Skip to content

UC5: notify removed PP backend on provider removal#51

Merged
AquiGorka merged 1 commit into
mainfrom
uc5-notify-removed-pp
Jun 23, 2026
Merged

UC5: notify removed PP backend on provider removal#51
AquiGorka merged 1 commit into
mainfrom
uc5-notify-removed-pp

Conversation

@AquiGorka

Copy link
Copy Markdown
Contributor

What

Part of the UC5 PP removal & continuity slice (council + provider stacks honour a PP removal end-to-end). This is the council-platform piece.

When the council channel-auth contract emits ProviderRemoved, the event-watcher already marks the provider REMOVED. This adds the outbound notify to the removed PP's backend so it reacts immediately rather than waiting for its own next poll.

How

  • New notify-provider-removed.ts: fire-and-forget POST {providerUrl}/api/v1/council/removed with { councilId, publicKey, ledger }.
  • Called from the provider_removed branch of applyEvent, guarded by the ACTIVE→REMOVED transition + presence of provider_url.
  • The notice is a low-trust live signal — the body is a hint, not an authority. The PP converges by re-querying the council's authoritative /public/provider/membership-status endpoint, so no shared secret is required and a spurious/replayed POST can only make a PP re-confirm its own status.
  • Never awaited → cannot stall or roll back the watcher's atomic poll commit (same shape as the existing notifyDiscord).
  • Idempotency / boot replay: only the ACTIVE→REMOVED transition notifies, so event re-delivery and a removal observed during downtime (replayed from the ledger cursor on boot) ping the PP exactly once.
  • Extracted applyEvent into env-free apply-event.ts so the transition logic is unit-testable without loading DATABASE_URL.

Tests

src/core/service/event-watcher/notify-on-removal.test.ts: active removal notifies once; already-REMOVED re-delivery/boot-replay does not re-notify; no provider_url → dormant; unknown provider → no-op.

Full PR pipeline run locally on the pinned deno 2.8.2: fmt --check, lint, check src/main.ts, test:unit (58), test:integration (185) — all green.

Version: 0.6.2 → 0.6.3.

Coordination

Lands together with the provider-platform inbound notify endpoint and the provider-stack (Rust standin) removal-honouring PRs. The contract needs no change — remove_provider already emits ProviderRemoved.

When the council contract emits ProviderRemoved, the watcher now sends a
fire-and-forget POST to the removed PP's backend (/api/v1/council/removed)
so it can react immediately instead of waiting for its own next poll.

The notice is a low-trust live signal — body is a hint, not an authority;
the PP converges by re-querying the council's authoritative
membership-status endpoint, so no shared secret is needed.

- Only the ACTIVE→REMOVED transition fires the notify, so event
  re-delivery and boot replay (a removal seen during downtime) ping the
  PP exactly once.
- Dormant when the provider row has no provider_url.
- Never awaited, so it cannot stall or roll back the poll's atomic commit.
- Extract applyEvent into apply-event.ts (env-free) so the transition
  logic is unit-testable without loading DATABASE_URL.

Bumps 0.6.2 -> 0.6.3.
@AquiGorka AquiGorka merged commit 0aea409 into main Jun 23, 2026
8 checks passed
@AquiGorka AquiGorka deleted the uc5-notify-removed-pp branch June 23, 2026 15:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant