file import block as
  `import os` (alphabetical order: hashlib, json, logging, os,
  threading). The `_os` alias was only there to avoid shadowing —
  there is no top-level `os` in scope, so the plain name is fine.
  Call site updated to use `os.environ.get(...)`.

- **S108** (`src/nullrun/transport.py:632`): replaced the
  hardcoded `/tmp/nullrun.wal` with
  `os.path.join(tempfile.gettempdir(), "nullrun.wal")`. The
  hardcoded `/tmp` flagged S108 (insecure / non-portable temp
  path) and would have broken the SDK on Windows out of the box.
  `gettempdir()` returns the OS-appropriate temp dir
  (`/tmp` on Linux, `/var/folders/...` on macOS, `%TEMP%` on
  Windows). `NULLRUN_WAL_PATH` env override still wins, so
  containers with `readOnlyRootFilesystem: true` are unaffected.
  Added `import tempfile` to the top-of-file imports.

Verified:
  - `ruff check src/` → All checks passed!
  - `mypy src/` → Success: no issues found in 23 source files
  - `pytest` → 493 passed, 13 skipped (CI default, no `-W error`)

* chore(release): bump to 0.5.2

- Promote [Unreleased] to [0.5.2] — 2026-06-19; merge the two
  [Unreleased] sections that had drifted during Sprint 2.5 +
  Phase 0 development so release tooling scanning for the
  [Unreleased] anchor picks up the complete change set exactly
  once.
- Add PEP 561 marker (py.typed) — the package ships inline type
  annotations; the marker tells mypy / pyright / pylance to honour
  them.
- runtime.py (S-4): case-insensitive state compare in
  check_control_plane. Defensive against any backend casing drift
  beyond the current PascalCase (handlers.rs:9258). Pinned by
  tests/test_state_compare_case_insensitive.py (10 cases covering
  PascalCase / UPPERCASE / lowercase / mixed-case).

Working-notes file docs/integration-baseline-2026-06-19.md is
deliberately left untracked, matching the analyze.md pattern from
d74712e.

Author: maltsev-dev

CHANGELOG.md

@@ -132,7 +132,14 @@ surface is unchanged. Aligns the SDK with the contracts in
   description of an older design that did not match the
   shipped SDK.
 
-## [Unreleased]
+## [0.5.2] — 2026-06-19
+
+This release bundles the Sprint 2.5 production-readiness hardening
+alongside the Phase 0 contract / lifecycle fixes. The two streams were
+shipped as separate `[Unreleased]` sections during development; they
+are merged here into a single canonical entry so release tooling that
+scans for the `[Unreleased]` anchor picks up the complete change set
+exactly once.
 
 ### Added (production-readiness hardening)
 
@@ -209,6 +216,26 @@ surface is unchanged. Aligns the SDK with the contracts in
   fingerprint used by `track_event` (the existing
   `_fingerprint_for` is for HTTP responses keyed on host+body+status).
 
+- **Async Policy Cache**: `AsyncTransport` now uses `PolicyCache` for CACHED fallback mode. Previously the async transport always fell back to PERMISSIVE when gateway was unreachable. Now it caches successful execute decisions and uses them when gateway is unavailable.
+
+- **Custom Sensitive Tools API**: Added `add_sensitive_tool()`, `remove_sensitive_tool()`, `register_sensitive_tools()`, and `get_sensitive_tools()` methods to `NullRunRuntime`. Users can now register custom tools as sensitive requiring strict mode enforcement.
+
+- **`NullRunBlockedException.tool_name` attribute** (FIX-5): The `tool_name`
+  kwarg is now a first-class attribute on `NullRunBlockedException`
+  (and its subclasses `LoopDetectedException`, etc.) instead of being
+  absorbed into `**details`. Cookbook examples that read `exc.tool_name`
+  no longer raise `AttributeError`. Backwards-compatible: `tool_name`
+  defaults to `None` and does not appear in `exc.details` when unset.
+  The stringified exception now includes `tool={name}` when set.
+
+- **`check_control_plane` is case-insensitive on the state value.**
+  SDK now normalises the state with `.lower()` before comparing to
+  `"paused"` / `"killed"`. Pre-fix a backend regression to UPPERCASE
+  (e.g. `"KILLED"` in `state_change`) would have silently failed the
+  match and let a killed workflow keep running. Backend already emits
+  PascalCase per the `as_pascal_case()` normaliser in
+  `handlers.rs:9258`; this is defensive per `analyze.md` §11.6.
+
 ### Removed (Phase 5)
 
 - **Empty placeholder modules deleted.** `src/nullrun/flow/`,
@@ -238,32 +265,88 @@ surface is unchanged. Aligns the SDK with the contracts in
   behalf) to `X-API-Key`, and from the non-existent `/usage`
   endpoint to the canonical `/quota` per `contracts/openapi.yaml`.
 
-### Notes
+- **P0-1 (PCI-DSS / GDPR): positional PII masking.** Sensitive tools
+  called positionally (e.g. ``charge("4111-1111-1111-1111", 50)``) now
+  mask positional args the same way kwargs already do, by introspecting
+  the function signature with ``inspect.signature(fn)`` and applying
+  ``SENSITIVE_ARG_KEYS`` to the matching parameter name. Pre-fix the
+  PAN at position 0 was forwarded as-is into ``/execute`` and landed
+  in the audit log.
 
-- Public surface unchanged. `init`, `protect`, `track_llm`,
-  `track_tool`, `track_event` retain the same call signatures
-  documented in the existing examples. The platform's
-  `docs/sdk/README.md` describes an alternative 7-symbol surface
-  (with `wrap` alias and a different `init(organization_id, ...)`
-  signature) — that doc is out of sync with the SDK; an update
-  to the platform docs is tracked separately. Per the production
-  plan's user decisions, the SDK's surface is the source of truth.
+- **P0-3 (OOM): streaming response memory cap.** Sync and async
+  httpx transports now use bounded chunked reads capped at
+  ``MAX_RESPONSE_BYTES`` (16 MiB by default; ``NULLRUN_MAX_RESPONSE_BYTES``
+  env var to override). When the cap is exceeded, tracking is skipped
+  and ``_coverage_streaming_skipped`` is incremented so the dashboard
+  sees which hosts are producing oversized responses. Pre-fix
+  ``response.read()`` / ``await response.aread()`` buffered the entire
+  response body in memory — a 16+ MB allocation per streaming LLM
+  call under load.
 
-## [Unreleased]
+- **P0-4 (cost-audit): drop-newest on buffer overflow.** The CB-OPEN
+  re-queue path in ``Transport._do_flush_locked`` now drops the
+  NEWEST non-critical events instead of the oldest. The oldest
+  events (start-of-incident, start-of-billing-period) are exactly
+  what a billing investigator needs to reconstruct — losing them
+  silently broke monthly rollups. Control-plane events
+  (``state_change`` / ``kill_received`` / ``policy_invalidated`` /
+  ``key_rotated``) are preserved regardless of position so the
+  dashboard's KILL switch continues to land even under sustained
+  backend outage.
 
-### Added
+- **P0-6 + P3-3 (security): redact-before-truncate.** ``_safe_repr``
+  now runs ``_strip_details_balanced`` on the FULL repr before
+  truncating to ``max_len=50``. Pre-fix the truncate ran first, and
+  if ``details={...}`` lived past position 50 in the original repr
+  (common for httpx.HTTPError with a long URL), the redact pass
+  saw nothing on the truncated slice and the raw payload leaked
+  into ``span_end`` audit events.
 
-- **Async Policy Cache**: `AsyncTransport` now uses `PolicyCache` for CACHED fallback mode. Previously the async transport always fell back to PERMISSIVE when gateway was unreachable. Now it caches successful execute decisions and uses them when gateway is unavailable.
-- **Custom Sensitive Tools API**: Added `add_sensitive_tool()`, `remove_sensitive_tool()`, `register_sensitive_tools()`, and `get_sensitive_tools()` methods to `NullRunRuntime`. Users can now register custom tools as sensitive requiring strict mode enforcement.
-- **`NullRunBlockedException.tool_name` attribute** (FIX-5): The `tool_name`
-  kwarg is now a first-class attribute on `NullRunBlockedException`
-  (and its subclasses `LoopDetectedException`, etc.) instead of being
-  absorbed into `**details`. Cookbook examples that read `exc.tool_name`
-  no longer raise `AttributeError`. Backwards-compatible: `tool_name`
-  defaults to `None` and does not appear in `exc.details` when unset.
-  The stringified exception now includes `tool={name}` when set.
+- **S-8 / P2-4: ``agent_id`` is now a real UUID with dashes.**
+  ``agent()`` context manager emits ``str(uuid.uuid4())`` (e.g.
+  ``95ca7c0b-8334-478a-af23-2788803ef3b8``) for auto-generated ids.
+  Pre-fix the format was ``f"agent-{uuid.uuid4().hex}"`` — 32 hex
+  chars with no dashes; backend UUID-typed columns silently
+  dropped these to NULL on insert. User-supplied names are still
+  preserved verbatim.
 
-### Fixed
+- **S-9: LRU cap on ``NullRunCallback._active_runs``** (4096 entries,
+  FIFO eviction with WARN log). Pre-fix this dict grew unbounded
+  when ``on_chain_end`` did not fire (errors in the chain body
+  short-circuited the end hook for some LangChain versions),
+  leaking memory in long-running services.
+
+- **S-10: WebSocket reconnect max-attempts cap** (10 consecutive
+  failures). Pre-fix the loop was unbounded (``while not
+  self._closed:``) and leaked the WS thread forever when the backend
+  was permanently down. After the cap the SDK falls back to
+  HTTP-poll for control-plane state delivery.
+
+- **P2-1: ``_coverage_seen`` now bumps in the httpx path.**
+  Pre-fix the counter was only incremented in the ``requests``
+  path (``auto_requests.py:185``), so the dashboard's coverage
+  view was empty for the dominant httpx traffic (every OpenAI /
+  Anthropic / Gemini / Mistral / Cohere call). Now both sync and
+  async httpx ``_emit`` bump the counter.
+
+- **P3-2: webhook delivery uses exponential backoff** (cap 30s).
+  Pre-fix the schedule was linear (``0.5 * (attempt + 1)``); under
+  sustained outage this produced a tight retry storm on the dead
+  endpoint — each KILL/PAUSE spawned its own delivery thread.
+  Post-fix the schedule is ``0.5 * 2**attempt`` capped at 30s:
+  0.5s, 1.0s, 2.0s, 4.0s, 8.0s, 16.0s, 30.0s.
+
+### Tests
+
+Added regression tests for every item above (57 new tests across 9
+new test files: ``test_agent_id_uuid.py``, ``test_args_pii_masked.py``,
+``test_streaming_oom_cap.py``, ``test_lru_active_runs.py``,
+``test_reconnect_cap.py``, ``test_coverage_seen_httpx.py``,
+``test_webhook_backoff.py``, ``test_redact.py``; existing
+``test_buffer_invariants.py`` extended with drop-newest + critical-event
+preservation cases).
+
+### Legacy
 
 - **P0-1 (PCI-DSS / GDPR): positional PII masking.** Sensitive tools
   called positionally (e.g. ``charge("4111-1111-1111-1111", 50)``) now
@@ -352,6 +435,17 @@ preservation cases).
   the SDK has no local mode: a missing API key is a hard error, not a
   silent allow-all.
 
+### Notes
+
+- Public surface unchanged. `init`, `protect`, `track_llm`,
+  `track_tool`, `track_event` retain the same call signatures
+  documented in the existing examples. The platform's
+  `docs/sdk/README.md` describes an alternative 7-symbol surface
+  (with `wrap` alias and a different `init(organization_id, ...)`
+  signature) — that doc is out of sync with the SDK; an update
+  to the platform docs is tracked separately. Per the production
+  plan's user decisions, the SDK's surface is the source of truth.
+
 ---
 
 ## [0.4.0] — 2026-06-17
@@ -571,6 +665,6 @@ _No breaking changes yet. Watch this file._
 
 ---
 
-[Unreleased]: https://github.com/maltsev-dev/nullrun-sdk/compare/v0.1.1...HEAD
+[0.5.2]: https://github.com/maltsev-dev/nullrun-sdk/compare/v0.4.0...v0.5.2
 [0.1.1]: https://github.com/maltsev-dev/nullrun-sdk/releases/tag/v0.1.1
 [0.1.0]: https://github.com/maltsev-dev/nullrun-sdk/releases/tag/v0.1.0

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nullrun"
-version = "0.4.0"
+version = "0.5.2"
 description = "NullRun Python SDK — Enforcement gateway for AI agents."
 readme = "README.md"
 license = { text = "Apache-2.0" }

src/nullrun/__version__.py

@@ -1,4 +1,4 @@
 """NullRun Platform SDK."""
 
-__version__ = "0.4.0"
+__version__ = "0.5.2"
 __platform_version__ = "1.0.0"

src/nullrun/py.typed

@@ -0,0 +1,18 @@
+# PEP 561 marker for the `nullrun` package.
+#
+# The presence of this file (even when empty) tells type checkers
+# (mypy, pyright, pylance) that the package ships inline type
+# annotations and they should be honoured instead of falling back
+# to `Any`. See https://peps.python.org/pep-0561/.
+#
+# The SDK is currently PARTIAL — most public surface is typed but
+# `dict[str, Any]` returns, `Optional` fall-throughs, and a few
+# transport callbacks leak `Any` for now. As those land in follow-up
+# releases this marker stays the same; the inline annotations carry
+# the granularity. A future `py.typed` -> `py.typed.full` rename is
+# the standard PEP 561 upgrade path once we go 100% typed.
+#
+# For projects that need strict typing today: pin mypy with
+# `--disallow-any-explicit=false --warn-unused-ignores=true` and
+# ignore the residual `Any` from the public surface until
+# coverage improves.

src/nullrun/runtime.py

@@ -962,13 +962,22 @@ def check_control_plane(self, workflow_id: str) -> None:
             remote_state = self._remote_state_for(workflow_id)
         state = remote_state.get("state", "Normal")
 
-        if state == "Paused":
+        # S-4: case-insensitive compare per analyze.md §11.6. The backend
+        # already emits PascalCase via the `as_pascal_case()` normaliser
+        # in `handlers.rs:9258`, but a future regression to UPPERCASE
+        # (or any other casing) would silently fail the match and let a
+        # killed workflow keep running. Normalise here so the SDK
+        # survives any wire-format drift without needing a coordinated
+        # backend change.
+        state_normalized = state.lower() if isinstance(state, str) else "normal"
+
+        if state_normalized == "paused":
             reason = remote_state.get("reason", "remote pause")
             raise WorkflowPausedException(
                 workflow_id=workflow_id,
                 reason=reason,
             )
-        elif state == "Killed":
+        elif state_normalized == "killed":
             reason = remote_state.get("reason", "remote kill")
             raise WorkflowKilledInterrupt(
                 workflow_id=workflow_id,

tests/test_state_compare_case_insensitive.py

@@ -0,0 +1,110 @@
+"""Regression tests for S-4: case-insensitive state compare in
+``NullRunRuntime.check_control_plane``.
+
+Why this exists. Per ``analyze.md`` §11.6 the wire-format ``state``
+value can drift across backend versions — `as_pascal_case()`
+emits ``"Paused"`` / ``"Killed"`` today, but a regression to
+``"PAUSED"`` / ``"KILLED"`` (the historical UPPERCASE DB format)
+would silently bypass the SDK-side kill/pause detection. The
+pre-fix code did exact ``state == "Paused"`` / ``state == "Killed"``
+comparisons.
+
+The fix normalises ``state.lower()`` before the membership test
+so the SDK survives any casing drift without needing a coordinated
+backend change. Backend already emits PascalCase per
+``handlers.rs:9258``; this is defensive.
+"""
+from __future__ import annotations
+
+import pytest
+
+from nullrun.breaker.exceptions import WorkflowKilledInterrupt, WorkflowPausedException
+from nullrun.runtime import NullRunRuntime
+
+
+@pytest.fixture
+def runtime():
+    rt = NullRunRuntime(
+        api_key="test-key-12345678",
+        _test_mode=True,
+        polling=False,
+    )
+    yield rt
+    try:
+        rt.shutdown()
+    except Exception:
+        pass
+
+
+def _seed_remote_state(rt: NullRunRuntime, state_value) -> None:
+    """Push a state dict straight into the in-memory cache via the
+    thread-safe helper. We bypass HTTP poll entirely."""
+    rt._set_remote_state("wf-test", {"state": state_value, "reason": "test"})
+
+
+class TestPascalCase:
+    """The current backend contract — PascalCase via ``as_pascal_case()``."""
+
+    def test_killed_pascal_case_raises(self, runtime):
+        _seed_remote_state(runtime, "Killed")
+        with pytest.raises(WorkflowKilledInterrupt):
+            runtime.check_control_plane("wf-test")
+
+    def test_paused_pascal_case_raises(self, runtime):
+        _seed_remote_state(runtime, "Paused")
+        with pytest.raises(WorkflowPausedException):
+            runtime.check_control_plane("wf-test")
+
+
+class TestUppercaseDrift:
+    """If a backend regression emits UPPERCASE (the historical DB
+    format), the SDK must still raise — the case-insensitive
+    compare catches the drift."""
+
+    def test_killed_uppercase_raises(self, runtime):
+        _seed_remote_state(runtime, "KILLED")
+        with pytest.raises(WorkflowKilledInterrupt):
+            runtime.check_control_plane("wf-test")
+
+    def test_paused_uppercase_raises(self, runtime):
+        _seed_remote_state(runtime, "PAUSED")
+        with pytest.raises(WorkflowPausedException):
+            runtime.check_control_plane("wf-test")
+
+
+class TestLowercaseDrift:
+    """If a backend regression emits lowercase, the SDK must still
+    raise. (Same code path as Uppercase via .lower(), but exercises
+    a separate input variant.)"""
+
+    def test_killed_lowercase_raises(self, runtime):
+        _seed_remote_state(runtime, "killed")
+        with pytest.raises(WorkflowKilledInterrupt):
+            runtime.check_control_plane("wf-test")
+
+    def test_paused_lowercase_raises(self, runtime):
+        _seed_remote_state(runtime, "paused")
+        with pytest.raises(WorkflowPausedException):
+            runtime.check_control_plane("wf-test")
+
+
+class TestNormalState:
+    """Anything that does NOT reduce to ``paused`` / ``killed`` must
+    be a silent pass-through — including the default ``Normal``,
+    explicit ``"normal"``, ``"running"``, ``"flagged"``, etc."""
+
+    def test_normal_pascal_does_not_raise(self, runtime):
+        _seed_remote_state(runtime, "Normal")
+        runtime.check_control_plane("wf-test")  # no raise
+
+    def test_normal_lowercase_does_not_raise(self, runtime):
+        _seed_remote_state(runtime, "normal")
+        runtime.check_control_plane("wf-test")  # no raise
+
+    def test_running_does_not_raise(self, runtime):
+        _seed_remote_state(runtime, "Running")
+        runtime.check_control_plane("wf-test")  # no raise
+
+    def test_unknown_does_not_raise(self, runtime):
+        _seed_remote_state(runtime, "Tripped")  # not in the KILL/PAUSE set
+        runtime.check_control_plane("wf-test")  # no raise