---
id: ops-e2e-flows
name: the ops wire-level lifecycle proofs — have/need diffing, the token lifecycle, and the ACL matrix end-to-end
status: pending
depends_on: [ops-json-ops, ops-fetch, ops-put]
scope: broad
risk: medium
impact: phase
level: implementation
tags: [wave-7, ops, e2e, tokens, acl, fleet]
---

## Description

The capstone proofs through the harness (`ops-call-harness`) — the
full lifecycle flows the individual handler tests exercise only in
pieces. This is wave 7's equivalent of the engine waves' suite
columns: the surface proven as a whole, on the wire.

- **The have/need flow**: a consumer diffs `blobs/have` over its
  digest set → fetches the absent digests (the need announcement *is*
  the fetch miss — the diff is caller-side; the wire carries only
  concrete fetch requests). Proven end-to-end: seed a store via the
  facade, diff from the client side, fetch exactly the absent set,
  re-diff to all-present.
- **The fleet token lifecycle end-to-end** (against the harness
  server — env-driven, skipping cleanly server-less; the
  pglo-poc convention): put → token → renew via have's renewal form
  before expiry (`present: true`; the row's expiry observed moving) →
  the embedder's registration confirms → the row's protection hands
  to the registered liveness source (the namespace binding's
  converter) → the row expires naturally and the entry survives on
  the registered source's protection. Then the failure half: pause
  past TTL → the renewal probe answers `present: false` → the
  sweeper reaps the row → the **re-put backstop** (delete-then-
  recover; CAS makes the re-put idempotent) → **the race resolves to
  a re-put, never to silent loss** (ADR-010 §4's expiry semantics
  verbatim, on the wire).
- **The foreign-token refusal**: a token minted by node A presented
  to node B (a second fleet instance's ops module over the same
  pool) → `present: false`, not an error — the validity domain is
  the minting node (ADR-012 §2).
- **The non-fleet token lifecycle**: put → token (the registry holds
  the guard) → have-present answers from the custody → the embedder's
  registration confirms → the guard converts (the namespace
  binding's converter) → the token retires. Proven on a non-fleet
  store (sqlite or mem — server-less).
- **The ACL matrix end-to-end**: an unlisted namespace denies read
  AND write (closed-by-default — OQ-09); a read-granted identity
  fetches/stats/haves but cannot put; a write-granted identity puts
  but a read-only peer cannot fetch its namespace; delete only under
  the internal authority context (never a namespace grant).
- **The re-routing posture's serving half** (ADR-008 §3): a large
  (pg-lo) entry served through `blobs/fetch` from the storage node's
  dual-tier fleet store — the shape client nodes in kv-only mode
  consume; no fleet-specific op exists (the module supports the shape
  without change).
- **The no-side-door audit** (structural, ADR-001 §4): the ops
  module's store access enumerated — the public facade plus the
  foundation's crate-internal renewal seam only; no `Backend` touch,
  no engine types, no path around the facade. Recorded as the audit
  the wave-7 review gate re-checks.
- **The renewal-cadence boundary honored** (ADR-013 §1): the tests
  drive renewal explicitly (the embedder's cadence role played by the
  test); no in-crate renewal worker exists.

## Acceptance Criteria

- [ ] The have/need flow proven end-to-end (diff caller-side; the
      wire carries only concrete fetches)
- [ ] The fleet token lifecycle end-to-end vs the harness server:
      renew-before-expiry (the row's expiry moves), the
      registration-handover, pause-past-TTL → reap → the re-put
      backstop — never silent loss (env-driven; skipping cleanly
      server-less; acceptance requires green against the server)
- [ ] The foreign-token refusal: `present: false`, not an error
- [ ] The non-fleet lifecycle: custody → confirmation → conversion →
      token retirement (server-less)
- [ ] The ACL matrix end-to-end (closed-by-default read+write denial;
      the read/write split; delete internal-only)
- [ ] The re-routing posture's serving half: a large entry fetched
      through the ops surface from the dual-tier fleet store
- [ ] The no-side-door audit recorded (the store-access enumeration)
- [ ] Gates green: `cargo test` (default), `cargo test --features
      ops`, `cargo test --all-features` (the fleet rows live at
      acceptance), clippy/fmt across the variants, `cargo doc
      --no-deps` clean

## References

- docs/architecture/ops-surface.md (§Op family — the hand-over
  contract; the need-half note; §Store-facing relationship — the
  re-routing posture)
- docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md
  §4 (the expiry semantics; the re-put backstop)
- docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md
  §2 (the validity domain; the non-fleet generalization)
- docs/architecture/decisions/008-trait-size-probe-fleet-gc-and-large-engines.md
  §2/§3 (the TTL/3 cadence; the re-routing topology)
- docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md
  §1 (the cadence is embedder composition)
- docs/architecture/open-questions.md OQ-09 (closed-by-default)
- tasks/ops-foundation.md, tasks/ops-call-harness.md,
  tasks/ops-json-ops.md, tasks/ops-fetch.md, tasks/ops-put.md (the
  surface this proves as a whole)
- tasks/suite-column-fleet.md (the env-driven harness-server
  convention this task's fleet rows follow)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion