Repository navigation
fix: recover compensation runs after lost acknowledgements - #363
Merged
Merged
Conversation
…ompensation-request-recovery
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A compensation creation response can be lost after the run is committed and its source fenced. Add an optional durable request UUID scoped to tenant and continuity: retries return the original run and saved plan with current progress, including completed outcomes. Recheck the exact intent after admission errors to recover concurrent winners and lost commit acknowledgements. Legacy callers can recover the active run through a tenant-scoped GET endpoint or
orch8 execution compensation-active.Share validated decoding between active and known-ID reads so inconsistent tenant, continuity, run ID, state or version fails closed. Preserve encrypted compensation parameters, strict tenant authorization and distinct-intent conflicts. Malformed request IDs and unknown fields are rejected before writing. OpenAPI exposes typed creation/recovery request, parameter and response schemas for SDK generators. No database schema or dependency changes.
Validation: 64 Rust tests (48 storage across plain/encrypted PostgreSQL and SQLite, 15 HTTP safety tests, one scoped identity unit test); all 129 invariant/compensation/runtime E2E cases and all 221 lifecycle/tenant-isolation cases on the isolated server and PostgreSQL; strict all-target Clippy across storage/engine/API/gRPC/CLI/mobile; formatting, typecheck and docs. The corrupt known-ID read regression failed on all four storage variants before the fix.
Builds on #362 and must merge after that source-fence prerequisite passes CI. Independent offline-owner acknowledgement, invocation-specific compensation inputs and acknowledged archival with retained receipts remain separate review work.
The complete API unit suite passes all 367 tests, including route inventory and generated recovery schemas; all 15 HTTP safety cases and strict all-target API lint pass on the API documentation repair.
The CI generated-client gate caught the expected OpenAPI fingerprint change. The representative Rust and JavaScript clients regenerate, compile/check and execute successfully; the regenerated contract fingerprint is updated and the complete generated-client gate passes locally.