create-wakii-stack 0.0.0-stage → 0.1.1

package/stack-template/.github/workflows/services-auth-svc.yml

@@ -0,0 +1,153 @@
+name: services-auth-svc
+
+# VU-59 SF-2 (VU-61) — build + test + docker build + boot-smoke (theo
+# workflow-templates/services-ci.yml.example pattern). auth-svc CHƯA có compose
+# entry (SF-5 mới commit) → boot-smoke: compose postgres + `docker run` image
+# trên network compose + mount users.json runtime (giống cách compose SF-5 sẽ
+# mount). Smoke CHUỖI: register→login→refresh→reuse→401→logout→logout-all.
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - "services/auth-svc/**"
+      - "platform/docker-compose.yml" # compose entry đổi (SF-5) cũng phải re-test
+      - "contracts/openapi/auth.yaml" # contract-first — spec đổi phải re-test
+      - "contracts/auth/users.json" # seed đọc fixture
+      - ".github/workflows/services-auth-svc.yml"
+  pull_request:
+    paths:
+      - "services/auth-svc/**"
+      - "platform/docker-compose.yml"
+      - "contracts/openapi/auth.yaml"
+      - "contracts/auth/users.json"
+
+permissions:
+  contents: read # least-privilege (P2 security-audit — follow-up repo-wide)
+
+jobs:
+  build-test:
+    name: build + test (auth-svc — unit + integration postgres)
+    runs-on: ubuntu-latest
+    services:
+      postgres: # integration tests chạy THẬT (rotation CAS + seed idempotent)
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: boilerplate
+          POSTGRES_PASSWORD: ci-postgres-password-not-real
+          POSTGRES_DB: boilerplate
+        ports:
+          - 5433:5432
+        options: >-
+          --health-cmd "pg_isready -U boilerplate"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 12
+    env:
+      AUTH_SVC_TEST_DATABASE_URL: postgres://boilerplate:ci-postgres-password-not-real@localhost:5433/boilerplate
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        # version đọc từ packageManager trong package.json (root) — không khai
+        # trùng ở đây (ERR_PNPM_BAD_PM_VERSION conflict, run 38227939477)
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - name: Install (workspace root, frozen)
+        run: pnpm install --frozen-lockfile
+      - name: Unit + integration tests (rotation CAS trên postgres thật)
+        run: pnpm --filter auth-svc test
+      - name: Build (tsc)
+        run: pnpm --filter auth-svc build
+
+  docker-build:
+    name: docker build (auth-svc)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image (multi-stage — platform/conventions/01)
+        run: docker build -t auth-svc:ci services/auth-svc
+
+  boot-smoke:
+    name: boot-smoke (auth-svc + postgres — chuỗi register→login→refresh→reuse→logout)
+    runs-on: ubuntu-latest
+    env:
+      JWT_SECRET: ci-smoke-secret-placeholder-not-real-32chars
+      POSTGRES_PASSWORD: ci-postgres-password-not-real
+    steps:
+      - uses: actions/checkout@v4
+      - name: Boot postgres (compose — entry auth-svc thuộc SF-5, chưa có ở SF-2)
+        run: |
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            up -d --wait postgres # --wait: chờ healthcheck pg_isready trước khi docker run auth-svc
+      - name: Build + run auth-svc image trên network compose (mount users.json)
+        run: |
+          docker build -t auth-svc:ci services/auth-svc
+          PG_CID=$(docker compose -f platform/docker-compose.yml --env-file platform/.env.example ps -q postgres)
+          NET=$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{end}}' "$PG_CID")
+          docker run -d --name auth-svc-smoke --network "$NET" -p 8090:8090 \
+            -e PORT=8090 \
+            -e DATABASE_URL="postgres://boilerplate:${POSTGRES_PASSWORD}@postgres:5432/boilerplate" \
+            -e JWT_SECRET="${JWT_SECRET}" \
+            -e AUTH_DEV_PASSWORD=demo-password \
+            -e ACCESS_TOKEN_TTL=30m \
+            -e USERS_FIXTURE_PATH=/app/users.json \
+            -e LOG_LEVEL=info \
+            -v "$PWD/contracts/auth/users.json:/app/users.json:ro" \
+            auth-svc:ci
+      - name: Smoke — healthz/readyz 200 (readyz = migration xong + DB ok)
+        run: |
+          ok=0
+          for i in $(seq 1 60); do
+            curl -sf http://localhost:8090/readyz >/dev/null && ok=1 && break
+            sleep 2
+          done
+          if [ "$ok" != "1" ]; then
+            echo "::error::readyz không 200 trong 120s — auth-svc logs:"
+            docker logs auth-svc-smoke
+            exit 1
+          fi
+          curl -sf http://localhost:8090/healthz | grep -q '"status":"ok"'
+          curl -sf http://localhost:8090/readyz | grep -q '"status":"ok"'
+          curl -sf http://localhost:8090/api/auth/healthz | grep -q '"status":"ok"' # mirror conventions/02 rule 6
+      - name: Smoke — seed fixture: alice login được bằng AUTH_DEV_PASSWORD (claims admin)
+        run: |
+          CODE=$(curl -s -o /tmp/alice.json -w '%{http_code}' -X POST http://localhost:8090/api/auth/login \
+            -H 'Content-Type: application/json' -d '{"email":"alice@demo.local","password":"demo-password"}')
+          [ "$CODE" = "200" ] || (echo "login alice → $CODE"; docker logs auth-svc-smoke; exit 1)
+          node -e 'const b=require("/tmp/alice.json"); if(b.user.roles[0]!=="admin"||!b.accessToken||!b.refreshToken) process.exit(1);'
+      - name: Smoke — chuỗi register→refresh→reuse→401→logout→logout-all (token-contract §3)
+        run: |
+          set -e
+          # register user mới → 201 cặp token (roles ["user"])
+          CODE=$(curl -s -o /tmp/reg.json -w '%{http_code}' -X POST http://localhost:8090/api/auth/register \
+            -H 'Content-Type: application/json' \
+            -d '{"email":"smoke-ci@example.com","password":"ci-password-1","displayName":"CI Smoke"}')
+          [ "$CODE" = "201" ] || (echo "register → $CODE"; cat /tmp/reg.json; exit 1)
+          RT1=$(node -e 'console.log(require("/tmp/reg.json").refreshToken)')
+          # refresh lần 1 → 200 TokenPair mới
+          CODE=$(curl -s -o /tmp/ref1.json -w '%{http_code}' -X POST http://localhost:8090/api/auth/refresh \
+            -H 'Content-Type: application/json' -d "{\"refreshToken\":\"$RT1\"}")
+          [ "$CODE" = "200" ] || (echo "refresh 1 → $CODE"; cat /tmp/ref1.json; exit 1)
+          RT2=$(node -e 'console.log(require("/tmp/ref1.json").refreshToken)')
+          # REUSE token cũ → 401 + toàn bộ session user chết (RT2 cũng không dùng được)
+          CODE=$(curl -s -o /tmp/reuse.json -w '%{http_code}' -X POST http://localhost:8090/api/auth/refresh \
+            -H 'Content-Type: application/json' -d "{\"refreshToken\":\"$RT1\"}")
+          [ "$CODE" = "401" ] || (echo "reuse → $CODE (expected 401)"; cat /tmp/reuse.json; exit 1)
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:8090/api/auth/refresh \
+            -H 'Content-Type: application/json' -d "{\"refreshToken\":\"$RT2\"}")
+          [ "$CODE" = "401" ] || (echo "refresh sau reuse → $CODE (expected 401 — revoke-all)"; exit 1)
+          # logout idempotent 204 + logout-all Bearer 204
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:8090/api/auth/logout \
+            -H 'Content-Type: application/json' -d '{"refreshToken":"unknown-token-value"}')
+          [ "$CODE" = "204" ] || (echo "logout lạ → $CODE (expected 204 idempotent)"; exit 1)
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:8090/api/auth/logout-all \
+            -H "Authorization: Bearer $(node -e 'console.log(require("/tmp/reg.json").accessToken)')")
+          [ "$CODE" = "204" ] || (echo "logout-all → $CODE (expected 204)"; exit 1)
+          # GET /users serve từ schema auth (seed + user vừa register)
+          curl -sf http://localhost:8090/api/auth/users | grep -q 'smoke-ci@example.com'
+      - name: Smoke — 401 logout-all khi thiếu token (service tự verify, không nhờ gateway)
+        run: |
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:8090/api/auth/logout-all)
+          [ "$CODE" = "401" ] || (echo "logout-all no-token → $CODE (expected 401)" && exit 1)
+      - name: Cleanup
+        if: always()
+        run: docker rm -f auth-svc-smoke 2>/dev/null || true

package/stack-template/.github/workflows/services-go-svc.yml

@@ -0,0 +1,281 @@
+name: services-go-svc
+
+# SF-3 (FI-80, story FI-76) — CI cho go-svc. Copy từ .github/workflow-templates/services-ci.yml.example.
+# jobs: build-test (go vet + unit + integration vs postgres service), docker-build,
+# boot-smoke (compose up + health + migration + kafka consumer event→feed + stats),
+# drift-guard (snapshot activity.yaml khớp contracts — precedent spring users.yaml).
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - "services/go-svc/**"
+      - "platform/docker-compose.yml"
+      - "platform/postgres/init/**"
+      - ".github/workflows/services-go-svc.yml"
+      - "contracts/openapi/activity.yaml"
+  pull_request:
+    paths:
+      - "services/go-svc/**"
+      - "platform/docker-compose.yml"
+      - "platform/postgres/init/**"
+      - ".github/workflows/services-go-svc.yml"
+      - "contracts/openapi/activity.yaml"
+
+permissions:
+  contents: read # least-privilege (P2 security-audit SF-7 — follow-up repo-wide)
+
+jobs:
+  build-test:
+    name: build + test (go-svc)
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: boilerplate
+          POSTGRES_PASSWORD: ci-postgres-password
+          POSTGRES_DB: boilerplate
+        ports:
+          - "5432:5432"
+        options: >-
+          --health-cmd "pg_isready -U boilerplate -d boilerplate"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 12
+    env:
+      # integration test đọc qua env này (test/integration, build tag `integration`)
+      GO_TEST_ADMIN_URL: postgres://boilerplate:ci-postgres-password@localhost:5432/boilerplate
+      GO_TEST_NODE_URL: postgres://node_svc:ci-node-password@localhost:5432/boilerplate
+      GO_TEST_GO_URL: postgres://go_svc:ci-go-password@localhost:5432/boilerplate
+      GO_TEST_READONLY_URL: postgres://go_readonly:ci-goreadonly-password@localhost:5432/boilerplate
+      GO_TEST_JWT_SECRET: ci-smoke-secret-placeholder-not-real-32chars
+    steps:
+      - uses: actions/checkout@v4
+      # KHÔNG mount init script vào service container (mount từ workspace chạy
+      # TRƯỚC checkout → dir root-owned → checkout clean EACCES — run 38226444489).
+      # Chạy init script THẬT của SF-1 qua psql client (TCP + PGHOST) sau checkout.
+      - name: Init schemas + roles (SF-1 init script thật qua psql TCP)
+        run: |
+          PGHOST=localhost PGPORT=5432 PGPASSWORD=ci-postgres-password \
+          POSTGRES_USER=boilerplate POSTGRES_DB=boilerplate \
+          NODE_SVC_DB_PASSWORD=ci-node-password \
+          SPRING_SVC_DB_PASSWORD=ci-spring-password \
+          GO_SVC_DB_PASSWORD=ci-go-password \
+          GO_READONLY_DB_PASSWORD=ci-goreadonly-password \
+          AUTH_SVC_DB_PASSWORD=ci-auth-password \
+          bash platform/postgres/init/01-init.sh
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.24"
+      # go.sum + indirect deps không commit được (dev machine không có Go) —
+      # tidy sửa in-place mỗi run (deterministic); Dockerfile build stage chạy tidy tương tự
+      - name: go mod tidy
+        run: cd services/go-svc && go mod tidy
+      - name: go vet
+        run: cd services/go-svc && go vet ./...
+      - name: unit tests (-race — consumer/concurrency là vùng rủi ro chính; runner có gcc cho CGO)
+        run: cd services/go-svc && go test -race ./...
+      - name: integration tests (readonly-exit criterion + consumer idempotency)
+        run: cd services/go-svc && go test -tags integration -v ./test/integration/...
+
+  boot-smoke:
+    name: boot-smoke (go-svc + postgres + auth-svc + kafka)
+    runs-on: ubuntu-latest
+    env:
+      JWT_SECRET: ci-smoke-secret-placeholder-not-real-32chars
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Boot postgres + auth-svc + kafka trước + TẠO TOPIC TRƯỚC go-svc boot
+        run: |
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            up -d --build postgres auth-svc kafka
+          for i in $(seq 1 30); do
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+              exec -T postgres pg_isready -U boilerplate -d boilerplate >/dev/null 2>&1 && break
+            sleep 2
+          done
+          # Chờ kafka healthy rồi tạo topic TƯỚC KHI go-svc boot — consumer join
+          # group với topic ĐÃ tồn tại (join-trước-topic-sau → assignment stale,
+          # fetch không bao giờ thấy message — bài học run 38366067233)
+          for i in $(seq 1 30); do
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+              exec -T kafka /opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092 >/dev/null 2>&1 && break
+            sleep 2
+          done
+          for TOPIC in task-events task-events.dlq; do
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+              exec -T kafka /opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 \
+              --create --if-not-exists --topic "$TOPIC" --partitions 1 --replication-factor 1
+          done
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 --list \
+            | grep -qx task-events
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 --list \
+            | grep -qx task-events.dlq
+
+      - name: Boot go-svc TRƯỚC khi có tasks table — readyz PHẢI 503 (probe thật, conventions/02 rule 2)
+        run: |
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            up -d --build go-svc
+          for i in $(seq 1 30); do
+            curl -sf http://localhost:8082/healthz >/dev/null && break
+            sleep 2
+          done
+          curl -sf http://localhost:8082/healthz | grep -q '"status":"ok"'
+          CODE=$(curl -s -o /tmp/readyz-503.json -w '%{http_code}' http://localhost:8082/readyz)
+          [ "$CODE" = "503" ] || { echo "readyz = $CODE, want 503 (tasks table chưa tồn tại — probe phải thật)"; cat /tmp/readyz-503.json; exit 1; }
+          grep -q '"code":"DEPENDENCY_DOWN"' /tmp/readyz-503.json
+
+      - name: Apply canonical DDL + seed bằng ROLE node_svc (ALTER DEFAULT PRIVILEGES chỉ hiệu lực với bảng do node_svc tạo)
+        run: |
+          # grep -v CREATE SCHEMA: schema tasks đã có từ init — node_svc không có
+          # CREATE trên DATABASE nên CREATE SCHEMA IF NOT EXISTS vẫn permission-denied
+          grep -v '^CREATE SCHEMA' contracts/db/tasks-schema.sql | \
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T postgres psql -v ON_ERROR_STOP=1 -U node_svc -d boilerplate
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T postgres psql -v ON_ERROR_STOP=1 -U node_svc -d boilerplate -c "
+          INSERT INTO tasks.tasks (id, title, description, status, created_by) VALUES
+            ('aaaaaaaa-1111-4111-8111-111111111101', 'Seed task A', NULL, 'todo',      '11111111-1111-4111-8111-111111111111'),
+            ('aaaaaaaa-1111-4111-8111-111111111102', 'Seed task B', NULL, 'in_progress','11111111-1111-4111-8111-111111111111'),
+            ('aaaaaaaa-1111-4111-8111-111111111103', 'Seed task C', NULL, 'done',      '11111111-1111-4111-8111-111111111111');"
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T postgres psql -U boilerplate -d boilerplate -tAc \
+            "SELECT tableowner FROM pg_tables WHERE schemaname='tasks' AND tablename='tasks'" | grep -qx node_svc
+
+      - name: readyz 200 sau DDL + readonly SELECT hoạt động
+        run: |
+          for i in $(seq 1 15); do
+            CODE=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8082/readyz)
+            [ "$CODE" = "200" ] && break
+            sleep 2
+          done
+          curl -sf http://localhost:8082/readyz | grep -q '"status":"ok"'
+
+      # P0 3 điểm chạm (context pack sf-3): kafka console producer publish GOLDEN
+      # FIXTURE thay POST /events (đã thanh lý); topic ĐÃ tạo tường minh ở step
+      # boot (trước go-svc — consumer join sạch); exec trong container kafka —
+      # 9092 internal-only.
+      - name: Console producer publish golden fixture → consumer → feed có row (proof event→feed)
+        run: |
+          # Publish task.created fixture — console producer coi MỖI DÒNG là 1
+          # message → flatten JSON về 1 dòng trước khi pipe (fixture gốc
+          # multi-line sẽ bị xé vụn thành message sai envelope)
+          python3 -c 'import json,datetime; d=json.load(open("contracts/events/fixtures/task.created.json")); d["occurredAt"]=datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.000Z"); print(json.dumps(d, separators=(",", ":")))' \
+          | docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-console-producer.sh \
+            --bootstrap-server localhost:9092 --topic task-events
+          # Proof produce: đọc lại topic bằng console consumer (group ngẫu nhiên,
+          # KHÔNG đụng go-svc-activity) — message PHẢI nằm trong topic
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-console-consumer.sh \
+            --bootstrap-server localhost:9092 --topic task-events --from-beginning \
+            --timeout-ms 10000 --max-messages 1 > /tmp/topic-msg.txt || true
+          cat /tmp/topic-msg.txt
+          grep -q 'task.created' /tmp/topic-msg.txt || { echo "produce THẤT BẠI — message không nằm trong topic"; exit 1; }
+          # Poll feed (JWT alice) đến khi consumer ghi row — rebalance + earliest có thể mất vài giây
+          TOKEN=$(curl -s -X POST http://localhost:8090/api/auth/login \
+            -H 'Content-Type: application/json' \
+            -d '{"email":"alice@demo.local","password":"demo-password"}' \
+            | python3 -c 'import json,sys; print(json.load(sys.stdin)["accessToken"])')
+          echo "$TOKEN" > /tmp/jwt
+          for i in $(seq 1 30); do
+            FEED=$(curl -sf http://localhost:8082/api/activity/feed -H "Authorization: Bearer $TOKEN")
+            echo "$FEED" | grep -q '6f1a2b3c-4d5e-4f60-8a71-9b0c1d2e3f40' && FOUND=1 && break
+            sleep 2
+          done
+          if [ "${FOUND:-0}" != "1" ]; then
+            echo "feed chưa thấy event sau 60s — consumer không consume?"; echo "$FEED"
+            echo "=== go-svc consumer-related logs (full window) ==="
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example logs go-svc 2>&1 | grep -iE "consumed|retry|dlq|duplicate|consumer|compensat|fetch" | tail -50 || true
+            echo "=== DLQ nội dung (nếu consumer poison/DLQ) ==="
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+              exec -T kafka /opt/kafka/bin/kafka-console-consumer.sh \
+              --bootstrap-server localhost:9092 --topic task-events.dlq --from-beginning \
+              --timeout-ms 5000 --max-messages 5 || true
+            exit 1
+          fi
+          echo "$FEED" | grep -q '"action":"task.created"'
+
+      - name: Idempotency e2e — publish DUPLICATE fixture → feed KHÔNG nhân đôi
+        run: |
+          TOKEN=$(cat /tmp/jwt)
+          BEFORE=$(curl -sf http://localhost:8082/api/activity/feed -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["total"])')
+          python3 -c 'import json,datetime; d=json.load(open("contracts/events/fixtures/task.created.json")); d["occurredAt"]=datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.000Z"); print(json.dumps(d, separators=(",", ":")))' \
+          | docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-console-producer.sh \
+            --bootstrap-server localhost:9092 --topic task-events
+          sleep 8 # đủ cho consumer poll + redelivery
+          AFTER=$(curl -sf http://localhost:8082/api/activity/feed -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys; print(json.load(sys.stdin)["total"])')
+          [ "$BEFORE" = "$AFTER" ] || { echo "feed total $BEFORE → $AFTER — duplicate envelope id nhân đôi row (vi phạm idempotency)"; exit 1; }
+
+      - name: Login auth-svc (JWT thật, cùng JWT_SECRET) — stats nới 4 keys + 401 từ service
+        run: |
+          TOKEN=$(cat /tmp/jwt)
+          # GET stats — exit criterion: seed bằng owner role → stats đúng (4 keys — SF-3 nới)
+          STATS=$(curl -sf http://localhost:8082/api/activity/stats -H "Authorization: Bearer $TOKEN")
+          echo "$STATS"
+          echo "$STATS" | python3 -c '
+          import json, sys
+          s = json.load(sys.stdin)
+          assert s["totalTasks"] == 3, "totalTasks=%s want 3" % s["totalTasks"]
+          assert s["tasksByStatus"] == {"todo": 1, "in_progress": 1, "done": 1, "assignment_failed": 0}, s["tasksByStatus"]
+          assert s["recentEvents"] >= 1, "recentEvents 0 sau khi consumer ghi event"'
+          # 401 từ service (token sai — enforcement 2 lớp, không phụ thuộc gateway)
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8082/api/activity/stats -H "Authorization: Bearer wrong-token")
+          [ "$CODE" = "401" ] || { echo "stats wrong-token = $CODE, want 401"; exit 1; }
+          # Thanh lý ingest: POST /events KHÔNG còn → 404 (acceptance sf-3)
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:8082/api/activity/events \
+            -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{}')
+          [ "$CODE" = "404" ] || { echo "POST /events = $CODE, want 404 (ingest đã thanh lý)"; exit 1; }
+
+      - name: Swagger docs + openapi.yaml (auth-exempt trên service, direct :8082)
+        run: |
+          curl -sf http://localhost:8082/api/activity/docs -o /dev/null
+          curl -sf http://localhost:8082/api/activity/openapi.yaml | grep -q 'Activity API'
+
+      - name: Gateway presence check — /api/activity không token → 401 envelope
+        run: |
+          # postgres đã có DDL từ step boot-trước (test readonly) → node migration
+          # CREATE TABLE sẽ đụng bảng tồn tại. Reset volume cho chain boot sạch.
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example down -v
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            up -d gateway || {
+              echo "=== dependency failed — dump node-svc logs ===";
+              docker compose -f platform/docker-compose.yml --env-file platform/.env.example logs --tail 60 node-svc;
+              exit 1; }
+          sleep 3
+          CODE=$(curl -s -o /tmp/gw401.json -w '%{http_code}' http://localhost:8080/api/activity/stats)
+          [ "$CODE" = "401" ] || { echo "gateway = $CODE, want 401"; exit 1; }
+          grep -q 'UNAUTHORIZED' /tmp/gw401.json
+
+      - name: Schemathesis contract test (activity.yaml, kèm JWT — 2 bài học SF-1)
+        run: |
+          python3 -m venv /tmp/stenv
+          /tmp/stenv/bin/pip install --quiet "schemathesis==3.*"
+          TOKEN=$(cat /tmp/jwt)
+          # base-url kèm prefix /api/activity — schemathesis 3.x bỏ qua servers.url relative
+          /tmp/stenv/bin/schemathesis run contracts/openapi/activity.yaml \
+            --base-url http://localhost:8082/api/activity \
+            --header "Authorization: Bearer $TOKEN" \
+            --checks all --hypothesis-max-examples 25 --hypothesis-deadline 5000
+
+  docker-build:
+    name: docker build (go-svc)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image (multi-stage distroless — platform/conventions/01)
+        run: docker build -t go-svc:ci services/go-svc
+
+  drift-guard:
+    name: drift-guard — snapshot activity.yaml bit-identical contracts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: diff snapshot vs contract (lệch = fail — sửa 1 bỏ 1 = docs endpoint lệch im lặng)
+        run: |
+          diff contracts/openapi/activity.yaml services/go-svc/internal/api/openapi/activity.yaml \
+            || { echo "::error::snapshot activity.yaml lệch contracts — copy lại (story FI-76 SF-3 P0 ×2 file)"; exit 1; }

package/stack-template/.github/workflows/services-node-svc.yml

@@ -0,0 +1,173 @@
+name: services-node-svc
+
+# SF-2 (FI-70) — build + test + docker build + boot-smoke (conventions/
+# services-ci.yml.example pattern). Boot-smoke: compose postgres + node-svc
+# (DATABASE_URL từ compose entry — node_svc role, fix ab207d8), migration chạy
+# lúc boot, healthz/readyz 200, task create/list/delete smoke với JWT tự ký.
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - "services/node-svc/**"
+      - "platform/docker-compose.yml" # compose entry đổi cũng phải re-test
+      - "contracts/openapi/tasks.yaml" # typegen drift + contract
+      - "contracts/db/tasks-schema.sql" # schema-diff test đọc canonical DDL (review P2)
+      - "contracts/events/fixtures/**" # relay/consumer test load chung golden fixtures
+      - ".github/workflows/services-node-svc.yml"
+  pull_request:
+    paths:
+      - "services/node-svc/**"
+      - "platform/docker-compose.yml"
+      - "contracts/openapi/tasks.yaml"
+
+permissions:
+  contents: read # least-privilege (P2 security-audit SF-7 — follow-up repo-wide)
+
+jobs:
+  build-test:
+    name: build + test (node-svc)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        # version đọc từ packageManager trong package.json (root) — không khai
+        # trùng ở đây (ERR_PNPM_BAD_PM_VERSION conflict, run 38227939477)
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - name: Install (workspace root, frozen)
+        run: pnpm install --frozen-lockfile
+      - name: Unit + contract tests
+        run: pnpm --filter node-svc test
+      - name: Build (tsc)
+        run: pnpm --filter node-svc build
+      - name: Typegen drift check (contract-first)
+        run: |
+          pnpm --filter node-svc generate:types
+          git diff --exit-code -- services/node-svc/src/types/api.d.ts \
+            || (echo "::error::src/types/api.d.ts lệch contracts/openapi/tasks.yaml — chạy pnpm --filter node-svc generate:types rồi commit" && exit 1)
+
+  docker-build:
+    name: docker build (node-svc)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image (multi-stage — platform/conventions/01)
+        run: docker build -t node-svc:ci services/node-svc
+
+  boot-smoke:
+    name: boot-smoke (node-svc + postgres, migration + CRUD smoke)
+    runs-on: ubuntu-latest
+    env:
+      JWT_SECRET: ci-smoke-secret-placeholder-not-real-32chars
+      NODE_SVC_DB_PASSWORD: ci-node-password-not-real
+      POSTGRES_PASSWORD: ci-postgres-password-not-real
+    steps:
+      - uses: actions/checkout@v4
+      - name: Boot postgres + node-svc (compose — DATABASE_URL role node_svc)
+        run: |
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            up -d --build postgres node-svc
+      - name: Smoke — healthz/readyz 200 (readyz = migration xong + DB ok)
+        run: |
+          ok=0
+          for i in $(seq 1 60); do
+            curl -sf http://localhost:3001/readyz >/dev/null && ok=1 && break
+            sleep 2
+          done
+          if [ "$ok" != "1" ]; then
+            echo "::error::readyz không 200 trong 120s — node-svc logs:"
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example logs node-svc postgres
+            exit 1
+          fi
+          curl -sf http://localhost:3001/healthz | grep -q '"status":"ok"'
+          curl -sf http://localhost:3001/readyz | grep -q '"status":"ok"'
+      - name: Smoke — CRUD qua JWT tự ký (create KHÔNG assignee → 201 khi go-svc vắng = fire-and-forget)
+        run: |
+          TOKEN=$(node -e '
+            const c = require("crypto");
+            const b = (o) => Buffer.from(JSON.stringify(o)).toString("base64url");
+            const h = b({ alg: "HS256", typ: "JWT" });
+            const now = Math.floor(Date.now() / 1000);
+            const p = b({ sub: "11111111-1111-4111-8111-111111111111", email: "alice@demo.local", roles: ["admin"], iss: "auth-mock", iat: now, exp: now + 3600 });
+            const s = c.createHmac("sha256", process.env.JWT_SECRET).update(h + "." + p).digest("base64url");
+            console.log(h + "." + p + "." + s);')
+          BASE=http://localhost:3001/api/tasks
+          CODE=$(curl -s -o /tmp/task.json -w '%{http_code}' -X POST "$BASE" \
+            -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
+            -d '{"title":"boot-smoke task"}')
+          echo "create → $CODE"
+          [ "$CODE" = "201" ] || (cat /tmp/task.json && exit 1)
+          TASK_ID=$(node -e 'console.log(require("/tmp/task.json").id)')
+          curl -sf "$BASE?limit=10" -H "Authorization: Bearer $TOKEN" | grep -q 'boot-smoke task'
+          curl -sf -X PATCH "$BASE/$TASK_ID" -H "Authorization: Bearer $TOKEN" \
+            -H 'Content-Type: application/json' -d '{"status":"done"}' | grep -q '"status":"done"'
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' -X DELETE "$BASE/$TASK_ID" \
+            -H "Authorization: Bearer $TOKEN")
+          [ "$CODE" = "204" ] || (echo "delete → $CODE (expected 204)" && exit 1)
+      - name: Smoke — 401 khi thiếu token (service tự chặn, không nhờ gateway)
+        run: |
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3001/api/tasks)
+          [ "$CODE" = "401" ] || (echo "no-token → $CODE (expected 401)" && exit 1)
+
+  # SF-2 FI-79 (P0 plan-critic): relay THẬT trên broker thật — không fake.
+  # Boot postgres + kafka + node-svc, tạo task, poll outbox row published_at
+  # IS NOT NULL (relay publish vào topic task-events rồi mark). Kafka lazy:
+  # KHÔNG chặn boot/readyz (conventions/09 rule 1) — poll riêng cho publish.
+  kafka-boot-smoke:
+    name: boot-smoke kafka (relay outbox - published_at NOT NULL trên broker thật)
+    runs-on: ubuntu-latest
+    env:
+      JWT_SECRET: ci-smoke-secret-placeholder-not-real-32chars
+      NODE_SVC_DB_PASSWORD: ci-node-password-not-real
+      POSTGRES_PASSWORD: ci-postgres-password-not-real
+    steps:
+      - uses: actions/checkout@v4
+      - name: Boot postgres + kafka + node-svc (compose - env từ .env.example)
+        run: |
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            up -d --build postgres kafka node-svc
+      - name: Smoke - readyz 200 (DB migrated; kafka KHÔNG chặn boot — lazy)
+        run: |
+          ok=0
+          for i in $(seq 1 90); do
+            curl -sf http://localhost:3001/readyz >/dev/null && ok=1 && break
+            sleep 2
+          done
+          if [ "$ok" != "1" ]; then
+            echo "::error::readyz không 200 trong 180s — node-svc logs:"
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example logs node-svc postgres kafka
+            exit 1
+          fi
+      - name: Smoke - create task rồi assert outbox published_at IS NOT NULL (relay thật)
+        run: |
+          DB_USER=$(grep -E '^POSTGRES_USER=' platform/.env.example | cut -d= -f2-)
+          DB_NAME=$(grep -E '^POSTGRES_DB=' platform/.env.example | cut -d= -f2-)
+          DB_USER=${DB_USER:-postgres}
+          DB_NAME=${DB_NAME:-boilerplate}
+          TOKEN=$(node -e '
+            const c = require("crypto");
+            const b = (o) => Buffer.from(JSON.stringify(o)).toString("base64url");
+            const h = b({ alg: "HS256", typ: "JWT" });
+            const now = Math.floor(Date.now() / 1000);
+            const p = b({ sub: "11111111-1111-4111-8111-111111111111", email: "alice@demo.local", roles: ["admin"], iss: "auth-mock", iat: now, exp: now + 3600 });
+            const s = c.createHmac("sha256", process.env.JWT_SECRET).update(h + "." + p).digest("base64url");
+            console.log(h + "." + p + "." + s);')
+          CODE=$(curl -s -o /tmp/task.json -w '%{http_code}' -X POST http://localhost:3001/api/tasks \
+            -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
+            -d '{"title":"kafka boot-smoke task"}')
+          echo "create → $CODE"
+          [ "$CODE" = "201" ] || (cat /tmp/task.json && exit 1)
+          TASK_ID=$(node -e 'console.log(require("/tmp/task.json").id)')
+          seen=0
+          for i in $(seq 1 45); do
+            ROW=$(docker compose -f platform/docker-compose.yml --env-file platform/.env.example exec -T postgres \
+              psql -U "$DB_USER" -d "$DB_NAME" -tAc "SELECT count(*) FROM tasks.outbox WHERE type='task.created' AND payload->>'taskId'='$TASK_ID' AND published_at IS NOT NULL")
+            if [ "$ROW" != "0" ]; then seen=1; break; fi
+            sleep 2
+          done
+          if [ "$seen" != "1" ]; then
+            echo "::error::outbox row không published trong 90s — relay/consumer/kafka logs:"
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example logs node-svc kafka
+            exit 1
+          fi
+          echo "outbox row published_at IS NOT NULL ✓ (taskId=$TASK_ID, attempt=$i)"