mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc
d93bde42e1
The residency gate's two halves were each unit-tested in isolation against
`insert_established_for_test`, but nothing exercised the composition: a
community whose invalidation topic is severed *while a caller is resolving
authorization*. That is the silent-stale-authz hole the whole B1 design
exists to close — an entry admitted in the reconnect gap stays readable for
a full TTL with nothing able to drop it, and reports no error anywhere.
The drill composes the production objects `main.rs` wires (`PubSubManager`,
its own `cache_invalidation_topics()`, a `CacheResidency` at
`AUTHZ_CACHE_TTL`) and walks bootstrap -> open gate -> `CLIENT KILL` sever
-> suppression -> resume, asserting real delivery either side of the sever
rather than establishment bookkeeping. No production code changes, and no
new production seam.
It lives in buzz-relay because it must: `CacheResidency` is here,
`CommunityTopics` is in buzz-pubsub, and the dependency edge only runs
relay -> pubsub. The `clients_with_exact_subs` helper is therefore a
test-private twin of the buzz-pubsub one rather than a new `pub`
cross-crate surface whose only consumer is one test.
Which forces the ci.yml change. The Redis-ignored step selected
`package(buzz-pubsub)` alone, so an `#[ignore]`d test added here would pass
locally and gate nothing; the selector now names `state::redis_tests` too.
Verified under that exact expression via nextest, not a package run: 54/54
pass, and a dead-port control (`REDIS_URL` -> 127.0.0.1:6399) makes the
drill FAIL rather than self-skip.
Two bounds in the drill are load-bearing and were both found by mutation,
not by reading:
* The sever's gate-close wait is 500ms, far below the 1s reconnect backoff.
`connect_and_serve` also clears establishment on connect, so a generous
bound is satisfied by that later clear — verified: with a 15s bound the
test still passes with the reconnect-gap `clear_established()` deleted.
Only the tight bound can be met by the clear that protects the gap.
* Resume asserts the still-resident community only. The suppressed
admission re-stamps its own residency; the other six age out at
`AUTHZ_CACHE_TTL` and are correctly never re-subscribed. Asserting all
seven claims a property the level-triggered design deliberately lacks and
turns the test into a race against a 10s TTL.
Mutation results: reconnect-gap clear removed -> fails at the sever assert
in 0.53s; residency gate bypassed -> fails at bootstrap; residency recorded
only when already established (the closed-loop deadlock) -> fails to
converge. Stale-snapshot withdrawal does not bite this drill and should
not: three existing buzz-pubsub tests already cover that invariant.
The two `buzz-relay --lib` failures on this branch
(`telemetry::tests::trace_context_lookup_does_not_enable_callsites`,
`api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo`) are
pre-existing — reproduced identically at a clean 784a5f3a5 with this diff
stashed, 834 passed / 2 failed both ways.
Co-authored-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>
Signed-off-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>