Align isolated Redis readiness with its native TCP bootstrap

Author: KSemenenko

docs/ADR/ADR-080-benchmark-failure-isolation.md

@@ -51,6 +51,22 @@ upload; cancellation/timeouts that prevent artifacts remain explicit blockers.
    hosts/URLs/environment overrides. Root integrates this port-isolation follow-up,
    reviews the unchanged production callers and reruns the10 original scenarios
    through freshly built Aspire/TUnit before the next scoped checkpoint.
+   Under FAIL-PREP-REDIS (REQ/AC-BC-FAIL-009), preserve the existing isolated
+   password-authenticated RESP/TCP bootstrap and native6379 replication. Use the
+   official resource-local `WithoutHttpsCertificate()` call, with compiler opt-in
+   ASPIRECERTIFICATES001 limited to the native API and direct annotation checks.
+   This prevents the pinned Aspire13.6 BeforeStart callback from changing the
+   endpoint/discovered connection to TLS while the owned bootstrap stays plain.
+   Native-failures agent owns only IsolatedRedisResources.cs, the existing Redis
+   resource-model regression and actual RedisNativeReadinessRegression transport
+   checks. Root owns docs, integration, build/format/Aspire verification, scoped
+   checkpoint and genuine new-source1/2/3-node preflight/publication evidence.
+   Resource tests require explicit certificate opt-out, fixed native port/scheme
+   and authenticated non-TLS client configuration; real startup tests also retain
+   PONG/write/direct-copy/cancellation and AOF/ack contracts. Never remove health
+   checks, alter shared TLS/trust settings, disable certificate validation or
+   change another engine's resources. Rollback is the scoped call/check removal
+   and honestly restores the known readiness mismatch; no storage migration.
    Under FAIL-PREP-KURRENT, `KurrentTarget.InitializeAsync` constructs the actual
    SDK writer only after `KurrentClusterVerifier.VerifyAsync` proves membership.
    Three SDK/resource-model tests belong to ComparisonTests and run in common

docs/Features/BenchmarkComparisons.md

@@ -691,6 +691,7 @@ KeyLoad engine repair and concurrent series-codec work are outside this task.
 | REQ-BC-FAIL-006 bounded registry readiness | AC-BC-FAIL-006 each native HTTP probe has at most2s within the unchanged30s total; only settled non-aborted HTTP200 succeeds; private no-follow diagnostics remain at most121 records/64KiB and evidence-write failures propagate. Actual fixture listeners use kernel-assigned loopback ports; optional numeric port accepts only integers1..65535 before HTTP/evidence, while both production callers keep the default5000 | `ImageRegistryReadinessTests`:10 actual loopback HTTP/error/bounds cases, including rejected port inputs before I/O, plus genuine pinned Docker image export/import in GitHub |
 | REQ-BC-FAIL-007 Kurrent writer starts after membership | AC-BC-FAIL-007 verify all native1/2/3-member views before constructing the SDK writer; retain native DNS seeds, TLS verification, leader preference, NoStream semantics, acknowledgements, replica-copy oracle and cleanup | `IsolatedKurrentDiscoverySettingsTests`:3 actual SDK/resource-model cases; genuine Aspire-owned StreamAppend preflights for1/2/3 nodes |
 | REQ-BC-FAIL-008 explicit cancellation stops owned work | AC-BC-FAIL-008 workload, finalization and result upload use `!cancelled()` so ordinary failure still finalizes while cancellation stops execution/publication; `always()` cleanup retains bounded diagnostics and safely removes owned registries whose setup was cancelled | `WorkflowBenchmarkFailureTests`, unchanged canceled-job/producer rejection regressions and actual GitHub lifecycle |
+| REQ-BC-FAIL-009 align native Redis transport | AC-BC-FAIL-009 each isolated Redis resource uses the documented native certificate opt-out for its existing authenticated RESP/TCP bootstrap; after actual Aspire startup, primary/replica endpoints retain scheme `redis` and native target port6379 with TLS disabled. Discovered mapped host ports remain dynamic; native client settings retain a password without `ssl=true`. Preserve health checks, wait dependencies, AOF `always`, native membership, direct-copy/cancellation checks and WAIT/WAITAOF acknowledgements | actual pinned resource-model regressions plus genuine Aspire-owned native Redis 1/2/3-node preflights; complete matrix and site qualification remain mandatory |
 
 [ADR-080](../ADR/ADR-080-benchmark-failure-isolation.md) owns the boundary change.
 Ordered task graph: FAIL-CONTRACT (root, complete) -> FAIL-SITE (site worker),
@@ -800,6 +801,28 @@ Source/module/fixture/runner and original report hashes are retained in the loca
 development receipt and status. Complete delivered-source GitHub publication is
 pending; these development results do not qualify a full cohort or website.
 
+The original source6ec Redis preflights now prove a separate preparation defect:
+jobs111319875391/111319875411 started native Redis8.4.0 on plain TCP, but the
+Aspire13.6 healthcheck attempted TLS and blocked `app.StartAsync` until the60-minute
+case deadline. Both failed jobs finalized and uploaded null-report availability
+envelopes, then completed owned cleanup successfully. No workload measurements
+started. FAIL-PREP-REDIS uses the documented resource-local native
+`WithoutHttpsCertificate()` API to preserve the existing authenticated RESP/TCP
+contract; it does not alter a connection string by hand or disable certificate
+validation. Its experimental compiler opt-in is limited to that API and direct
+annotation verification. Root integrates the bounded benchmark-only change after
+the native source review, runs focused regressions and full build/format checks,
+then verifies genuine new-source preflights and complete publication. No Redis
+measurement repair or full-cohort publication is claimed before that evidence.
+
+The Redis transport candidate (archive of3aeb8cb plus its scoped benchmark patch)
+passed full Release build with0warnings/errors, formatter and governance. Its
+freshly built actual pinned resource-model regressions passed3/3 through the
+Aspire/TUnit comparison entry point, without skips/cancellation/timeouts. The
+experimental opt-in is confined to the resource API and actual annotation checks.
+These model results do not prove Docker startup or workload execution; new-source
+native1/2/3 preflights and complete aggregate/site/Pages acceptance remain pending.
+
 ```mermaid
 flowchart LR
   Plan[Complete native cell plan] --> Jobs[Independent Aspire workloads]

docs/implementation/status.json

@@ -3139,7 +3139,7 @@
     "status": "in_progress",
     "feature": "docs/Features/BenchmarkComparisons.md",
     "decision": "docs/ADR/ADR-080-benchmark-failure-isolation.md",
-    "sourceStage": "authenticated_failed_cell_publication_with_native_preparation_repair_and_explicit_cancellation_cleanup",
+    "sourceStage": "authenticated_failed_cell_publication_with_native_registry_kurrent_redis_transport_repairs_and_explicit_cancellation_cleanup",
     "baselineRun": 37154664616,
     "originalFailedJob": 111299652762,
     "originalDiagnosticArtifact": 11286445994,
@@ -3190,7 +3190,7 @@
         "scope": "preparation and native preflight only;4096-record development workload; no scale, full cohort, winner or power-loss qualification"
       }
     },
-    "localDevelopmentVerification": "Delivered6ec Linux clean build, formatter, workflow inventory, registry10/10 and SDK/resource settings3/3 passed. Clean88e2cec snapshot passed full Release build, formatter and governance; actual full unit2821/2867 passed with46 failures, no skips/cancellation (including a registry port conflict, macOS temp-link rejections, missing Git metadata for the chunk child and an allocation assertion). Workflow cancellation3/3 and failed producer/finalizer2/2 passed through Aspire. Benchmark-only ephemeral-port follow-up freshly built clean with0warnings/errors; formatter and governance passed; actual registry10/10 normal and10/10 scalar passed through Aspire/TUnit with canonical owned TMPDIR. Complete delivered-source native/site/Pages qualification remains pending; no KeyLoad engine repair in this stage.",
+    "localDevelopmentVerification": "Delivered6ec Linux clean build, formatter, workflow inventory, registry10/10 and SDK/resource settings3/3 passed. Clean88e2cec snapshot passed full Release build, formatter and governance; actual full unit2821/2867 passed with46 failures, no skips/cancellation (including a registry port conflict, macOS temp-link rejections, missing Git metadata for the chunk child and an allocation assertion). Workflow cancellation3/3 and failed producer/finalizer2/2 passed through Aspire. Benchmark-only ephemeral-port follow-up freshly built clean with0warnings/errors; formatter and governance passed; actual registry10/10 normal and10/10 scalar passed through Aspire/TUnit with canonical owned TMPDIR. Complete delivered-source native/site/Pages qualification remains pending; no KeyLoad engine repair in this stage. Redis transport follow-up: fresh benchmark-only snapshot full Release0warnings/errors, formatter and governance passed; actual pinned resource models3/3 passed through Aspire/TUnit. Genuine new-source Redis1/2/3 startup/workload and complete website publication remain pending.",
     "runtimeQualified": false,
     "publicationQualified": false,
     "keyLoadEngineChanges": false,
@@ -3277,6 +3277,82 @@
         }
       },
       "githubQualified": false
+    },
+    "redisTransportRepair": {
+      "requirement": "REQ-BC-FAIL-009",
+      "originalSourceRevision": "6ec9233a5de963efd85fda041bc5d6d3d4b9972b",
+      "originalRunId": 37161833119,
+      "originalJobs": {
+        "n1": 111319875391,
+        "n2": 111319875411,
+        "n3": 111319875402
+      },
+      "provenFailurePhase": "Native Aspire startup before seeding or workload. Redis server accepted TCP6379 while native healthchecks attempted TLS; comparisons runner waited primaryhealthy until actual60min testcasecancel.",
+      "originalArchives": [
+        {
+          "artifactId": 11289029479,
+          "name": "comparison-preflight-redis-n1-point-read",
+          "digest": "sha256:6e963b3cc15bf8a79b3328712636ec72147c2e3e1f46e4689ddaa793ef1ac1bc"
+        },
+        {
+          "artifactId": 11288519787,
+          "name": "comparison-preflight-qualification-redis-n1-point-read",
+          "digest": "sha256:9bb2fab3ea9c39e9eae39d45d6ae8b9fc1dbc789b7656110002b283037807ca0"
+        },
+        {
+          "artifactId": 11289538105,
+          "name": "comparison-preflight-redis-n2-point-read",
+          "digest": "sha256:16fe4c4fca48dd680d1efc0986337f8c0b78a20a63ff73be9a2420b96dc46b3b"
+        },
+        {
+          "artifactId": 11289572992,
+          "name": "comparison-preflight-qualification-redis-n2-point-read",
+          "digest": "sha256:96627401553c71807f98036a137bab1d64b6db02224deaae4fc546991e706ce0"
+        },
+        {
+          "artifactId": 11289009755,
+          "name": "comparison-preflight-redis-n3-point-read",
+          "digest": "sha256:53a7c302c24004dc5f964a372893b77a7b9df63d8f5916d9c6c1a9e86d222006"
+        },
+        {
+          "artifactId": 11289618006,
+          "name": "comparison-preflight-qualification-redis-n3-point-read",
+          "digest": "sha256:a552fbfaf70045b1b3ae6774586892fc2f5bb3553b257d7a6fc7132814575ea8"
+        }
+      ],
+      "originalTeardown": "all3 succeeded;failedStages empty;actual failed/null availability envelopes uploaded",
+      "nativeApi": "resource-local WithoutHttpsCertificate;single-call experimental opt-in;native TCP target6379 and discovered mapped host ports",
+      "preserved": "password,healthcheck,WaitFor,AOFalways,native replication,direct-copy,cancellation,WAIT/WAITAOF acknowledgement",
+      "development": {
+        "scope": "local development; actual pinned native resource model, not Docker startup or GitHub qualification",
+        "sourceRevision": "3aeb8cb7201ade69682d3f7106abd80ef137155e",
+        "candidatePatchSha256": "67c6834fb7a390e59684b7d8516c54b0fe3ef76c0500d216ff1dd0a26b86ac62",
+        "sourceFiles": {
+          "src/KeyLoad.AppHost/Features/BenchmarkComparisons/IsolatedRedisResources.cs": "283621f15aeb23adc7b40319ab45a030458242e45542763c785908952f1519b9",
+          "tests/KeyLoad.ComparisonTests/Features/BenchmarkComparisons/IsolatedResourceTopologyRedisTests.cs": "9909e073cb2faba4ad330dc79e90623ab798c1eb328c0e41ff5cd268ffdc3e77",
+          "tests/KeyLoad.ComparisonTests/Features/BenchmarkComparisons/RedisNativeReadinessRegression.cs": "f3c10491d7c5f1377591039f2111893ae6505e85edc3fe98481e9c46af130e72"
+        },
+        "runnerDllSha256": "ba7cf6baa9f2e0360be0019ded6a2c2c5191834362fb85dfe4551f6fe79b9665",
+        "fullReleaseBuild": "passed;0warnings;0errors",
+        "formatter": "passed",
+        "governance": "passed",
+        "invoker": "freshly built Aspire/TUnit comparison runner with owned canonical TMPDIR",
+        "report": {
+          "summary": {
+            "total": 3,
+            "passed": 3,
+            "failed": 0,
+            "skipped": 0,
+            "cancelled": 0,
+            "timedOut": 0,
+            "flaky": 0
+          },
+          "sha256": "29566022b609fb9e8ee50614fc3bbe35c79532c27e3712cbe7720a8bd194ab10",
+          "operatingSystem": "macOS 27.0.1",
+          "runtimeVersion": ".NET 10.0.12"
+        }
+      },
+      "nativeGitHubQualified": false
     }
   }
 }

src/KeyLoad.AppHost/Features/BenchmarkComparisons/IsolatedRedisResources.cs

@@ -67,7 +67,7 @@ private static IResourceBuilder<RedisResource> AddNode(IsolatedResourceContext c
         var name = NodeNames[index];
         var directory = context.DataDirectory(name);
         ClusterProfileStore.PrepareDirectory(directory);
-        var node = context.Builder.AddRedis(name, password: password)
+        var node = UseNativeTcp(context.Builder.AddRedis(name, password: password))
             .WithImageTag(Version).WithImageSHA256(BenchmarkResources.RedisDigest[7..])
             .WithContainerNetworkAlias(name).WithDataBindMount(directory)
             .WithBindMount(script, ScriptTarget, isReadOnly: true).WithEntrypoint(Shell)
@@ -83,4 +83,12 @@ private static IResourceBuilder<RedisResource> AddNode(IsolatedResourceContext c
         }
         return node;
     }
+
+    private static IResourceBuilder<RedisResource> UseNativeTcp(IResourceBuilder<RedisResource> node)
+    {
+        // ADR-080: the owned authenticated bootstrap and replica links use native TCP on port 6379.
+#pragma warning disable ASPIRECERTIFICATES001
+        return node.WithoutHttpsCertificate();
+#pragma warning restore ASPIRECERTIFICATES001
+    }
 }

tests/KeyLoad.ComparisonTests/Features/BenchmarkComparisons/IsolatedResourceTopologyRedisTests.cs

@@ -16,8 +16,10 @@ internal sealed class IsolatedResourceTopologyRedisTests
     private const string ReplicationHostGuard = "[ \"$KEYLOAD_REDIS_PRIMARY\" = primary.dev.internal ] || exit 1";
     private const string ReplicationConfiguration = "'replicaof primary.dev.internal 6379'";
     private const string IncorrectReplicationConfiguration = "'replicaof primary 6379'";
+    private const string NativeScheme = "redis";
+    private const int NativePort = 6379;
 
-    /// <summary>AC-ISO-003/005: one native primary and direct replicas, authenticated and persisted independently.</summary>
+    /// <summary>AC-ISO-003/005 and AC-BC-FAIL-009: native authenticated TCP resources with explicit certificate opt-out.</summary>
     [Test]
     [Arguments(1)]
     [Arguments(2)]
@@ -62,6 +64,7 @@ await Assert.That(runnerEnvironment[IsolatedResourceTopologyFixture.NativePrefix
 
     private static async Task VerifyNodeAsync(IsolatedResourceTopologyFixture fixture, RedisResource node, RedisResource primary)
     {
+        await VerifyNativeTransportAsync(node);
         await IsolatedResourceTopologyFixture.VerifyPrivateDataAsync(node, fixture.Context.Root);
         await IsolatedResourceTopologyFixture.VerifyUserAsync(node);
         await Assert.That(node.PasswordParameter).IsSameReferenceAs(primary.PasswordParameter);
@@ -90,6 +93,21 @@ await Assert.That(node.Annotations.OfType<ContainerImageAnnotation>().Single().S
             .IsEqualTo(BenchmarkResources.RedisDigest[7..]);
     }
 
+    private static async Task VerifyNativeTransportAsync(RedisResource node)
+    {
+        // Inspect the actual pinned Aspire annotation; a missing explicit opt-out must fail this regression.
+#pragma warning disable ASPIRECERTIFICATES001
+        var certificate = node.Annotations.OfType<HttpsCertificateAnnotation>().Single();
+        await Assert.That(certificate.Certificate).IsNull();
+        await Assert.That(certificate.UseDeveloperCertificate).IsFalse();
+#pragma warning restore ASPIRECERTIFICATES001
+        var endpoint = node.Annotations.OfType<EndpointAnnotation>().Single();
+        await Assert.That(endpoint.UriScheme).IsEqualTo(NativeScheme);
+        await Assert.That(endpoint.TargetPort).IsEqualTo(NativePort);
+        await Assert.That(endpoint.TlsEnabled).IsFalse();
+        await Assert.That(node.Annotations.OfType<HealthCheckAnnotation>().Any()).IsTrue();
+    }
+
     private static async Task VerifyBootstrapReplicationAsync(string path)
     {
         var source = await File.ReadAllTextAsync(path, TestContext.Current!.Execution.CancellationToken);