Egothor/ZeroEcho
2
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects 1 Releases 4 Wiki Activity

feat(pki): reconcile recovered signing operations

Browse Source 
Add bounded durable reconciliation with retry metadata, fencing-safe
status and cancellation handling, and server-managed background recovery.

Include versioned persistence migration, bounded keyset paging, lifecycle-safe
worker shutdown, redacted diagnostics, and restart/failure coverage.

Closes #10
This commit is contained in:
Leo Galambos
2026-08-12 01:48:11 +02:00
parent 67989b232f
commit 0312cf699f
42 changed files with 2318 additions and 275 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
docs/pki-server-admin-https.md
View File

@@ -84,8 +84,23 @@ Responses are deterministic version-one JSON. They carry only safe typed results
Transport workers, transport backlog, concurrent operation workers, waiting operation capacity, admitted requests, request body size, deadlines, and both shutdown periods are finite configuration values. Saturation never runs a request on the caller thread and a rejected request never invokes the gateway.
Configuration schema version 6 adds `signingReconciliation`. Its production
defaults are enabled, 256 examined records, 64 provider calls, a 30-second pass
timeout, a 10-second provider-call timeout, and a fixed 2-second idle interval.
`maxRecords` is 1 through 4096, `maxCalls` is 1 through the record
bound, all durations are positive, and the provider timeout cannot exceed the
pass timeout. Version 5 configurations migrate to these defaults. Set `enabled`
to `false` only when an external owner deliberately invokes the transport-neutral
session reconciliation API.
Shutdown first removes readiness and admission, stops listener acceptance, drains for the configured graceful period, cooperatively cancels remaining work, waits only for the forced period, then closes the one realm context. Already committed PKI changes remain committed.
Signing-provider deadlines and cancellation are cooperative for trusted
in-process implementations. A provider call that remains live after forced
shutdown causes `SIGNING_RECONCILIATION_SHUTDOWN_TIMEOUT`; the session, provider,
and store stay open and `close` may be retried after the call returns. Hard
isolation for non-cooperative providers requires an out-of-process boundary.
## Request correlation
Clients may supply `X-ZeroEcho-Request-Id` using 16–128 ASCII letters, digits, underscore, or hyphen. Otherwise the server creates a random opaque identifier. It is correlation metadata—not an idempotency key, object identity, approval, or capability token.