qqeasonchen opened a new pull request, #5385:
URL: https://github.com/apache/eventmesh/pull/5385
## Motivation
Fixes the four post-review hardening issues from the production-HA
acceptance pass.
Closes #5379
Closes #5380
Closes #5381
Closes #5382
## Changes
### #5379 — unacknowledged-delivery recovery semantics
- `ReliableDispatcher.recover()` no longer advances the subscriber offset as
if the absent client had ACKed — that converted an unACKed delivery into
acknowledged progress across the crash window (a skip). Recovery now
**RE-DISPATCHES** each persisted in-flight record through a buffered poll
channel (`channelFor(clientId)`), preserving the attempt counter; the offset
advances exactly once, when the client actually ACKs. Records already live on
this dispatcher are skipped (idempotent recovery).
- Legacy/corrupt records without a decodable frame retire **without** any
offset advance (backend redelivery bound covers them). The old
retire-on-recover semantics is kept as a `@Deprecated` private method for
source compatibility.
- Tests: new `RecoveryRedispatchTest` (crash -> re-dispatch, no offset ->
ACK advances exactly once; legacy record retires without offset);
`DeliveryRecoveryTest` and `CrossStoreFaultInjectionTest` scenario 1/1b updated
to the re-dispatch contract (crashed-instance channel never re-invoked).
### #5380 — deployment modes vs. capability claims
- `docs/eventmesh-features.md` gains **§5b Deployment modes**: core Runtime
(default `bin/start.sh`/Docker — traffic HTTP, token-guarded admin, opt-in
WebSocket, connector scheduling), session/streaming Runtime (embedder-wired),
A2A Gateway (separate launcher, experimental). The capability surface now
matches what the default bootstrap actually starts.
- `docker/Dockerfile` note hardened accordingly (this image is the core
Runtime; A2A gateway and v2 streaming sessions are not started by
`bin/start.sh`).
### #5381 — SecurityGate wired into the default bootstrap, fail closed
- `EventMeshApplication.main()` builds a config-backed `SecurityGate`:
profile from `eventmesh.security.profile` (default `production`), tokens from
`eventmesh.security.tokens`; installs it into the traffic httpServer via the
new `withSecurityGate(gate)` builder.
- **Fail-closed**: `production` profile with empty token filters throws
`IllegalStateException` at boot instead of silently allowing all traffic.
### #5382 — generation fencing for Connector Runtime assignments
- `ConnectorScheduler` bumps a per-connector monotonic **generation** on
every (re)assignment or def change and splices `"generation"` into the
`/control/start` envelope (`injectGeneration`).
- `ConnectorManager.startConnector` accepts a start iff `gen >= running gen`
(equal = idempotent re-push, greater = superseding rebuild: stop old runtime
first); a stale delayed start (gen < running) is rejected and logged.
`stopConnector` clears the running generation. Rebuild path no longer
double-stops the old runtime.
- `ConnectorDef` (both the runtime and connector-runtime copies) carries the
`generation` field. New `ConnectorGenerationFencingTest` covers
accept/reject/idempotent-re-push/rebuild.
## Verification
Local (Windows, JDK 21), all green:
```
./gradlew :eventmesh-runtime:test \
:eventmesh-connector-runtime:test \
:eventmesh-architecture-guard:test \
:eventmesh-runtime:checkstyleMain
:eventmesh-runtime:checkstyleTest \
:eventmesh-connector-runtime:checkstyleMain
:eventmesh-connector-runtime:checkstyleTest
```
(321 runtime tests + connector-runtime suite + 16 ArchUnit rules; checkstyle
clean.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
