89 lines
3.6 KiB
Markdown
89 lines
3.6 KiB
Markdown
|
# T10.10 — Orchestration composition gate
|
||
|
|
|
||
|
|
| Field | Value |
|
||
|
|
|---|---|
|
||
|
|
| Phase | P10 — Orchestration |
|
||
|
|
| Size | L — over 3 days |
|
||
|
|
| Status | Not started |
|
||
|
|
| Flags | gate |
|
||
|
|
| Spec | inlined below |
|
||
|
|
| Blocks | — |
|
||
|
|
|
||
|
|
## Goal
|
||
|
|
|
||
|
|
Prove the properties no single T10.x task owns: a full goal chain survives a
|
||
|
|
real Kafka outage, dispatch is idempotent under forced redelivery,
|
||
|
|
`Suspended`-approval produces byte-identical IR to hand-authored YAML, and
|
||
|
|
the HTTP method table stands as a published artifact.
|
||
|
|
|
||
|
|
## Facts (inlined — no spec read needed)
|
||
|
|
|
||
|
|
- Mirrors T7.4's fault-injection shape — broker down for the whole test —
|
||
|
|
extended across the full events → reconcile → dispatch → inbox-relay →
|
||
|
|
spawn loop, not just outbox delivery.
|
||
|
|
- Front-door equivalence for door (b) extends T3.10's existing hash-equality
|
||
|
|
gate — same discipline, new door.
|
||
|
|
- Gate script follows board convention: one script, diffed against a
|
||
|
|
committed expected output, empty diff is the only pass.
|
||
|
|
|
||
|
|
## Steps
|
||
|
|
|
||
|
|
1. Compose a fixture: one goal, a 2-run chain (A → reconcile → B → reconcile
|
||
|
|
→ `Stop`), driven through real HTTP calls and real Kafka topics.
|
||
|
|
2. Kill the broker mid-chain — after A completes, before the dispatch
|
||
|
|
message for B is consumed; assert the chain still completes once the
|
||
|
|
broker returns, with B eventually spawned.
|
||
|
|
3. Force redelivery of the `.dispatch` message for B; assert exactly one
|
||
|
|
run B exists.
|
||
|
|
4. Submit a problem statement through door (b), edit the draft, approve;
|
||
|
|
separately hand-author the identical edited content as YAML and load it
|
||
|
|
through door (a); assert both `WorkflowVersion` hashes match.
|
||
|
|
5. Snapshot the HTTP method table (paths + request/response shapes) to a
|
||
|
|
committed fixture; assert no path removed and no field removed relative
|
||
|
|
to the fixture — additions are fine, removals fail the gate.
|
||
|
|
6. Assert a goal-stall metric fires for a deliberately broken `Reconciler`
|
||
|
|
on one goal while a healthy goal in the same tenant proceeds unaffected
|
||
|
|
(T10.8's concurrency claim, at gate scope).
|
||
|
|
|
||
|
|
## Acceptance
|
||
|
|
|
||
|
|
- All six checks above pass with an empty diff against
|
||
|
|
`verify/expected/T10.10.txt`.
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
**Harness:** full stack — embedded `redb`, real Kafka (or the board's
|
||
|
|
chosen fault-injection substrate), `axum` API instance, stub `Reconciler`
|
||
|
|
with scripted multi-step decisions.
|
||
|
|
|
||
|
|
**Integration test** — `tests/it_p10_composition_gate.rs`, one numbered
|
||
|
|
assertion per Steps item above (`a1`..`a6`), reported by name per the
|
||
|
|
board's script convention.
|
||
|
|
|
||
|
|
**Command:** `verify/T10.10.sh`, diffed against `verify/expected/T10.10.txt`.
|
||
|
|
|
||
|
|
**False pass:**
|
||
|
|
- Running the chain with the broker never actually taken down — the
|
||
|
|
"survives an outage" claim needs the outage to really happen mid-chain,
|
||
|
|
not just be configured as theoretically tolerable.
|
||
|
|
- Skipping the method-table snapshot diff — a route or field silently
|
||
|
|
removed here breaks every embedder bound to the table (HTTP today, stdio
|
||
|
|
later) without any single T10.x task's own tests catching it, since none
|
||
|
|
of them own the whole table.
|
||
|
|
|
||
|
|
## Traps
|
||
|
|
|
||
|
|
- Treating this gate as "run all T10.x tests together." It must assert
|
||
|
|
properties none of them individually assert, per the board's own gate
|
||
|
|
discipline (INDEX.md, "Verification practice," point 5).
|
||
|
|
- Committing the method-table fixture as freeform prose instead of a
|
||
|
|
diffable, structured snapshot. An unreviewable diff defeats the point of
|
||
|
|
having a fixture at all.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
Background (not required to do this task):
|
||
|
|
[../INDEX.md](../INDEX.md) (verification practice) ·
|
||
|
|
[T7.4-outbox-relay.md](T7.4-outbox-relay.md) ·
|
||
|
|
[T3.10-front-door-equivalence.md](T3.10-front-door-equivalence.md)
|