[liran]

AWS OpenSearch Service domains often enable compatibility.override_main_response_version so Elasticsearch 7.10 clients keep working. In that mode GET / reports version 7.10.2 with no distribution and no build_flavor. qualify() accepts only distribution: opensearch or Elasticsearch build_flavor: default, so Weir refused to start with "unsupported Search server product". A production OpenSearch 2.17 domain answers like this (account and node names removed):

{"version":{"number":"7.10.2","build_type":"tar","build_hash":"unknown","build_snapshot":false,"lucene_version":"9.11.1","minimum_wire_compatibility_version":"7.10.0","minimum_index_compatibility_version":"7.0.0"},"tagline":"The OpenSearch Project: https://opensearch.org/"}

qualify() now also accepts a root with version 7.10.2, no distribution, no build flavor and exactly the OpenSearch tagline, and uses the OpenSearch dialect for it. Elasticsearch, including 7.10 OSS (build_flavor: oss) and any root with the Elasticsearch tagline, is still accepted or rejected as before. The unit table adds this response and its near misses.

Weir's fixtures had moved to OpenSearch 3.3 (2.19.x until 70ddb58) and none ran compatibility mode, so this adds a third fixture: scripts/search-local.sh start opensearch-compat runs OpenSearch 2.17.1 with the compatibility setting on port 19203, and WEIR_SEARCH_PRODUCT=opensearch-compat selects it. The secure (HTTPS and basic-auth security plugin) fixture uses the same image and setting. Because the root reports 7.10.2, both fixtures also check that GET /_nodes/_local reports 2.17.1. The Go fixtures share one table in internal/testutil/testsearch/backend.go; scripts/search-local.sh keeps its own copy of the names, ports, digests and identity checks. CI adds opensearch-compat to the integration and process-integration matrices.

Run locally against the new fixture (MongoDB 8.0.32):

• go test -race -p=1 -tags=integration ./... with the normal profile passes, apart from the two fixture expectations changed below.
• The capacity-rejection tests pass with the overload profile, so the 2.17 rejected_execution_exception is recognized.
• The process fault and load tests were not run locally; CI runs them in the new matrix entry.

Two fixture expectations changed for 2.17:

• TestSecureSearchQualification: OpenSearch 2.17 returns the same unstructured text/plain 401 as 3.3, so the 401 cases expect the same UNKNOWN outcome.
• TestSearchSecurityInputBoundary skips this profile. It probes OpenSearch's own search.query.max_query_string_length, which does not exercise Weir. That limit is the fix for CVE-2025-9624 (a query_string denial of service) and first shipped in 2.19.4, so this profile is a known-unpatched build. It is pinned to 2.17 because that is the production domain's version.

The new CI checks are not yet required by branch protection. README, docs/configuration.md (product detection) and docs/development.md (the fixture) are updated.