docs(tasks): decompose wave 7 — the ops surface, the alkcall-backed op family behind the default-off feature

tasks/ops-e2e-flows.md

@@ -0,0 +1,115 @@
+---
+id: ops-e2e-flows
+name: the ops wire-level lifecycle proofs — have/need diffing, the token lifecycle, and the ACL matrix end-to-end
+status: pending
+depends_on: [ops-json-ops, ops-fetch, ops-put]
+scope: broad
+risk: medium
+impact: phase
+level: implementation
+tags: [wave-7, ops, e2e, tokens, acl, fleet]
+---
+
+## Description
+
+The capstone proofs through the harness (`ops-call-harness`) — the
+full lifecycle flows the individual handler tests exercise only in
+pieces. This is wave 7's equivalent of the engine waves' suite
+columns: the surface proven as a whole, on the wire.
+
+- **The have/need flow**: a consumer diffs `blobs/have` over its
+  digest set → fetches the absent digests (the need announcement *is*
+  the fetch miss — the diff is caller-side; the wire carries only
+  concrete fetch requests). Proven end-to-end: seed a store via the
+  facade, diff from the client side, fetch exactly the absent set,
+  re-diff to all-present.
+- **The fleet token lifecycle end-to-end** (against the harness
+  server — env-driven, skipping cleanly server-less; the
+  pglo-poc convention): put → token → renew via have's renewal form
+  before expiry (`present: true`; the row's expiry observed moving) →
+  the embedder's registration confirms → the row's protection hands
+  to the registered liveness source (the namespace binding's
+  converter) → the row expires naturally and the entry survives on
+  the registered source's protection. Then the failure half: pause
+  past TTL → the renewal probe answers `present: false` → the
+  sweeper reaps the row → the **re-put backstop** (delete-then-
+  recover; CAS makes the re-put idempotent) → **the race resolves to
+  a re-put, never to silent loss** (ADR-010 §4's expiry semantics
+  verbatim, on the wire).
+- **The foreign-token refusal**: a token minted by node A presented
+  to node B (a second fleet instance's ops module over the same
+  pool) → `present: false`, not an error — the validity domain is
+  the minting node (ADR-012 §2).
+- **The non-fleet token lifecycle**: put → token (the registry holds
+  the guard) → have-present answers from the custody → the embedder's
+  registration confirms → the guard converts (the namespace
+  binding's converter) → the token retires. Proven on a non-fleet
+  store (sqlite or mem — server-less).
+- **The ACL matrix end-to-end**: an unlisted namespace denies read
+  AND write (closed-by-default — OQ-09); a read-granted identity
+  fetches/stats/haves but cannot put; a write-granted identity puts
+  but a read-only peer cannot fetch its namespace; delete only under
+  the internal authority context (never a namespace grant).
+- **The re-routing posture's serving half** (ADR-008 §3): a large
+  (pg-lo) entry served through `blobs/fetch` from the storage node's
+  dual-tier fleet store — the shape client nodes in kv-only mode
+  consume; no fleet-specific op exists (the module supports the shape
+  without change).
+- **The no-side-door audit** (structural, ADR-001 §4): the ops
+  module's store access enumerated — the public facade plus the
+  foundation's crate-internal renewal seam only; no `Backend` touch,
+  no engine types, no path around the facade. Recorded as the audit
+  the wave-7 review gate re-checks.
+- **The renewal-cadence boundary honored** (ADR-013 §1): the tests
+  drive renewal explicitly (the embedder's cadence role played by the
+  test); no in-crate renewal worker exists.
+
+## Acceptance Criteria
+
+- [ ] The have/need flow proven end-to-end (diff caller-side; the
+      wire carries only concrete fetches)
+- [ ] The fleet token lifecycle end-to-end vs the harness server:
+      renew-before-expiry (the row's expiry moves), the
+      registration-handover, pause-past-TTL → reap → the re-put
+      backstop — never silent loss (env-driven; skipping cleanly
+      server-less; acceptance requires green against the server)
+- [ ] The foreign-token refusal: `present: false`, not an error
+- [ ] The non-fleet lifecycle: custody → confirmation → conversion →
+      token retirement (server-less)
+- [ ] The ACL matrix end-to-end (closed-by-default read+write denial;
+      the read/write split; delete internal-only)
+- [ ] The re-routing posture's serving half: a large entry fetched
+      through the ops surface from the dual-tier fleet store
+- [ ] The no-side-door audit recorded (the store-access enumeration)
+- [ ] Gates green: `cargo test` (default), `cargo test --features
+      ops`, `cargo test --all-features` (the fleet rows live at
+      acceptance), clippy/fmt across the variants, `cargo doc
+      --no-deps` clean
+
+## References
+
+- docs/architecture/ops-surface.md (§Op family — the hand-over
+  contract; the need-half note; §Store-facing relationship — the
+  re-routing posture)
+- docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md
+  §4 (the expiry semantics; the re-put backstop)
+- docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md
+  §2 (the validity domain; the non-fleet generalization)
+- docs/architecture/decisions/008-trait-size-probe-fleet-gc-and-large-engines.md
+  §2/§3 (the TTL/3 cadence; the re-routing topology)
+- docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md
+  §1 (the cadence is embedder composition)
+- docs/architecture/open-questions.md OQ-09 (closed-by-default)
+- tasks/ops-foundation.md, tasks/ops-call-harness.md,
+  tasks/ops-json-ops.md, tasks/ops-fetch.md, tasks/ops-put.md (the
+  surface this proves as a whole)
+- tasks/suite-column-fleet.md (the env-driven harness-server
+  convention this task's fleet rows follow)
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion