alkblobs/tasks/ops-e2e-flows.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
ops-e2e-flows	the ops wire-level lifecycle proofs — have/need diffing, the token lifecycle, and the ACL matrix end-to-end	pending	ops-json-ops ops-fetch ops-put	broad	medium	phase	implementation	wave-7 ops e2e tokens acl fleet

Description

The capstone proofs through the harness (ops-call-harness) — the full lifecycle flows the individual handler tests exercise only in pieces. This is wave 7's equivalent of the engine waves' suite columns: the surface proven as a whole, on the wire.

• The have/need flow: a consumer diffs blobs/have over its digest set → fetches the absent digests (the need announcement is the fetch miss — the diff is caller-side; the wire carries only concrete fetch requests). Proven end-to-end: seed a store via the facade, diff from the client side, fetch exactly the absent set, re-diff to all-present.
• The fleet token lifecycle end-to-end (against the harness server — env-driven, skipping cleanly server-less; the pglo-poc convention): put → token → renew via have's renewal form before expiry (present: true; the row's expiry observed moving) → the embedder's registration confirms → the row's protection hands to the registered liveness source (the namespace binding's converter) → the row expires naturally and the entry survives on the registered source's protection. Then the failure half: pause past TTL → the renewal probe answers present: false → the sweeper reaps the row → the re-put backstop (delete-then- recover; CAS makes the re-put idempotent) → the race resolves to a re-put, never to silent loss (ADR-010 §4's expiry semantics verbatim, on the wire).
• The foreign-token refusal: a token minted by node A presented to node B (a second fleet instance's ops module over the same pool) → present: false, not an error — the validity domain is the minting node (ADR-012 §2).
• The non-fleet token lifecycle: put → token (the registry holds the guard) → have-present answers from the custody → the embedder's registration confirms → the guard converts (the namespace binding's converter) → the token retires. Proven on a non-fleet store (sqlite or mem — server-less).
• The ACL matrix end-to-end: an unlisted namespace denies read AND write (closed-by-default — OQ-09); a read-granted identity fetches/stats/haves but cannot put; a write-granted identity puts but a read-only peer cannot fetch its namespace; delete only under the internal authority context (never a namespace grant).
• The re-routing posture's serving half (ADR-008 §3): a large (pg-lo) entry served through blobs/fetch from the storage node's dual-tier fleet store — the shape client nodes in kv-only mode consume; no fleet-specific op exists (the module supports the shape without change).
• The no-side-door audit (structural, ADR-001 §4): the ops module's store access enumerated — the public facade plus the foundation's crate-internal renewal seam only; no Backend touch, no engine types, no path around the facade. Recorded as the audit the wave-7 review gate re-checks.
• The renewal-cadence boundary honored (ADR-013 §1): the tests drive renewal explicitly (the embedder's cadence role played by the test); no in-crate renewal worker exists.

Acceptance Criteria

• The have/need flow proven end-to-end (diff caller-side; the wire carries only concrete fetches)
• The fleet token lifecycle end-to-end vs the harness server: renew-before-expiry (the row's expiry moves), the registration-handover, pause-past-TTL → reap → the re-put backstop — never silent loss (env-driven; skipping cleanly server-less; acceptance requires green against the server)
• The foreign-token refusal: present: false, not an error
• The non-fleet lifecycle: custody → confirmation → conversion → token retirement (server-less)
• The ACL matrix end-to-end (closed-by-default read+write denial; the read/write split; delete internal-only)
• The re-routing posture's serving half: a large entry fetched through the ops surface from the dual-tier fleet store
• The no-side-door audit recorded (the store-access enumeration)
• Gates green: cargo test (default), cargo test --features ops, cargo test --all-features (the fleet rows live at acceptance), clippy/fmt across the variants, cargo doc --no-deps clean

References

• docs/architecture/ops-surface.md (§Op family — the hand-over contract; the need-half note; §Store-facing relationship — the re-routing posture)
• docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md §4 (the expiry semantics; the re-put backstop)
• docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md §2 (the validity domain; the non-fleet generalization)
• docs/architecture/decisions/008-trait-size-probe-fleet-gc-and-large-engines.md §2/§3 (the TTL/3 cadence; the re-routing topology)
• docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md §1 (the cadence is embedder composition)
• docs/architecture/open-questions.md OQ-09 (closed-by-default)
• tasks/ops-foundation.md, tasks/ops-call-harness.md, tasks/ops-json-ops.md, tasks/ops-fetch.md, tasks/ops-put.md (the surface this proves as a whole)
• tasks/suite-column-fleet.md (the env-driven harness-server convention this task's fleet rows follow)

Notes

To be filled by implementation agent

Summary

To be filled on completion