Skip to content

Session brief — Raft minority-live-leader partition test (FLT-17, final gate item)

Worktree C:\Users\fives\source\repos\ug-wt-raft, branch wt/WT-0026/FLT-17-raft-ha (HEAD 95f2390). This is the LAST item before Raft can be re-gated for fleet switchover. Everything else is done + green.

State (all committed, 271 tests green, NOT pushed)

Raft HA for the agy quota-ledger admission authority is built and twice-gated: - Council REJECT'd v1 (no client idempotency = double-spend). Fixed: client-stable AdmitId, dedup on RaftIndex OR AdmitId, deny markers, malformed-Ts denies, fail-closed-on-unreadable, serve-raft asserts (local ledger + odd voters). Commit a612dbd. - Re-gate (grok) found 2 HIGH bugs IN the fix: TZ-dependent deny sentinel (fixed -> DateTime.UnixEpoch) and non-durable soft-deny on a committed entry (fixed -> throw so dotNext retries apply). Commit 95f2390. Read docs/RAFT-BLOCKERS.md and docs/RAFT-HA-SPEC.md for full design + the 4 known gaps.

Both council seats + RAFT-BLOCKERS #4 flag the ONE untested invariant: a still-running leader partitioned into the MINORITY must NOT commit (must fail closed while the majority elects a new leader). The existing quorum-loss test only kills peers = self-demotion, NOT a live-leader isolation. The existing tests/UsageGovernor.Tests/Raft/LoopbackProxy.cs blocks INBOUND only — a leader dials OUT heartbeats, so it can't isolate a leader.

THE SEAM (already found): dotNext RaftCluster.CustomTransportConfiguration(EndPoint, IConnectionListenerFactory, IConnectionFactory). The IConnectionFactory controls OUTBOUND connections — wrap it so a node's egress to specific peers can be blocked at runtime. Delegate to Kestrel sockets (Microsoft.AspNetCore.Connections is in the .NET 10 shared framework, confirmed present). AgyRaftNode.Create currently uses TcpConfiguration (AgyRaftNode.cs ~line 116) — add a test-only path that injects CustomTransportConfiguration with a blockable factory, or expose a hook so the test can.

The test (add to AgyRaftJepsenTests.cs): 3 voters, identify the leader, block its OUTBOUND links to the other 2 (directed-link partition, leader in a minority of 1), then: - assert the isolated leader CANNOT commit a new admit (returns Unreachable/NotLeader, books nothing), - assert the majority (2 nodes) elects a new leader and DOES serve admits, - heal the partition, assert the old leader rejoins as follower and ledgers converge with NO double-book. NEGATIVE-CONTROL it (plant a "leader serves in minority" break, watch it go red), per the guardrail.

Guardrails

C#-first, .NET 10. Money-path test infra — a FALSELY-GREEN partition test is worse than none, so verify by artifact (ledger convergence + exactly-once counts), not just "passed". Worktree isolation. When green + negative-controlled: run /council-code-review (re-gate) on the whole Raft branch, then report — do NOT push/land without the re-gate passing. Raft stays opt-in (raft.enabled=false); the live authority is the single-writer on gaming (DESKTOP-D249KD4:47610), fail-closed — do not touch it. Board: FLT-17.