One running instance = one world.The isolation boundary is the process, not a key lookup inside a shared server. Two worlds never share objects, webhooks, or time — because they’re two different running instances.
The key authenticates, it doesn’t select
Each instance mints its own key at startup (high-entropy, printed to the boot log, pinnable via env for reproducible CI). Your test reads that key; it’s never user-chosen. That key authenticates you to this one world. It does not select among worlds — there’s only one. So two test suites can never collide on a shared key, and a wrong key is simply a401.
reset() between tests
You don’t get a fresh instance per test — that would be slow. Instead the world is reset between
tests: state emptied, clock rewound to t0. It’s the beforeEach / DB-transaction-rollback
pattern, and your test plugin does it for you.
t0 is a fixed, reproducible constant
Every fresh world starts at the same canonical
t0 (e.g. 2025-01-01T00:00:00Z), not
system-now — so time-derived fields are byte-identical across runs. Override it per world to test
date-sensitive logic like month-end billing. See The virtual clock.Parallelism: one instance per worker
Because one instance is one world, parallel test workers must not share an instance. Each worker gets its own instance (its own world + key);reset() keeps tests independent within a worker.
The CLI provisions this for you:
A future “many worlds out of one shared instance” model (session-ids) is on the roadmap, but today the
mental model is dead simple: a fresh world is a fresh instance.