Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
35 lines
1.8 KiB
Markdown
35 lines
1.8 KiB
Markdown
# 7.3 — `/workflow/*` to Temporal (GREEN)
|
|
|
|
Phase: 7 — Additional capability prefixes
|
|
Stage: GREEN
|
|
Depends on: [6.5](6.5-cutover.md)
|
|
|
|
Temporal runs in the `temporal` namespace. Temporal namespace registration is
|
|
automatic via queue-operator and is NEVER done manually — this route must not create,
|
|
register or mutate Temporal namespaces, only proxy to what queue-operator has already
|
|
provisioned.
|
|
|
|
- [ ] `/workflow/*` on `api.riotpiao.com` proxies to the Temporal Service in the `temporal` namespace
|
|
- [ ] Nothing in this route registers a Temporal namespace. Registration stays with queue-operator
|
|
- [ ] Path rewriting between the `/workflow` prefix and Temporal's own paths is explicit in configuration
|
|
- [ ] Timeouts and body caps are explicit, with no silent defaults (G6). Long-poll semantics are accounted for rather than truncated by a short read timeout
|
|
- [ ] The route requires authentication and the token is checked for workflow capability — a GPU token must not drive workflows
|
|
- [ ] The NetworkPolicy is extended to reach only Temporal
|
|
- [ ] Streaming or long-poll responses pass through unbuffered, and a client disconnect cancels the upstream call rather than orphaning it (G4)
|
|
- [ ] `/v1/*` behaviour is unchanged before and after
|
|
- [ ] Metrics and rejection counters cover this route with its own route label
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
|
|
# expected: 401 without a token
|
|
|
|
curl -s -H "authorization: Bearer $WORKFLOW_TOKEN" https://api.riotpiao.com/workflow/health
|
|
# expected: Temporal's own response, proxied unmodified
|
|
|
|
kubectl -n temporal exec svc/temporal-admintools -- tctl --ad temporal-frontend:7233 namespace list | sort > /tmp/ns.after
|
|
diff /tmp/ns.before /tmp/ns.after
|
|
# expected: no diff — the gateway registered nothing; queue-operator remains the only registrar
|
|
```
|