62 lines
3.0 KiB
Markdown
62 lines
3.0 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: Durable logs recover after restart
|
|
|
|
The system SHALL persist accepted log batches, acknowledged sequence state, retention metadata, and bounded query indexes so a Platform restart does not duplicate or lose acknowledged ranges.
|
|
|
|
#### Scenario: Restart preserves log cursor
|
|
|
|
- **WHEN** a batch is acknowledged, Platform restarts, and a caller queries after a cursor
|
|
- **THEN** the ordered entries and latest acknowledged sequence MUST be available from the persisted store
|
|
|
|
#### Scenario: Retry remains idempotent
|
|
|
|
- **WHEN** Run retries an acknowledged batch with the same stream, range, and checksum
|
|
- **THEN** Platform MUST return an idempotent acknowledgement without duplicating entries
|
|
|
|
### Requirement: Run log spool is restart-safe
|
|
|
|
The Run log spool SHALL atomically persist unacknowledged batches, tolerate a process restart, and remove a batch only when an acknowledgement covers its full stream range.
|
|
|
|
#### Scenario: Interrupted enqueue
|
|
|
|
- **WHEN** a process restarts after an incomplete temporary spool write
|
|
- **THEN** the next spool load MUST ignore temporary files and retain every committed unacknowledged batch
|
|
|
|
### Requirement: Durable artifacts recover with checksum and chunk bounds
|
|
|
|
The system SHALL persist artifact metadata, transfer manifests, received chunk indexes, chunk checksums, final checksums, and bounded content so uploads can resume after restart.
|
|
|
|
#### Scenario: Resume missing chunk
|
|
|
|
- **WHEN** a transfer has received some chunks and Platform restarts
|
|
- **THEN** status MUST return the same received indexes and next missing index without exposing storage paths
|
|
|
|
#### Scenario: Checksum conflict is rejected
|
|
|
|
- **WHEN** a retry uses a different payload or checksum for an already received chunk
|
|
- **THEN** Platform MUST reject it and leave the original chunk and transfer state unchanged
|
|
|
|
### Requirement: Metrics and backups are durable and bounded
|
|
|
|
The system SHALL persist metric samples and backup records, apply explicit age/count/byte retention, support recovery status, and expose only owner-authorized safe projections.
|
|
|
|
#### Scenario: Retention prunes oldest records
|
|
|
|
- **WHEN** a metric or backup append exceeds its configured bound
|
|
- **THEN** the oldest records MUST be pruned deterministically and an audit event MUST record the retention result
|
|
|
|
#### Scenario: Interrupted backup is recoverable
|
|
|
|
- **WHEN** a backup remains in an incomplete state during restart
|
|
- **THEN** it MUST be projected as failed/recoverable with an audit outcome and MUST NOT claim an available artifact
|
|
|
|
### Requirement: Safe queries enforce ownership
|
|
|
|
The system SHALL authorize log, artifact, metric, and backup queries by platform session and server ownership/admin scope, returning bounded pages/cursors and never returning host paths, credentials, sockets, Run tokens, leases, session hashes, or secret references.
|
|
|
|
#### Scenario: Cross-owner query
|
|
|
|
- **WHEN** a user queries another owner's resource
|
|
- **THEN** the service MUST reject with the existing 403 behavior and MUST NOT reveal whether private body data exists
|