(plan) update the plan to captures more

2026-08-18 20:04:29 -07:00
parent 5a30d0ffc6
commit 139f8419bb
11 changed files with 993 additions and 1 deletions
@@ -0,0 +1,88 @@
+# T10.10 — Orchestration composition gate
+
+| Field | Value |
+|---|---|
+| Phase | P10 — Orchestration |
+| Size | L — over 3 days |
+| Status | Not started |
+| Flags | gate |
+| Spec | inlined below |
+| Blocks | — |
+
+## Goal
+
+Prove the properties no single T10.x task owns: a full goal chain survives a
+real Kafka outage, dispatch is idempotent under forced redelivery,
+`Suspended`-approval produces byte-identical IR to hand-authored YAML, and
+the HTTP method table stands as a published artifact.
+
+## Facts (inlined — no spec read needed)
+
+- Mirrors T7.4's fault-injection shape — broker down for the whole test —
+  extended across the full events → reconcile → dispatch → inbox-relay →
+  spawn loop, not just outbox delivery.
+- Front-door equivalence for door (b) extends T3.10's existing hash-equality
+  gate — same discipline, new door.
+- Gate script follows board convention: one script, diffed against a
+  committed expected output, empty diff is the only pass.
+
+## Steps
+
+1. Compose a fixture: one goal, a 2-run chain (A → reconcile → B → reconcile
+   → `Stop`), driven through real HTTP calls and real Kafka topics.
+2. Kill the broker mid-chain — after A completes, before the dispatch
+   message for B is consumed; assert the chain still completes once the
+   broker returns, with B eventually spawned.
+3. Force redelivery of the `.dispatch` message for B; assert exactly one
+   run B exists.
+4. Submit a problem statement through door (b), edit the draft, approve;
+   separately hand-author the identical edited content as YAML and load it
+   through door (a); assert both `WorkflowVersion` hashes match.
+5. Snapshot the HTTP method table (paths + request/response shapes) to a
+   committed fixture; assert no path removed and no field removed relative
+   to the fixture — additions are fine, removals fail the gate.
+6. Assert a goal-stall metric fires for a deliberately broken `Reconciler`
+   on one goal while a healthy goal in the same tenant proceeds unaffected
+   (T10.8's concurrency claim, at gate scope).
+
+## Acceptance
+
+- All six checks above pass with an empty diff against
+  `verify/expected/T10.10.txt`.
+
+## Verify
+
+**Harness:** full stack — embedded `redb`, real Kafka (or the board's
+chosen fault-injection substrate), `axum` API instance, stub `Reconciler`
+with scripted multi-step decisions.
+
+**Integration test** — `tests/it_p10_composition_gate.rs`, one numbered
+assertion per Steps item above (`a1`..`a6`), reported by name per the
+board's script convention.
+
+**Command:** `verify/T10.10.sh`, diffed against `verify/expected/T10.10.txt`.
+
+**False pass:**
+- Running the chain with the broker never actually taken down — the
+  "survives an outage" claim needs the outage to really happen mid-chain,
+  not just be configured as theoretically tolerable.
+- Skipping the method-table snapshot diff — a route or field silently
+  removed here breaks every embedder bound to the table (HTTP today, stdio
+  later) without any single T10.x task's own tests catching it, since none
+  of them own the whole table.
+
+## Traps
+
+- Treating this gate as "run all T10.x tests together." It must assert
+  properties none of them individually assert, per the board's own gate
+  discipline (INDEX.md, "Verification practice," point 5).
+- Committing the method-table fixture as freeform prose instead of a
+  diffable, structured snapshot. An unreviewable diff defeats the point of
+  having a fixture at all.
+
+---
+
+Background (not required to do this task):
+[../INDEX.md](../INDEX.md) (verification practice) ·
+[T7.4-outbox-relay.md](T7.4-outbox-relay.md) ·
+[T3.10-front-door-equivalence.md](T3.10-front-door-equivalence.md)