feat: model operation outcome guarantees

crates/wip-host/tests/host.rs

@@ -1,13 +1,16 @@
 use std::cell::Cell;
 use std::collections::BTreeMap;
 use std::rc::Rc;
+use std::time::{Duration, Instant};
 
 use wip_host::{
-    CallError, CallErrorKind, CallRequest, InterfaceRef, InterfaceRegistry, InterfaceTarget,
-    ObjectProvider, PublishedObject, RegisteredInterface, Target, Validator, WipObject,
+    CallError, CallErrorKind, CallRequest, CancellationToken, ExecutionContext, InterfaceRef,
+    InterfaceRegistry, InterfaceTarget, ObjectProvider, OperationAttempt, ProviderResult,
+    PublishedObject, RegisteredInterface, Target, Validator, WipObject,
 };
 use wip_interface::{
-    CodecError, HostError, OperationResult, TypeDeclaration, TypeExpr, Value, WipType, interface,
+    CodecError, EffectGuarantee, HostError, OperationResult, TypeDeclaration, TypeExpr, Value,
+    WipType, interface,
 };
 use wip_protocol::ProtocolErrorCode;
 
@@ -39,6 +42,24 @@ pub trait Hidden {
 pub trait Broken {
     /// Returns a deliberately invalid encoded value.
     fn broken(&self) -> OperationResult<BadValue>;
+
+    /// Produces a result codec failure after implementation invocation.
+    fn encode_failure(&self) -> OperationResult<EncodeFailure>;
+
+    /// Panics after implementation invocation begins.
+    fn panic_after_call(&self) -> OperationResult<String>;
+
+    /// Reports an internal failure without an effect guarantee.
+    fn unknown_internal(&self) -> OperationResult<String>;
+
+    /// Reports an internal failure with a non-commit guarantee.
+    fn safe_internal(&self) -> OperationResult<String>;
+
+    /// Reports a resource failure without an effect guarantee.
+    fn unknown_resource(&self) -> OperationResult<String>;
+
+    /// Reports a resource failure with a non-commit guarantee.
+    fn safe_resource(&self) -> OperationResult<String>;
 }
 
 #[derive(Debug)]
@@ -60,6 +81,25 @@ impl WipType for BadValue {
     }
 }
 
+#[derive(Debug)]
+pub struct EncodeFailure;
+
+impl WipType for EncodeFailure {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::String
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        Err(CodecError::new("private://backend/result could not encode"))
+    }
+
+    fn decode(_: Value) -> Result<Self, CodecError> {
+        Ok(Self)
+    }
+}
+
 struct Document {
     name: String,
     description: Option<String>,
@@ -135,7 +175,10 @@ impl Reader for Document {
 
     fn fail(&self) -> OperationResult<String> {
         self.record_call();
-        Err(HostError::new("backend unavailable"))
+        Err(HostError::internal(
+            "backend unavailable",
+            EffectGuarantee::Unknown,
+        ))
     }
 }
 
@@ -158,6 +201,48 @@ impl Broken for Document {
         self.record_call();
         Ok(BadValue)
     }
+
+    fn encode_failure(&self) -> OperationResult<EncodeFailure> {
+        self.record_call();
+        Ok(EncodeFailure)
+    }
+
+    fn panic_after_call(&self) -> OperationResult<String> {
+        self.record_call();
+        panic!("private://backend panic with credential=secret")
+    }
+
+    fn unknown_internal(&self) -> OperationResult<String> {
+        self.record_call();
+        Err(HostError::internal(
+            "private://backend/path credential=secret",
+            EffectGuarantee::Unknown,
+        ))
+    }
+
+    fn safe_internal(&self) -> OperationResult<String> {
+        self.record_call();
+        Err(HostError::internal(
+            "private://backend/path credential=secret",
+            EffectGuarantee::NotCommitted,
+        ))
+    }
+
+    fn unknown_resource(&self) -> OperationResult<String> {
+        self.record_call();
+        Err(HostError::resource_limit(
+            "private scheduler deadline details",
+            EffectGuarantee::Unknown,
+        ))
+    }
+
+    fn safe_resource(&self) -> OperationResult<String> {
+        self.record_call();
+        Err(HostError::resource_limit(
+            "private scheduler deadline details",
+            EffectGuarantee::NotCommitted,
+        ))
+    }
 }
 
 struct TestProvider {
@@ -169,6 +254,11 @@ struct TestProvider {
     authorization_checks: Cell<usize>,
     deny: Cell<bool>,
     switched: Cell<bool>,
+    confirm_rollback: Cell<bool>,
+    provider_failure: Cell<Option<(bool, EffectGuarantee)>>,
+    observed_budget: Cell<Option<u64>>,
+    observed_deadline: Cell<Option<Instant>>,
+    observed_cancelled: Cell<bool>,
 }
 
 impl TestProvider {
@@ -186,6 +276,11 @@ impl TestProvider {
             authorization_checks: Cell::new(0),
             deny: Cell::new(false),
             switched: Cell::new(false),
+            confirm_rollback: Cell::new(false),
+            provider_failure: Cell::new(None),
+            observed_budget: Cell::new(None),
+            observed_deadline: Cell::new(None),
+            observed_cancelled: Cell::new(false),
         }
     }
 }
@@ -195,9 +290,14 @@ impl ObjectProvider for TestProvider {
 
     fn with_object<R>(
         &self,
+        context: &ExecutionContext,
         path: &str,
         operation: impl FnOnce(&PublishedObject<Self::Object>) -> R,
-    ) -> Option<R> {
+    ) -> ProviderResult<R> {
+        self.observed_budget.set(context.resource_budget());
+        self.observed_deadline.set(context.deadline());
+        self.observed_cancelled
+            .set(context.cancellation().is_cancelled());
         self.resolutions.set(self.resolutions.get() + 1);
         let (document, interfaces) = match path {
             "/document" => (
@@ -243,7 +343,7 @@ impl ObjectProvider for TestProvider {
                 Document::open("broken", Some("broken-ref"), Rc::clone(&self.calls)),
                 3,
             ),
-            _ => return None,
+            _ => return ProviderResult::NotFound,
         };
 
         let publication = PublishedObject::new(document);
@@ -257,7 +357,32 @@ impl ObjectProvider for TestProvider {
             3 => publication.expose(&self.broken).unwrap(),
             _ => unreachable!(),
         };
-        Some(operation(&publication))
+        ProviderResult::Found(operation(&publication))
+    }
+
+    fn execute_operation(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+        operation: impl FnOnce(&PublishedObject<Self::Object>) -> OperationAttempt,
+    ) -> ProviderResult<OperationAttempt> {
+        let result = self.with_object(context, path, operation);
+        if let Some((resource, guarantee)) = self.provider_failure.get() {
+            let error = if resource {
+                HostError::resource_limit("private provider scheduler state", guarantee)
+            } else {
+                HostError::internal("private provider transaction path", guarantee)
+            };
+            return ProviderResult::Failure(error);
+        }
+        if self.confirm_rollback.get() {
+            match result {
+                ProviderResult::Found(attempt) => ProviderResult::Found(attempt.confirm_rollback()),
+                other => other,
+            }
+        } else {
+            result
+        }
     }
 
     fn authorize(&self, _: &str, _: &Document, _: &InterfaceRef, _: &str) -> bool {
@@ -320,12 +445,21 @@ fn registry_returns_atomic_canonical_observation_without_rewriting_descriptor()
     assert_eq!(observation.reference, *reference);
     assert_eq!(observation.descriptor, ReaderDefinition::descriptor());
     assert_eq!(observation.validator, Some(Validator::new(b"schema-v1")));
-    let response = observation.protocol_response();
+    let response = observation.protocol_response().unwrap();
     assert_eq!(response.interface, reference.as_str());
     assert_eq!(response.descriptor, ReaderDefinition::descriptor());
     assert_eq!(response.validator.as_deref(), Some(b"schema-v1".as_slice()));
     response.descriptor.validate().unwrap();
 
+    let mut invalid_observation = registry.fetch_interface(reference.as_str()).unwrap();
+    let duplicate_operation = invalid_observation.descriptor.operations[0].clone();
+    invalid_observation
+        .descriptor
+        .operations
+        .push(duplicate_operation);
+    let invalid_response = invalid_observation.protocol_response().unwrap_err();
+    assert_eq!(invalid_response.code, ProtocolErrorCode::Internal);
+
     let error = registry.fetch_interface("unknown").unwrap_err();
     assert_eq!(error.code, ProtocolErrorCode::InterfaceNotFound);
 }
@@ -648,7 +782,7 @@ fn invalid_host_responses_and_uncertain_operation_failures_use_canonical_codes()
                 BTreeMap::new(),
             ))
             .unwrap_err(),
-        CallErrorKind::InvalidResult,
+        CallErrorKind::OperationOutcomeUnknown,
         ProtocolErrorCode::OperationOutcomeUnknown,
     );
     assert_failure(
@@ -662,7 +796,190 @@ fn invalid_host_responses_and_uncertain_operation_failures_use_canonical_codes()
                 BTreeMap::new(),
             ))
             .unwrap_err(),
-        CallErrorKind::Implementation,
+        CallErrorKind::OperationOutcomeUnknown,
         ProtocolErrorCode::OperationOutcomeUnknown,
     );
 }
+
+fn call_broken(provider: &TestProvider, operation: &str) -> CallError {
+    provider
+        .call_operation(request(
+            "/broken",
+            None,
+            provider.broken.reference(),
+            None,
+            operation,
+            BTreeMap::new(),
+        ))
+        .unwrap_err()
+}
+
+#[test]
+fn typed_implementation_failures_map_only_with_a_non_commit_guarantee() {
+    let (_, provider, _) = registry_and_provider();
+
+    let unknown_internal = call_broken(&provider, "unknown_internal");
+    assert_failure(
+        unknown_internal.clone(),
+        CallErrorKind::OperationOutcomeUnknown,
+        ProtocolErrorCode::OperationOutcomeUnknown,
+    );
+    assert!(!unknown_internal.message().contains("private://"));
+    assert!(
+        !unknown_internal
+            .protocol_error()
+            .message
+            .contains("credential")
+    );
+
+    assert_failure(
+        call_broken(&provider, "safe_internal"),
+        CallErrorKind::Internal,
+        ProtocolErrorCode::Internal,
+    );
+    assert_failure(
+        call_broken(&provider, "unknown_resource"),
+        CallErrorKind::OperationOutcomeUnknown,
+        ProtocolErrorCode::OperationOutcomeUnknown,
+    );
+    assert_failure(
+        call_broken(&provider, "safe_resource"),
+        CallErrorKind::ResourceLimitExceeded,
+        ProtocolErrorCode::ResourceLimitExceeded,
+    );
+}
+
+#[test]
+fn post_invocation_result_and_panic_failures_require_provider_rollback() {
+    for operation in ["broken", "encode_failure", "panic_after_call"] {
+        let (_, provider, _) = registry_and_provider();
+        let error = call_broken(&provider, operation);
+        assert_failure(
+            error.clone(),
+            CallErrorKind::OperationOutcomeUnknown,
+            ProtocolErrorCode::OperationOutcomeUnknown,
+        );
+        assert!(!error.message().contains("private://"));
+        assert!(!error.message().contains("credential"));
+
+        provider.confirm_rollback.set(true);
+        assert_failure(
+            call_broken(&provider, operation),
+            CallErrorKind::Internal,
+            ProtocolErrorCode::Internal,
+        );
+    }
+}
+
+#[test]
+fn provider_failures_after_invocation_use_the_provider_effect_guarantee() {
+    let (_, provider, _) = registry_and_provider();
+
+    provider
+        .provider_failure
+        .set(Some((false, EffectGuarantee::Unknown)));
+    assert_failure(
+        call_broken(&provider, "safe_internal"),
+        CallErrorKind::OperationOutcomeUnknown,
+        ProtocolErrorCode::OperationOutcomeUnknown,
+    );
+
+    provider
+        .provider_failure
+        .set(Some((false, EffectGuarantee::NotCommitted)));
+    let internal = call_broken(&provider, "unknown_internal");
+    assert_failure(
+        internal.clone(),
+        CallErrorKind::Internal,
+        ProtocolErrorCode::Internal,
+    );
+    assert!(!internal.message().contains("transaction"));
+
+    provider
+        .provider_failure
+        .set(Some((true, EffectGuarantee::Unknown)));
+    assert_failure(
+        call_broken(&provider, "safe_resource"),
+        CallErrorKind::OperationOutcomeUnknown,
+        ProtocolErrorCode::OperationOutcomeUnknown,
+    );
+
+    provider
+        .provider_failure
+        .set(Some((true, EffectGuarantee::NotCommitted)));
+    assert_failure(
+        call_broken(&provider, "unknown_resource"),
+        CallErrorKind::ResourceLimitExceeded,
+        ProtocolErrorCode::ResourceLimitExceeded,
+    );
+}
+
+#[test]
+fn execution_context_is_propagated_and_preflight_prevents_invocation() {
+    let (_, provider, _) = registry_and_provider();
+    let deadline = Instant::now() + Duration::from_secs(60);
+    let context = ExecutionContext::new()
+        .with_deadline(deadline)
+        .with_resource_budget(17);
+
+    provider
+        .call_operation_with_context(
+            &context,
+            request(
+                "/open",
+                None,
+                provider.reader.reference(),
+                Some(b"schema-v1"),
+                "label",
+                BTreeMap::new(),
+            ),
+        )
+        .unwrap();
+    assert_eq!(provider.observed_deadline.get(), Some(deadline));
+    assert_eq!(provider.observed_budget.get(), Some(17));
+    assert!(!provider.observed_cancelled.get());
+
+    let calls = provider.calls.get();
+    let cancellation = CancellationToken::new();
+    cancellation.cancel();
+    let cancelled = ExecutionContext::new().with_cancellation(cancellation);
+    assert_failure(
+        provider
+            .call_operation_with_context(
+                &cancelled,
+                request(
+                    "/open",
+                    None,
+                    provider.reader.reference(),
+                    Some(b"schema-v1"),
+                    "label",
+                    BTreeMap::new(),
+                ),
+            )
+            .unwrap_err(),
+        CallErrorKind::ResourceLimitExceeded,
+        ProtocolErrorCode::ResourceLimitExceeded,
+    );
+    assert_eq!(provider.calls.get(), calls);
+    assert!(provider.observed_cancelled.get());
+
+    let expired = ExecutionContext::new().with_deadline(Instant::now() - Duration::from_secs(1));
+    assert_failure(
+        provider
+            .call_operation_with_context(
+                &expired,
+                request(
+                    "/open",
+                    None,
+                    provider.reader.reference(),
+                    Some(b"schema-v1"),
+                    "label",
+                    BTreeMap::new(),
+                ),
+            )
+            .unwrap_err(),
+        CallErrorKind::ResourceLimitExceeded,
+        ProtocolErrorCode::ResourceLimitExceeded,
+    );
+    assert_eq!(provider.calls.get(), calls);
+}