feat: 实现可靠事件与证据 connector (#153) #165

Merged
ila merged 1 commits from feature/153-event-evidence-connector into dev 2026-08-31 15:16:18 +08:00
Owner

Closes implementation scope of #153; keep the issue open until human acceptance.

Result

  • Brain maps stable internal candidates to canonical yovision.event/v1 and can deliver them to Sense over verified HTTPS with request-bound Ed25519 machine identity.
  • Sense accepts Brain events with durable replay protection, commits inbound facts/evidence metadata/Bell Outbox atomically, and relays unchanged payloads with retry/dead-letter behavior.
  • Bell registers the authenticated POST /v1/events ingress, persists replay security state, enforces permanent business idempotency/conflict audit, maps immutable Event/Receipt facts, and tracks evidence degradation separately from Alert state.
  • Formal migrations and runtime gates are included for Sense and Bell. Disabled connectors preserve independent startup.
  • Sense selects only the explicit default runtime database, preventing multi-DB duplicate route/worker startup.

Verification

  • Brain Python 3.11.15 full suite: 60 passed.
  • Sense Go 1.26.5: go test ./... and go vet ./... passed.
  • Bell Go 1.26.5: go test ./... and go vet ./... passed.
  • Sense connector module: test/vet passed.
  • Race: Sense local_event/cmd-api/migration/connector and Bell ingress/migration/cmd-api passed.
  • Contracts: events 7/7, evidence 4/4, machine identity 10/10.
  • Repository unit tests: 48/48.
  • DevHarness strict, module verification, dependency compatibility, diff, secret and write-path audits passed.

Known boundary / not verified

  • PostgreSQL concurrency tests are implemented but require SENSE_BELL_CONNECTOR_TEST_DATABASE_URL / BELL_EVENT_INGRESS_TEST_DATABASE_URL; this run used the restart/concurrency SQLite coverage and did not claim a live PostgreSQL result.
  • No live customer PKI, real Sense/Bell network, production migration, or production event traffic was exercised.
  • local_event.CreateWithOutbox is now the formal atomic write entry for a Sense local candidate plus Bell-contract Outbox row. The current repository has no existing production local-candidate creation caller, so this PR does not claim an upstream producer path that does not yet exist.
  • Long-term Wiki pages and their docs/ mirrors are intentionally not changed in this implementation PR; they remain for acceptance closure according to repository workflow.
Closes implementation scope of #153; keep the issue open until human acceptance. ## Result - Brain maps stable internal candidates to canonical `yovision.event/v1` and can deliver them to Sense over verified HTTPS with request-bound Ed25519 machine identity. - Sense accepts Brain events with durable replay protection, commits inbound facts/evidence metadata/Bell Outbox atomically, and relays unchanged payloads with retry/dead-letter behavior. - Bell registers the authenticated `POST /v1/events` ingress, persists replay security state, enforces permanent business idempotency/conflict audit, maps immutable Event/Receipt facts, and tracks evidence degradation separately from Alert state. - Formal migrations and runtime gates are included for Sense and Bell. Disabled connectors preserve independent startup. - Sense selects only the explicit default runtime database, preventing multi-DB duplicate route/worker startup. ## Verification - Brain Python 3.11.15 full suite: 60 passed. - Sense Go 1.26.5: `go test ./...` and `go vet ./...` passed. - Bell Go 1.26.5: `go test ./...` and `go vet ./...` passed. - Sense connector module: test/vet passed. - Race: Sense local_event/cmd-api/migration/connector and Bell ingress/migration/cmd-api passed. - Contracts: events 7/7, evidence 4/4, machine identity 10/10. - Repository unit tests: 48/48. - DevHarness strict, module verification, dependency compatibility, diff, secret and write-path audits passed. ## Known boundary / not verified - PostgreSQL concurrency tests are implemented but require `SENSE_BELL_CONNECTOR_TEST_DATABASE_URL` / `BELL_EVENT_INGRESS_TEST_DATABASE_URL`; this run used the restart/concurrency SQLite coverage and did not claim a live PostgreSQL result. - No live customer PKI, real Sense/Bell network, production migration, or production event traffic was exercised. - `local_event.CreateWithOutbox` is now the formal atomic write entry for a Sense local candidate plus Bell-contract Outbox row. The current repository has no existing production local-candidate creation caller, so this PR does not claim an upstream producer path that does not yet exist. - Long-term Wiki pages and their `docs/` mirrors are intentionally not changed in this implementation PR; they remain for acceptance closure according to repository workflow.
ila added 1 commit 2026-08-31 14:58:50 +08:00
ila merged commit 130087a1ba into dev 2026-08-31 15:16:18 +08:00
Sign in to join this conversation.