Navid
23 lines
2.1 KiB
Markdown
23 lines
2.1 KiB
Markdown
# Availability implementation
|
|
|
|
Implemented on `feat/refactor-v1` on 2026-08-28.
|
|
|
|
- Added one fail-closed financial availability gate shared by Wallet, Internal Wallet, Market, and transaction workers.
|
|
- Normal mode requires healthy GL (including its database) and Kuknos Horizon. `network.kuknos-enabled=false` is the explicit, startup-time GL-only switch; it never changes automatically.
|
|
- Mutation RPCs return gRPC `UNAVAILABLE` during an outage. Read-only RPCs remain available; unknown future RPCs are treated as mutations.
|
|
- Transaction event outbox/inbox workers pause before claiming work. Dependency outages do not dead-letter business events.
|
|
- Kuknos subscription blocks its callback during a GL outage so the Horizon cursor cannot advance past an unrecorded external deposit; the streamer pauses entirely when Kuknos is manually disabled.
|
|
- GL health now reports not-serving when PostgreSQL is unavailable. Wallet/Market health propagates the gate, and the public API returns HTTP 503 with `status=critical`.
|
|
- Availability transition/recovery logs are structured JSON on stderr for the existing OTel collector. Outages use `CRITICAL`; recovery uses `INFO`.
|
|
- Added GL to the development Procfile and explicit GL/availability/Kuknos settings to dev, stage, and main service configs.
|
|
|
|
Verification:
|
|
|
|
- Wallet: `go test ./...` passes.
|
|
- GL: `go test ./...` passes (loopback test required the unrestricted runner).
|
|
- API health tests pass in an isolated verification copy populated with compatible generated stubs. The checkout itself still requires its normal `buf generate` build step because `domain/stub/go` is not committed.
|
|
|
|
Deployment prerequisite: the compose files still need the actual GL image/service definition and database secret. The config intentionally points to `gl:8600`; without that service, health is critical and mutations remain halted.
|
|
|
|
Remaining architectural limit: health preflight closes the known outage path but cannot make a GL write and Kuknos submission atomic. GL-first acknowledged reservation/command processing plus reconciliation is still required for a strict cross-system guarantee.
|