[ExtraToast]

Closes #629. Part of #429.

Summary

E_CLIENT_OPEN is the Release Gate's anonymous request to a native Client's protectedPath. The inputs carried the path but not which member serves it. A static UI member answers any path with its index page, so asking the wrong member, or every member, would hold a sound release. By the maintainer's choice, the member is the one the edge itself would send the request to.

• protectedBy. Beside protectedPath, the release-gate inputs name the Process the longest matching Route of the Client's exposure takes the path to.
  • A prefix Route matches a path it opens, an exact one the path itself, and a redirect Route reaches no Process.
  • A tie goes to the Route declared first.
  • routeFor in project-intent-queries.ts is the one place this is decided, for the check and the resolution alike.
• E_CLIENT_PATH_UNROUTED, at client/protectedPath: no Route of the Client's exposure reaches the path, or the Route that does reaches a Process that publishes no readiness, so the gate could not ask it. A Route to a Process the Application lacks is left to E_UNKNOWN_PROCESS.
• Records.
  • Chapter 17 gains the code and a paragraph on which member is asked.
  • Chapter 20's release-gate inputs gain protectedBy.
  • Chapter 55 says the gate asks that member's Canary service, that no answer holds the release, and that a protectedBy member which did not change in the release is not asked.
• Oracles.
  • A new refusal fixture, refusals/client-path-unrouted/, with its diagnostics oracle and README row.
  • The identity example's grafana and portal gain protectedBy, in resolved.json and in their release-gate ConfigMaps. Revisions follow.
  • The published schemas are regenerated.

To know

• TypeScript only: emf/ is frozen at mde-task-3.
• Additive for consumers. Release Gate: hold a release whose native Client serves its protected path to anyone (E_CLIENT_OPEN) delivery#86 is the gate's half and reads protectedBy once delivery vendors a deploy-kit ref that has it.
• This changes the identity example's oracles, which feat(model): admit the Release Gate's own requests to every gate member #606 and feat(model)!: cut the model to what 1.0 keeps #628 also touch. Whichever merges second regenerates them.

Checks

• Full suite: 2314 tests pass. New tests:
  • the member chosen: the default Route, a longer prefix, an exact Route over a prefix, an exact Route that does not match, the longer Route declared first, a tie, and a redirect;
  • the refusal's message and hint; an exact Route reaching its own path only; a Process without readiness, whether liveness-only or with no probes; the reached Process being the second one; and a Route to an unknown Process;
  • the native /.auth/ case now also routes /api/.
• Every lint passes: format, ESLint, typecheck, ADRs, links, meaning, docs, manifests, boundaries, codes (163 defined, 119 exercised), rules, requirements.
• Stryker on the new check and query: 100%, after tests for the survivors of a first run.

[github-actions]

Shape

bucket	files	additions	deletions
production code	5	+109	-5
tests	3	+141	-2
specification	5	+28	-4
examples	11	+144	-12

Coverage

Baseline: main @ 5cdface.

metric	this branch	main	diff
statements	99.71%	99.71%	0.00
branches	98.49%	98.47%	+0.02
functions	100.00%	100.00%	0.00
lines	99.69%	99.68%	+0.01

Lines this pull request changed: 21/21 covered (100.00%).