Task 24 Execution Packet: Domain E2E Contract Suites (Aligned to 2026-01-25 Plan)

This packet replaces the old Task 24 notes. It is aligned to Phase 16 / Task 24 in docs/plans/2026-01-25-end-state.md and the current repo structure.

Use this as the exact execution guide for an agent implementing Task 24.

Objective

Create spec-driven end-to-end contract suites for:

• federal
• finance
• healthcare

Each suite must:

• Deploy a minimal cell from SEA/SDS fixtures (not handwritten scenarios)
• Validate platform invariants:
  • auth/RBAC
  • policy enforcement
  • messaging semantics
  • observability presence
  • drift detection path

Non-negotiables

• Deterministic, runnable locally
• Fixtures are SEA/SDS-based and checked into repo
• Failures emit actionable logs
• Opt-in E2E only (not in default just ci)
• No generated-zone edits

Step 0 — Resolved defaults (no open questions)

• Compose profile: create a dedicated minimal stack in infra/docker/docker-compose.e2e.yml.
• Auth for E2E: use AUTH_DEV_MODE headers for test simplicity.

Default ports (match dev unless overridden):

• Postgres: 5432
• NATS: 4222 (monitor 8222)
• OPA: 8181
• Policy Gateway: 8080 (entrypoint default)
• Workbench BFF: 8010 (README dev default)
• OpenObserve: 5080
• OTEL collector: 4317/4318/8888/13133

Step 1 — Harness structure

Create:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
tests/e2e/
  harness/
    e2e_runner.py
    compose_driver.py
    spec_driver.py
    probes/
      http_probe.py
      auth_probe.py
      policy_probe.py
      nats_probe.py
      otel_probe.py
      drift_probe.py
  fixtures/
    federal/
    finance/
    healthcare/

Add a manual just e2e recipe (do not add to just ci).

Step 2 — Minimal E2E compose stack

Create:

• infra/docker/docker-compose.e2e.yml

Include (minimal):

• postgres
• nats (single-node JetStream)
• opa
• policy-gateway
• workbench-bff
• otel-collector
• openobserve

Enable AUTH_DEV_MODE=true for BFF.

Port consistency: use the defaults from Step 0 unless there is a conflict; if conflicts exist, document overrides in the fixture env.example.

Step 3 — Contract checks (required)

For each domain suite, run in deterministic order:

A) Spec pipeline determinism

• Run just pipeline <ctx> for fixture context
• Assert AST/IR/manifest validation passes
• Optional: run twice and diff for determinism

B) Auth + RBAC

• No token → 401
• viewer → read manifests/provenance
• operator → safe ops (validate/status)
• admin → governance export

C) Policy enforcement

• Send allow + deny requests to policy-gateway
• Assert decisions match fixture policy

D) Messaging semantics

• Publish on canonical subject sea.event.contract_probe.v1
• Assert receive within timeout

E) Observability presence (minimal)

• Collector endpoint up and/or OpenObserve API reachable
• Emit a request that triggers telemetry
• Assert collector accepted payload or logs show exporter attempt

F) Drift path (smoke)

• Call drift scan endpoint (or tools/drift_heal.py scan)
• Assert structured JSON output including fixture context id

Step 4 — Fixtures (spec-first, minimal)

Each domain fixture must include:

• ctx.sea (1 command + 1 event, required annotations)
• ctx.sds.yaml (minimal adapters + service recipes)
• policies/policy.rego (simple allow/deny rule)
• env.example (document required env vars)

Step 5 — Commands

Add manual recipe (not in just ci):

1
2
e2e domain="federal":
  E2E_DOMAIN= python tests/e2e/harness/e2e_runner.py

Acceptance criteria (from plan)

• E2E suites compile and deploy minimal cells from specs
• Invariants pass for all three domains
• Deterministic, opt-in execution