qqeasonchen opened a new pull request, #5367: URL: https://github.com/apache/eventmesh/pull/5367
## What this PR does Closes #5356 — Phase 0 enforcement of the production-HA plan (#5354): **`PARTITION_OWNED_PULL` must never silently degrade to an isolated in-process MetaStore.** ### 1. Boot fail-fast (the two silent fallbacks removed) | Site | Before | After | |---|---|---| | `UniRuntime.startPartitionOwnership()` (L177) | `clusterMeta == null` → `new InMemoryMetaStore()` — a misconfigured cluster *looks* healthy while every instance polls every partition (duplicate consumption, CAS/fencing ineffective) | `IllegalStateException`: `PARTITION_OWNED_PULL requires a shared MetaStore: set eventmesh.meta.type/addr (e.g. nacos + address) or use LOCAL_STICKY_PULL for single-instance` | | `EventMeshApplication` cluster mode (L348) | unknown `eventmesh.meta.type` → silently `new InMemoryMetaStore()` in cluster mode — instance isolates itself from shared assignments | `IllegalStateException`: `unsupported eventmesh.meta.type='<type>': cluster mode requires a shared MetaStore (supported: nacos)` | Single-instance mode (`LOCAL_STICKY_PULL` default) **keeps** the documented in-memory store — that is the intended mode, not a fallback. The unused `InMemoryMetaStore` import is removed from `UniRuntime`. ### 2. ArchUnit guardrails (12 → 14 rules) - **`ruleInMemoryMetaStoreOnlyFromBoot`** — only `org.apache.eventmesh.runtime.boot..` may depend on `InMemoryMetaStore`. Any other production class reaching for it is a silent isolation fallback. - **`rulePartitionOwnershipOnlyFromBootAndCluster`** — `PartitionOwnership` is cluster coordination state; only `boot` (wiring), `cluster` (implementation), `ingress` (poll filter) and `admin` (read-only view at `UniAdminServer:237`) may depend on it. Both rules use `haveFullyQualifiedName(...)` (not package matching) for the target class, and run in FAIL mode (`rule.check(classes)` throws). ### 3. Tests - **New** `UniRuntimeTopologyWiringTest.partitionOwnedPullWithoutMetaStoreFailsFast` — boots a real `UniRuntime` with `PARTITION_OWNED_PULL` and no `clusterMeta`, asserts the `IllegalStateException` and its explanatory message. - **New** `ArchitectureRulesTest.ruleInMemoryMetaStoreOnlyFromBoot_check` / `rulePartitionOwnershipOnlyFromBootAndCluster_check` — run the 2 new rules in FAIL mode over production classes. - **Existing** `UniRuntimeTopologyWiringTest` wiring tests inject `clusterMeta` explicitly (verified: L69-70 `runtimeA.clusterMeta = sharedMeta`), unaffected. ### Verification ```bash ./gradlew :eventmesh-architecture-guard:test ./gradlew :eventmesh-runtime:test --tests "*UniRuntimeTopologyWiringTest*" ``` Static checks done locally (no JDK on this DLP-restricted machine): brace/paren balance verified against the pre-patch file (the -1 paren balance is a pre-existing javadoc `§` artifact, unchanged); no unused imports; both new rules compile-safe DSL (mirrors the existing `ruleStoragePluginsIsolated` shape). ### Relations - Closes #5356 (Phase 0, P0) - Parent: #5354 · Plan: `docs/architecture-review/production-ha-plan.md` (PR #5366) - Unblocks #5359 (boot wiring builds on the fail-fast contract this PR establishes) Co-authored-by: qqeasonchen <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
