115 lines
5.6 KiB
Markdown
115 lines
5.6 KiB
Markdown
---
|
|
id: ops-e2e-flows
|
|
name: the ops wire-level lifecycle proofs — have/need diffing, the token lifecycle, and the ACL matrix end-to-end
|
|
status: pending
|
|
depends_on: [ops-json-ops, ops-fetch, ops-put]
|
|
scope: broad
|
|
risk: medium
|
|
impact: phase
|
|
level: implementation
|
|
tags: [wave-7, ops, e2e, tokens, acl, fleet]
|
|
---
|
|
|
|
## Description
|
|
|
|
The capstone proofs through the harness (`ops-call-harness`) — the
|
|
full lifecycle flows the individual handler tests exercise only in
|
|
pieces. This is wave 7's equivalent of the engine waves' suite
|
|
columns: the surface proven as a whole, on the wire.
|
|
|
|
- **The have/need flow**: a consumer diffs `blobs/have` over its
|
|
digest set → fetches the absent digests (the need announcement *is*
|
|
the fetch miss — the diff is caller-side; the wire carries only
|
|
concrete fetch requests). Proven end-to-end: seed a store via the
|
|
facade, diff from the client side, fetch exactly the absent set,
|
|
re-diff to all-present.
|
|
- **The fleet token lifecycle end-to-end** (against the harness
|
|
server — env-driven, skipping cleanly server-less; the
|
|
pglo-poc convention): put → token → renew via have's renewal form
|
|
before expiry (`present: true`; the row's expiry observed moving) →
|
|
the embedder's registration confirms → the row's protection hands
|
|
to the registered liveness source (the namespace binding's
|
|
converter) → the row expires naturally and the entry survives on
|
|
the registered source's protection. Then the failure half: pause
|
|
past TTL → the renewal probe answers `present: false` → the
|
|
sweeper reaps the row → the **re-put backstop** (delete-then-
|
|
recover; CAS makes the re-put idempotent) → **the race resolves to
|
|
a re-put, never to silent loss** (ADR-010 §4's expiry semantics
|
|
verbatim, on the wire).
|
|
- **The foreign-token refusal**: a token minted by node A presented
|
|
to node B (a second fleet instance's ops module over the same
|
|
pool) → `present: false`, not an error — the validity domain is
|
|
the minting node (ADR-012 §2).
|
|
- **The non-fleet token lifecycle**: put → token (the registry holds
|
|
the guard) → have-present answers from the custody → the embedder's
|
|
registration confirms → the guard converts (the namespace
|
|
binding's converter) → the token retires. Proven on a non-fleet
|
|
store (sqlite or mem — server-less).
|
|
- **The ACL matrix end-to-end**: an unlisted namespace denies read
|
|
AND write (closed-by-default — OQ-09); a read-granted identity
|
|
fetches/stats/haves but cannot put; a write-granted identity puts
|
|
but a read-only peer cannot fetch its namespace; delete only under
|
|
the internal authority context (never a namespace grant).
|
|
- **The re-routing posture's serving half** (ADR-008 §3): a large
|
|
(pg-lo) entry served through `blobs/fetch` from the storage node's
|
|
dual-tier fleet store — the shape client nodes in kv-only mode
|
|
consume; no fleet-specific op exists (the module supports the shape
|
|
without change).
|
|
- **The no-side-door audit** (structural, ADR-001 §4): the ops
|
|
module's store access enumerated — the public facade plus the
|
|
foundation's crate-internal renewal seam only; no `Backend` touch,
|
|
no engine types, no path around the facade. Recorded as the audit
|
|
the wave-7 review gate re-checks.
|
|
- **The renewal-cadence boundary honored** (ADR-013 §1): the tests
|
|
drive renewal explicitly (the embedder's cadence role played by the
|
|
test); no in-crate renewal worker exists.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] The have/need flow proven end-to-end (diff caller-side; the
|
|
wire carries only concrete fetches)
|
|
- [ ] The fleet token lifecycle end-to-end vs the harness server:
|
|
renew-before-expiry (the row's expiry moves), the
|
|
registration-handover, pause-past-TTL → reap → the re-put
|
|
backstop — never silent loss (env-driven; skipping cleanly
|
|
server-less; acceptance requires green against the server)
|
|
- [ ] The foreign-token refusal: `present: false`, not an error
|
|
- [ ] The non-fleet lifecycle: custody → confirmation → conversion →
|
|
token retirement (server-less)
|
|
- [ ] The ACL matrix end-to-end (closed-by-default read+write denial;
|
|
the read/write split; delete internal-only)
|
|
- [ ] The re-routing posture's serving half: a large entry fetched
|
|
through the ops surface from the dual-tier fleet store
|
|
- [ ] The no-side-door audit recorded (the store-access enumeration)
|
|
- [ ] Gates green: `cargo test` (default), `cargo test --features
|
|
ops`, `cargo test --all-features` (the fleet rows live at
|
|
acceptance), clippy/fmt across the variants, `cargo doc
|
|
--no-deps` clean
|
|
|
|
## References
|
|
|
|
- docs/architecture/ops-surface.md (§Op family — the hand-over
|
|
contract; the need-half note; §Store-facing relationship — the
|
|
re-routing posture)
|
|
- docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md
|
|
§4 (the expiry semantics; the re-put backstop)
|
|
- docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md
|
|
§2 (the validity domain; the non-fleet generalization)
|
|
- docs/architecture/decisions/008-trait-size-probe-fleet-gc-and-large-engines.md
|
|
§2/§3 (the TTL/3 cadence; the re-routing topology)
|
|
- docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md
|
|
§1 (the cadence is embedder composition)
|
|
- docs/architecture/open-questions.md OQ-09 (closed-by-default)
|
|
- tasks/ops-foundation.md, tasks/ops-call-harness.md,
|
|
tasks/ops-json-ops.md, tasks/ops-fetch.md, tasks/ops-put.md (the
|
|
surface this proves as a whole)
|
|
- tasks/suite-column-fleet.md (the env-driven harness-server
|
|
convention this task's fleet rows follow)
|
|
|
|
## Notes
|
|
|
|
> To be filled by implementation agent
|
|
|
|
## Summary
|
|
|
|
> To be filled on completion |