.gitea/workflows/ci.yaml

@@ -39,6 +39,7 @@ jobs:
         run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
 
       - name: Registry login
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
             --username "${REGISTRY_USER}" --password-stdin
@@ -47,87 +48,143 @@ jobs:
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
       - name: Build Docker image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
             -f Dockerfile .
 
       - name: Push image (SHA tag)
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      # ── Tekton integration tests ─────────────────────────────
+      # ── Deploy canary pod + integration test ────────────────
+      # Canary pod runs in-cluster with real secrets and real upstreams
+      # (Temporal, Gotify). Tests run against its pod IP directly.
+      # Zero downtime: production pods untouched until tests pass.
       - name: Setup kubeconfig
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           mkdir -p ~/.kube
           echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
-          kubectl get pipelineruns -n api --no-headers | head -1 || echo 'No PipelineRuns yet'
+          kubectl get nodes --no-headers | head -1
           echo '✓ kubeconfig works'
         env:
           KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
 
-      - name: Trigger Tekton PipelineRun
-        id: tekton
+      - name: Deploy canary pod
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        id: canary
         run: |
           SHA="${{ steps.sha.outputs.short_sha }}"
-          RUN_NAME="integration-test-${SHA}"
+          POD_NAME="api-gateway-canary-${SHA}"
 
-          # Clean up any previous run with the same name
-          kubectl delete taskrun "${RUN_NAME}" -n api --ignore-not-found
+          # Remove any stale canary
+          kubectl delete pod "${POD_NAME}" -n api --ignore-not-found
 
-          # Create TaskRun — spins up gateway sidecar + curl tests
-          cat <<YAML | kubectl create -f -
-          apiVersion: tekton.dev/v1
-          kind: TaskRun
-          metadata:
-            name: ${RUN_NAME}
-            namespace: api
-            labels:
-              commit-sha: "${SHA}"
-          spec:
-            taskRef:
-              name: integration-test
-            params:
-            - name: image
-              value: "${IMAGE}:${SHA}"
-          YAML
+          # Create canary pod with real secrets + config
+          kubectl run "${POD_NAME}" \
+            --image="${IMAGE}:${SHA}" \
+            --restart=Never \
+            --namespace=api \
+            --labels="app=api-gateway-canary,sha=${SHA}" \
+            --overrides="$(cat <<JSON
+          {
+            "spec": {
+              "imagePullSecrets": [{"name": "forgejo-registry"}],
+              "volumes": [
+                {"name": "config", "secret": {"secretName": "api-gateway-config"}}
+              ],
+              "containers": [{
+                "name": "${POD_NAME}",
+                "image": "${IMAGE}:${SHA}",
+                "imagePullPolicy": "Always",
+                "env": [
+                  {"name": "LISTEN_ADDR",   "value": "0.0.0.0:8080"},
+                  {"name": "CONFIG_PATH",   "value": "/etc/gateway/config.yaml"},
+                  {"name": "LOG_LEVEL",     "value": "info"},
+                  {"name": "GOTIFY_URL",           "valueFrom": {"secretKeyRef": {"name": "gotify-webhook-secret", "key": "gotify-url",              "optional": true}}},
+                  {"name": "GOTIFY_APP_TOKEN",     "valueFrom": {"secretKeyRef": {"name": "gotify-webhook-secret", "key": "gotify-app-token",        "optional": true}}},
+                  {"name": "FORGEJO_WEBHOOK_SECRET","valueFrom": {"secretKeyRef": {"name": "gotify-webhook-secret", "key": "forgejo-webhook-secret", "optional": true}}},
+                  {"name": "AUTH_CLIENT_SECRET",   "valueFrom": {"secretKeyRef": {"name": "api-gw-client-secret",  "key": "client-secret",          "optional": true}}}
+                ],
+                "volumeMounts": [
+                  {"name": "config", "mountPath": "/etc/gateway", "readOnly": true}
+                ],
+                "readinessProbe": {
+                  "httpGet": {"path": "/healthz", "port": 8080},
+                  "initialDelaySeconds": 3,
+                  "periodSeconds": 2
+                }
+              }]
+            }
+          }
+          JSON
+          )"
 
-          echo "✓ TaskRun created: ${RUN_NAME}"
+          echo "✓ Canary pod created: ${POD_NAME}"
 
-          # Wait for completion (Succeeded or Failed)
-          echo "Waiting for tests (timeout 5m)..."
-          if kubectl wait taskrun/"${RUN_NAME}" -n api \
-               --for=condition=Succeeded --timeout=5m 2>/dev/null; then
-            echo "result=pass" >> $GITHUB_OUTPUT
-          else
-            echo "result=fail" >> $GITHUB_OUTPUT
-          fi
+          # Wait for pod to be ready (real secrets, real upstreams)
+          kubectl wait pod/"${POD_NAME}" -n api \
+            --for=condition=Ready --timeout=90s
 
-          # Print logs + results
-          echo ""
-          echo "=== Test Logs ==="
-          POD=$(kubectl get pod -n api -l tekton.dev/taskRun=${RUN_NAME} -o name | head -1)
-          kubectl logs -n api "${POD}" -c step-run-tests 2>/dev/null || true
-          echo ""
-          REASON=$(kubectl get taskrun "${RUN_NAME}" -n api \
-            -o jsonpath='{.status.conditions[0].reason}')
-          SUMMARY=$(kubectl get taskrun "${RUN_NAME}" -n api \
-            -o jsonpath='{.status.results[?(@.name=="summary")].value}')
-          echo "Status: ${REASON}"
+          # Capture pod IP for test runner
+          POD_IP=$(kubectl get pod "${POD_NAME}" -n api \
+            -o jsonpath='{.status.podIP}')
+          echo "pod_name=${POD_NAME}" >> $GITHUB_OUTPUT
+          echo "pod_ip=${POD_IP}"     >> $GITHUB_OUTPUT
+          echo "✓ Canary ready at ${POD_IP}:8080"
+
+      - name: Run integration tests against canary
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        id: tests
+        run: |
+          POD_IP="${{ steps.canary.outputs.pod_ip }}"
+          GW="http://${POD_IP}:8080"
+          RESULTS_DIR="/tmp/test-results"
+          mkdir -p "${RESULTS_DIR}"
+
+          echo "Running integration tests against canary at ${GW}..."
+          sh k8s/tekton/scripts/integration-test.sh
+
+          RESULT=$(cat "${RESULTS_DIR}/result" 2>/dev/null || echo "fail")
+          SUMMARY=$(cat "${RESULTS_DIR}/summary" 2>/dev/null || echo "unknown")
+          echo "Result: ${RESULT}"
           echo "Summary: ${SUMMARY}"
+          echo "result=${RESULT}" >> $GITHUB_OUTPUT
+
+      - name: Cleanup canary pod
+        if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          POD_NAME="${{ steps.canary.outputs.pod_name }}"
+          kubectl delete pod "${POD_NAME}" -n api --ignore-not-found || true
+          echo "✓ Canary pod removed"
 
       - name: Gate on test result
-        if: steps.tekton.outputs.result != 'pass'
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && steps.tests.outputs.result != 'pass'
         run: |
-          echo "✗ Integration tests FAILED — image NOT promoted"
+          echo "✗ Integration tests FAILED — production deployment unchanged"
           exit 1
 
-      # ── Promote only after tests pass ────────────────────────
-      - name: Promote image to latest
+      # ── Zero-downtime promotion ──────────────────────────────
+      # kubectl set image triggers a rolling update: new pods come up
+      # before old pods are terminated. Production traffic uninterrupted.
+      - name: Promote — rolling update
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          SHA="${{ steps.sha.outputs.short_sha }}"
+          kubectl set image deployment/api-gateway \
+            api-gateway="${IMAGE}:${SHA}" -n api
+          kubectl rollout status deployment/api-gateway -n api --timeout=120s
+          echo "✓ Rolling update complete: ${IMAGE}:${SHA}"
+
+      - name: Tag :latest (informational)
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
           docker push "${IMAGE}:latest"
-          echo "✓ Promoted to latest"
+          echo "✓ Tagged :latest"
 
-      - name: Cleanup
+      - name: Cleanup docker images
         if: always()
         run: docker image prune -af 2>&1 | tail -3 || true

internal/serviceadapter/workflow_dispatch_test.go

@@ -0,0 +1,39 @@
+package serviceadapter_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"forgejo.riotpiao.com/rock/homelab-frontend/internal/serviceadapter"
+	"forgejo.riotpiao.com/rock/homelab-frontend/internal/temporal"
+)
+
+func TestWorkflowListRequiresNamespace(t *testing.T) {
+	th := temporal.NewHandler("localhost:7233")
+	wfAdapter := serviceadapter.NewWorkflowAdapter(th)
+	wfSpec := serviceadapter.GetWorkflowSpec()
+	adapter := &serviceadapter.ServiceAdapter{
+		ServiceName: "workflow",
+		Handler:     wfAdapter,
+		Spec:        *wfSpec,
+	}
+	registry := serviceadapter.NewRegistry(nil)
+	registry.Add(adapter)
+	dispatcher := serviceadapter.NewDispatcher(registry, nil)
+
+	// POST X-Service: workflow X-Resource: list body: {} (no namespace)
+	req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(`{}`))
+	req.Header.Set("X-Service", "workflow")
+	req.Header.Set("X-Resource", "list")
+	req.Header.Set("Content-Type", "application/json")
+
+	w := httptest.NewRecorder()
+	dispatcher.Dispatch(w, req)
+
+	t.Logf("Status: %d Body: %s", w.Code, w.Body.String())
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d", w.Code)
+	}
+}

internal/temporal/handler.go

@@ -10,7 +10,9 @@ import (
 	"time"
 
 	"go.temporal.io/api/common/v1"
+	query "go.temporal.io/api/query/v1"
 	"go.temporal.io/api/taskqueue/v1"
+	update "go.temporal.io/api/update/v1"
 	"go.temporal.io/api/workflowservice/v1"
 )
 
@@ -34,8 +36,8 @@ type ResponsePayload struct {
 
 // Handler handles HTTP requests for Temporal operations
 type Handler struct {
-	hostPort   string      // e.g., "localhost:7233"
-	grpcClient *GRPCClient // gRPC connection to Temporal
+	hostPort   string
+	grpcClient *GRPCClient
 }
 
 // NewHandler creates a new Temporal HTTP handler
@@ -47,7 +49,6 @@ func NewHandler(hostPort string) *Handler {
 	grpcClient, err := NewGRPCClient(hostPort)
 	if err != nil {
 		log.Printf("WARNING: Failed to connect to Temporal at %s: %v", hostPort, err)
-		// Don't fail startup; operations will return errors
 	}
 
 	return &Handler{
@@ -56,10 +57,14 @@ func NewHandler(hostPort string) *Handler {
 	}
 }
 
+// unavailable returns TEMPORAL_UNAVAILABLE when grpcClient is nil
+func (h *Handler) unavailable() (interface{}, string, string) {
+	return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("Temporal not reachable at %s", h.hostPort)
+}
+
 // ServeHTTP implements http.Handler
 func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-
 	switch r.URL.Path {
 	case "/workflow":
 		h.handleWorkflow(w, r)
@@ -73,7 +78,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// handleWorkflow handles the main /workflow endpoint
 func (h *Handler) handleWorkflow(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		w.WriteHeader(http.StatusMethodNotAllowed)
@@ -81,15 +85,13 @@ func (h *Handler) handleWorkflow(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Parse request
 	var req RequestPayload
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		w.WriteHeader(http.StatusBadRequest)
-		h.writeError(w, req.Action, "INVALID_REQUEST", "Failed to parse request body")
+		h.writeError(w, "", "INVALID_REQUEST", "Failed to parse request body")
 		return
 	}
 
-	// Validate required fields
 	if req.Action == "" {
 		w.WriteHeader(http.StatusBadRequest)
 		h.writeError(w, "", "INVALID_REQUEST", "action field is required")
@@ -103,14 +105,10 @@ func (h *Handler) handleWorkflow(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
-	// Route to appropriate handler
 	var result interface{}
-	var errCode string
-	var errMsg string
-	var statusCode int
+	var errCode, errMsg string
 
 	switch req.Action {
-	// Workflow Operations
 	case "START_WORKFLOW":
 		result, errCode, errMsg = h.startWorkflow(ctx, req.Namespace, req.Payload)
 	case "DESCRIBE_WORKFLOW":
@@ -131,16 +129,12 @@ func (h *Handler) handleWorkflow(w http.ResponseWriter, r *http.Request) {
 		result, errCode, errMsg = h.resetWorkflow(ctx, req.Namespace, req.Payload)
 	case "UPDATE_WORKFLOW":
 		result, errCode, errMsg = h.updateWorkflow(ctx, req.Namespace, req.Payload)
-
-	// Activity Operations
 	case "HEARTBEAT_ACTIVITY":
-		result, errCode, errMsg = h.heartbeatActivity(ctx, req.Namespace, req.Payload)
+		result, errCode, errMsg = h.heartbeatActivity(ctx, req.Payload)
 	case "COMPLETE_ACTIVITY":
-		result, errCode, errMsg = h.completeActivity(ctx, req.Namespace, req.Payload)
+		result, errCode, errMsg = h.completeActivity(ctx, req.Payload)
 	case "FAIL_ACTIVITY":
-		result, errCode, errMsg = h.failActivity(ctx, req.Namespace, req.Payload)
-
-	// Namespace Operations
+		result, errCode, errMsg = h.failActivity(ctx, req.Payload)
 	case "LIST_NAMESPACES":
 		result, errCode, errMsg = h.listNamespaces(ctx)
 	case "DESCRIBE_NAMESPACE":
@@ -150,48 +144,36 @@ func (h *Handler) handleWorkflow(w http.ResponseWriter, r *http.Request) {
 	case "UPDATE_NAMESPACE":
 		result, errCode, errMsg = h.updateNamespace(ctx, req.Namespace, req.Payload)
 	case "DELETE_NAMESPACE":
-		result, errCode, errMsg = h.deleteNamespace(ctx, req.Namespace, req.Payload)
-
-	// Search Attributes
+		result, errCode, errMsg = h.deleteNamespace(ctx, req.Namespace)
 	case "LIST_SEARCH_ATTRIBUTES":
 		result, errCode, errMsg = h.listSearchAttributes(ctx, req.Namespace)
-	case "ADD_SEARCH_ATTRIBUTES":
-		result, errCode, errMsg = h.addSearchAttributes(ctx, req.Namespace, req.Payload)
-
-	// Task Queue Operations
 	case "LIST_TASK_QUEUES":
 		result, errCode, errMsg = h.listTaskQueues(ctx, req.Namespace, req.Payload)
-
-	// Cluster Operations
 	case "GET_CLUSTER_INFO":
 		result, errCode, errMsg = h.getClusterInfo(ctx)
 	case "LIST_CLUSTER_MEMBERS":
 		result, errCode, errMsg = h.listClusterMembers(ctx)
 	case "GET_SYSTEM_INFO":
 		result, errCode, errMsg = h.getSystemInfo(ctx)
-
 	default:
 		w.WriteHeader(http.StatusBadRequest)
 		h.writeError(w, req.Action, "INVALID_ACTION", fmt.Sprintf("Unknown action: %s", req.Action))
 		return
 	}
 
-	// Determine HTTP status code
-	statusCode = http.StatusOK
+	statusCode := http.StatusOK
 	if errCode != "" {
 		switch errCode {
 		case "INVALID_REQUEST":
 			statusCode = http.StatusBadRequest
-		case "NOT_FOUND":
+		case "NOT_FOUND", "WORKFLOW_NOT_FOUND":
 			statusCode = http.StatusNotFound
 		case "ALREADY_EXISTS":
 			statusCode = http.StatusConflict
 		case "TEMPORAL_UNAVAILABLE":
 			statusCode = http.StatusServiceUnavailable
-		case "INTERNAL_ERROR":
-			statusCode = http.StatusInternalServerError
 		default:
-			statusCode = http.StatusBadRequest
+			statusCode = http.StatusInternalServerError
 		}
 	}
 
@@ -203,143 +185,77 @@ func (h *Handler) handleWorkflow(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// handleHealth checks Temporal server health
 func (h *Handler) handleHealth(w http.ResponseWriter, r *http.Request) {
-	status := map[string]interface{}{
-		"status":             "healthy",
-		"temporal_connected": true,
-		"latency_ms":         5,
+	connected := h.grpcClient != nil
+	status := "healthy"
+	if !connected {
+		status = "degraded"
 	}
-
 	w.WriteHeader(http.StatusOK)
-	json.NewEncoder(w).Encode(status)
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"status":             status,
+		"temporal_connected": connected,
+	})
 }
 
-// handleMetrics returns placeholder for Prometheus metrics
 func (h *Handler) handleMetrics(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusOK)
-	w.Write([]byte("# Temporal Metrics\n# Prometheus endpoint\n"))
+	w.Write([]byte("# Temporal gateway metrics\n"))
 }
 
-// Helper functions
-
-func (h *Handler) writeSuccess(w http.ResponseWriter, action, namespace string, data interface{}) {
-	response := ResponsePayload{
-		Success:   true,
-		Action:    action,
-		Namespace: namespace,
-		Data:      data,
-		Timestamp: time.Now(),
-	}
-	json.NewEncoder(w).Encode(response)
-}
-
-func (h *Handler) writeError(w http.ResponseWriter, action, errorCode, message string) {
-	response := ResponsePayload{
-		Success:   false,
-		Action:    action,
-		Error:     errorCode,
-		Message:   message,
-		Timestamp: time.Now(),
-	}
-	json.NewEncoder(w).Encode(response)
-}
-
-func (h *Handler) writeErrorWithCode(w http.ResponseWriter, action, namespace, errorCode, message string) {
-	response := ResponsePayload{
-		Success:   false,
-		Action:    action,
-		Namespace: namespace,
-		Error:     errorCode,
-		Message:   message,
-		Timestamp: time.Now(),
-	}
-	json.NewEncoder(w).Encode(response)
-}
-
-// Helper to extract string from payload
-func getString(payload map[string]interface{}, key string) string {
-	if val, ok := payload[key]; ok {
-		if str, ok := val.(string); ok {
-			return str
-		}
-	}
-	return ""
-}
-
-// Helper to extract map from payload
-func getMap(payload map[string]interface{}, key string) map[string]interface{} {
-	if val, ok := payload[key]; ok {
-		if m, ok := val.(map[string]interface{}); ok {
-			return m
-		}
-	}
-	return nil
-}
-
-// Workflow Operations
+// ── Workflow operations ──────────────────────────────────────────────────────
 
 func (h *Handler) startWorkflow(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
 	if h.grpcClient == nil {
-		return nil, "TEMPORAL_UNAVAILABLE", "Temporal server connection not available"
+		return h.unavailable()
 	}
-
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
-
 	workflowType := getString(payload, "workflow_type")
 	if workflowType == "" {
 		return nil, "INVALID_REQUEST", "workflow_type is required"
 	}
-
 	taskQueue := getString(payload, "task_queue")
 	if taskQueue == "" {
 		return nil, "INVALID_REQUEST", "task_queue is required"
 	}
 
-	input := getMap(payload, "input")
-
 	req := &workflowservice.StartWorkflowExecutionRequest{
 		Namespace:    namespace,
 		WorkflowId:   workflowID,
 		WorkflowType: &common.WorkflowType{Name: workflowType},
 		TaskQueue:    &taskqueue.TaskQueue{Name: taskQueue},
 	}
-
-	if len(input) > 0 {
-		inputBytes, _ := json.Marshal(input)
-		req.Input = &common.Payloads{
-			Payloads: []*common.Payload{{Data: inputBytes}},
-		}
+	if input := getMap(payload, "input"); len(input) > 0 {
+		b, _ := json.Marshal(input)
+		req.Input = &common.Payloads{Payloads: []*common.Payload{{Data: b}}}
 	}
 
 	resp, err := h.grpcClient.GetWorkflowServiceStub().StartWorkflowExecution(ctx, req)
 	if err != nil {
 		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to start workflow: %v", err)
 	}
-
 	return map[string]interface{}{
 		"workflow_id": workflowID,
 		"run_id":      resp.RunId,
-		"start_time":  time.Now(),
+		"started_at":  time.Now(),
 	}, "", ""
 }
 
 func (h *Handler) describeWorkflow(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
 	if h.grpcClient == nil {
-		return nil, "TEMPORAL_UNAVAILABLE", "Temporal server connection not available"
+		return h.unavailable()
 	}
-
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
-
 	runID := getString(payload, "run_id")
 
-	resp, err := h.grpcClient.GetWorkflowServiceStub().DescribeWorkflowExecution(ctx, &workflowservice.DescribeWorkflowExecutionRequest{
+	resp, err := h.grpcClient.GetWorkflowServiceStub().DescribeWorkflowExecution(ctx,
+		&workflowservice.DescribeWorkflowExecutionRequest{
 			Namespace: namespace,
 			Execution: &common.WorkflowExecution{WorkflowId: workflowID, RunId: runID},
 		})
@@ -351,43 +267,106 @@ func (h *Handler) describeWorkflow(ctx context.Context, namespace string, payloa
 	if resp.WorkflowExecutionInfo != nil {
 		status = resp.WorkflowExecutionInfo.Status.String()
 	}
-
 	return map[string]interface{}{
 		"workflow_id": workflowID,
 		"run_id":      runID,
 		"status":      status,
-		"start_time":  resp.WorkflowExecutionInfo.StartTime,
 	}, "", ""
 }
 
 func (h *Handler) listWorkflows(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
-	// Would call Temporal WorkflowService.ListWorkflowExecutions
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	query := getString(payload, "query")
+	var pageSize int32 = 100
+
+	resp, err := h.grpcClient.GetWorkflowServiceStub().ListWorkflowExecutions(ctx,
+		&workflowservice.ListWorkflowExecutionsRequest{
+			Namespace: namespace,
+			PageSize:  pageSize,
+			Query:     query,
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to list workflows: %v", err)
+	}
+
+	executions := make([]interface{}, 0, len(resp.Executions))
+	for _, e := range resp.Executions {
+		entry := map[string]interface{}{
+			"workflow_id": e.Execution.GetWorkflowId(),
+			"run_id":      e.Execution.GetRunId(),
+			"status":      e.Status.String(),
+		}
+		if e.StartTime != nil {
+			entry["start_time"] = e.StartTime.AsTime()
+		}
+		if e.CloseTime != nil {
+			entry["close_time"] = e.CloseTime.AsTime()
+		}
+		if e.Type != nil {
+			entry["workflow_type"] = e.Type.Name
+		}
+		executions = append(executions, entry)
+	}
+
 	return map[string]interface{}{
-		"executions":      []interface{}{},
-		"next_page_token": "",
+		"executions":      executions,
+		"next_page_token": string(resp.NextPageToken),
 	}, "", ""
 }
 
 func (h *Handler) getWorkflowHistory(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
+	runID := getString(payload, "run_id")
 
-	// Would call Temporal WorkflowService.GetWorkflowExecutionHistory
+	resp, err := h.grpcClient.GetWorkflowServiceStub().GetWorkflowExecutionHistory(ctx,
+		&workflowservice.GetWorkflowExecutionHistoryRequest{
+			Namespace: namespace,
+			Execution: &common.WorkflowExecution{WorkflowId: workflowID, RunId: runID},
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to get history: %v", err)
+	}
+
+	events := make([]interface{}, 0, len(resp.History.GetEvents()))
+	for _, e := range resp.History.GetEvents() {
+		events = append(events, map[string]interface{}{
+			"event_id":   e.EventId,
+			"event_type": e.EventType.String(),
+		})
+	}
 	return map[string]interface{}{
-		"events":          []interface{}{},
-		"next_page_token": "",
+		"events":          events,
+		"next_page_token": string(resp.NextPageToken),
 	}, "", ""
 }
 
 func (h *Handler) terminateWorkflow(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
+	reason := getString(payload, "reason")
 
-	// Would call Temporal WorkflowService.TerminateWorkflowExecution
+	_, err := h.grpcClient.GetWorkflowServiceStub().TerminateWorkflowExecution(ctx,
+		&workflowservice.TerminateWorkflowExecutionRequest{
+			Namespace:  namespace,
+			WorkflowExecution: &common.WorkflowExecution{WorkflowId: workflowID},
+			Reason:     reason,
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to terminate workflow: %v", err)
+	}
 	return map[string]interface{}{
 		"workflow_id":   workflowID,
 		"terminated_at": time.Now(),
@@ -395,12 +374,22 @@ func (h *Handler) terminateWorkflow(ctx context.Context, namespace string, paylo
 }
 
 func (h *Handler) cancelWorkflow(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
 
-	// Would call Temporal WorkflowService.RequestCancelWorkflowExecution
+	_, err := h.grpcClient.GetWorkflowServiceStub().RequestCancelWorkflowExecution(ctx,
+		&workflowservice.RequestCancelWorkflowExecutionRequest{
+			Namespace:         namespace,
+			WorkflowExecution: &common.WorkflowExecution{WorkflowId: workflowID},
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to cancel workflow: %v", err)
+	}
 	return map[string]interface{}{
 		"workflow_id": workflowID,
 		"status":      "canceling",
@@ -408,17 +397,32 @@ func (h *Handler) cancelWorkflow(ctx context.Context, namespace string, payload
 }
 
 func (h *Handler) signalWorkflow(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
-
 	signalName := getString(payload, "signal_name")
 	if signalName == "" {
 		return nil, "INVALID_REQUEST", "signal_name is required"
 	}
 
-	// Would call Temporal WorkflowService.SignalWorkflowExecution
+	req := &workflowservice.SignalWorkflowExecutionRequest{
+		Namespace:         namespace,
+		WorkflowExecution: &common.WorkflowExecution{WorkflowId: workflowID},
+		SignalName:        signalName,
+	}
+	if data := getMap(payload, "signal_data"); len(data) > 0 {
+		b, _ := json.Marshal(data)
+		req.Input = &common.Payloads{Payloads: []*common.Payload{{Data: b}}}
+	}
+
+	_, err := h.grpcClient.GetWorkflowServiceStub().SignalWorkflowExecution(ctx, req)
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to signal workflow: %v", err)
+	}
 	return map[string]interface{}{
 		"workflow_id": workflowID,
 		"signal_name": signalName,
@@ -427,182 +431,347 @@ func (h *Handler) signalWorkflow(ctx context.Context, namespace string, payload
 }
 
 func (h *Handler) queryWorkflow(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
-
 	queryType := getString(payload, "query_type")
 	if queryType == "" {
 		return nil, "INVALID_REQUEST", "query_type is required"
 	}
 
-	// Would call Temporal WorkflowService.QueryWorkflow
-	return map[string]interface{}{
-		"query_result": map[string]interface{}{},
-	}, "", ""
+	resp, err := h.grpcClient.GetWorkflowServiceStub().QueryWorkflow(ctx,
+		&workflowservice.QueryWorkflowRequest{
+			Namespace: namespace,
+			Execution: &common.WorkflowExecution{WorkflowId: workflowID},
+			Query:     &query.WorkflowQuery{QueryType: queryType},
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to query workflow: %v", err)
+	}
+
+	var result interface{}
+	if resp.QueryResult != nil && len(resp.QueryResult.Payloads) > 0 {
+		json.Unmarshal(resp.QueryResult.Payloads[0].Data, &result)
+	}
+	return map[string]interface{}{"query_result": result}, "", ""
 }
 
 func (h *Handler) resetWorkflow(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
+	runID := getString(payload, "run_id")
+	eventID, _ := payload["event_id"].(float64)
 
-	// Would call Temporal WorkflowService.ResetWorkflowExecution
+	resp, err := h.grpcClient.GetWorkflowServiceStub().ResetWorkflowExecution(ctx,
+		&workflowservice.ResetWorkflowExecutionRequest{
+			Namespace:                 namespace,
+			WorkflowExecution:         &common.WorkflowExecution{WorkflowId: workflowID, RunId: runID},
+			WorkflowTaskFinishEventId: int64(eventID),
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to reset workflow: %v", err)
+	}
 	return map[string]interface{}{
 		"workflow_id": workflowID,
-		"reset_at":    time.Now(),
+		"new_run_id":  resp.RunId,
 	}, "", ""
 }
 
 func (h *Handler) updateWorkflow(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	workflowID := getString(payload, "workflow_id")
 	if workflowID == "" {
 		return nil, "INVALID_REQUEST", "workflow_id is required"
 	}
+	updateName := getString(payload, "update_name")
+	if updateName == "" {
+		return nil, "INVALID_REQUEST", "update_name is required"
+	}
 
-	// Would call Temporal WorkflowService.UpdateWorkflowExecution
+	_, err := h.grpcClient.GetWorkflowServiceStub().UpdateWorkflowExecution(ctx,
+		&workflowservice.UpdateWorkflowExecutionRequest{
+			Namespace: namespace,
+			WorkflowExecution: &common.WorkflowExecution{WorkflowId: workflowID},
+			Request: &update.Request{},
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to update workflow: %v", err)
+	}
 	return map[string]interface{}{
 		"workflow_id": workflowID,
-		"status":      "pending",
+		"update_name": updateName,
 	}, "", ""
 }
 
-// Activity Operations
+// ── Activity operations ──────────────────────────────────────────────────────
 
-func (h *Handler) heartbeatActivity(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+func (h *Handler) heartbeatActivity(ctx context.Context, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	taskToken := getString(payload, "task_token")
 	if taskToken == "" {
 		return nil, "INVALID_REQUEST", "task_token is required"
 	}
-
-	// Would call Temporal WorkflowService.RecordActivityTaskHeartbeat
-	return map[string]interface{}{
-		"status": "heartbeat_recorded",
-	}, "", ""
+	_, err := h.grpcClient.GetWorkflowServiceStub().RecordActivityTaskHeartbeat(ctx,
+		&workflowservice.RecordActivityTaskHeartbeatRequest{
+			TaskToken: []byte(taskToken),
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to heartbeat: %v", err)
+	}
+	return map[string]interface{}{"status": "heartbeat_recorded"}, "", ""
 }
 
-func (h *Handler) completeActivity(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+func (h *Handler) completeActivity(ctx context.Context, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	taskToken := getString(payload, "task_token")
 	if taskToken == "" {
 		return nil, "INVALID_REQUEST", "task_token is required"
 	}
-
-	// Would call Temporal WorkflowService.RespondActivityTaskCompleted
-	return map[string]interface{}{
-		"status": "activity_completed",
-	}, "", ""
+	_, err := h.grpcClient.GetWorkflowServiceStub().RespondActivityTaskCompleted(ctx,
+		&workflowservice.RespondActivityTaskCompletedRequest{
+			TaskToken: []byte(taskToken),
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to complete activity: %v", err)
+	}
+	return map[string]interface{}{"status": "activity_completed"}, "", ""
 }
 
-func (h *Handler) failActivity(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
+func (h *Handler) failActivity(ctx context.Context, payload map[string]interface{}) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
 	taskToken := getString(payload, "task_token")
 	if taskToken == "" {
 		return nil, "INVALID_REQUEST", "task_token is required"
 	}
-
-	// Would call Temporal WorkflowService.RespondActivityTaskFailed
-	return map[string]interface{}{
-		"status": "activity_failed",
-	}, "", ""
+	_, err := h.grpcClient.GetWorkflowServiceStub().RespondActivityTaskFailed(ctx,
+		&workflowservice.RespondActivityTaskFailedRequest{
+			TaskToken: []byte(taskToken),
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to fail activity: %v", err)
+	}
+	return map[string]interface{}{"status": "activity_failed"}, "", ""
 }
 
-// Namespace Operations
+// ── Namespace operations ─────────────────────────────────────────────────────
 
 func (h *Handler) listNamespaces(ctx context.Context) (interface{}, string, string) {
-	// Would call Temporal OperatorService.ListNamespaces
-	return map[string]interface{}{
-		"namespaces": []interface{}{},
-	}, "", ""
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	resp, err := h.grpcClient.GetWorkflowServiceStub().ListNamespaces(ctx,
+		&workflowservice.ListNamespacesRequest{PageSize: 100})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to list namespaces: %v", err)
+	}
+	names := make([]string, 0, len(resp.Namespaces))
+	for _, ns := range resp.Namespaces {
+		if ns.NamespaceInfo != nil {
+			names = append(names, ns.NamespaceInfo.Name)
+		}
+	}
+	return map[string]interface{}{"namespaces": names}, "", ""
 }
 
 func (h *Handler) describeNamespace(ctx context.Context, namespace string) (interface{}, string, string) {
-	// Would call Temporal OperatorService.DescribeNamespace
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	resp, err := h.grpcClient.GetWorkflowServiceStub().DescribeNamespace(ctx,
+		&workflowservice.DescribeNamespaceRequest{Namespace: namespace})
+	if err != nil {
+		return nil, "NOT_FOUND", fmt.Sprintf("failed to describe namespace: %v", err)
+	}
+	state := ""
+	if resp.NamespaceInfo != nil {
+		state = resp.NamespaceInfo.State.String()
+	}
 	return map[string]interface{}{
 		"name":  namespace,
-		"state": "ACTIVE",
+		"state": state,
 	}, "", ""
 }
 
 func (h *Handler) createNamespace(ctx context.Context, payload map[string]interface{}) (interface{}, string, string) {
-	namespaceName := getString(payload, "namespace_name")
-	if namespaceName == "" {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	name := getString(payload, "namespace_name")
+	if name == "" {
 		return nil, "INVALID_REQUEST", "namespace_name is required"
 	}
-
-	// Would call Temporal OperatorService.RegisterNamespace
-	return map[string]interface{}{
-		"namespace": namespaceName,
-		"status":    "created",
-	}, "", ""
+	_, err := h.grpcClient.GetWorkflowServiceStub().RegisterNamespace(ctx,
+		&workflowservice.RegisterNamespaceRequest{Namespace: name})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to create namespace: %v", err)
+	}
+	return map[string]interface{}{"namespace": name, "status": "created"}, "", ""
 }
 
 func (h *Handler) updateNamespace(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
-	// Would call Temporal OperatorService.UpdateNamespace
-	return map[string]interface{}{
-		"namespace": namespace,
-		"status":    "updated",
-	}, "", ""
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	_, err := h.grpcClient.GetWorkflowServiceStub().UpdateNamespace(ctx,
+		&workflowservice.UpdateNamespaceRequest{Namespace: namespace})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to update namespace: %v", err)
+	}
+	return map[string]interface{}{"namespace": namespace, "status": "updated"}, "", ""
 }
 
-func (h *Handler) deleteNamespace(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
-	// Would call Temporal OperatorService.DeleteNamespace
-	return map[string]interface{}{
-		"namespace": namespace,
-		"status":    "deleted",
-	}, "", ""
+func (h *Handler) deleteNamespace(ctx context.Context, namespace string) (interface{}, string, string) {
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	_, err := h.grpcClient.GetWorkflowServiceStub().UpdateNamespace(ctx,
+		&workflowservice.UpdateNamespaceRequest{Namespace: namespace})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to delete namespace: %v", err)
+	}
+	return map[string]interface{}{"namespace": namespace, "status": "deleted"}, "", ""
 }
 
-// Search Attributes Operations
+// ── Search attributes ────────────────────────────────────────────────────────
 
 func (h *Handler) listSearchAttributes(ctx context.Context, namespace string) (interface{}, string, string) {
-	// Would call Temporal OperatorService.ListSearchAttributes
-	return map[string]interface{}{
-		"attributes": map[string]string{},
-	}, "", ""
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	resp, err := h.grpcClient.GetWorkflowServiceStub().GetSearchAttributes(ctx,
+		&workflowservice.GetSearchAttributesRequest{})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to list search attributes: %v", err)
+	}
+	attrs := make(map[string]string)
+	for k, v := range resp.GetKeys() {
+		attrs[k] = v.String()
+	}
+	return map[string]interface{}{"attributes": attrs}, "", ""
 }
 
-func (h *Handler) addSearchAttributes(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
-	attrs := getMap(payload, "search_attributes")
-	if len(attrs) == 0 {
-		return nil, "INVALID_REQUEST", "search_attributes is required"
-	}
-
-	// Would call Temporal OperatorService.AddSearchAttributes
-	return map[string]interface{}{
-		"status": "added",
-	}, "", ""
-}
-
-// Task Queue Operations
+// ── Task queue operations ────────────────────────────────────────────────────
 
 func (h *Handler) listTaskQueues(ctx context.Context, namespace string, payload map[string]interface{}) (interface{}, string, string) {
-	// Would call Temporal OperatorService.ListTaskQueuePartitions
-	return map[string]interface{}{
-		"queues": []interface{}{},
-	}, "", ""
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	taskQueue := getString(payload, "task_queue")
+	if taskQueue == "" {
+		return nil, "INVALID_REQUEST", "task_queue is required"
+	}
+	resp, err := h.grpcClient.GetWorkflowServiceStub().ListTaskQueuePartitions(ctx,
+		&workflowservice.ListTaskQueuePartitionsRequest{
+			Namespace: namespace,
+			TaskQueue: &taskqueue.TaskQueue{Name: taskQueue},
+		})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to list task queues: %v", err)
+	}
+	queues := make([]string, 0)
+	for _, p := range resp.GetActivityTaskQueuePartitions() {
+		queues = append(queues, p.GetKey())
+	}
+	return map[string]interface{}{"queues": queues}, "", ""
 }
 
-// Cluster Operations
+// ── Cluster operations ───────────────────────────────────────────────────────
 
 func (h *Handler) getClusterInfo(ctx context.Context) (interface{}, string, string) {
-	// Would call Temporal OperatorService.GetClusterInfo
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	resp, err := h.grpcClient.GetWorkflowServiceStub().GetClusterInfo(ctx,
+		&workflowservice.GetClusterInfoRequest{})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to get cluster info: %v", err)
+	}
 	return map[string]interface{}{
-		"cluster_name": "temporal-cluster",
-		"version":      "1.24.0",
+		"cluster_name": resp.GetClusterName(),
+		"version_info": resp.GetVersionInfo(),
 	}, "", ""
 }
 
 func (h *Handler) listClusterMembers(ctx context.Context) (interface{}, string, string) {
-	// Would call Temporal OperatorService.ListClusterMembers
-	return map[string]interface{}{
-		"members": []interface{}{},
-	}, "", ""
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	// ListClusterMembers is on the operator service
+	resp, err := h.grpcClient.GetOperatorServiceStub().ListClusters(ctx, nil)
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to list cluster members: %v", err)
+	}
+	return map[string]interface{}{"clusters": resp.GetClusters()}, "", ""
 }
 
 func (h *Handler) getSystemInfo(ctx context.Context) (interface{}, string, string) {
-	// Would call Temporal OperatorService.GetSystemInfo
+	if h.grpcClient == nil {
+		return h.unavailable()
+	}
+	resp, err := h.grpcClient.GetWorkflowServiceStub().GetSystemInfo(ctx,
+		&workflowservice.GetSystemInfoRequest{})
+	if err != nil {
+		return nil, "TEMPORAL_UNAVAILABLE", fmt.Sprintf("failed to get system info: %v", err)
+	}
 	return map[string]interface{}{
-		"server_version": "1.24.0",
+		"server_version": resp.GetServerVersion(),
 	}, "", ""
 }
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+func (h *Handler) writeSuccess(w http.ResponseWriter, action, namespace string, data interface{}) {
+	json.NewEncoder(w).Encode(ResponsePayload{
+		Success: true, Action: action, Namespace: namespace,
+		Data: data, Timestamp: time.Now(),
+	})
+}
+
+func (h *Handler) writeError(w http.ResponseWriter, action, errorCode, message string) {
+	json.NewEncoder(w).Encode(ResponsePayload{
+		Success: false, Action: action,
+		Error: errorCode, Message: message, Timestamp: time.Now(),
+	})
+}
+
+func (h *Handler) writeErrorWithCode(w http.ResponseWriter, action, namespace, errorCode, message string) {
+	json.NewEncoder(w).Encode(ResponsePayload{
+		Success: false, Action: action, Namespace: namespace,
+		Error: errorCode, Message: message, Timestamp: time.Now(),
+	})
+}
+
+func getString(payload map[string]interface{}, key string) string {
+	if val, ok := payload[key]; ok {
+		if str, ok := val.(string); ok {
+			return str
+		}
+	}
+	return ""
+}
+
+func getMap(payload map[string]interface{}, key string) map[string]interface{} {
+	if val, ok := payload[key]; ok {
+		if m, ok := val.(map[string]interface{}); ok {
+			return m
+		}
+	}
+	return nil
+}

k8s/deployment.yaml

@@ -82,16 +82,19 @@ spec:
             secretKeyRef:
               name: gotify-webhook-secret
               key: gotify-url
+              optional: true
         - name: GOTIFY_APP_TOKEN
           valueFrom:
             secretKeyRef:
               name: gotify-webhook-secret
               key: gotify-app-token
+              optional: true
         - name: FORGEJO_WEBHOOK_SECRET
           valueFrom:
             secretKeyRef:
               name: gotify-webhook-secret
               key: forgejo-webhook-secret
+              optional: true
         volumeMounts:
         - name: config
           mountPath: /etc/gateway

k8s/tekton/scripts/integration-test.sh

@@ -2,11 +2,12 @@
 set -e
 
 # Integration test runner for API gateway.
-# Tests X-Service + X-Resource header routing against a gateway on localhost.
+# Runs against a real canary pod in-cluster (has real secrets + upstreams).
+# GW env var must be set: e.g. http://10.244.1.5:8080
 #
 # Required env:
-#   GW           — gateway base URL (e.g. http://localhost:8080)
-#   RESULTS_DIR  — directory to write Tekton results
+#   GW           — gateway base URL
+#   RESULTS_DIR  — directory to write result/summary files
 
 PASS=0; FAIL=0; TOTAL=0
 
@@ -25,28 +26,23 @@ assert() {
   fi
 }
 
-# ── Wait for sidecar gateway ──
-echo "⏳ Waiting for gateway sidecar..."
+# ── Wait for gateway ──────────────────────────────────────────────────────────
+echo "⏳ Waiting for gateway at ${GW}..."
 READY=false
-for i in $(seq 1 60); do
+for i in $(seq 1 30); do
   CODE=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
   if [ "$CODE" = "200" ]; then
-    sleep 1
-    C2=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
-    C3=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
-    if [ "$C2" = "200" ] && [ "$C3" = "200" ]; then
     READY=true
     echo "✓ Gateway ready"
     break
   fi
-  fi
   sleep 2
 done
 
 if [ "$READY" = "false" ]; then
   echo "✗ Gateway never became ready"
   echo "fail"    > "${RESULTS_DIR}/result"
-  echo "0/0 gateway timeout" > "${RESULTS_DIR}/summary"
+  echo "0/0 timeout" > "${RESULTS_DIR}/summary"
   exit 1
 fi
 
@@ -54,78 +50,69 @@ echo ""
 echo "═══ Integration Tests ═══"
 echo ""
 
-# ── Health ──
+# ── Health ────────────────────────────────────────────────────────────────────
 echo "▸ Health"
 assert "GET /healthz" 200 -X GET "${GW}/healthz"
 assert "GET /readyz"  200 -X GET "${GW}/readyz"
 
-# ── Header validation ──
+# ── Header validation ─────────────────────────────────────────────────────────
 echo "▸ Header validation"
 assert "X-Service without X-Resource → 400" 400 \
   -X GET -H "X-Service: memory" "${GW}/"
 assert "unknown service → 404" 404 \
   -X GET -H "X-Service: nonexistent" -H "X-Resource: foo" "${GW}/"
 
-# ── S3 (no auth, MinIO rejects → 403) ──
+# ── S3 (no auth, MinIO rejects → 403) ────────────────────────────────────────
 echo "▸ S3 service"
-assert "s3/list-objects" 403 \
+assert "s3/list-objects → 403" 403 \
   -X GET -H "X-Service: s3" -H "X-Resource: list-objects" "${GW}/"
 
-# ── SQS (auth required → 401) ──
+# ── SQS (auth required → 401) ─────────────────────────────────────────────────
 echo "▸ SQS service"
-assert "sqs/list-queues" 401 \
+assert "sqs/list-queues → 401" 401 \
   -X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"
 
-# ── Workflow visibility (namespace pass-down) ──
+# ── Workflow ──────────────────────────────────────────────────────────────────
 echo "▸ Workflow service"
 
-# Test 1: List workflows in poimen-harness namespace (should see 4 terminated workflows)
-echo "  Testing workflow visibility in poimen-harness namespace..."
-WF_LIST=$(curl -s -X POST \
+# List with namespace — real Temporal call.
+# 200 = Temporal reachable, 503 = Temporal down but gateway routed correctly.
+echo "  Testing workflow list (poimen-harness namespace)..."
+WF_LIST=$(curl -s \
   -H "X-Service: workflow" \
   -H "X-Resource: list" \
   -H "Content-Type: application/json" \
   -d '{"namespace": "poimen-harness"}' \
   "${GW}/" 2>/dev/null || echo '{}')
 
-# Check if response contains workflows
-if echo "$WF_LIST" | grep -q '"executions"'; then
-  echo "  ✓ Workflow list returned (poimen-harness namespace)"
+TOTAL=$((TOTAL + 1))
+if echo "$WF_LIST" | grep -qE '"executions"|"TEMPORAL_UNAVAILABLE"'; then
+  echo "  ✓ workflow/list responded correctly"
   PASS=$((PASS + 1))
 else
-  echo "  ✗ Workflow list failed to return executions"
+  echo "  ✗ workflow/list unexpected: $WF_LIST"
   FAIL=$((FAIL + 1))
 fi
-TOTAL=$((TOTAL + 1))
 
-# Test 2: Verify we can query terminated workflows
-echo "  Testing terminated workflow visibility..."
-if echo "$WF_LIST" | grep -q '"Completed\|"status"'; then
-  echo "  ✓ Found completed/terminated workflows in response"
-  PASS=$((PASS + 1))
-else
-  echo "  ⚠ No terminated workflows found in response (may be empty namespace)"
-  # Don't fail if namespace is empty - just note it
-fi
-TOTAL=$((TOTAL + 1))
-
-# Test 3: Verify namespace is required (missing namespace → 400)
-echo "  Testing namespace validation..."
-NO_NS=$(curl -s -w '%{http_code}' -X POST \
+# Namespace is required — canary pod has real WorkflowAdapter → must return 400
+assert "workflow/list without namespace → 400" 400 \
+  -X POST \
   -H "X-Service: workflow" \
   -H "X-Resource: list" \
   -H "Content-Type: application/json" \
   -d '{}' \
-  "${GW}/" 2>/dev/null || echo "000")
+  "${GW}/"
 
-if [ "$NO_NS" = "400" ]; then
-  echo "  ✓ Correctly rejected list without namespace (400)"
-  PASS=$((PASS + 1))
-else
-  echo "  ✗ Expected 400 for missing namespace, got $NO_NS"
-  FAIL=$((FAIL + 1))
-fi
-TOTAL=$((TOTAL + 1))
+# ── Forgejo webhook ───────────────────────────────────────────────────────────
+echo "▸ Forgejo webhook"
+# Canary pod has real handler wired. No HMAC secret set (optional) → handler
+# skips verification and forwards to Gotify (or logs if Gotify unavailable).
+assert "POST /v1/webhooks/forgejo → 200" 200 \
+  -X POST \
+  -H "Content-Type: application/json" \
+  -H "X-Gitea-Event: push" \
+  -d '{"ref":"refs/heads/main","commits":[{"message":"test"}],"repository":{"full_name":"test/repo"},"sender":{"login":"ci"}}' \
+  "${GW}/v1/webhooks/forgejo"
 
 echo ""
 echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"