feat(server): rfc 0048 slice 6 — deadline event, status green - #719
Conversation
One registry-backed ourios.server.graph.list_deadline event at startup carries list_timeout_ms and the declared server deadline (RFC0048.7; the RFC 0047 at-or-above rejection stays). The §7 truncation question is settled by measurement against openfga v1.11.1: a server-side deadline ends the stream with HTTP 200 and a clean EOF — no error frame — so the fail-closed property rests on the client timeout firing first, which the config validation enforces against the declared deadline and the new event makes loud. RFC 0048 flips to green: all eight criteria pass, the container scenarios in the openfga-resolver CI job. Signed-off-by: Jens Holdgaard Pedersen <Jens@holdgaard.org>
|
Warning Review limit reached
Next review available in: 10 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Final slice of RFC 0048 implementation: makes the OpenFGA streamed list_objects deadline coupling explicitly observable via a registry-backed startup log event, and updates RFC 0048 to green with the measured outcome for streamed deadline truncation behavior.
Changes:
- Add a new semconv event (
ourios.server.graph.list_deadline) and emit it once at startup, logging bothlist_timeout_msand the declaredserver_list_objects_deadline_ms. - Mark RFC 0048 as
greenand record the empirical result that streamed deadline expiry can end with HTTP 200 + clean EOF (silent truncation). - Add an integration test asserting the startup log line includes both configured values, and plumb the declared server deadline through
VisibilityConfig.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| semconv/registry/events.yaml | Registers the new ourios.server.graph.list_deadline event in semconv. |
| docs/rfcs/0048-graph-operational-surfaces.md | Updates RFC 0048 status to green and documents the measured streamed-deadline EOF behavior. |
| crates/ourios-server/tests/it/rfc0048_grammar.rs | Adds RFC0048.7 integration test asserting both deadline values appear in startup logs. |
| crates/ourios-server/src/main.rs | Emits the new registry-backed startup event with both deadline values. |
| crates/ourios-semconv/src/lib.rs | Adds the semconv constant for the new event name. |
| crates/ourios-core/src/auth/openfga/mod.rs | Stores and exposes the declared server list deadline on VisibilityConfig for logging. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Summary
RFC 0048 implementation, final slice: the deadline assumption made loud (§3.6) — RFC0048.7 — and the status flip to
green.ourios.server.graph.list_deadlineevent at startup carries the clientlist_timeout_msand the declaredserver_list_objects_deadline_ms. The server cannot observe OpenFGA's realOPENFGA_LIST_OBJECTS_DEADLINE, so it makes its assumption greppable; the RFC 0047 startup rejection (client timeout at or above the declared deadline) is unchanged.green. All eight criteria pass; the banner names the test for each. Container scenarios (RFC0048.2, RFC0048.5/.8) run in theopenfga-resolverCI job.§7 settled by measurement
The open question from #712 — does a server-side list deadline announce itself? — is now answered empirically, not by inference: against openfga v1.11.1 with
OPENFGA_LIST_OBJECTS_DEADLINE=1msand 3 000 matching tuples,streamed-list-objectsreturned 127 results and ended with HTTP 200 and a clean EOF — no error frame. Truncation is silent on the wire.That does not weaken the fail-closed property, and the RFC now says exactly why: the client timeout is validated strictly below the declared server deadline, so on any enumeration that would outlive the real deadline the client cuts off first (
Incomplete→ fail closed). The one way to lose that is a declaration that overstates the server's real flag — which is precisely what the new startup event exists to surface. §7's flush-cadence question is closed too (the emitter is the graph's only writer; every non-erasure path is additive and idempotent).Tests
rfc0048_7_list_deadline_event_at_startup: the served binary logs one line carrying both values.fmt --check,clippy -D warnings,cargo test --workspace --all-features, all five OpenFGA container tests,mdbook build— green locally on this head.