Rongsong Shen
06135954ff
Pre-existing uncommitted work: ha-repl-hardening payload data plane (7.x), heartbeat liveness fix (Req 1.3), connection-reuse ASAN fixes, doc cleanup. New: ha-consistency-invariants umbrella (requirements/design/research) and its four implementation sub-specs (specs generated via batch, cross-spec review applied), steering roadmap + product.md Raft+CP decision.
24 lines
2.5 KiB
Markdown
24 lines
2.5 KiB
Markdown
# Brief: ha-commit-barrier-rollout
|
|
|
|
> Sub-spec 2 of 4 implementing the **ha-consistency-invariants** umbrella contract.
|
|
> Authoritative requirements/design/research: `.kiro/specs/ha-consistency-invariants/` (design.md §Write-Path Classification + §Config Barrier + §Idempotency Guards). This brief scopes the slice; do not re-derive decisions.
|
|
|
|
## Problem
|
|
Only WAL_JOB_SUBMIT goes through a commit barrier. Job state changes, queue control, and worker control apply locally with fire-and-forget replication; job/queue control replies before any durability; config push ignores its majority-ACK result; worker-reported facts are silently lost on rejection (bug-396); `mark_job_*` have no idempotency guards.
|
|
|
|
## Desired Outcome
|
|
Every state-changing WAL type routed per the design's classification table: request-shaped → WAIT mode with **commit-first-then-reply** (validate → mutate provisional → append → commit_submit → reply); fact-shaped → RETAIN mode (log-is-the-queue, appended + retried until committed, no timeout, never dropped while running+leading). Config upgrade fails to the requester on missed majority. `mark_job_*` transitions are idempotent and ordered.
|
|
|
|
## Scope
|
|
- **In**: classification table + dispatch in `persist.c` (debug assert on unclassified types); reply-ordering sweep of all control handlers in `job.c` (incl. `do_jobcontrol_op`), queue and worker join/update paths; `handle_jobdispatch` classification (per design Reply-Ordering Contract); RETAIN routing for fact WAL types; `push_config_to_standbys` error propagation + caller failure; `mark_job_*` state-machine guards; integration tests (no success reply observable before commit; fact retention across quorum loss).
|
|
- **Out**: the commit engine itself (ha-commit-engine); promotion/COMMITTING (ha-single-leader-role); egress filter and demotion (ha-convergence-recovery); worker protocol changes (worker-rejoin-resync backlog).
|
|
|
|
## Requirements (umbrella IDs)
|
|
2.1 (all operation types), 2.2, 2.8, 5.1, 5.2, 5.3.
|
|
|
|
## Upstream / Downstream
|
|
- **Upstream**: ha-commit-engine (WAIT/RETAIN API).
|
|
- **Downstream**: ha-single-leader-role (must land after this — barrier before state removal); worker-rejoin-resync (shares idempotency guards).
|
|
|
|
## Constraints
|
|
Commit-first-then-reply is non-negotiable for request-shaped ops; a missed handler silently violates umbrella Req 2.1 — the sweep must be exhaustive (grep all xce_reply sites in control paths). Crash-loss of uncommitted facts accepted until worker-rejoin-resync lands.
|