Skip to content

Commit d48bb97

Browse files
megyptmmegyptm
committed
chore(roadmap): harden phase5.5 integration contracts + align with grok review
- Mark Phase 5.5 as in_progress instead of completed - Define explicit MySQL schema contract for IntegrationV2 tests - Add schema bootstrap / documentation requirement for MySQL - Enforce clear failure when required infrastructure schema is missing - Address PHPUnit risky test policy (explicit assertions or intent markers) - Clarify IntegrationV2 responsibilities without introducing auto-migrations - Align roadmap and integration expectations with Grok Phase 5 review findings This change stabilizes IntegrationV2 semantics and prepares the project for DTO-based configuration hardening and pre-freeze validation.
1 parent 44498af commit d48bb97

File tree

1 file changed

+216
-26
lines changed

1 file changed

+216
-26
lines changed

‎roadmap1.0.2.json‎

Lines changed: 216 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -189,42 +189,232 @@
189189
"examples": { "tasks": [], "outputs": [] }
190190
}
191191
},
192-
193192
{
194193
"id": "phase5_5",
195194
"title": "IntegrationV2 Stabilization",
196-
"version": "1.0.0",
197-
"status": "completed",
198-
"summary": "Introduce authoritative real infrastructure integration tests (IntegrationV2) and deprecate legacy integration behavior.",
195+
"version": "1.0.1",
196+
"status": "in_progress",
197+
"summary": "Stabilize IntegrationV2 as the single authoritative source of real infrastructure behavior, define explicit infrastructure contracts, and eliminate ambiguous or unsafe integration assumptions.",
199198
"tracks": {
200-
"core": { "tasks": [], "outputs": [] },
199+
"core": {
200+
"tasks": [],
201+
"outputs": []
202+
},
201203
"tests": {
202204
"tasks": [
203205
"Create IntegrationV2 test layer",
204206
"Enforce resolver-based adapter creation",
205207
"Deprecate legacy integration tests",
206-
"Exclude legacy tests from PHPUnit execution",
207-
"Validate Redis/MySQL/Mongo real behavior",
208-
"Fail explicitly when infrastructure is unavailable"
208+
"Exclude legacy integration tests from PHPUnit execution",
209+
"Validate Redis/MySQL/Mongo real behavior using real infrastructure",
210+
"Fail explicitly when infrastructure is unavailable",
211+
"Define explicit MySQL schema contract for IntegrationV2 tests",
212+
"Provide schema bootstrap or documentation for MySQL IntegrationV2",
213+
"Ensure MySQL integration tests fail clearly when schema is missing",
214+
"Eliminate PHPUnit risky tests by enforcing explicit assertions or intent markers"
209215
],
210216
"rules": [
211217
"IntegrationV2 is the ONLY source of truth for real infrastructure behavior",
212-
"Legacy Integration tests are deprecated and excluded",
218+
"Legacy integration tests are deprecated and excluded",
213219
"No mocks, fakes, or hardcoded hosts allowed in IntegrationV2",
214-
"All adapters MUST be resolved via DatabaseResolver + EnvironmentLoader"
220+
"All adapters MUST be resolved via DatabaseResolver + EnvironmentLoader",
221+
"Security Guard MUST NOT auto-create or auto-migrate database schemas",
222+
"Integration tests MUST clearly document all external infrastructure expectations"
215223
],
216224
"outputs": [
217225
"tests/IntegrationV2/",
226+
"tests/IntegrationV2/MySQL/schema.sql",
227+
"tests/IntegrationV2/MySQL/README.md",
218228
"tests/Integration/README.md",
219-
"phpunit.xml.dist (exclude legacy integration)"
229+
"phpunit.xml.dist (exclude legacy integration)",
230+
"docs/integration/INTEGRATION_V2_CONTRACT.md"
220231
]
221232
},
222-
"examples": { "tasks": [], "outputs": [] }
233+
"examples": {
234+
"tasks": [],
235+
"outputs": []
236+
}
223237
}
224238
},
225239

240+
226241
{
227242
"id": "phase6",
243+
"title": "Config Normalization & DTO Injection Layer",
244+
"version": "1.1.0",
245+
"status": "pending",
246+
"summary": "Introduce strict DTO-based configuration model. Eliminate all internal defaults and ensure the library is fully controlled by host-provided configuration.",
247+
"tracks": {
248+
"core": {
249+
"tasks": [
250+
"Design SecurityGuardConfigDTO as the single configuration entry point",
251+
"Design ActionRateLimitConfigDTO",
252+
"Design GlobalRateLimitConfigDTO",
253+
"Design BackoffPolicyConfigDTO",
254+
"Remove all internal default configuration logic",
255+
"Ensure all runtime logic consumes DTOs only"
256+
],
257+
"outputs": [
258+
"src/Config/DTO/SecurityGuardConfigDTO.php",
259+
"src/Config/DTO/ActionRateLimitConfigDTO.php",
260+
"src/Config/DTO/GlobalRateLimitConfigDTO.php",
261+
"src/Config/DTO/BackoffPolicyConfigDTO.php"
262+
]
263+
},
264+
"tests": {
265+
"tasks": [
266+
"Validate DTO acceptance",
267+
"Validate resolver wiring using DTOs"
268+
],
269+
"outputs": []
270+
},
271+
"examples": {
272+
"tasks": [
273+
"Document host-driven configuration injection flow"
274+
],
275+
"outputs": [
276+
"docs/phases/README.phase6.md"
277+
]
278+
}
279+
}
280+
},
281+
282+
{
283+
"id": "phase7",
284+
"title": "Global Rate Limiter Overlay Enforcement",
285+
"version": "1.1.1",
286+
"status": "pending",
287+
"summary": "Introduce a real global rate limiter overlay that executes before all action-level enforcement using a dedicated DTO-based configuration.",
288+
"tracks": {
289+
"core": {
290+
"tasks": [
291+
"Introduce GlobalRateLimiter enforcement layer",
292+
"Ensure global limiter executes before action limiter",
293+
"Ensure global limiter uses GlobalRateLimitConfigDTO only",
294+
"Add explicit source attribution for global violations"
295+
],
296+
"outputs": [
297+
"src/RateLimit/GlobalRateLimiter.php",
298+
"src/Enforcement/EnforcingRateLimiter.php"
299+
]
300+
},
301+
"tests": {
302+
"tasks": [
303+
"Unit tests for global-before-action enforcement order",
304+
"Integration tests using Redis adapter"
305+
],
306+
"outputs": []
307+
},
308+
"examples": {
309+
"tasks": [],
310+
"outputs": []
311+
}
312+
}
313+
},
314+
315+
{
316+
"id": "phase8",
317+
"title": "Backoff Policy Hardening & banTime Integration",
318+
"version": "1.1.2",
319+
"status": "pending",
320+
"summary": "Upgrade exponential backoff logic to a deterministic punishment strategy governed fully by DTO-provided policy, including banTime integration.",
321+
"tracks": {
322+
"core": {
323+
"tasks": [
324+
"Introduce BackoffPolicyInterface",
325+
"Implement ExponentialBackoffPolicy using BackoffPolicyConfigDTO",
326+
"Integrate banTime as a hard cap on calculated delays",
327+
"Remove any implicit backoff assumptions"
328+
],
329+
"outputs": [
330+
"src/Backoff/BackoffPolicyInterface.php",
331+
"src/Backoff/ExponentialBackoffPolicy.php"
332+
]
333+
},
334+
"tests": {
335+
"tasks": [
336+
"Unit tests for backoff calculation",
337+
"Ensure banTime cap is respected"
338+
],
339+
"outputs": []
340+
},
341+
"examples": {
342+
"tasks": [],
343+
"outputs": []
344+
}
345+
}
346+
},
347+
348+
{
349+
"id": "phase9",
350+
"title": "Phase 5 Coverage Completion & Validation",
351+
"version": "1.1.3",
352+
"status": "pending",
353+
"summary": "Complete missing tests for Phase 5 core logic and enforcement layers to ensure production-grade stability.",
354+
"tracks": {
355+
"core": {
356+
"tasks": [
357+
"No production code changes allowed"
358+
],
359+
"outputs": []
360+
},
361+
"tests": {
362+
"tasks": [
363+
"Cover EnforcingRateLimiter logic",
364+
"Cover GlobalRateLimiter enforcement",
365+
"Cover BackoffPolicy behavior",
366+
"Use real Redis adapter only (no mocks)"
367+
],
368+
"outputs": [
369+
"tests/RateLimit/",
370+
"tests/Backoff/"
371+
]
372+
},
373+
"examples": {
374+
"tasks": [],
375+
"outputs": []
376+
}
377+
}
378+
},
379+
380+
{
381+
"id": "phase10",
382+
"title": "Internal API Freeze (No Public Release)",
383+
"version": "1.2.0",
384+
"status": "pending",
385+
"summary": "Freeze internal APIs for stabilization and validation. No public release, no tags, no Packagist publishing.",
386+
"tracks": {
387+
"core": {
388+
"tasks": [
389+
"Lock public API surface",
390+
"Prohibit breaking changes without major version bump",
391+
"Tag stable release"
392+
],
393+
"outputs": [
394+
"CHANGELOG.md",
395+
"README.md"
396+
]
397+
},
398+
"tests": {
399+
"tasks": [
400+
"Final CI validation",
401+
"Coverage threshold enforcement"
402+
],
403+
"outputs": []
404+
},
405+
"examples": {
406+
"tasks": [
407+
"Final integration documentation"
408+
],
409+
"outputs": [
410+
"docs/phases/README.phase10.md"
411+
]
412+
}
413+
}
414+
},
415+
416+
{
417+
"id": "phase11",
228418
"title": "Rate Limiter Bridge",
229419
"version": "1.0.0",
230420
"status": "pending",
@@ -259,7 +449,7 @@
259449
},
260450

261451
{
262-
"id": "phase7",
452+
"id": "phase12",
263453
"title": "Audit DTO & Storage",
264454
"version": "1.0.0",
265455
"status": "pending",
@@ -282,7 +472,7 @@
282472
},
283473

284474
{
285-
"id": "phase8",
475+
"id": "phase13",
286476
"title": "Mongo Audit Forwarding",
287477
"version": "1.0.0",
288478
"status": "pending",
@@ -304,7 +494,7 @@
304494
},
305495

306496
{
307-
"id": "phase9",
497+
"id": "phase14",
308498
"title": "Audit History API",
309499
"version": "1.0.0",
310500
"status": "pending",
@@ -326,7 +516,7 @@
326516
},
327517

328518
{
329-
"id": "phase10",
519+
"id": "phase15",
330520
"title": "Audit Filters & Indexes",
331521
"version": "1.0.0",
332522
"status": "pending",
@@ -348,7 +538,7 @@
348538
},
349539

350540
{
351-
"id": "phase11",
541+
"id": "phase16",
352542
"title": "PSR Logger Integration",
353543
"version": "1.0.0",
354544
"status": "pending",
@@ -370,7 +560,7 @@
370560
},
371561

372562
{
373-
"id": "phase12",
563+
"id": "phase17",
374564
"title": "Telegram Alerts",
375565
"version": "1.0.0",
376566
"status": "pending",
@@ -392,7 +582,7 @@
392582
},
393583

394584
{
395-
"id": "phase13",
585+
"id": "phase18",
396586
"title": "Webhook Dispatcher",
397587
"version": "1.0.0",
398588
"status": "pending",
@@ -414,7 +604,7 @@
414604
},
415605

416606
{
417-
"id": "phase14",
607+
"id": "phase19",
418608
"title": "Retry Engine & Delivery Tests",
419609
"version": "1.0.0",
420610
"status": "pending",
@@ -439,7 +629,7 @@
439629
},
440630

441631
{
442-
"id": "phase15",
632+
"id": "phase20",
443633
"title": "Monitoring APIs",
444634
"version": "1.0.0",
445635
"status": "pending",
@@ -461,7 +651,7 @@
461651
},
462652

463653
{
464-
"id": "phase16",
654+
"id": "phase21",
465655
"title": "Unit Consistency Tests",
466656
"version": "1.0.0",
467657
"status": "pending",
@@ -482,7 +672,7 @@
482672
},
483673

484674
{
485-
"id": "phase17",
675+
"id": "phase22",
486676
"title": "Attack Simulations",
487677
"version": "1.0.0",
488678
"status": "pending",
@@ -503,7 +693,7 @@
503693
},
504694

505695
{
506-
"id": "phase18",
696+
"id": "phase23",
507697
"title": "Redis & Mongo Stress",
508698
"version": "1.0.0",
509699
"status": "pending",
@@ -524,7 +714,7 @@
524714
},
525715

526716
{
527-
"id": "phase19",
717+
"id": "phase24",
528718
"title": "Coverage Hardening",
529719
"version": "1.0.0",
530720
"status": "pending",
@@ -545,7 +735,7 @@
545735
},
546736

547737
{
548-
"id": "phase20",
738+
"id": "phase25",
549739
"title": "Documentation & Packagist Release",
550740
"version": "1.0.0",
551741
"status": "pending",

0 commit comments

Comments
 (0)