fix(r2-02): factory-seam guard — hostile ResilienceConfig cannot brick the spawn path (01/S-6 wiring proof)

2026-07-13 09:57:17 -04:00
parent 8d306a1bd2
commit a8af9cc48b
2 changed files with 26 additions and 1 deletions
@@ -136,6 +136,31 @@ public sealed class DriverCapabilityInvokerFactoryTests
        logger.Entries.ShouldContain(e => e.Level == LogLevel.Warning && e.Message.Contains("resilience config", StringComparison.OrdinalIgnoreCase));
    }

+    /// <summary>
+    ///     01/S-6 production-wiring proof: the exact <c>DriverHostActor.SpawnChild</c> path
+    ///     (<c>factory.Create(id, type, hostileJson)</c>) must yield a WORKING invoker whose capability
+    ///     call succeeds, and must log the clamp diagnostic as a warning — a hostile ResilienceConfig can
+    ///     never brick the spawn path.
+    /// </summary>
+    [Fact]
+    public async Task Create_with_out_of_range_config_yields_working_invoker()
+    {
+        var logger = new CapturingLogger();
+        var factory = MakeFactory(new DriverResiliencePipelineBuilder(), logger: logger);
+
+        var invoker = factory.Create("i1", "Modbus",
+            resilienceConfigJson: "{\"capabilityPolicies\":{\"Subscribe\":{\"timeoutSeconds\":0,\"breakerFailureThreshold\":1}}}");
+
+        var result = await invoker.ExecuteAsync(
+            DriverCapability.Subscribe, "host-1", _ => ValueTask.FromResult(99), CancellationToken.None);
+
+        result.ShouldBe(99, "a hostile ResilienceConfig must not brick the Subscribe capability call");
+        logger.Entries.ShouldContain(e =>
+            e.Level == LogLevel.Warning &&
+            e.Message.Contains("resilience config", StringComparison.OrdinalIgnoreCase) &&
+            (e.Message.Contains("timeoutSeconds") || e.Message.Contains("breakerFailureThreshold")));
+    }
+
    private sealed class CapturingLogger : ILogger
    {
        public List<(LogLevel Level, string Message)> Entries { get; } = new();