homelab-frontend/tasks/8.10-serviceadapter-gate.md

# 8.10 — Phase 8 gate: every service on `ServiceAdapter` routing (GREEN)

Phase: 8 — ServiceAdapter routing rollout
Stage: GREEN ✅
Depends on: 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8

**Gate**: All 5 services (workflow, s3, sqs, iam, memory) now route via X-Service/X-Resource.
No hand-written path switches. Old routes deprecated. Ready for Phase 3 auth work.

- [x] 5 adapters defined in ConfigMap: workflow, s3, sqs, iam, memory
- [x] No CRs in cluster (decision: config over K8s API, Phase 8 used ConfigMap)
- [x] All services onboarded to X-Service/X-Resource dispatch
- [x] Schema validation integrated (8.3 DSL parser)
- [x] Real integration tests passing
- [x] `go test ./... -race`, `go vet ./...` passing
- [x] Old path-based routes deprecated (now 404)

## Verification (Done)

```bash
# ✅ 5 adapters in ConfigMap
kubectl get configmap api-gateway-config -n api -o yaml | grep serviceName
# sqs, workflow, memory, s3, iam

# ✅ Real integration tests
GATEWAY_URL=https://api.riotpiao.com go test -tags integration -v ./internal/serviceadapter

# ✅ Unknown service → 404
curl -H 'X-Service: nonexistent' https://api.riotpiao.com/

# ✅ Old path routes gone
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/db/healthz
# All 404

# ✅ Go tests pass
go test ./... -race
go vet ./...
```

## Notes

- Architecture: ConfigMap config (not K8s CRs) drives adapter definitions
- Stakater Reloader auto-restarts pods on ConfigMap change
- Gateway is dumb pipe (Option B): services validate JWTs
- SQS special case: gateway checks Authorization header
- Phase 3: JWT signature validation in services
- Phase 9: gRPC proxying for Temporal