cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

test(workers): prove clock and restart safety
CI and Deploy / test (pull_request) Successful in 5m13s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-15 20:18:02 +02:00
parent a08ba9b45d
commit dbf28b97ce
7 changed files with 124 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/verification/bg-001-tenant-workers.md
+4 -4
View File
@@ -1,6 +1,6 @@
# BG-001 tenant-safe worker foundation verification
Updated: 2026-08-02
Updated: 2026-08-15
Status: `IMPLEMENTED — NOT VERIFIED`. The owner-scoping foundation and default-off activation contract pass local tests. Browser, production canary, durable notification/idempotency and multi-replica gates remain.
@@ -16,12 +16,12 @@ The four repaired workers are deny-by-default through new switches. Old email/ex
| Check | Result |
|---|---|
| `dotnet test ... --filter "FullyQualifiedName~BackgroundWorkerTenantTests|FullyQualifiedName~CurrentUserIdLiveEvaluationTests|FullyQualifiedName~RulesEngineTests"` | PASS — 9/9 after final trust-boundary test |
| `dotnet test ... --filter "FullyQualifiedName~BackgroundWorkerTenantTests"` | PASS — 9/9, including fixed-clock boundary and restart cases |
| `dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --no-restore` | PASS — 532/532 after the final trust-boundary test |
| `docker compose config --quiet` | PASS; only unset optional/local environment warnings |
| `git diff --check` | PASS — no whitespace errors; repository line-ending notices only |
Real SQLite tests prove two-owner/no-HTTP filtering, owner-failure isolation, per-owner rules with an idempotent second pass, atomic per-owner daily exports with hashed filenames, fake-AI enrichment for both owners, fake-email reminders for both confirmed owners, default-off behavior for all four workers and HTTP-context override refusal.
Real SQLite tests prove two-owner/no-HTTP filtering, owner-failure isolation, per-owner rules at an exact fixed-clock threshold with an idempotent post-restart pass, atomic per-owner daily exports that overwrite the same date file after restart, fake-AI enrichment for both owners, fake-email reminders that do not resend after restart, default-off behavior for all four workers and HTTP-context override refusal. All four worker loops and business-date decisions now use the injected `TimeProvider` rather than hidden system clocks.
## Runtime evidence
@@ -32,5 +32,5 @@ An isolated app using disposable data under `docs/audits/evidence/bg-001-runtime
- Reminder delivery is not exactly-once across an email-success/database-failure boundary. Keep it off until OPS-001 supplies a persistent notification/outbox operation.
- AI enrichment must remain off until POL-001/POL-002 and durable AI operations are enforced server-side.
- Rules and export remain off pending notification/audit and retention/operator rollout respectively.
- No lease, heartbeat, distributed scheduler, restart/clock-boundary suite, browser surface or production canary was added here.
- No lease, heartbeat, distributed scheduler, browser surface or production canary was added here. Local restart and clock-boundary coverage is complete; multi-replica coordination remains an activation concern rather than default-off foundation work.
- Rollback is setting all four worker switches false, then reverting the runner/service changes. Do not delete export files or undo user-visible mutations without a separate reviewed procedure. No schema migration was introduced.