ms2k/nuthatch
SHA256
Watch
0
Code Releases Activity

Replace planning-era names and squash initial schema

Browse source 
Use descriptive test and executable names so implementation surfaces do not depend on journal organization. Consolidate the unreleased migration history into the authoritative initial schema because no deployed database requires an upgrade path.
This commit is contained in:
ms2k 2026-07-19 15:21:24 +09:00
commit 15eb0038d2
2 changed files with 299 additions and 436 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/spec/contracts.md
View file

@ -55,13 +55,12 @@ certificate and key paths.
## SQL contract
The ordered files `sql/001_schema.sql`, `sql/002_pool_limit_guard.sql`, and
`sql/003_recovery_settlement.sql` are the authoritative schema history.
`postgresql-migration` initializes, applies, records, and validates that
history at process startup. A fixed PostgreSQL advisory lock serializes
migration across replicas, and startup fails if migration or validation fails.
Schema changes are new ordered migration files; deployed migration contents do
not change.
`sql/001_initial_schema.sql` is the authoritative initial schema.
`postgresql-migration` initializes, applies, records, and validates it at
process startup. A fixed PostgreSQL advisory lock serializes migration across
replicas, and startup fails if migration or validation fails. After the first
deployment, schema changes are new ordered migration files and deployed
migration contents do not change.
`pools` owns quota limits, used bytes, and reservations.
`mutations` owns idempotency identity, request fingerprint data, protocol
@ -183,7 +182,8 @@ credentials.
The deployment's object-store IAM or policy system enforces that scope. The
Kubernetes manifest supplies the scoped credential through the secret boundary;
`tests/kind/lib.sh` provisions equivalent fixture principals, and
`tests/kind/wp05-job.yaml.in` verifies denial against a different bucket.
`tests/kind/product-matrix-job.yaml.in` verifies denial against a different
bucket.
Nuthatch is the exclusive writer to `users/` and `shared/` in the configured
bucket while the service is enabled. Operators may inspect those prefixes, but

4
docs/spec/testing.md
View file

@ -42,7 +42,7 @@ All fixture credentials and data are synthetic. Test workloads use ClusterIP
service names and do not require host port forwarding. The fixture does not
read or change the user's Kubernetes context.
Package runners select the `base`, `durable`, `coordination`, `oidc`, and
Test runners select the `base`, `durable`, `coordination`, `oidc`, and
`target` fixture families; `all` selects every dependency family. The selected
families expand into provider lanes, which run sequentially and stop at the
first failure. Each lane receives an isolated PostgreSQL database,
@ -52,7 +52,7 @@ Lane configuration is available both as environment variables from a
lane-specific ConfigMap and as `/run/nuthatch-fixture/profile.env`. Successful
lanes delete their Job, profile, database, coordination state, and bucket
before the next lane. Failed lanes remain intact when the enclosing runner is
retained. Package-owned application or test images are loaded with
retained. Locally built application or test images are loaded with
`load_local_image`; released dependencies always use the digest-pinned images
from `tests/kind/versions.env`.