feat(resource): data-plane resource layer — Provisioner family + resources: block (spec 27) - #87
Merged
Merged
Conversation
…cred + RemoveProvisioned (spec 27) Behavior-preserving generalization of Postgres provisioning: - internal/resource: Resource model, Provisioner interface + Registry, Postgres provisioner wrapping provision.EnsureProject verbatim (same guarded/idempotent SQL, predictable dev-cred), plus engine->kinds catalog. - internal/secrets: RandomPassword(n) via crypto/rand for the 'generated' policy. - internal/state: RemoveProvisioned(project,kind,name) single-resource teardown. The up-saga provision phase is untouched; all orchestrate tests still pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…hase (spec 27) - internal/config: additive ResourceDecl on Project, cross-ref validated (uses targets a declared shared instance, kind supported by the engine, no (engine,kind,name) collision); forward-tolerant to unknown keys. - internal/orchestrate: new 'resources' saga phase provisions every declared resource via the engine Provisioner under the flock, records ledger + event, and REPORTS drift without auto-dropping. Wired into BuildUp after the implicit postgres provision phase; gated on --no-provision. Provision phase untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rkspace destroy --purge-data (spec 27) - internal/orchestrate: imperative CreateResource/DropResource/GCResources ops (lock -> overlay -> provisioner -> ledger -> event), mirroring the saga phase. - internal/cli: engine-agnostic 'resource' command group (list/show are lock-free reads; create/rm/gc drive the ops; secrets masked unless --show-secrets), and a new destructive 'workspace destroy --purge-data' flag beside the data-preserving default. Registered under root. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec 27 — the load-bearing substrate for the local-cloud data plane. Built in a worktree, verified locally (
make ci+ determinism green, up-saga regression clean).internal/resource— aResourcemodel +Provisionerinterface + Registry + engine→kinds catalog; a Postgres provisioner wrapping the existingprovision.EnsureProjectverbatim (same idempotent guarded SQL, same predictable dev-cred, same host-port overlay) withDrop/Preflight.internal/secrets.RandomPassword(crypto/rand, pure-Go) for the future generated-cred policy.internal/state.RemoveProvisioned(project,kind,name)— single-resource teardown (free-text kind, no migration).resources:block on the project config (additive, forward-tolerant, cross-ref-validated).resourcessaga phase — provisions declared resources under the flock, records ledger + event, reports drift without dropping. Runs alongside the untouchedprovisionPhase(so every existing orchestrate test passes unchanged — the refactor is behavior-preserving); both share one Provisioner/ledger/flock/overlay.resource list|show|create|rm|gcengine-agnostic verbs +workspace destroy --purge-data(opt-in destructive).make ci+ determinism green; CGO-free; no new deps (crypto/rand is stdlib). Scope note: only the Postgres provisioner is live; Redis/MinIO/LocalStack/NATS/Kafka provisioners are catalogued + reserved (the "Full" scope that spec 29's verbs fill in); generated-cred → Pusher delivery is not wired yet (predictable dev-cred only, never on disk).🤖 Generated with Claude Code