DataOps-platform/docs/validation/P3_WP03_FAILURE_INJECTION.json

{
  "schema_version": "1.0",
  "work_package": "P3-WP03",
  "status": "ENGINEERING_COMPLETE_ENTERPRISE_SOURCE_UAT_BLOCKED",
  "samples": [
    {"id": "unknown-version", "inject": "unregistered connector version", "expect": "configuration, no external call"},
    {"id": "plaintext-secret", "inject": "password in config", "expect": "configuration, rejected before persistence"},
    {"id": "driver-missing", "inject": "optional Oracle or SQL Server driver absent", "expect": "driver unavailable, process remains healthy"},
    {"id": "rate-limit", "inject": "persistent minute window capacity exhausted across sessions", "expect": "rate_limit, no process-local bypass"},
    {"id": "upstream-timeout", "inject": "transport timeout", "expect": "timeout, at most configured attempts"},
    {"id": "cancel-complete-race", "inject": "cancel wins before a second worker commits completion", "expect": "CAS preserves cancelled terminal state"},
    {"id": "late-attempt-terminal-write", "inject": "attempt 1 completes after cancel and attempt 2 lease acquisition", "expect": "both stale success and stale failure writes are rejected; attempt 2 remains owner"},
    {"id": "failed-retry-ownership-race", "inject": "two database sessions retry the same failed run", "expect": "one CAS owner invokes the connector once; loser is rejected and no duplicate attempt is written"},
    {"id": "cancelled-resume-ownership-race", "inject": "two database sessions resume the same cancelled run", "expect": "one CAS owner invokes resume once; loser is rejected and no duplicate attempt is written"},
    {"id": "cancel-resume", "inject": "cancel between checkpoints", "expect": "connector cancel invoked, then connector resume consumes persisted cursor/checkpoint"},
    {"id": "human-dry-run-resume-io", "inject": "cancel a running human dry-run and resume it", "expect": "validation-only dry_run; no connector operation, secret resolver, network or database I/O"},
    {"id": "nonterminal-operation-status", "inject": "third-party operation returns running, failed or cancelled", "expect": "configuration failure; runtime never persists an operation-controlled nonterminal status"},
    {"id": "cross-session-cancel-probe", "inject": "session A cancels while session B probes", "expect": "one atomic update commits cancelled and cancel_requested=true; session B immediately observes both"},
    {"id": "same-source-cancel-isolation", "inject": "cancel one run while another run uses the same source", "expect": "database run flag cancels only the selected run"},
    {"id": "resume-upstream-failure", "inject": "resume exhausts its invocation retry budget", "expect": "failed with error metadata; original checkpoint remains reusable"},
    {"id": "attempt-cap", "inject": "execute fails 3 times then is invoked again", "expect": "only attempts 4 and 5 occur; attempt 6 is rejected"},
    {"id": "credential-replay", "inject": "reuse one-time machine token", "expect": "replayed and rejected with audit"},
    {"id": "payload-config-injection", "inject": "machine payload guesses an approved secret reference but changes target host", "expect": "configuration rejected before transport; server binding remains authoritative"},
    {"id": "human-machine-action-crossover", "inject": "human bearer cancels/resumes a machine run or machine token targets a human run", "expect": "scope-separated lookup rejects the action"},
    {"id": "cross-binding-action", "inject": "fresh credential from another principal/binding targets an existing run", "expect": "permission denied without revealing run internals"},
    {"id": "client-hint-conflict", "inject": "reuse the same raw idempotency hint across principal/domain/environment/process boundaries", "expect": "409 conflict and no foreign run record returned"},
    {"id": "cross-binding", "inject": "credential used with another connector version, source, domain or environment", "expect": "permission, credential scope rejected"},
    {"id": "unbound-enterprise-principal", "inject": "create Oracle, SQL Server or REST principal without an approved binding", "expect": "application and 476 database trigger reject it"},
    {"id": "binding-version-rebind", "inject": "approve version 2 while principals reference version 1", "expect": "one transaction revokes v1, creates v2 and rebinds principals without a unique-constraint gap"},
    {"id": "binding-revoke-cascade", "inject": "revoke a binding with active principals and credentials", "expect": "principals and active credentials are deactivated in the same transaction"},
    {"id": "unknown-scope-key", "inject": "machine request includes an undeclared resource scope key", "expect": "configuration, fail closed"},
    {"id": "human-non-dry-run", "inject": "human bearer endpoint omits dry_run or sets false", "expect": "configuration, machine-only path enforced"},
    {"id": "secret-resolver-missing", "inject": "REST connector has no production secret resolver", "expect": "configuration before DNS or socket"},
    {"id": "ssrf-private-ip", "inject": "allowlisted host resolves to loopback/private/link-local/mixed public-private set", "expect": "configuration, no socket opened"},
    {"id": "redirect", "inject": "3xx REST response", "expect": "upstream, redirect rejected"},
    {"id": "oversize", "inject": "streamed REST body exceeds 2 MiB", "expect": "contract, connection released and body rejected"},
    {"id": "operation-output-oversize", "inject": "connector returns records/cursor/checkpoint/evidence beyond persistence limits", "expect": "contract rejection before any unsafe output is persisted"},
    {"id": "output-secret-redaction", "inject": "secrets appear in records, cursor, checkpoint and evidence", "expect": "all four channels recursively redacted before persistence; list response exposes summaries only"},
    {"id": "rest-repeated-cursor", "inject": "REST pagination repeats or numerically decreases next_cursor", "expect": "contract failure within 100-page and 10000-record bounds"},
    {"id": "rest-completed-cursor-reuse", "inject": "run incremental again with a persisted completed cursor", "expect": "restart full scan, persist completion marker and bounded snapshot summary, report no false removed detail"},
    {"id": "sqlserver-insecure-tls", "inject": "production config disables encryption or trusts the server certificate", "expect": "configuration rejected; development exception requires explicit opt-in"},
    {"id": "sqlserver-forged-development", "inject": "machine payload or tls_options claims development for a production binding", "expect": "permission/configuration rejection before credential consumption; adapter receives authenticated production environment"},
    {"id": "schema-recursion", "inject": "nested/array/bounds/oneOf/additionalProperties violation", "expect": "configuration, Draft 2020-12 rejection"},
    {"id": "migration-roundtrip", "inject": "single-version 475 downgrade through 474/473/472 then upgrade to 475", "expect": "safe round trip; new non-dry-run rows remain binding constrained"},
    {"id": "migration-upgrade-ambiguity", "inject": "principal connector has multiple active manifest versions before 473", "expect": "upgrade rejected before ALTER/backfill until explicit mapping"},
    {"id": "migration-continuous-version-ambiguity", "inject": "insert a second active manifest after 474 is installed", "expect": "trigger rejects ambiguity while an existing principal is bound"},
    {"id": "migration-binding-downgrade", "inject": "downgrade 475 while source bindings or bound runs/principals exist", "expect": "downgrade rejected until explicit cleanup"},
    {"id": "migration-476-unbound-principal", "inject": "upgrade 475 to 476 with an active unbound enterprise principal", "expect": "upgrade rejected until an approved source binding is attached"},
    {"id": "migration-476-status-only-activation", "inject": "upgrade a revoked unbound principal from 475, then activate it by changing status only", "expect": "476 trigger rejects activation until an approved exact binding is attached"}
  ]
}