Contract & resilience

04 breaking-gate — the contract-breaking gate

Proves gortexa regen’s buf breaking gate blocks compatibility-breaking proto edits and allows additive ones. This scenario also exercises regen’s isGitToplevel() path (a macOS /tmp → /private/tmp symlink once made the gate skip silently; fixed).

gortexa create bg --module github.com/me/bg --repo "$REPO" --ref main
cd bg && make gen                 # first gen: no main ref yet, gate skips (expected)
git add -A && git commit -m base && git branch -M main

# delete Resource's owner field (tag 3) — a breaking edit
gortexa regen                     # non-zero exit: gate BLOCKS the breaking edit

An additive edit (a new field) passes regen cleanly. The gate reads proto from the git main ref, not from gen/.

05 resilience-shutdown — graceful drain on SIGTERM

Authenticated mixed load is interrupted mid-flight with SIGTERM; the server must drain in-flight requests within shutdown_timeout, exit 0, not panic, and recover on restart.

./server &                        # a real binary, so SIGTERM lands on the server (not a go run wrapper)
./loadgen ...                     # authenticated load
kill -TERM $SRV                   # SIGTERM while load is in flight
wait $SRV                         # exit 0, drain complete, drain time <= shutdown_timeout

A real binary (not go run) is used so the exit code is unambiguous — go run wraps the server in an extra process.