diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index e6dafbcc2..c1e57c2b6 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -69,7 +69,7 @@ boundaries above remain the target modular MSA architecture. | `corpus_split` | cutoff-safe, relation-aware partitioning | | `tepp_simulation` | known-truth temporal/event data generation | | `validation_core` | RMSE, bias, coverage, graph, Monte Carlo, and exact-head claim-promotion metrics | -| `tepp_api` | versioned DTO, schema, terminal-result, and export contracts | +| `tepp_api` | versioned DTO, schema, terminal-result, export contracts, and published `tepp-retry` loopback CLI | | `analysis_engine` | bounded cutoff-safe temporal evidence readiness execution and digest-bound terminal artifacts | | `episode_membership` | event-time episode membership containment gate | | `prompt_source` | prompt boilerplate is not unique latent content and not stopword deletion | diff --git a/CHANGELOG.d/analysis-run-retry-cli.md b/CHANGELOG.d/analysis-run-retry-cli.md new file mode 100644 index 000000000..81b872b4a --- /dev/null +++ b/CHANGELOG.d/analysis-run-retry-cli.md @@ -0,0 +1,3 @@ +### Added + +- `tepp_api` GAP-003A retry CLI slice (ADR 0043, active-PR, not implemented-main): naruon and `LineageWeave` mint credential-free `POST /v1/analysis-runs/{run_id}/retry` through the published `tepp-retry` CLI onto spawned `tepp-loopback` TCP. Child `202 Accepted` stays metric-free. Persistence remains GAP-003B. diff --git a/CHANGELOG.md b/CHANGELOG.md index 438b4aa31..fdfb317d6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -38,6 +38,8 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang ## [Unreleased] +- `tepp_api` GAP-003A retry CLI slice (ADR 0043, active-PR, not implemented-main): published `tepp-retry` mints typed naruon and `LineageWeave` `POST /v1/analysis-runs/{run_id}/retry` exchanges onto spawned `tepp-loopback` TCP so operators clone a failed or cancelled run without hand-rolled HTTP. Public bind hosts, `localhost`, and non-`https` origins fail closed. Child `202 Accepted` stays metric-free. This does not duplicate retry HTTP (#369), retry consumer parity (#393), execute CLI (#390), cancel CLI (#378), create CLI (#385), status CLI (#392), collection CLI (#371), or lifecycle CLI (#362); persistence remains GAP-003B. + - `tepp_api` adds `lineageweave_analysis_run_retry_exchange`, Naruon compatibility-listener `POST /v1/analysis-runs/{run_id}/retry`, and a `tepp-loopback` TCP retry proof (ADR 0033). Failed and cancelled Naruon runs clone into a metric-free child `202 Accepted`. LineageWeave remains refused on `NaruonLiveService`. GET remains refused there. Not GET-by-id, not lifecycle POST, not an ADR 0014 claim. - `tepp_api` serves `GET /v1/analysis-runs` on the shared loopback listener (ADR 0031). Operators enumerate accepted, running, cancelled, and terminal runs as metric-free collection rows. Collection bodies refuse RMSE/bias/coverage/SE-gate/scientific-acceptance/`terminal_result` keys. GET-by-id and running/terminal POST remain later GAP-003A slices; this is not an ADR 0014 claim. diff --git a/DOCUMENTATION.md b/DOCUMENTATION.md index 3283a37d3..4b242db2d 100644 --- a/DOCUMENTATION.md +++ b/DOCUMENTATION.md @@ -17,6 +17,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin | Analysis-run collection HTTP doctoring | [`docs/research/analysis-run-collection-http.md`](docs/research/analysis-run-collection-http.md) | | Analysis-run retry HTTP doctoring | [`docs/research/analysis-run-retry-http.md`](docs/research/analysis-run-retry-http.md) | | Analysis-run retry consumer-parity doctoring | [`docs/research/analysis-run-retry-consumer-parity.md`](docs/research/analysis-run-retry-consumer-parity.md) | +| Analysis-run retry CLI doctoring | [`docs/research/analysis-run-retry-cli.md`](docs/research/analysis-run-retry-cli.md) | | UML/runtime/scientific flows | [`docs/UML.md`](docs/UML.md) | | Logical/physical ERD | [`docs/ERD.md`](docs/ERD.md) | | Security policy | [`SECURITY.md`](SECURITY.md) | diff --git a/crates/tepp_api/Cargo.toml b/crates/tepp_api/Cargo.toml index 47ad7c433..b66556ccb 100644 --- a/crates/tepp_api/Cargo.toml +++ b/crates/tepp_api/Cargo.toml @@ -29,5 +29,11 @@ path = "src/bin/tepp_loopback.rs" test = false bench = false +[[bin]] +name = "tepp-retry" +path = "src/bin/tepp_retry.rs" +test = false +bench = false + [lints] workspace = true diff --git a/crates/tepp_api/src/analysis_run_retry_cli.rs b/crates/tepp_api/src/analysis_run_retry_cli.rs new file mode 100644 index 000000000..831c1bbd2 --- /dev/null +++ b/crates/tepp_api/src/analysis_run_retry_cli.rs @@ -0,0 +1,453 @@ +//! Operator loopback CLI for analysis-run retry POST. +//! +//! GAP-003A retry CLI slice: operators run `tepp-retry retry` to clone a +//! failed or cancelled run from the typed naruon/`LineageWeave` retry exchange +//! onto spawned `tepp-loopback` TCP. Stdout is a metric-free child `202 +//! Accepted`. `tepp.scientific_acceptance.v1` never appears. Persistence +//! remains GAP-003B. + +use std::fmt::Write as _; +use std::io::{Read, Write}; +use std::net::{SocketAddr, TcpStream}; + +use crate::lineageweave_http::consumer_is_supported; +use crate::live_http::map_io_error; +use crate::naruon_http::header_is_credential; +use crate::wire::require_nonempty; +use crate::{ + lineageweave_analysis_run_retry_exchange, naruon_analysis_run_retry_exchange, + refuse_metrics_on_retry_payload, AnalysisRunAccepted, AnalysisRunLiveService, + AnalysisRunRetryRequest, ApiError, NaruonHttpExchange, NaruonLiveResponse, + ANALYSIS_RUN_RETRY_ID_MAX_LEN, LINEAGEWEAVE_CONSUMER_CODE, NARUON_CONSUMER_CODE, + NARUON_LIVE_IO_TIMEOUT, +}; + +const SCIENTIFIC_ACCEPTANCE_SCHEMA: &str = "tepp.scientific_acceptance.v1"; + +/// Supported operator verbs for the loopback retry CLI. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum AnalysisRunRetryCliVerb { + /// `POST /v1/analysis-runs/{run_id}/retry`. + Retry, +} + +impl AnalysisRunRetryCliVerb { + /// Parse one exact lowercase verb token. + /// + /// # Errors + /// + /// Returns [`ApiError::InvalidWirePayload`] for an unknown token. + pub fn parse(token: &str) -> Result { + match token { + "retry" => Ok(Self::Retry), + _ => Err(ApiError::InvalidWirePayload), + } + } + + /// Return the canonical lowercase verb token. + #[must_use] + pub const fn as_str(self) -> &'static str { + match self { + Self::Retry => "retry", + } + } +} + +/// One operator CLI invocation against a loopback retry POST listener. +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct AnalysisRunRetryCliInvocation { + /// CLI verb to execute. + pub verb: AnalysisRunRetryCliVerb, + /// Loopback `host:port` of `tepp-loopback`. + pub host: String, + /// Published HTTPS origin used to mint the typed retry exchange. + pub origin: String, + /// Published modular consumer (`naruon` or `lineageweave`). + pub consumer: String, + /// Opaque server-assigned parent run identity. + pub run_id: String, + /// New request idempotency key for the cloned attempt. + pub idempotency_key: String, + /// Optional typed retry JSON. Empty POST is admitted. + pub body: String, +} + +impl AnalysisRunRetryCliInvocation { + /// Parse argv plus stdin body into a validated loopback retry invocation. + /// + /// # Errors + /// + /// Returns a fail-closed error for unknown verbs, missing required flags, a + /// non-loopback host, a non-`https` origin, an unpublished consumer, + /// credential-shaped flags, hostile identities, metric bodies, or a typed + /// body that does not match the path identity and new idempotency key. + pub fn from_args(args: I, body: impl Into) -> Result + where + I: IntoIterator, + S: AsRef, + { + let tokens: Vec = args + .into_iter() + .map(|token| token.as_ref().to_owned()) + .collect(); + let (verb_token, rest) = tokens.split_first().ok_or(ApiError::InvalidWirePayload)?; + let verb = AnalysisRunRetryCliVerb::parse(verb_token)?; + let flags = parse_flags(rest)?; + assemble_invocation(verb, flags, body.into()) + } + + /// Reject a non-loopback host, unpublished consumer, or hostile retry body. + /// + /// # Errors + /// + /// Returns [`ApiError::AuthorizationDenied`] for a non-loopback host and + /// [`ApiError::InvalidWirePayload`] or [`ApiError::LimitExceeded`] for + /// empty, unpublished, oversized, or metric-bearing fields. + pub fn validate(&self) -> Result<(), ApiError> { + require_loopback_host(&self.host)?; + require_nonempty(&self.origin)?; + if !self.origin.starts_with("https://") { + return Err(ApiError::InvalidWirePayload); + } + require_nonempty(&self.consumer)?; + if !consumer_is_supported(&self.consumer) { + return Err(ApiError::InvalidWirePayload); + } + require_nonempty(&self.run_id)?; + require_nonempty(&self.idempotency_key)?; + if self.run_id.len() > ANALYSIS_RUN_RETRY_ID_MAX_LEN { + return Err(ApiError::LimitExceeded); + } + refuse_scientific_acceptance_schema(&self.body)?; + refuse_metrics_on_retry_payload(&self.body)?; + if !self.body.is_empty() { + let request = AnalysisRunRetryRequest::from_json(&self.body)?; + if request.run_id != self.run_id || request.idempotency_key != self.idempotency_key { + return Err(ApiError::InvalidWirePayload); + } + } + Ok(()) + } +} + +struct ParsedFlags { + host: Option, + origin: Option, + consumer: Option, + run_id: Option, + idempotency_key: Option, +} + +fn parse_flags(rest: &[String]) -> Result { + let mut flags = ParsedFlags { + host: None, + origin: None, + consumer: None, + run_id: None, + idempotency_key: None, + }; + let mut index = 0; + while index < rest.len() { + let flag = rest[index].as_str(); + if !flag.starts_with("--") { + return Err(ApiError::InvalidWirePayload); + } + let name = &flag[2..]; + if header_is_credential(name) { + return Err(ApiError::AuthorizationDenied); + } + let slot = match name { + "host" => &mut flags.host, + "origin" => &mut flags.origin, + "consumer" => &mut flags.consumer, + "run-id" => &mut flags.run_id, + "idempotency-key" => &mut flags.idempotency_key, + _ => return Err(ApiError::InvalidWirePayload), + }; + if slot.is_some() || index + 1 >= rest.len() { + return Err(ApiError::InvalidWirePayload); + } + let value = rest[index + 1].as_str(); + require_nonempty(value)?; + *slot = Some(value.to_owned()); + index += 2; + } + Ok(flags) +} + +fn assemble_invocation( + verb: AnalysisRunRetryCliVerb, + flags: ParsedFlags, + body: String, +) -> Result { + let invocation = AnalysisRunRetryCliInvocation { + verb, + host: flags.host.ok_or(ApiError::InvalidWirePayload)?, + origin: flags.origin.ok_or(ApiError::InvalidWirePayload)?, + consumer: flags + .consumer + .unwrap_or_else(|| NARUON_CONSUMER_CODE.to_owned()), + run_id: flags.run_id.ok_or(ApiError::InvalidWirePayload)?, + idempotency_key: flags.idempotency_key.ok_or(ApiError::InvalidWirePayload)?, + body, + }; + invocation.validate()?; + Ok(invocation) +} + +fn require_loopback_host(host: &str) -> Result { + let addr: SocketAddr = host.parse().map_err(|_| ApiError::InvalidWirePayload)?; + if addr.ip().is_loopback() { + Ok(addr) + } else { + Err(ApiError::AuthorizationDenied) + } +} + +fn retry_request( + invocation: &AnalysisRunRetryCliInvocation, +) -> Result { + if invocation.body.is_empty() { + AnalysisRunRetryRequest::new(&invocation.run_id, &invocation.idempotency_key) + } else { + AnalysisRunRetryRequest::from_json(&invocation.body) + } +} + +fn retry_exchange( + invocation: &AnalysisRunRetryCliInvocation, +) -> Result { + let request = retry_request(invocation)?; + if invocation.consumer == LINEAGEWEAVE_CONSUMER_CODE { + lineageweave_analysis_run_retry_exchange(&invocation.origin, &request) + } else if invocation.consumer == NARUON_CONSUMER_CODE { + naruon_analysis_run_retry_exchange(&invocation.origin, &request) + } else { + Err(ApiError::InvalidWirePayload) + } +} + +/// Render a typed retry exchange as HTTP/1.1 for a bound loopback listener. +/// +/// The exchange keeps its HTTPS origin contract. Only the HTTP/1.1 `Host` is +/// the loopback bind address. Public bind hosts fail closed. +/// +/// # Errors +/// +/// Returns [`ApiError::AuthorizationDenied`] for a non-loopback host or a +/// credential-bearing header, and [`ApiError::InvalidWirePayload`] when the +/// exchange is not a POST `/retry`. +pub fn loopback_http1_from_retry_exchange( + exchange: &NaruonHttpExchange, + loopback_host: &str, +) -> Result { + let _addr = require_loopback_host(loopback_host)?; + let host = loopback_host.trim(); + if exchange.method != "POST" { + return Err(ApiError::InvalidWirePayload); + } + let rest = exchange + .target_url + .strip_prefix("https://") + .ok_or(ApiError::InvalidWirePayload)?; + let path = rest + .find('/') + .map(|index| &rest[index..]) + .ok_or(ApiError::InvalidWirePayload)?; + if path.rsplit('/').next() != Some("retry") { + return Err(ApiError::InvalidWirePayload); + } + for (name, _) in &exchange.headers { + if header_is_credential(name) { + return Err(ApiError::AuthorizationDenied); + } + } + let mut request = String::new(); + write!( + request, + "{} {path} HTTP/1.1\r\nHost: {host}\r\n", + exchange.method + ) + .map_err(|_| ApiError::InvalidWirePayload)?; + for (name, value) in &exchange.headers { + if name.eq_ignore_ascii_case("host") || name.eq_ignore_ascii_case("content-length") { + continue; + } + write!(request, "{name}: {value}\r\n").map_err(|_| ApiError::InvalidWirePayload)?; + } + write!( + request, + "content-length: {}\r\n\r\n{}", + exchange.body.len(), + exchange.body + ) + .map_err(|_| ApiError::InvalidWirePayload)?; + Ok(request) +} + +/// Compose one HTTP/1.1 retry POST from the typed consumer exchange. +/// +/// # Errors +/// +/// Returns the same fail-closed errors as +/// [`AnalysisRunRetryCliInvocation::validate`]. +pub fn compose_analysis_run_retry_cli_http( + invocation: &AnalysisRunRetryCliInvocation, +) -> Result { + invocation.validate()?; + let exchange = retry_exchange(invocation)?; + loopback_http1_from_retry_exchange(&exchange, &invocation.host) +} + +/// Dispatch one retry CLI invocation against an in-process loopback service. +/// +/// # Errors +/// +/// Returns fail-closed validation errors before the HTTP handler runs. +pub fn dispatch_analysis_run_retry_cli( + service: &mut AnalysisRunLiveService, + invocation: &AnalysisRunRetryCliInvocation, +) -> Result { + let request = compose_analysis_run_retry_cli_http(invocation)?; + Ok(service.handle_http_request(&request)) +} + +/// Execute one retry CLI invocation over loopback TCP against `tepp-loopback`. +/// +/// # Errors +/// +/// Returns fail-closed validation, transport, or response-framing errors. +pub fn execute_analysis_run_retry_cli( + invocation: &AnalysisRunRetryCliInvocation, +) -> Result { + let addr = require_loopback_host(&invocation.host)?; + let request = compose_analysis_run_retry_cli_http(invocation)?; + let mut stream = TcpStream::connect(addr).map_err(|error| map_io_error(&error))?; + stream + .set_read_timeout(Some(NARUON_LIVE_IO_TIMEOUT)) + .map_err(|error| map_io_error(&error))?; + stream + .set_write_timeout(Some(NARUON_LIVE_IO_TIMEOUT)) + .map_err(|error| map_io_error(&error))?; + stream + .write_all(request.as_bytes()) + .map_err(|error| map_io_error(&error))?; + stream.flush().map_err(|error| map_io_error(&error))?; + let mut bytes = Vec::new(); + stream + .read_to_end(&mut bytes) + .map_err(|error| map_io_error(&error))?; + parse_http_response(&bytes) +} + +/// Filter CLI stdout so retry receipts never print scientific acceptance. +/// +/// # Errors +/// +/// Returns [`ApiError::InvalidWirePayload`] when a receipt carries metric keys, +/// `tepp.scientific_acceptance.v1`, or a success body that is not a new child +/// `202 Accepted`. +pub fn render_analysis_run_retry_cli_stdout( + invocation: &AnalysisRunRetryCliInvocation, + response: &NaruonLiveResponse, +) -> Result { + invocation.validate()?; + if response.body.is_empty() { + return Err(ApiError::InvalidWirePayload); + } + refuse_scientific_acceptance_schema(&response.body)?; + refuse_metrics_on_retry_payload(&response.body)?; + if !(200..300).contains(&response.status_code) { + return Ok(response.body.clone()); + } + if response.status_code != 202 { + return Err(ApiError::InvalidWirePayload); + } + let accepted = AnalysisRunAccepted::from_json(&response.body)?; + if accepted.run_id == invocation.run_id + || accepted.idempotency_key != invocation.idempotency_key + || accepted.run_state != "accepted" + { + return Err(ApiError::InvalidWirePayload); + } + accepted.to_json() +} + +fn refuse_scientific_acceptance_schema(body: &str) -> Result<(), ApiError> { + if body.contains(SCIENTIFIC_ACCEPTANCE_SCHEMA) { + Err(ApiError::InvalidWirePayload) + } else { + Ok(()) + } +} + +fn parse_http_response(bytes: &[u8]) -> Result { + let text = std::str::from_utf8(bytes).map_err(|_| ApiError::InvalidWirePayload)?; + let (header_block, body) = text + .split_once("\r\n\r\n") + .ok_or(ApiError::InvalidWirePayload)?; + let mut lines = header_block.split("\r\n"); + let status_line = lines.next().ok_or(ApiError::InvalidWirePayload)?; + let mut parts = status_line.split(' '); + if parts.next() != Some("HTTP/1.1") { + return Err(ApiError::InvalidWirePayload); + } + let code = parts + .next() + .ok_or(ApiError::InvalidWirePayload)? + .parse::() + .map_err(|_| ApiError::InvalidWirePayload)?; + let reason_phrase = match code { + 200 => "OK", + 202 => "Accepted", + 400 => "Bad Request", + 403 => "Forbidden", + 413 => "Payload Too Large", + 422 => "Unprocessable Entity", + _ => return Err(ApiError::InvalidWirePayload), + }; + let mut content_length = None; + for line in lines { + let (name, value) = line.split_once(':').ok_or(ApiError::InvalidWirePayload)?; + if name.eq_ignore_ascii_case("content-length") { + if content_length.is_some() { + return Err(ApiError::InvalidWirePayload); + } + content_length = Some( + value + .trim() + .parse::() + .map_err(|_| ApiError::InvalidWirePayload)?, + ); + } + } + let declared = content_length.ok_or(ApiError::InvalidWirePayload)?; + if declared != body.len() { + return Err(ApiError::InvalidWirePayload); + } + Ok(NaruonLiveResponse { + status_code: code, + reason_phrase, + body: body.to_owned(), + }) +} + +/// Read stdin leftover bytes on a non-terminal; empty retry POST is admitted. +/// +/// # Errors +/// +/// Returns [`ApiError::InvalidWirePayload`] when stdin cannot be read. +pub fn read_analysis_run_retry_cli_stdin( + stdin_is_terminal: bool, + mut stdin: impl Read, +) -> Result { + if stdin_is_terminal { + Ok(String::new()) + } else { + let mut body = String::new(); + stdin + .read_to_string(&mut body) + .map_err(|_| ApiError::InvalidWirePayload)?; + Ok(body) + } +} diff --git a/crates/tepp_api/src/bin/tepp_retry.rs b/crates/tepp_api/src/bin/tepp_retry.rs new file mode 100644 index 000000000..366c17d1f --- /dev/null +++ b/crates/tepp_api/src/bin/tepp_retry.rs @@ -0,0 +1,30 @@ +//! Operator CLI for loopback analysis-run retry POST. + +use std::io::{self, IsTerminal}; +use std::process::ExitCode; + +use tepp_api::{ + execute_analysis_run_retry_cli, read_analysis_run_retry_cli_stdin, + render_analysis_run_retry_cli_stdout, AnalysisRunRetryCliInvocation, ApiError, +}; + +fn main() -> ExitCode { + match run() { + Ok(()) => ExitCode::SUCCESS, + Err(_) => ExitCode::FAILURE, + } +} + +fn run() -> Result<(), ApiError> { + let args: Vec = std::env::args().skip(1).collect(); + let body = read_analysis_run_retry_cli_stdin(io::stdin().is_terminal(), io::stdin())?; + let invocation = AnalysisRunRetryCliInvocation::from_args(&args, body)?; + let response = execute_analysis_run_retry_cli(&invocation)?; + let stdout = render_analysis_run_retry_cli_stdout(&invocation, &response)?; + println!("{stdout}"); + if (200..300).contains(&response.status_code) { + Ok(()) + } else { + Err(ApiError::InvalidWirePayload) + } +} diff --git a/crates/tepp_api/src/lib.rs b/crates/tepp_api/src/lib.rs index 67c5c4aa9..4a5b035b7 100644 --- a/crates/tepp_api/src/lib.rs +++ b/crates/tepp_api/src/lib.rs @@ -9,13 +9,16 @@ //! may also request a cutoff-safe project-history projection from explicit //! source evidence. Naruon owns the current purpose-bound export adapter. //! Loopback listeners prove the HTTP boundary without claiming production TLS, -//! causality, or completed psychometric model results. +//! causality, or completed psychometric model results. The published `tepp-retry` +//! CLI mints typed naruon/`LineageWeave` retry exchanges onto spawned +//! `tepp-loopback` TCP. mod analysis_result; mod analysis_run; mod analysis_run_cancel_http; mod analysis_run_collection_http; mod analysis_run_live; +mod analysis_run_retry_cli; mod analysis_run_retry_http; mod analysis_run_status_http; mod authorization; @@ -116,6 +119,22 @@ pub use analysis_run_retry_http::AnalysisRunRetryRequest; pub use analysis_run_retry_http::naruon_analysis_run_retry_exchange; /// Refuse scientific-metric keys on a retry payload. pub use analysis_run_retry_http::refuse_metrics_on_retry_payload; +/// Loopback retry CLI invocation. +pub use analysis_run_retry_cli::AnalysisRunRetryCliInvocation; +/// Loopback retry CLI verb. +pub use analysis_run_retry_cli::AnalysisRunRetryCliVerb; +/// Compose HTTP/1.1 retry POST from the typed exchange. +pub use analysis_run_retry_cli::compose_analysis_run_retry_cli_http; +/// Dispatch retry CLI against an in-process loopback service. +pub use analysis_run_retry_cli::dispatch_analysis_run_retry_cli; +/// Execute retry CLI over loopback TCP. +pub use analysis_run_retry_cli::execute_analysis_run_retry_cli; +/// Render a typed retry exchange onto a loopback HTTP/1.1 request. +pub use analysis_run_retry_cli::loopback_http1_from_retry_exchange; +/// Read retry CLI stdin leftover bytes. +pub use analysis_run_retry_cli::read_analysis_run_retry_cli_stdin; +/// Filter retry CLI stdout so receipts stay metric-free. +pub use analysis_run_retry_cli::render_analysis_run_retry_cli_stdout; /// Analysis-run status HTTP exchange re-exports. pub use analysis_run_status_http::{ANALYSIS_RUN_ID_MAX_LEN, naruon_analysis_run_status_exchange}; /// Corpus-split leakage-audit contract version. diff --git a/crates/tepp_api/tests/analysis_run_retry_cli_contract.rs b/crates/tepp_api/tests/analysis_run_retry_cli_contract.rs new file mode 100644 index 000000000..03c5b302a --- /dev/null +++ b/crates/tepp_api/tests/analysis_run_retry_cli_contract.rs @@ -0,0 +1,356 @@ +//! GAP-003A naruon/LineageWeave analysis-run retry CLI. + +use tepp_api::{ + compose_analysis_run_retry_cli_http, dispatch_analysis_run_retry_cli, + execute_analysis_run_retry_cli, read_analysis_run_retry_cli_stdin, + render_analysis_run_retry_cli_stdout, AnalysisRunAccepted, AnalysisRunLiveService, + AnalysisRunRequest, AnalysisRunRetryCliInvocation, AnalysisRunRetryCliVerb, ApiError, + NaruonLiveResponse, ANALYSIS_RUN_CONTRACT_VERSION, ANALYSIS_RUN_RETRY_CONTRACT_VERSION, + LINEAGEWEAVE_CONSUMER_CODE, NARUON_ANALYSIS_RUN_PATH, NARUON_CONSUMER_CODE, +}; + +const ORIGIN: &str = "https://tepp.example.test"; +const SCHEMA: &str = "tepp.scientific_acceptance.v1"; + +fn request(idempotency_key: &str) -> AnalysisRunRequest { + AnalysisRunRequest { + contract_version: ANALYSIS_RUN_CONTRACT_VERSION, + idempotency_key: idempotency_key.into(), + tenant_workspace_id: "cli-retry-tenant".into(), + snapshot_id: "cli-retry-snapshot".into(), + knowledge_cutoff: "2026-08-01T00:00:00Z".into(), + model_contract_version: "tepp-analysis-run-v1".into(), + output_profile: "calibrated_event_measurement".into(), + } +} + +fn create_http(run: &AnalysisRunRequest, consumer: &str, host: &str) -> String { + let body = run.to_json().expect("json"); + format!( + "POST {NARUON_ANALYSIS_RUN_PATH} HTTP/1.1\r\nHost: {host}\r\ncontent-type: application/json\r\ntepp-consumer: {consumer}\r\ntepp-contract-version: 1\r\nidempotency-key: {}\r\ncontent-length: {}\r\n\r\n{body}", + run.idempotency_key, + body.len() + ) +} + +fn cancel_http(run_id: &str, consumer: &str, host: &str, idempotency_key: &str) -> String { + format!( + "POST {NARUON_ANALYSIS_RUN_PATH}/{run_id}/cancel HTTP/1.1\r\nHost: {host}\r\ncontent-type: application/json\r\ntepp-consumer: {consumer}\r\ntepp-contract-version: 1\r\nidempotency-key: {idempotency_key}\r\ncontent-length: 0\r\n\r\n" + ) +} + +fn retry_args<'a>( + host: &'a str, + run_id: &'a str, + idempotency_key: &'a str, + consumer: &'a str, +) -> [&'a str; 11] { + [ + "retry", + "--host", + host, + "--origin", + ORIGIN, + "--consumer", + consumer, + "--run-id", + run_id, + "--idempotency-key", + idempotency_key, + ] +} + +fn accept_and_cancel( + service: &mut AnalysisRunLiveService, + idempotency_key: &str, + consumer: &str, +) -> AnalysisRunAccepted { + let created = service.handle_http_request(&create_http( + &request(idempotency_key), + consumer, + "127.0.0.1:18081", + )); + assert_eq!(created.status_code, 202, "{}", created.body); + let accepted = AnalysisRunAccepted::from_json(&created.body).expect("accepted"); + let cancelled = service.handle_http_request(&cancel_http( + &accepted.run_id, + consumer, + "127.0.0.1:18081", + idempotency_key, + )); + assert_eq!(cancelled.status_code, 200, "{}", cancelled.body); + accepted +} + +#[test] +fn verbs_and_from_args_fail_closed() { + assert_eq!( + AnalysisRunRetryCliVerb::parse("retry").expect("retry"), + AnalysisRunRetryCliVerb::Retry + ); + assert_eq!(AnalysisRunRetryCliVerb::Retry.as_str(), "retry"); + assert_eq!( + AnalysisRunRetryCliVerb::parse("cancel"), + Err(ApiError::InvalidWirePayload) + ); + assert_eq!( + AnalysisRunRetryCliInvocation::from_args(Vec::::new(), "").unwrap_err(), + ApiError::InvalidWirePayload + ); + assert_eq!( + AnalysisRunRetryCliInvocation::from_args( + retry_args( + "8.8.8.8:80", + "tepp-run-1", + "idem-child", + NARUON_CONSUMER_CODE + ), + "", + ) + .unwrap_err(), + ApiError::AuthorizationDenied + ); + assert_eq!( + AnalysisRunRetryCliInvocation::from_args( + [ + "retry", + "--host", + "127.0.0.1:18081", + "--origin", + "http://tepp.example.test", + "--run-id", + "tepp-run-1", + "--idempotency-key", + "idem-child", + ], + "", + ) + .unwrap_err(), + ApiError::InvalidWirePayload + ); + assert_eq!( + AnalysisRunRetryCliInvocation::from_args( + [ + "retry", + "--host", + "localhost:18081", + "--origin", + ORIGIN, + "--run-id", + "tepp-run-1", + "--idempotency-key", + "idem-child", + ], + "", + ) + .unwrap_err(), + ApiError::InvalidWirePayload + ); + assert_eq!( + AnalysisRunRetryCliInvocation::from_args( + [ + "retry", + "--host", + "127.0.0.1:18081", + "--origin", + ORIGIN, + "--authorization", + "secret", + "--run-id", + "tepp-run-1", + "--idempotency-key", + "idem-child", + ], + "", + ) + .unwrap_err(), + ApiError::AuthorizationDenied + ); + let mismatched = format!( + r#"{{"contract_version":{ANALYSIS_RUN_RETRY_CONTRACT_VERSION},"run_id":"other","idempotency_key":"idem-child"}}"# + ); + assert_eq!( + AnalysisRunRetryCliInvocation::from_args( + retry_args( + "127.0.0.1:18081", + "tepp-run-1", + "idem-child", + NARUON_CONSUMER_CODE + ), + mismatched, + ) + .unwrap_err(), + ApiError::InvalidWirePayload + ); +} + +#[test] +fn compose_is_typed_https_post_retry_without_credentials() { + let invocation = AnalysisRunRetryCliInvocation::from_args( + retry_args( + "127.0.0.1:18081", + "tepp-run-1", + "idem-child", + NARUON_CONSUMER_CODE, + ), + "", + ) + .expect("invocation"); + let http = compose_analysis_run_retry_cli_http(&invocation).expect("http"); + assert!(http.starts_with("POST /v1/analysis-runs/tepp-run-1/retry HTTP/1.1")); + assert!(http.contains("tepp-consumer: naruon")); + assert!(http.contains("idempotency-key: idem-child")); + assert!(!http.to_ascii_lowercase().contains("authorization")); + assert!(!http.contains("rmse")); + assert!(!http.contains(SCHEMA)); +} + +#[test] +fn naruon_and_lineageweave_cli_retry_cancelled_runs() { + let mut service = AnalysisRunLiveService::new(); + let parent = accept_and_cancel(&mut service, "cli-retry-naruon", NARUON_CONSUMER_CODE); + let invocation = AnalysisRunRetryCliInvocation::from_args( + retry_args( + "127.0.0.1:18081", + parent.run_id.as_str(), + "cli-retry-naruon-child", + NARUON_CONSUMER_CODE, + ), + "", + ) + .expect("naruon"); + let retried = dispatch_analysis_run_retry_cli(&mut service, &invocation).expect("retry"); + assert_eq!(retried.status_code, 202, "{}", retried.body); + let stdout = render_analysis_run_retry_cli_stdout(&invocation, &retried).expect("stdout"); + let child = AnalysisRunAccepted::from_json(&stdout).expect("child"); + assert_ne!(child.run_id, parent.run_id); + assert_eq!(child.idempotency_key, "cli-retry-naruon-child"); + assert!(!stdout.contains("rmse")); + assert!(!stdout.contains(SCHEMA)); + + let lineage_parent = accept_and_cancel( + &mut service, + "cli-retry-lineage", + LINEAGEWEAVE_CONSUMER_CODE, + ); + let lineage = AnalysisRunRetryCliInvocation::from_args( + retry_args( + "127.0.0.1:18081", + lineage_parent.run_id.as_str(), + "cli-retry-lineage-child", + LINEAGEWEAVE_CONSUMER_CODE, + ), + "", + ) + .expect("lineage"); + let lineage_http = compose_analysis_run_retry_cli_http(&lineage).expect("http"); + assert!(lineage_http.contains("tepp-consumer: lineageweave")); + assert!(!lineage_http.contains("tepp-consumer: naruon")); + let lineage_retried = + dispatch_analysis_run_retry_cli(&mut service, &lineage).expect("lineage retry"); + assert_eq!(lineage_retried.status_code, 202, "{}", lineage_retried.body); + let lineage_stdout = + render_analysis_run_retry_cli_stdout(&lineage, &lineage_retried).expect("lineage stdout"); + let lineage_child = AnalysisRunAccepted::from_json(&lineage_stdout).expect("lineage child"); + assert_ne!(lineage_child.run_id, lineage_parent.run_id); + + let accepted_only = service.handle_http_request(&create_http( + &request("cli-retry-accepted"), + NARUON_CONSUMER_CODE, + "127.0.0.1:18081", + )); + let accepted = AnalysisRunAccepted::from_json(&accepted_only.body).expect("accepted only"); + let refused = AnalysisRunRetryCliInvocation::from_args( + retry_args( + "127.0.0.1:18081", + accepted.run_id.as_str(), + "cli-retry-accepted-child", + NARUON_CONSUMER_CODE, + ), + "", + ) + .expect("refused"); + let denied = dispatch_analysis_run_retry_cli(&mut service, &refused).expect("denied"); + assert_eq!(denied.status_code, 400, "{}", denied.body); + let denied_stdout = render_analysis_run_retry_cli_stdout(&refused, &denied).expect("err"); + assert!(denied_stdout.contains("invalid_wire_payload")); + assert!(!denied_stdout.contains(SCHEMA)); +} + +#[test] +fn render_refuses_metrics_and_parent_identity() { + let invocation = AnalysisRunRetryCliInvocation::from_args( + retry_args( + "127.0.0.1:18081", + "tepp-run-1", + "idem-child", + NARUON_CONSUMER_CODE, + ), + "", + ) + .expect("invocation"); + assert_eq!( + render_analysis_run_retry_cli_stdout( + &invocation, + &NaruonLiveResponse { + status_code: 202, + reason_phrase: "Accepted", + body: String::new(), + } + ) + .unwrap_err(), + ApiError::InvalidWirePayload + ); + assert_eq!( + render_analysis_run_retry_cli_stdout( + &invocation, + &NaruonLiveResponse { + status_code: 202, + reason_phrase: "Accepted", + body: r#"{"contract_version":1,"run_id":"tepp-run-2","run_state":"accepted","idempotency_key":"idem-child","rmse":1.0}"#.into(), + } + ) + .unwrap_err(), + ApiError::InvalidWirePayload + ); + assert_eq!( + render_analysis_run_retry_cli_stdout( + &invocation, + &NaruonLiveResponse { + status_code: 202, + reason_phrase: "Accepted", + body: r#"{"contract_version":1,"run_id":"tepp-run-1","run_state":"accepted","idempotency_key":"idem-child"}"#.into(), + } + ) + .unwrap_err(), + ApiError::InvalidWirePayload + ); +} + +#[test] +fn execute_over_tcp_and_stdin_reader() { + let mut service = AnalysisRunLiveService::bind_loopback().expect("bind"); + let addr = service.local_addr().expect("addr").to_string(); + let parent = accept_and_cancel(&mut service, "cli-retry-tcp", NARUON_CONSUMER_CODE); + let handle = std::thread::spawn(move || { + drop(service.serve_one()); + }); + let invocation = AnalysisRunRetryCliInvocation::from_args( + retry_args( + addr.as_str(), + parent.run_id.as_str(), + "cli-retry-tcp-child", + NARUON_CONSUMER_CODE, + ), + "", + ) + .expect("tcp"); + let response = execute_analysis_run_retry_cli(&invocation).expect("execute"); + assert_eq!(response.status_code, 202, "{}", response.body); + handle.join().expect("join"); + let empty = read_analysis_run_retry_cli_stdin(true, std::io::empty()).expect("tty"); + assert!(empty.is_empty()); + let piped = + read_analysis_run_retry_cli_stdin(false, std::io::Cursor::new(b"{}")).expect("pipe"); + assert_eq!(piped, "{}"); +} diff --git a/docs/API_CONTRACT.md b/docs/API_CONTRACT.md index 9da7f697f..2a5f23003 100644 --- a/docs/API_CONTRACT.md +++ b/docs/API_CONTRACT.md @@ -88,7 +88,10 @@ operators do not guess run identities. Collection bodies never carry `tepp.scientific_acceptance.v1`. `POST /v1/analysis-runs/{run_id}/retry` clones a failed or cancelled run into a new metric-free `202 Accepted` with a new idempotency key; accepted, running, succeeded, and unknown runs fail -closed. GET-by-id remains a later slice on this protected-main lineage. +closed. `tepp-retry retry` is the published CLI that mints those typed +naruon/`LineageWeave` retry exchanges onto spawned `tepp-loopback` TCP. +Public bind hosts and `localhost` fail closed. GET-by-id remains a later +slice on this protected-main lineage. The stacked `analysis_engine` slice provides the first executable service-side path behind these DTOs. It consumes a bounded identity-free snapshot, excludes diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index a4a6b33c3..0b43880a4 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -57,6 +57,7 @@ The full APA 7th standards/literature register remains `docs/research/standards- | loopback analysis-run collection GET | ADR 0031; API contract; RFC 9110 | `tepp_api` `GET /v1/analysis-runs` on `AnalysisRunLiveService`: metric-free enumeration of accepted/running/cancelled/terminal runs; collection bodies refuse scientific-acceptance and RMSE keys; GET-by-id remains a later slice | active-PR | | loopback analysis-run retry HTTP | ADR 0032; API contract; RFC 9110 | `tepp_api` `POST /v1/analysis-runs/{run_id}/retry` on `AnalysisRunLiveService`: clones failed/cancelled into a new metric-free `202 Accepted` with a new idempotency key; accepted/running/succeeded/unknown refuse; GET-by-id remains a later slice | active-PR | | loopback analysis-run retry consumer parity | ADR 0033; API contract; RFC 9110 | `tepp_api` `lineageweave_analysis_run_retry_exchange` plus Naruon compatibility-listener retry; LineageWeave remains refused on `NaruonLiveService`; `tepp-loopback` TCP create-cancel-retry proof; GET remains refused on the compatibility listener | active-PR | +| loopback analysis-run retry CLI | ADR 0043; ADR 0032/0033; API contract; RFC 9110 | `tepp_api` `tepp-retry` CLI (this PR): typed naruon/`LineageWeave` retry exchanges render onto spawned `tepp-loopback` TCP; public bind/`localhost`/non-`https` fail closed; child `202 Accepted` stays metric-free; not implemented-main; Postgres persistence remains GAP-003B | active-PR | | executable cutoff-safe analysis-run readiness | ADR 0021; temporal research; API terminal-result contract | stacked `analysis_engine` PR on #157: availability cutoff, snapshot binding, multiple-membership aggregation, digest-bound artifact, realistic end-to-end tests | active-PR | | delayed-reporting cutoff eligibility in truth corpora | ADR 0002; research | `tepp_simulation` eligible-at-cutoff filter on the active PR | active-PR | | versioned service/API contracts and exports | PRD; API contract; ADR 0011/0013 | `tepp_api` analysis-run/export/JSON-LD/GraphML contracts on protected main (PR #21); HTTP service remaining accepted-target | partial | diff --git a/docs/adr/0043-analysis-run-retry-cli.md b/docs/adr/0043-analysis-run-retry-cli.md new file mode 100644 index 000000000..1b8dfdd6a --- /dev/null +++ b/docs/adr/0043-analysis-run-retry-cli.md @@ -0,0 +1,97 @@ +# ADR 0043 — Loopback analysis-run retry CLI + +**Decision status:** Accepted +**Implementation maturity:** active-PR +**Date:** 2026-08-31 +**Supersedes:** None; complements ADR 0032 (retry HTTP) and ADR 0033 (retry consumer parity). Does not reuse ADR 0030–0042 numbers from other stacks. Does not supersede ADR 0014 claim-promotion authority. + +## Context + +ADR 0032 owns `POST /v1/analysis-runs/{run_id}/retry`. ADR 0033 owns typed +naruon/`LineageWeave` retry exchanges. Operators still have to hand-roll +HTTP/1.1 to clone a failed or cancelled run on spawned `tepp-loopback`. +Cancel CLI (#378), create CLI (#385), status CLI (#392), collection CLI +(#371), lifecycle CLI (#362), and execute CLI (#390) are different verbs or +different stacks. `tepp_api` owns retry; the CLI belongs here. + +## Decision + +Publish `tepp-retry`: + +- `tepp-retry retry` mints `naruon_analysis_run_retry_exchange` or + `lineageweave_analysis_run_retry_exchange` and renders through + `loopback_http1_from_retry_exchange`. +- `--origin` stays the published HTTPS origin; only `--host` is the loopback + bind address printed by `tepp-loopback`. +- Empty stdin is admitted; typed retry JSON must match `--run-id` and the + **new** `--idempotency-key`. +- Success stdout is a metric-free child `202 Accepted` with a new `run_id`. +- Public bind hosts, `localhost`, unpublished consumers, credential-shaped + flags, and non-`https` origins fail closed. +- Persistence remains GAP-003B. + +## Non-goals + +- Production TLS, public bind, or durable status storage. +- Leiden community detection, Driver p.16 restoration, or Figma/export work. +- Promoting an ADR 0014 scientific claim from HTTP success. +- Execute CLI, cancel CLI, create CLI, status CLI, collection CLI, or another + retry HTTP/consumer-parity slice. + +## Alternatives considered + +1. **Keep hand-rolled retry HTTP in each operator script** — rejected because + GAP-003A is operator-visible and create/cancel already have CLIs. +2. **Add `retry` to `tepp-analysis-runs` on the create-CLI stack** — rejected + because that stack does not include retry HTTP (#369). +3. **Reuse execute CLI** — rejected; execute is a different verb on + `analysis_engine`. + +## Consequences + +- Operators can clone failed or cancelled runs without embedding the library. +- HTTP 202 on retry is not release evidence. + +## Failure and recovery + +Non-loopback hosts, `localhost`, non-`https` origins, unpublished consumers, +metric keys, unknown artifact fields, empty identities, and retry of +accepted/running/succeeded/unknown parents return a fail-closed API error. +The in-memory registry is not durable. + +## Security, privacy, scientific-integrity, and governance impact + +- No credential headers cross the consumer boundary. +- Retry remains loopback-served, size-bounded, and content-redacting. +- Child receipts stay metric-free. + +## Compatibility and migration + +Create, cancel, collection, and retry HTTP exchanges are unchanged. Production +adapters may replace loopback while preserving metric-free child receipts. + +## Verification + +Falsifiable evidence: + +- naruon retry CLI is HTTPS POST `/retry` without credentials or RMSE keys; +- LineageWeave retry CLI changes only `tepp-consumer`; +- public bind, `localhost`, `http://` origins, and accepted parents fail closed; +- create then cancel then typed retry CLI then stdout is a new metric-free + `202 Accepted` for both consumers; +- Clippy `-D warnings`, `tepp_api` tests, rustdoc, and exact-head review remain + required. + +## Rollback and supersession + +Rollback removes the retry CLI; retry HTTP and consumer exchanges remain +valid. A superseding ADR is required to persist status, bind a public +address, or treat HTTP success as an ADR 0014 claim. + +## Related authority + +- ADR 0032 owns retry HTTP. +- ADR 0033 owns retry consumer parity. +- ADR 0018 owns consumer-scoped ingress and metric-free `202 Accepted`. +- ADR 0011 owns standalone/modular HTTP boundaries. +- ADR 0014 owns scientific claim promotion. diff --git a/docs/adr/README.md b/docs/adr/README.md index 017023cf4..e7aa93fa6 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -34,6 +34,7 @@ Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementatio | [0031](0031-analysis-run-collection-get.md) | Loopback GET analysis-run collection is metric-free enumeration | Accepted | active-PR | Complements ADR 0018/0029; does not supersede ADR 0014. ADR 0026–0030 live on other GAP-003A PRs. | | [0032](0032-analysis-run-retry-http.md) | Loopback POST analysis-run retry clones failed/cancelled into a new metric-free 202 | Accepted | active-PR | Complements ADR 0018/0029/0031; does not supersede ADR 0014. ADR 0026–0031 live on other GAP-003A PRs. | | [0033](0033-analysis-run-retry-consumer-parity.md) | LineageWeave retry-exchange and Naruon compatibility-listener retry | Accepted | active-PR | Complements ADR 0032/0018; does not supersede ADR 0014. Unique on the retry-HTTP lineage. | +| [0043](0043-analysis-run-retry-cli.md) | Loopback analysis-run retry CLI | Accepted | active-PR | Published `tepp-retry` mints typed naruon/`LineageWeave` retry exchanges onto spawned `tepp-loopback` TCP. Persistence remains GAP-003B. | | [0023](0023-lineage-criterion-anchor-contract.md) | TEPP-owned Event Lineage criterion anchor | Accepted | active-PR | PR #237 publishes the strict accepted/rejected artifact and identities; estimator execution remains fail-closed future work. | | [0024](0024-independent-topic-importance-anchor.md) | Posterior topic-context producer contract | Accepted | contract-only active-PR | Strict DTO/schema only; the current estimator does not emit it. fast-mlsirm owns case-deletion influence. | | [0001](0001-rust-first-modular-msa.md) | Rust-first numerical core and CPU `f64` reference | Accepted | partial | ADR 0011 owns cross-service/MSA authority; 0001 retains numerical/backend authority. | @@ -148,6 +149,7 @@ Use the narrowest owning ADR when decisions overlap: - **analysis-run collection GET:** ADR 0031. - **analysis-run retry HTTP:** ADR 0032. - **analysis-run retry consumer parity:** ADR 0033. +- **analysis-run retry CLI:** ADR 0043. ## Change and supersession rule diff --git a/docs/connectors/naruon-artifact-consumer.md b/docs/connectors/naruon-artifact-consumer.md index 120de3f4e..47418eafe 100644 --- a/docs/connectors/naruon-artifact-consumer.md +++ b/docs/connectors/naruon-artifact-consumer.md @@ -29,6 +29,7 @@ TEPP remains the scientific authority for estimation, recovery metrics, temporal | HTTP analysis-run collection | `tepp_api` `naruon_analysis_run_collection_exchange` → `GET /v1/analysis-runs` | naruon → TEPP | | HTTP analysis-run cancel | `tepp_api` `naruon_analysis_run_cancel_exchange` → `POST /v1/analysis-runs/{run_id}/cancel` | naruon → TEPP | | HTTP analysis-run retry | `tepp_api` `naruon_analysis_run_retry_exchange` → `POST /v1/analysis-runs/{run_id}/retry` | naruon → TEPP | +| Typed retry CLI on spawned `tepp-loopback` TCP | `tepp_api` `tepp-retry` renders the typed POST onto the packaged loopback listener | naruon → TEPP | | HTTP export authorize | `tepp_api` `naruon_export_exchange` → `POST /v1/exports` | naruon → TEPP | | Live loopback POST | `tepp_api` `NaruonLiveService` → `POST /v1/analysis-runs`, `/v1/analysis-runs/{run_id}/retry`, and `/v1/exports` | naruon → TEPP | diff --git a/docs/research/analysis-run-retry-cli.md b/docs/research/analysis-run-retry-cli.md new file mode 100644 index 000000000..652247b56 --- /dev/null +++ b/docs/research/analysis-run-retry-cli.md @@ -0,0 +1,31 @@ +# Analysis-run retry CLI + +## Scope + +This note doctors the GAP-003A naruon/`LineageWeave` retry CLI slice: + +1. `tepp-retry retry` is the published operator CLI for `POST /v1/analysis-runs/{run_id}/retry`; +2. the CLI mints `naruon_analysis_run_retry_exchange` or `lineageweave_analysis_run_retry_exchange` and renders onto spawned `tepp-loopback` TCP; +3. success stdout is a metric-free child `202 Accepted` with a new `run_id` and a new idempotency key; +4. public bind hosts, `localhost`, non-`https` origins, unpublished consumers, and retry of accepted parents fail closed. + +Postgres persistence, restart/recovery, and Compose execution remain GAP-003B. This slice is not implemented-main. It does not duplicate retry HTTP (#369), retry consumer parity (#393), execute CLI (#390), cancel CLI (#378), create CLI (#385), status CLI (#392), collection CLI (#371), or lifecycle CLI (#362). + +## Authoritative sources + +Fielding, R., Ed., & Reschke, J., Ed. (2014). *Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content* (RFC 9110). RFC Editor. https://www.rfc-editor.org/rfc/rfc9110 + +National Academies of Sciences, Engineering, and Medicine. (2019). *Reproducibility and replicability in science*. The National Academies Press. https://doi.org/10.17226/25303 + +Wasserstein, R. L., & Lazar, N. A. (2016). The ASA statement on *p*-values: Context, process, and purpose. *The American Statistician, 70*(2), 129–133. https://doi.org/10.1080/00031305.2016.1154108 + +## Application + +RFC 9110 requires that a published method be invoked through a documented interface, not an ad-hoc operator wire. The National Academies (2019) require that a computational procedure be runnable from the published interface. Wasserstein and Lazar (2016) refuse to treat a passing threshold as automatic scientific authority, so the CLI emits the same metric-free child `202 Accepted` as the library bind and never treats HTTP success as ADR 0014 promotion. TEPP therefore gives operators a credential-free retry CLI, refuses caller-supplied artifacts, and keeps RMSE, bias, coverage, and scientific acceptance off the retry receipt (Fielding & Reschke, 2014; National Academies of Sciences, Engineering, and Medicine, 2019; Wasserstein & Lazar, 2016). Meredith (1993) remains unread (Unpaywall/OpenAlex 2026-08-31T15:00Z: `is_oa: false`, 0 locations). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`). + +## Verification + +- naruon retry CLI is HTTPS POST `/retry` without credentials or RMSE keys; +- LineageWeave retry CLI changes only `tepp-consumer`; +- public bind, `localhost`, `http://` origins, and accepted parents fail closed; +- create then cancel then typed retry CLI then stdout is a new metric-free `202 Accepted` for both consumers.