skilldrop-cli 0.16.44 → 0.16.46

package/packs/solution-architect/skills/context-graph/evals/files/10/services/ledger-worker/auth/mtls.py

@@ -0,0 +1,18 @@
+"""Check the peer certificate's SPIFFE ID on internal requests (see ADR-0011)."""
+from functools import wraps
+
+ALLOWED_PEERS = {
+    "spiffe://tallowmere.internal/billing-api",
+}
+CA_BUNDLE = "/etc/ironbark/ca-bundle.pem"
+
+
+def require_peer_identity(handler):
+    @wraps(handler)
+    def wrapper(event, peer_cert, *args, **kwargs):
+        spiffe_id = peer_cert.get("uri_san", "")
+        if spiffe_id not in ALLOWED_PEERS:
+            raise PermissionError(f"peer {spiffe_id!r} not allowed")
+        return handler(event, peer_cert, *args, **kwargs)
+
+    return wrapper

package/packs/solution-architect/skills/context-graph/evals/files/11/README.md

@@ -0,0 +1,4 @@
+# Pebblecart
+
+Small storefront backend. Models in `app/models/`, SQL migrations in `migrations/`.
+Design decisions are kept in `eng/decisions/` (DR-NNN).

package/packs/solution-architect/skills/context-graph/evals/files/11/app/models/base.py

@@ -0,0 +1,3 @@
+from sqlalchemy.orm import declarative_base
+
+Base = declarative_base()

package/packs/solution-architect/skills/context-graph/evals/files/11/app/models/line_item.py

@@ -0,0 +1,14 @@
+"""Line item model. Immutable once the parent order is placed (DR-009)."""
+from sqlalchemy import BigInteger, Column, ForeignKey, Integer, String
+
+from .base import Base
+
+
+class LineItem(Base):
+    __tablename__ = "line_items"
+
+    id = Column(BigInteger, primary_key=True)
+    order_id = Column(BigInteger, ForeignKey("orders.id"), nullable=False, index=True)
+    sku = Column(String(32), nullable=False)
+    quantity = Column(Integer, nullable=False)
+    unit_price_minor = Column(Integer, nullable=False)

package/packs/solution-architect/skills/context-graph/evals/files/11/app/models/order.py

@@ -0,0 +1,24 @@
+"""Order model."""
+from sqlalchemy import JSON, BigInteger, Column, DateTime, Integer, String
+
+from .base import Base
+
+# Keys allowed in Order.attributes (DR-014). Review additions like a column.
+ORDER_ATTRIBUTE_KEYS = {
+    "delivery_note",
+    "leave_with_neighbour",
+}
+
+
+class Order(Base):
+    __tablename__ = "orders"
+
+    id = Column(BigInteger, primary_key=True)
+    customer_id = Column(BigInteger, nullable=False, index=True)
+    status = Column(String(16), nullable=False, default="draft")
+    currency = Column(String(3), nullable=False)
+    subtotal_minor = Column(Integer, nullable=False)
+    shipping_minor = Column(Integer, nullable=False, default=0)
+    total_minor = Column(Integer, nullable=False)
+    placed_at = Column(DateTime(timezone=True))
+    attributes = Column(JSON, nullable=False, default=dict)

package/packs/solution-architect/skills/context-graph/evals/files/11/eng/decisions/DR-003-money-as-minor-units.md

@@ -0,0 +1,10 @@
+---
+id: DR-003
+title: Store money as integer minor units with a currency code
+status: Accepted
+date: 2022-02-17
+governs: [app/models/order.py, app/models/line_item.py]
+---
+
+All monetary amounts are stored as integer minor units (`*_minor`, e.g. pence) alongside a
+three-letter `currency` column. No floats or decimals for money anywhere in the schema.

package/packs/solution-architect/skills/context-graph/evals/files/11/eng/decisions/DR-005-orders-typed-columns-only.md

@@ -0,0 +1,10 @@
+---
+id: DR-005
+title: Orders table uses typed columns only
+status: Accepted
+date: 2022-04-11
+governs: [app/models/order.py, migrations/]
+---
+
+Every field on an order is a typed, named column with a migration. We do not store JSON blobs
+on the orders table: they hide schema changes from review and cannot be indexed.

package/packs/solution-architect/skills/context-graph/evals/files/11/eng/decisions/DR-009-line-items-immutable.md

@@ -0,0 +1,11 @@
+---
+id: DR-009
+title: Order line items are immutable once the order is placed
+status: Accepted
+date: 2023-01-30
+governs: [app/models/line_item.py]
+cites: [DR-003]
+---
+
+After an order moves to `placed`, its line items are never updated. Price or quantity
+corrections are written as rows in `order_adjustments`, amounts in minor units per DR-003.

package/packs/solution-architect/skills/context-graph/evals/files/11/eng/decisions/DR-014-optional-order-attributes-json.md

@@ -0,0 +1,16 @@
+---
+id: DR-014
+title: Optional customer-supplied order fields go in orders.attributes
+status: Accepted
+date: 2024-02-08
+amends: DR-005
+governs: [app/models/order.py, migrations/0012_add_order_attributes.sql]
+---
+
+DR-005's typed-columns rule produced a migration for every small checkout tweak. We relax it:
+
+- New **optional, customer-supplied** fields that are not filtered, joined or reported on
+  (delivery notes, gift options, and similar) are stored as keys in the `orders.attributes`
+  JSON column. Each key is listed in `ORDER_ATTRIBUTE_KEYS` in `app/models/order.py` and is
+  reviewed like a column.
+- Anything we filter, join, index or report on stays a typed column, as DR-005 says.

package/packs/solution-architect/skills/context-graph/evals/files/11/eng/decisions/DR-016-order-attributes-table.md

@@ -0,0 +1,11 @@
+---
+id: DR-016
+title: Move order attributes into a separate order_attributes table
+status: Proposed
+date: 2026-09-30
+cites: [DR-014]
+---
+
+Proposal (under discussion, not agreed): replace the `orders.attributes` JSON column from
+DR-014 with an `order_attributes(order_id, key, value)` table so attributes can be indexed.
+Open question: whether existing keys are back-filled or dual-written.

package/packs/solution-architect/skills/context-graph/evals/files/11/migrations/0007_create_orders.sql

@@ -0,0 +1,11 @@
+CREATE TABLE orders (
+    id             BIGINT PRIMARY KEY,
+    customer_id    BIGINT NOT NULL,
+    status         VARCHAR(16) NOT NULL DEFAULT 'draft',
+    currency       CHAR(3) NOT NULL,
+    subtotal_minor INTEGER NOT NULL,
+    shipping_minor INTEGER NOT NULL DEFAULT 0,
+    total_minor    INTEGER NOT NULL,
+    placed_at      TIMESTAMPTZ
+);
+CREATE INDEX orders_customer_id_idx ON orders (customer_id);

package/packs/solution-architect/skills/context-graph/evals/files/11/migrations/0012_add_order_attributes.sql

@@ -0,0 +1,2 @@
+-- DR-014: optional customer-supplied order fields.
+ALTER TABLE orders ADD COLUMN attributes JSONB NOT NULL DEFAULT '{}'::jsonb;

package/packs/solution-architect/skills/context-graph/evals/files/12/README.md

@@ -0,0 +1,8 @@
+# parcelhook
+
+Sends shipment-status webhooks (picked_up, in_transit, delivered, exception) from the
+Corvane Freight tracking platform to partner endpoints. Owned by Platform Integrations.
+
+- Entry point: `src/delivery/dispatcher.py`
+- Decisions: `docs/adr/`
+- Config: `config/`

package/packs/solution-architect/skills/context-graph/evals/files/12/config/delivery.yaml

@@ -0,0 +1,4 @@
+retry:
+  max_attempts: 20
+  base_delay_seconds: 10
+timeout_seconds: 10

package/packs/solution-architect/skills/context-graph/evals/files/12/config/export.yaml

@@ -0,0 +1,2 @@
+schedule: "0 2 * * *"
+bucket: corvane-parcelhook-exports

package/packs/solution-architect/skills/context-graph/evals/files/12/config/partners.yaml

@@ -0,0 +1,10 @@
+# Partner configuration (ADR-0008). Loaded at startup.
+partners:
+  - id: velo
+    url: https://hooks.velo.example/parcel
+    events: [picked_up, delivered, exception]
+    secret_ref: vault://parcelhook/partners/velo
+  - id: northwind-retail
+    url: https://api.northwind.example/webhooks/shipments
+    events: [delivered]
+    secret_ref: vault://parcelhook/partners/northwind-retail

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0001-record-architecture-decisions.md

@@ -0,0 +1,10 @@
+# ADR-0001: Record architecture decisions
+
+- Status: Accepted
+- Date: 2022-03-01
+- Deciders: Platform Integrations
+
+## Decision
+We record significant decisions about parcelhook as numbered ADRs in `docs/adr/`.
+A record that replaces another says "Supersedes ADR-NNNN", and the replaced record's
+status is changed to "Superseded by ADR-MMMM".

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0002-postgres-delivery-log.md

@@ -0,0 +1,15 @@
+# ADR-0002: Postgres for the delivery log
+
+- Status: Accepted
+- Date: 2022-03-10
+- Governs: `src/store/`
+
+## Context
+Partners dispute whether a webhook was sent. We need a durable, queryable record of every attempt.
+
+## Decision
+Every delivery attempt is written to the `delivery_attempts` table in the service's Postgres
+database (event_id, partner_id, attempt_no, status_code, sent_at).
+
+## Consequences
+Support can answer "did we send it?" with a query. The table grows ~2M rows/month; partition by month.

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0003-redis-idempotency-keys.md

@@ -0,0 +1,15 @@
+# ADR-0003: Idempotency keys in Redis
+
+- Status: Accepted
+- Date: 2022-05-02
+- Governs: `src/idempotency/redis_store.py`
+
+## Context
+The tracking platform delivers events at-least-once. Partners complained about duplicate webhooks.
+
+## Decision
+Before dispatching, the dispatcher sets `idem:{event_id}:{partner_id}` in Redis with NX and a
+24h TTL. If the key already exists the event is dropped as a duplicate.
+
+## Consequences
+Fast and simple. If Redis is flushed or evicts keys under memory pressure, duplicates can get through.

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0004-retry-policy.md

@@ -0,0 +1,16 @@
+# ADR-0004: Retry policy for failed deliveries
+
+- Status: Accepted
+- Date: 2022-06-20
+- Governs: `src/delivery/retry.py`, `config/delivery.yaml`
+
+## Context
+Partner endpoints go down. Retrying too aggressively has had us rate-limited and blocked by two partners.
+
+## Decision
+Retry failed deliveries with exponential backoff: delay = 30s * 2^(attempt-1), at most 6 attempts
+(last retry roughly 16 minutes after the first). After the 6th failure, publish the event to the
+dead-letter queue `parcelhook.dlq` for manual replay.
+
+## Consequences
+A partner outage of more than ~30 minutes means events land in the DLQ and need replaying.

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0005-hmac-signed-payloads.md

@@ -0,0 +1,10 @@
+# ADR-0005: Sign payloads with HMAC-SHA256
+
+- Status: Accepted
+- Date: 2022-07-11
+- Governs: `src/delivery/signing.py`
+
+## Decision
+Each webhook body is signed with HMAC-SHA256 using the partner's shared secret. The hex digest
+is sent in the `X-Parcelhook-Signature` header, together with `X-Parcelhook-Timestamp`, and the
+timestamp is part of the signed string (`{timestamp}.{body}`) to prevent replay.

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0006-postgres-idempotency.md

@@ -0,0 +1,15 @@
+# ADR-0006: Move idempotency keys to Postgres
+
+- Status: Accepted
+- Date: 2023-09-04
+- Supersedes: ADR-0003
+- Governs: `src/idempotency/pg_store.py`, `migrations/003_idempotency_keys.sql`
+
+## Context
+INC-1874 (2023-08-22): a Redis failover lost the idempotency keyspace and ~41,000 duplicate
+webhooks went to partners in one hour.
+
+## Decision
+Idempotency keys move to the `idempotency_keys` table in Postgres with a unique constraint on
+(event_id, partner_id). The dispatcher inserts with ON CONFLICT DO NOTHING and only dispatches
+if a row was inserted. Rows older than 7 days are purged nightly. Redis is no longer used for idempotency.

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0007-sftp-batch-export.md

@@ -0,0 +1,12 @@
+# ADR-0007: Nightly SFTP export of the delivery log
+
+- Status: Accepted
+- Date: 2023-02-15
+- Governs: `src/export/sftp_export.py`
+
+## Context
+Three partners reconcile against a daily file rather than our webhooks.
+
+## Decision
+At 02:00 UTC, export the previous day's `delivery_attempts` rows per partner as CSV and push
+them to each partner's SFTP server using `src/export/sftp_export.py`.

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0008-partner-config-in-yaml.md

@@ -0,0 +1,12 @@
+# ADR-0008: Partner configuration in a YAML file
+
+- Status: Accepted
+- Date: 2023-11-20
+- Governs: `config/partners.yaml`, `src/partners/`
+
+## Decision
+Partner endpoints, enabled event types and secret references live in `config/partners.yaml`,
+reviewed by pull request. The service loads the file at startup.
+
+## Consequences
+Onboarding a partner needs a deploy. Acceptable at our current 12 partners.

package/packs/solution-architect/skills/context-graph/evals/files/12/docs/adr/0009-partner-config-admin-api.md

@@ -0,0 +1,13 @@
+# ADR-0009: Partner configuration via an admin API
+
+- Status: Accepted
+- Date: 2024-05-13
+- Governs: `src/partners/`, `migrations/004_partners.sql`
+
+## Context
+We now have 60+ partners and onboarding through a YAML PR and a deploy takes days.
+
+## Decision
+Partner configuration is stored in the `partners` table and edited through an internal admin API.
+The service reloads partners from the table every 60 seconds. See ADR-0011 for the authentication
+model of the admin API.

package/packs/solution-architect/skills/context-graph/evals/files/12/migrations/003_idempotency_keys.sql

@@ -0,0 +1,6 @@
+CREATE TABLE idempotency_keys (
+    event_id   text        NOT NULL,
+    partner_id text        NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY (event_id, partner_id)
+);

package/packs/solution-architect/skills/context-graph/evals/files/12/migrations/004_partners.sql

@@ -0,0 +1,7 @@
+CREATE TABLE partners (
+    id         text PRIMARY KEY,
+    url        text NOT NULL,
+    events     text[] NOT NULL,
+    secret_ref text NOT NULL,
+    enabled    boolean NOT NULL DEFAULT true
+);

package/packs/solution-architect/skills/context-graph/evals/files/12/src/delivery/dispatcher.py

@@ -0,0 +1,29 @@
+"""Consume tracking events and deliver them to partner endpoints."""
+import json
+import urllib.request
+
+from src.idempotency import redis_store
+from src.partners.loader import load_partners
+from src.delivery.signing import sign
+from src.delivery.retry import schedule_retry
+from src.store.delivery_log import record_attempt
+
+
+def dispatch(event, attempt_no=1):
+    for partner in load_partners():
+        if event["type"] not in partner["events"]:
+            continue
+        # drop duplicates from the at-least-once feed
+        if not redis_store.claim(event["id"], partner["id"]):
+            continue
+        body = json.dumps(event).encode()
+        headers = {"Content-Type": "application/json", **sign(partner, body)}
+        req = urllib.request.Request(partner["url"], data=body, headers=headers, method="POST")
+        try:
+            with urllib.request.urlopen(req, timeout=10) as resp:
+                status = resp.status
+        except Exception:
+            status = 0
+        record_attempt(event["id"], partner["id"], attempt_no, status)
+        if not 200 <= status < 300:
+            schedule_retry(event, partner, attempt_no)

package/packs/solution-architect/skills/context-graph/evals/files/12/src/delivery/retry.py

@@ -0,0 +1,15 @@
+"""Retry scheduling for failed deliveries."""
+from src.config import load_yaml
+from src.store.delivery_log import mark_failed
+from src.queue import enqueue_delayed
+
+CFG = load_yaml("config/delivery.yaml")["retry"]
+
+
+def schedule_retry(event, partner, attempt_no):
+    if attempt_no >= CFG["max_attempts"]:
+        mark_failed(event["id"], partner["id"])
+        return
+    # TODO(INC-2291): backoff disabled while partner Velo's endpoint flaps; restore afterwards
+    delay = CFG["base_delay_seconds"]
+    enqueue_delayed(event, partner, attempt_no + 1, delay_seconds=delay)

package/packs/solution-architect/skills/context-graph/evals/files/12/src/delivery/signing.py

@@ -0,0 +1,13 @@
+"""HMAC-SHA256 signing of webhook bodies."""
+import hashlib
+import hmac
+import time
+
+from src.secrets import partner_secret
+
+
+def sign(partner, body: bytes) -> dict:
+    ts = str(int(time.time()))
+    msg = ts.encode() + b"." + body
+    digest = hmac.new(partner_secret(partner["id"]), msg, hashlib.sha256).hexdigest()
+    return {"X-Parcelhook-Signature": digest, "X-Parcelhook-Timestamp": ts}

package/packs/solution-architect/skills/context-graph/evals/files/12/src/export/s3_export.py

@@ -0,0 +1,24 @@
+"""Nightly export of the delivery log to per-partner S3 prefixes."""
+import csv
+import io
+
+from src.config import load_yaml
+from src.db import execute
+from src.s3 import put_object
+
+CFG = load_yaml("config/export.yaml")
+
+
+def run(day):
+    rows = execute(
+        "SELECT partner_id, event_id, attempt_no, status_code, sent_at FROM delivery_attempts "
+        "WHERE sent_at::date = %s ORDER BY partner_id",
+        (day,),
+    )
+    by_partner = {}
+    for r in rows:
+        by_partner.setdefault(r[0], []).append(r)
+    for partner_id, prows in by_partner.items():
+        buf = io.StringIO()
+        csv.writer(buf).writerows(prows)
+        put_object(CFG["bucket"], f"{partner_id}/{day}.csv", buf.getvalue())

package/packs/solution-architect/skills/context-graph/evals/files/12/src/idempotency/pg_store.py

@@ -0,0 +1,11 @@
+"""Idempotency claims in Postgres (see ADR-0006)."""
+from src.db import execute
+
+
+def claim(event_id, partner_id) -> bool:
+    rows = execute(
+        "INSERT INTO idempotency_keys (event_id, partner_id) VALUES (%s, %s) "
+        "ON CONFLICT DO NOTHING RETURNING 1",
+        (event_id, partner_id),
+    )
+    return len(rows) == 1

package/packs/solution-architect/skills/context-graph/evals/files/12/src/idempotency/redis_store.py

@@ -0,0 +1,8 @@
+"""Idempotency claims in Redis (see ADR-0003)."""
+from src.redis_client import redis
+
+TTL_SECONDS = 24 * 3600
+
+
+def claim(event_id, partner_id) -> bool:
+    return bool(redis.set(f"idem:{event_id}:{partner_id}", 1, nx=True, ex=TTL_SECONDS))

package/packs/solution-architect/skills/context-graph/evals/files/12/src/partners/loader.py

@@ -0,0 +1,15 @@
+"""Load partner configuration."""
+import time
+
+from src.db import execute
+
+_cache = {"at": 0, "partners": []}
+RELOAD_SECONDS = 60
+
+
+def load_partners():
+    if time.time() - _cache["at"] > RELOAD_SECONDS:
+        rows = execute("SELECT id, url, events FROM partners WHERE enabled")
+        _cache["partners"] = [{"id": r[0], "url": r[1], "events": r[2]} for r in rows]
+        _cache["at"] = time.time()
+    return _cache["partners"]

package/packs/solution-architect/skills/context-graph/evals/files/12/src/store/delivery_log.py

@@ -0,0 +1,18 @@
+"""Delivery attempt log (see ADR-0002)."""
+from src.db import execute
+
+
+def record_attempt(event_id, partner_id, attempt_no, status_code):
+    execute(
+        "INSERT INTO delivery_attempts (event_id, partner_id, attempt_no, status_code, sent_at) "
+        "VALUES (%s, %s, %s, %s, now())",
+        (event_id, partner_id, attempt_no, status_code),
+    )
+
+
+def mark_failed(event_id, partner_id):
+    execute(
+        "UPDATE delivery_attempts SET final_status = 'failed' "
+        "WHERE event_id = %s AND partner_id = %s",
+        (event_id, partner_id),
+    )

package/packs/solution-architect/skills/context-graph/evals/files/13/README.md

@@ -0,0 +1,3 @@
+# shopfront
+
+The Brindle & Co. web store monolith: catalog, cart, checkout. Design records live in `docs/decisions/`.

package/packs/solution-architect/skills/context-graph/evals/files/13/config/cache.yaml

@@ -0,0 +1,2 @@
+pricing:
+  ttl_seconds: 60

package/packs/solution-architect/skills/context-graph/evals/files/13/config/settings.yaml

@@ -0,0 +1,2 @@
+PRICING_SVC_URL: http://pricing-svc.internal:8080
+REDIS_URL: redis://cache.internal:6379/0

package/packs/solution-architect/skills/context-graph/evals/files/13/docs/decisions/RFC-008-pricing-from-erp.md

@@ -0,0 +1,10 @@
+# RFC-008: Read prices from the Halvorsen ERP
+
+Status: Accepted
+Date: 2023-02-07
+Author: M. Okafor
+Governs: shopfront/pricing/erp_client.py
+
+## Decision
+Shopfront reads the current price for a SKU from the Halvorsen ERP `GetItemPrice` SOAP call
+through `shopfront/pricing/erp_client.py`. The ERP is the single source of truth for prices.

package/packs/solution-architect/skills/context-graph/evals/files/13/docs/decisions/RFC-012-pricing-cache.md

@@ -0,0 +1,23 @@
+# RFC-012: Cache prices in Redis
+
+Status: Accepted
+Date: 2023-06-14
+Author: M. Okafor
+Builds on: RFC-008
+Governs: shopfront/pricing/cache.py, config/cache.yaml
+
+## Context
+The Halvorsen ERP limits `GetItemPrice` to 40 requests/second per client and its p95 latency is
+~900 ms. During the June sale the product page timed out and the ERP throttled us for 20 minutes.
+
+## Decision
+Put a read-through Redis cache in front of pricing. Key `price:{sku}`, TTL 60 seconds. A price
+change in the ERP can therefore take up to a minute to show on the site; merchandising agreed
+this is acceptable.
+
+## Alternatives considered
+- Nightly price snapshot: rejected, price changes during sales must show within minutes.
+- Asking Halvorsen to raise the limit: rejected by the vendor.
+
+## Revisit when
+The ERP rate limit no longer applies to us.

package/packs/solution-architect/skills/context-graph/evals/files/13/docs/decisions/RFC-015-checkout-price-lock.md

@@ -0,0 +1,15 @@
+# RFC-015: Lock the price for the duration of checkout
+
+Status: Accepted
+Date: 2024-01-09
+Author: J. Lindqvist
+Amends: RFC-012
+Governs: shopfront/checkout/lock.py
+
+## Context
+Customers were charged a different price from the one shown when a price changed mid-checkout.
+
+## Decision
+When a cart enters checkout, the price a customer saw must be the price they are charged for
+15 minutes. We do this by reusing the pricing cache: checkout keeps the cached price for each
+SKU in the cart alive for 15 minutes.

package/packs/solution-architect/skills/context-graph/evals/files/13/docs/decisions/RFC-019-pricing-service.md

@@ -0,0 +1,17 @@
+# RFC-019: Read prices from pricing-svc instead of the ERP
+
+Status: Proposed
+Date: 2025-03-18
+Author: P. Achterberg
+Supersedes: RFC-008
+
+## Context
+The pricing team now runs `pricing-svc`, a REST service that replicates ERP prices within
+5 seconds of a change. It has no per-client rate limit and a p95 of 35 ms.
+
+## Proposal
+Shopfront calls `GET {PRICING_SVC_URL}/v1/prices/{sku}` instead of the ERP SOAP call, and
+`erp_client.py` is deleted.
+
+## Open questions
+- Do we still need the Redis cache from RFC-012 once the ERP is out of the path?

package/packs/solution-architect/skills/context-graph/evals/files/13/shopfront/catalog/views.py

@@ -0,0 +1,8 @@
+"""Product detail page."""
+from shopfront.pricing import cache
+
+
+def product_detail(request, sku):
+    product = request.catalog.get(sku)
+    price = cache.get_price(sku)
+    return request.render("product.html", {"product": product, "price": price})

package/packs/solution-architect/skills/context-graph/evals/files/13/shopfront/checkout/lock.py

@@ -0,0 +1,14 @@
+"""Hold prices steady while a cart is in checkout (RFC-015)."""
+from shopfront.pricing import cache
+
+LOCK_SECONDS = 15 * 60
+
+
+def lock_cart_prices(cart) -> None:
+    for line in cart.lines:
+        cache.get_price(line.sku)              # make sure the entry exists
+        cache.touch(line.sku, LOCK_SECONDS)    # keep it alive for the checkout window
+
+
+def price_for_charge(sku: str) -> dict:
+    return cache.get_price(sku)

package/packs/solution-architect/skills/context-graph/evals/files/13/shopfront/pricing/cache.py

@@ -0,0 +1,22 @@
+"""Read-through price cache (RFC-012)."""
+import json
+
+from shopfront.redis_client import redis
+from shopfront.settings import load_yaml
+from shopfront.pricing.client import fetch_price
+
+TTL = load_yaml("config/cache.yaml")["pricing"]["ttl_seconds"]
+
+
+def get_price(sku: str) -> dict:
+    key = f"price:{sku}"
+    hit = redis.get(key)
+    if hit is not None:
+        return json.loads(hit)
+    price = fetch_price(sku)
+    redis.set(key, json.dumps(price), ex=TTL)
+    return price
+
+
+def touch(sku: str, ttl: int) -> None:
+    redis.expire(f"price:{sku}", ttl)

package/packs/solution-architect/skills/context-graph/evals/files/13/shopfront/pricing/client.py

@@ -0,0 +1,10 @@
+"""Fetch the current price for a SKU."""
+import json
+import urllib.request
+
+from shopfront.settings import PRICING_SVC_URL
+
+
+def fetch_price(sku: str) -> dict:
+    with urllib.request.urlopen(f"{PRICING_SVC_URL}/v1/prices/{sku}", timeout=2) as resp:
+        return json.load(resp)  # {"sku": ..., "amount_minor": ..., "currency": ...}