Verifying isolation under load

bench/multi_tenant.py simulates N concurrent users × M turns through one shared Agent and reports p50 / p99 latency, RSS growth, isolation violations (cross-user data leakage), and budget accounting mismatches:


python bench/multi_tenant.py --users 100 --turns 3
python bench/multi_tenant.py --users 500 --turns 5  # stress

Output for the 500 × 5 stress run on a developer laptop:


============================================================
  Multi-tenant load bench
============================================================
  users          : 500
  turns / user   : 5
  total runs     : 2500

  p50 turn latency : 1008.04 ms
  p99 turn latency : 1057.01 ms
  RSS growth         : 10179 KB
  per-user growth    : 20.36 KB/user

  isolation violations : 0
  budget mismatches    : 0

  PASS: isolation + budget accounting hold under load

A smoke-test variant runs as part of the regular pytest suite (tests/test_multi_tenant_load.py) at lower scale (10 users × 2 turns) so a regression to the isolation contract gets caught in CI.