Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
1.8 KiB
1.8 KiB
7.3 — /workflow/* to Temporal (GREEN)
Phase: 7 — Additional capability prefixes Stage: GREEN Depends on: 6.5
Temporal runs in the temporal namespace. Temporal namespace registration is
automatic via queue-operator and is NEVER done manually — this route must not create,
register or mutate Temporal namespaces, only proxy to what queue-operator has already
provisioned.
/workflow/*onapi.riotpiao.comproxies to the Temporal Service in thetemporalnamespace- Nothing in this route registers a Temporal namespace. Registration stays with queue-operator
- Path rewriting between the
/workflowprefix and Temporal's own paths is explicit in configuration - Timeouts and body caps are explicit, with no silent defaults (G6). Long-poll semantics are accounted for rather than truncated by a short read timeout
- The route requires authentication and the token is checked for workflow capability — a GPU token must not drive workflows
- The NetworkPolicy is extended to reach only Temporal
- Streaming or long-poll responses pass through unbuffered, and a client disconnect cancels the upstream call rather than orphaning it (G4)
/v1/*behaviour is unchanged before and after- Metrics and rejection counters cover this route with its own route label
Verify
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
# expected: 401 without a token
curl -s -H "authorization: Bearer $WORKFLOW_TOKEN" https://api.riotpiao.com/workflow/health
# expected: Temporal's own response, proxied unmodified
kubectl -n temporal exec svc/temporal-admintools -- tctl --ad temporal-frontend:7233 namespace list | sort > /tmp/ns.after
diff /tmp/ns.before /tmp/ns.after
# expected: no diff — the gateway registered nothing; queue-operator remains the only registrar