Follow-up F3 from the product-version selector discussion. This issue tracks implementation work; the decision to keep host/serviceId/envTag lookup does not complete it.
Coordinating owner: @stevehu — Java DCL transport, diagnostics, and log-safety coordination.
Scope and acceptance criteria
Capture x-light-config-snapshot-id from the successful /configs response and
pass that exact snapshotId to /certs and /files. This uses existing server
support and does not depend on F5. Preserve the authorized host/service/env and
phase on all requests. Do not resolve current again between these calls.
Capture the host, instance, snapshot, and values-content-digest response headers
as non-secret provenance. Log/expose them through a supported runtime information
surface only with accurate state: fetched, written, and successfully adopted are
different stages. Track startup versus reload, remote versus local source, and
partial/failed bundle status. Verify the digest over the raw response before
parsing if claiming transport-content verification; do not imply it attests
in-memory values or ancillary files.
Report endpoint-specific success/failure without logging response payloads:
the present shared “configs” error and empty-map result obscure whether certs
or files failed. Remove/redact loadFiles DEBUG payloads, loadConfigs TRACE
values, and raw HTTP error bodies, including exception messages. Preserve useful
endpoint category, status, and non-secret provenance rather than secret content.
Acceptance: activate snapshot B between values and ancillary calls for A and
verify every downloaded asset still belongs to A. Exercise missing/malformed
headers, older servers, unavailable snapshots, and write failures with explicit
behavior. After a successful values fetch, make /certs and /files independently
return >=300 or fail to connect; each failure must be distinguishable from a
successful empty inventory and must not yield a complete-bundle success claim.
Test at INFO, DEBUG, and TRACE with sentinel secrets in values, binary file maps,
and error bodies; none may appear in logs or exposed provenance. Do not claim
bundle-wide reload support while reload only fetches values. Coordinate F3 and
F7 as linked light-4j DCL work items with clear failure-state ownership.
Implementation area and related history
server/src/main/java/com/networknt/server/DefaultConfigLoader.java, runtime-information exposure, and targeted loader tests. Related completed work: #2752 (source logging), #2753 (downloaded filenames), and #2785 (legacy request compatibility). These do not provide the snapshot pinning/provenance requested here.
Design reference
Product Upgrade Runtime Contract (publication accompanies the approved documentation change). F identifiers refer to the sections of that design. The related work below is tracked separately; these links are coordination references, not a claim that every item blocks this issue.
Related implementation issues
Follow-up F3 from the product-version selector discussion. This issue tracks implementation work; the decision to keep host/serviceId/envTag lookup does not complete it.
Coordinating owner: @stevehu — Java DCL transport, diagnostics, and log-safety coordination.
Scope and acceptance criteria
Capture
x-light-config-snapshot-idfrom the successful/configsresponse andpass that exact
snapshotIdto/certsand/files. This uses existing serversupport and does not depend on F5. Preserve the authorized host/service/env and
phase on all requests. Do not resolve current again between these calls.
Capture the host, instance, snapshot, and values-content-digest response headers
as non-secret provenance. Log/expose them through a supported runtime information
surface only with accurate state: fetched, written, and successfully adopted are
different stages. Track startup versus reload, remote versus local source, and
partial/failed bundle status. Verify the digest over the raw response before
parsing if claiming transport-content verification; do not imply it attests
in-memory values or ancillary files.
Report endpoint-specific success/failure without logging response payloads:
the present shared “configs” error and empty-map result obscure whether certs
or files failed. Remove/redact
loadFilesDEBUG payloads,loadConfigsTRACEvalues, and raw HTTP error bodies, including exception messages. Preserve useful
endpoint category, status, and non-secret provenance rather than secret content.
Acceptance: activate snapshot B between values and ancillary calls for A and
verify every downloaded asset still belongs to A. Exercise missing/malformed
headers, older servers, unavailable snapshots, and write failures with explicit
behavior. After a successful values fetch, make
/certsand/filesindependentlyreturn >=300 or fail to connect; each failure must be distinguishable from a
successful empty inventory and must not yield a complete-bundle success claim.
Test at INFO, DEBUG, and TRACE with sentinel secrets in values, binary file maps,
and error bodies; none may appear in logs or exposed provenance. Do not claim
bundle-wide reload support while reload only fetches values. Coordinate F3 and
F7 as linked light-4j DCL work items with clear failure-state ownership.
Implementation area and related history
server/src/main/java/com/networknt/server/DefaultConfigLoader.java, runtime-information exposure, and targeted loader tests. Related completed work: #2752 (source logging), #2753 (downloaded filenames), and #2785 (legacy request compatibility). These do not provide the snapshot pinning/provenance requested here.Design reference
Product Upgrade Runtime Contract (publication accompanies the approved documentation change). F identifiers refer to the sections of that design. The related work below is tracked separately; these links are coordination references, not a claim that every item blocks this issue.
Related implementation issues