ms2k/remora
SHA256
Watch
0
Code Releases Activity

Add complete system qualification evidence

Browse source
This commit is contained in:
ms2k 2026-07-18 14:09:04 +09:00
commit 6952767503
3 changed files with 1256 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

54
tests/qualification/check-requirements.sh Executable file
View file

@ -0,0 +1,54 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
MATRIX="$ROOT/tests/qualification/requirements.tsv"
TLC_EVIDENCE="$ROOT/tests/qualification/tlc-evidence.tsv"
ARCHITECTURE="$ROOT/docs/spec/architecture.md"
expected="$(
{
rg -o 'FR-[0-9]+' "$ARCHITECTURE"
printf '%s\n' \
NFR-Reliability \
NFR-Observability \
NFR-Scalability \
NFR-Performance \
NFR-Security \
NFR-Deployment
} | sort -Vu
)"
actual="$(cut -f1 "$MATRIX" | sort -Vu)"
if [[ "$actual" != "$expected" ]]; then
diff -u <(printf '%s\n' "$expected") <(printf '%s\n' "$actual")
exit 1
fi
while IFS=$'\t' read -r requirement path symbol; do
[[ -n "$requirement" && -n "$path" && -n "$symbol" ]]
[[ -f "$ROOT/$path" ]]
rg --fixed-strings --quiet "$symbol" "$ROOT/$path"
done < "$MATRIX"
model_commit="$(cut -f4 "$TLC_EVIDENCE" | sort -u)"
test "$(printf '%s\n' "$model_commit" | wc -l)" = 1
git -C "$ROOT" cat-file -e "$model_commit^{commit}"
git -C "$ROOT" diff --quiet "$model_commit" -- docs/protocol
configs="$(find "$ROOT/docs/protocol" -maxdepth 1 -name '*.cfg' -printf '%f\n' | sort)"
evidence_configs="$(cut -f1 "$TLC_EVIDENCE" | sort)"
test "$configs" = "$evidence_configs"
tla_sha256="$(sha256sum "$ROOT/docs/protocol/Remora.tla" | cut -d ' ' -f1)"
while IFS=$'\t' read -r config config_sha256 evidence_tla_sha256 commit spec generated distinct depth completion; do
test "$(sha256sum "$ROOT/docs/protocol/$config" | cut -d ' ' -f1)" = "$config_sha256"
test "$evidence_tla_sha256" = "$tla_sha256"
test "$commit" = "$model_commit"
test "$(awk '/^SPECIFICATION / { print $2 }' "$ROOT/docs/protocol/$config")" = "$spec"
[[ "$generated" =~ ^[1-9][0-9]*$ ]]
[[ "$distinct" =~ ^[1-9][0-9]*$ ]]
[[ "$depth" =~ ^[1-9][0-9]*$ ]]
test "$completion" = "Model checking completed. No error has been found."
done < "$TLC_EVIDENCE"
printf 'requirement trace and complete TLC evidence binding passed\n'

26
tests/qualification/requirements.tsv Normal file
View file

@ -0,0 +1,26 @@
FR-1 crates/remora-identity/tests/token_validation.rs keycloak_resource_access_client_roles_decode
FR-2 crates/remora-identity/tests/policy.rs scope_segment_matching_rejects_textual_prefix_coincidence
FR-3 crates/remora-worker/tests/runtime.rs production_adapters_complete_one_job_per_source_kind
FR-4 crates/remora-identity/tests/policy.rs default_target_applies_bucket_and_prefix_overrides
FR-5 crates/remora-api/tests/live_events.rs live_event_replay_authorization_progress_and_resync_converge
FR-6 crates/remora-attempt/tests/mutations.rs failure_disposition_retries_with_budget_and_becomes_terminal_when_exhausted
FR-7 crates/remora-api/tests/public_api.rs public_routes_are_authenticated_replayable_authorized_and_redacted
FR-8 crates/remora-deletion/tests/lifecycle.rs soft_delete_restore_and_authorization_are_terminal_and_idempotent
FR-9 crates/remora-deletion/tests/lifecycle.rs concurrent_hard_delete_is_irreversible_exact_and_manifest_last
FR-10 crates/remora-stream/tests/kernel.rs multi_gigabyte_stream_keeps_bounded_memory
FR-10 crates/remora-result/tests/substrate.rs pages_large_ordered_inventory_without_materializing_all_rows
FR-11 crates/remora-coordination/tests/substrate.rs permit_contention_benchmark_preserves_global_bound
FR-11 crates/remora-worker/tests/runtime.rs local_limit_bounds_concurrent_attempt_tasks
FR-11 deploy/charts/remora/templates/config.yaml REMORA_GLOBAL_ATTEMPT_LIMIT
FR-11 deploy/charts/remora/templates/worker.yaml REMORA_WORKER_LOCAL_ATTEMPT_LIMIT
FR-12 crates/remora-attempt/tests/mutations.rs success_is_an_exact_fenced_commit_cas_and_terminal_state_is_immutable
FR-13 crates/remora-attempt/tests/authority.rs crash_injection_covers_every_cross_store_and_lost_response_boundary
FR-14 crates/remora-attempt/tests/recovery.rs coordination_wipes_reap_lost_attempts_and_reconstruct_dispatch
FR-15 crates/remora-outbound/tests/transport.rs redirects_reauthorize_and_strip_cross_origin_credentials
NFR-Reliability crates/remora-attempt/tests/recovery.rs coordination_partition_rolls_back_and_restart_converges
NFR-Observability crates/remora-api/tests/public_api.rs public_routes_are_authenticated_replayable_authorized_and_redacted
NFR-Observability web/src/App.browser.test.ts renders job status progress and failure
NFR-Scalability crates/remora-worker/tests/runtime.rs local_limit_bounds_concurrent_attempt_tasks
NFR-Performance crates/remora-stream/tests/kernel.rs multi_gigabyte_stream_keeps_bounded_memory
NFR-Security crates/remora-api/tests/public_api.rs public_routes_are_authenticated_replayable_authorized_and_redacted
NFR-Deployment tests/kind/run-deployment.sh operational_restore
1 FR-1 crates/remora-identity/tests/token_validation.rs keycloak_resource_access_client_roles_decode
2 FR-2 crates/remora-identity/tests/policy.rs scope_segment_matching_rejects_textual_prefix_coincidence
3 FR-3 crates/remora-worker/tests/runtime.rs production_adapters_complete_one_job_per_source_kind
4 FR-4 crates/remora-identity/tests/policy.rs default_target_applies_bucket_and_prefix_overrides
5 FR-5 crates/remora-api/tests/live_events.rs live_event_replay_authorization_progress_and_resync_converge
6 FR-6 crates/remora-attempt/tests/mutations.rs failure_disposition_retries_with_budget_and_becomes_terminal_when_exhausted
7 FR-7 crates/remora-api/tests/public_api.rs public_routes_are_authenticated_replayable_authorized_and_redacted
8 FR-8 crates/remora-deletion/tests/lifecycle.rs soft_delete_restore_and_authorization_are_terminal_and_idempotent
9 FR-9 crates/remora-deletion/tests/lifecycle.rs concurrent_hard_delete_is_irreversible_exact_and_manifest_last
10 FR-10 crates/remora-stream/tests/kernel.rs multi_gigabyte_stream_keeps_bounded_memory
11 FR-10 crates/remora-result/tests/substrate.rs pages_large_ordered_inventory_without_materializing_all_rows
12 FR-11 crates/remora-coordination/tests/substrate.rs permit_contention_benchmark_preserves_global_bound
13 FR-11 crates/remora-worker/tests/runtime.rs local_limit_bounds_concurrent_attempt_tasks
14 FR-11 deploy/charts/remora/templates/config.yaml REMORA_GLOBAL_ATTEMPT_LIMIT
15 FR-11 deploy/charts/remora/templates/worker.yaml REMORA_WORKER_LOCAL_ATTEMPT_LIMIT
16 FR-12 crates/remora-attempt/tests/mutations.rs success_is_an_exact_fenced_commit_cas_and_terminal_state_is_immutable
17 FR-13 crates/remora-attempt/tests/authority.rs crash_injection_covers_every_cross_store_and_lost_response_boundary
18 FR-14 crates/remora-attempt/tests/recovery.rs coordination_wipes_reap_lost_attempts_and_reconstruct_dispatch
19 FR-15 crates/remora-outbound/tests/transport.rs redirects_reauthorize_and_strip_cross_origin_credentials
20 NFR-Reliability crates/remora-attempt/tests/recovery.rs coordination_partition_rolls_back_and_restart_converges
21 NFR-Observability crates/remora-api/tests/public_api.rs public_routes_are_authenticated_replayable_authorized_and_redacted
22 NFR-Observability web/src/App.browser.test.ts renders job status progress and failure
23 NFR-Scalability crates/remora-worker/tests/runtime.rs local_limit_bounds_concurrent_attempt_tasks
24 NFR-Performance crates/remora-stream/tests/kernel.rs multi_gigabyte_stream_keeps_bounded_memory
25 NFR-Security crates/remora-api/tests/public_api.rs public_routes_are_authenticated_replayable_authorized_and_redacted
26 NFR-Deployment tests/kind/run-deployment.sh operational_restore

14
tests/qualification/tlc-evidence.tsv Normal file
View file

@ -0,0 +1,14 @@
Remora.cfg 541a10f9075f416447ba79bf1777933ab07c824145662dfa028a61bf6c08279d ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 Spec 31095299 3051836 32 Model checking completed. No error has been found.
RemoraApiMutation.cfg a8dfe0d53ac6703cf283694b626ff8a74ebf84c73f3098d67af825c026975309 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 Spec 14883248 354363 6 Model checking completed. No error has been found.
RemoraClaimActivation.cfg 17e8da65aed191356895e6f9db068b5cceac621def72eebe650fc8c43d748101 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 Spec 275060 32496 13 Model checking completed. No error has been found.
RemoraCombined.cfg 07ba63c59012ae1b8ff4ebfb130b3fada08f5a570fefc16d7b73d95c5ce20645 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 89489746 7186644 31 Model checking completed. No error has been found.
RemoraCredentials.cfg c27c2faa29c1517c8fe4f16b701aa25be949c46523d6fb9c1deb2cefc28b2709 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 999724 116235 26 Model checking completed. No error has been found.
RemoraDisposition.cfg f32ab6af66b11350276ba0b316c7a1d8ad5f8f0a25595684e24ae5e8f210a83d ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 179748 23946 28 Model checking completed. No error has been found.
RemoraDurableFault.cfg 1779d795ed139d18ea553a67a76a0d475363c7112db205f24d87d5624075533b ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 957130 119730 32 Model checking completed. No error has been found.
RemoraFencing.cfg 252f9d0fe071cf835f9ba2fcd62a232420f467eec7bc3ec35273987dd99127df ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 1092925873 92042852 44 Model checking completed. No error has been found.
RemoraGlobal.cfg 045ec597b4c406ba38a3c85c8b40fa8882e0c7b29b7ffa77b2d59af59f6bdf63 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 65998186 5589556 31 Model checking completed. No error has been found.
RemoraLocal.cfg 0fc8e08acf8c1324738009277c406f3c3dd9136016106945fa271c4c2e19bbd3 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 89489746 7186644 31 Model checking completed. No error has been found.
RemoraMultiShot.cfg 52c6247c22a98d13a72738247da9ae31366f9c01047ab672496f2e7ade6c1fc1 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 123778284 11568126 34 Model checking completed. No error has been found.
RemoraResume.cfg b3432788093ae86b37e68dc0afcac42f794a5de7cc9786da8bb5127a89ae2761 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 822029 103911 29 Model checking completed. No error has been found.
RemoraStress.cfg ce0c93848958f6ee9e8247536eda978bb3cc38a27571aa6b002e2163ea591adb ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 250078254 23679190 33 Model checking completed. No error has been found.
RemoraTargetFault.cfg 2389efaace2237d7dca0a55711222885db1446cac59ea2e834b32badffa8f991 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 991208 119730 32 Model checking completed. No error has been found.
1 Remora.cfg 541a10f9075f416447ba79bf1777933ab07c824145662dfa028a61bf6c08279d ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 Spec 31095299 3051836 32 Model checking completed. No error has been found.
2 RemoraApiMutation.cfg a8dfe0d53ac6703cf283694b626ff8a74ebf84c73f3098d67af825c026975309 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 Spec 14883248 354363 6 Model checking completed. No error has been found.
3 RemoraClaimActivation.cfg 17e8da65aed191356895e6f9db068b5cceac621def72eebe650fc8c43d748101 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 Spec 275060 32496 13 Model checking completed. No error has been found.
4 RemoraCombined.cfg 07ba63c59012ae1b8ff4ebfb130b3fada08f5a570fefc16d7b73d95c5ce20645 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 89489746 7186644 31 Model checking completed. No error has been found.
5 RemoraCredentials.cfg c27c2faa29c1517c8fe4f16b701aa25be949c46523d6fb9c1deb2cefc28b2709 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 999724 116235 26 Model checking completed. No error has been found.
6 RemoraDisposition.cfg f32ab6af66b11350276ba0b316c7a1d8ad5f8f0a25595684e24ae5e8f210a83d ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 179748 23946 28 Model checking completed. No error has been found.
7 RemoraDurableFault.cfg 1779d795ed139d18ea553a67a76a0d475363c7112db205f24d87d5624075533b ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 957130 119730 32 Model checking completed. No error has been found.
8 RemoraFencing.cfg 252f9d0fe071cf835f9ba2fcd62a232420f467eec7bc3ec35273987dd99127df ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 1092925873 92042852 44 Model checking completed. No error has been found.
9 RemoraGlobal.cfg 045ec597b4c406ba38a3c85c8b40fa8882e0c7b29b7ffa77b2d59af59f6bdf63 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 65998186 5589556 31 Model checking completed. No error has been found.
10 RemoraLocal.cfg 0fc8e08acf8c1324738009277c406f3c3dd9136016106945fa271c4c2e19bbd3 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 89489746 7186644 31 Model checking completed. No error has been found.
11 RemoraMultiShot.cfg 52c6247c22a98d13a72738247da9ae31366f9c01047ab672496f2e7ade6c1fc1 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 123778284 11568126 34 Model checking completed. No error has been found.
12 RemoraResume.cfg b3432788093ae86b37e68dc0afcac42f794a5de7cc9786da8bb5127a89ae2761 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 822029 103911 29 Model checking completed. No error has been found.
13 RemoraStress.cfg ce0c93848958f6ee9e8247536eda978bb3cc38a27571aa6b002e2163ea591adb ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 250078254 23679190 33 Model checking completed. No error has been found.
14 RemoraTargetFault.cfg 2389efaace2237d7dca0a55711222885db1446cac59ea2e834b32badffa8f991 ec9e4ffaaa367b1420d68e2be332c2ddee32c27970a84edd13dfaa995181cd96 45ebeacaab2034913232c5963a6f526be221eb33 SafetySpec 991208 119730 32 Model checking completed. No error has been found.