dtoro
64f7d54011
Problem: the hexagon's Phase 2 (plans/2026-08-15-hexagonal-architecture.md) must give the use-cases-to-be their contract surface: driven-port interfaces, test fakes, the secrets interface moved into core, and the postgres package inside the adapters tree — before the first vertical slice (Phase 3) can wire a composition root. Change: - internal/core/ports: full driven-port catalog per plan §3.3 — repositories as transaction-scoped aggregates whose inputs carry derived checks, audit, and events (§3.6), plus CommandExecutor, TargetResolver, Checker, Secrets, EventPublisher, Provisioner. Port-local payload types (Event, AuditEntry, CheckDef, KnowledgeEntry, ExecResult) keep signatures off infrastructure; TypeTree aliases internal/ontology (pure over domain) until checkdefaults is absorbed. ReadModels intentionally not declared yet — it materializes with the Phase 3 slice and grows as report handlers rewire. - secrets.Backend is now an alias of ports.Secrets; implementations (Infisical, SOPS, Manager) unchanged. mcp's local secretBackend subset is deleted; tool constructors take ports.Secrets. - internal/db → internal/adapters/postgres (mechanical import rewrite; package identifier stays db until the Phase 3 repository split). sqlc.yaml, Makefile, golangci exclusions, and docs follow the move; make generate-check verified. - internal/adapters/ssh: Executor implements ports.CommandExecutor over the actuator dial pool + RunStreaming (10-min default timeout carried over from the httpapi path). - internal/adapters/remote: Resolver implements ports.TargetResolver delegating to internal/remote (still pool-based; drops onto ports.EntityRepository when repositories land in Phase 3 — documented transitional import). - internal/core/ports/portstest: importable fakes — in-memory EntityRepo (with check-then-act SetState, side-effect recording), RecordingExecutor, FakeChecker, SpyPublisher; port-satisfaction guards; tests. Risk: ports are declared ahead of implementations — signatures firm up per phase as slices land (documented in the package doc); the remote→postgres transitional import is explicit and dissolves in Phase 3. Verification: go vet, make test (race, 19 packages), generate-check, golangci on core+adapters — 0 issues; full-repo baseline down 365→344.
98 lines
3.0 KiB
Go
98 lines
3.0 KiB
Go
package ports
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"github.com/dtoro/oikos/internal/core/domain"
|
|
)
|
|
|
|
// SignalUpsertInput is the observe-pass signal write: open/resolve
|
|
// transitions with their triggers, committed atomically.
|
|
type SignalUpsertInput struct {
|
|
Signal domain.Signal
|
|
Triggers []SignalTrigger
|
|
Audit []AuditEntry
|
|
Event *Event
|
|
}
|
|
|
|
// SignalTrigger is an automatic follow-up fired on a signal transition
|
|
// (payload firm; shapes firm up with the Phase 5 observation slice).
|
|
type SignalTrigger struct {
|
|
Kind string
|
|
EntityID domain.UUID
|
|
Parameters map[string]any
|
|
}
|
|
|
|
// SignalTransitionInput acks/resolves/mutes a signal (check-then-act on the
|
|
// signal's current state inside the transaction).
|
|
type SignalTransitionInput struct {
|
|
SignalID domain.UUID
|
|
Action string // "ack", "resolve", "mute"
|
|
Note string
|
|
MuteFor time.Duration
|
|
Actor string
|
|
Audit []AuditEntry
|
|
Event *Event
|
|
}
|
|
|
|
// SignalRepository is the signal aggregate.
|
|
type SignalRepository interface {
|
|
Open(ctx context.Context) ([]domain.Signal, error)
|
|
History(ctx context.Context, entityID domain.UUID, limit int) ([]domain.Signal, error)
|
|
|
|
UpsertWithTriggers(ctx context.Context, input SignalUpsertInput) error
|
|
Transition(ctx context.Context, input SignalTransitionInput) (domain.Signal, error)
|
|
}
|
|
|
|
// ExecutionSubmitInput is the queued-execution write: execution row,
|
|
// approval (for gated risk classes), audit, and event — one transaction.
|
|
type ExecutionSubmitInput struct {
|
|
Execution domain.Execution
|
|
Approval *domain.Approval
|
|
Audit []AuditEntry
|
|
Event *Event
|
|
}
|
|
|
|
// ExecutionCompleteInput closes out an execution: final status, output
|
|
// summary, audit, event.
|
|
type ExecutionCompleteInput struct {
|
|
ExecutionID domain.UUID
|
|
Status string
|
|
Output string
|
|
ExitCode int
|
|
Audit []AuditEntry
|
|
Event *Event
|
|
}
|
|
|
|
// ExecutionRepository is the execution aggregate. Claim uses an advisory
|
|
// lock so exactly one worker claims a queued execution.
|
|
type ExecutionRepository interface {
|
|
List(ctx context.Context, cursor string, limit int) ([]domain.Execution, error)
|
|
ReadLog(ctx context.Context, executionID domain.UUID) ([]string, error)
|
|
|
|
SubmitQueued(ctx context.Context, input ExecutionSubmitInput) (domain.Execution, error)
|
|
Claim(ctx context.Context) (*domain.Execution, error)
|
|
AppendLog(ctx context.Context, executionID domain.UUID, chunk string) error
|
|
Complete(ctx context.Context, input ExecutionCompleteInput) error
|
|
}
|
|
|
|
// ApprovalDecideInput verifies the HMAC token (check-then-act), flips the
|
|
// approval, un-gates the execution, and appends audit — one transaction.
|
|
// Double-approve must not double-execute.
|
|
type ApprovalDecideInput struct {
|
|
ApprovalID domain.UUID
|
|
Token string
|
|
Approved bool
|
|
Actor string
|
|
Audit []AuditEntry
|
|
Event *Event
|
|
}
|
|
|
|
// ApprovalRepository is the approval aggregate.
|
|
type ApprovalRepository interface {
|
|
ListPending(ctx context.Context, entityID domain.UUID, limit int) ([]domain.Approval, error)
|
|
|
|
Decide(ctx context.Context, input ApprovalDecideInput) (domain.Approval, error)
|
|
}
|