homelab-frontend/tasks/8.10-serviceadapter-gate.md

8.10 — Phase 8 gate: every service on ServiceAdapter + KV-schema (GREEN)

Phase: 8 — ServiceAdapter CRD rollout Stage: gate Depends on: 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8 (8.9 optional — see below)

Purpose: confirm all real backend services — workflow, s3, sqs, iam, memory — are onboarded through the ServiceAdapter CRD with requestSchema/ responseSchema validation (8.3's DSL), none of them left on hand-written switch-case Go routes or the old path-prefix scheme (/workflow/*, /sqs/*, /db/*). This is the "make sure every service adapts to this format" checkpoint — it does not add new capability, it verifies consistency across what 8.4–8.8 built.

• kubectl -n api get serviceadapters lists exactly workflow, s3, sqs, iam, memory (plus postgres only if that example CR was actually applied as a real onboarding, not just kept as doc illustration)
• No adapter's CR has an empty requestSchema on a method that accepts a body — every write path validates input
• internal/server/router.go has no remaining path-based switch case for /workflow, /sqs, or /db — those prefixes 404 or are fully removed from the router, superseded by X-Service dispatch
• One curl per adapter succeeds end-to-end through the header-based path (below)
• go test ./... -race, CGO_ENABLED=0 go build ./..., go vet ./... all pass

Verify

for svc_resource in "workflow:workflow" "sqs:message" "iam:user" "memory:project"; do
  svc="${svc_resource%%:*}"; res="${svc_resource##*:}"
  code=$(curl -s -o /dev/null -w '%{http_code}' https://api.riotpiao.com/ \
    -H 'Authorization: Bearer <jwt-with-all-capabilities>' \
    -H "X-Service: $svc" -H "X-Resource: $res")
  echo "$svc/$res -> $code"
done
# expected: none of the four returns 404 for "unknown X-Service" — each is a live adapter

curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/db/healthz
# expected: 404 on all three — old prefix routes are gone, not just unused

kubectl -n api get serviceadapters -o jsonpath='{range .items[*]}{.spec.serviceName}{"\n"}{end}' | sort
# expected: iam, memory, s3, sqs, workflow (plus postgres iff real)