No-Rework Migration Checklist (Kafka/MSK + ECS)
Document ID: GOS-80-CHAIN-NO-REWORK-CHECKLIST Version: 0.1.0 Status: DRAFT Owner Role: CHAIN_OFFICER Last Review Date: 2026-03-04 Next Review Date: 2026-04-04
Resolving locale, route permissions, and workspace projection.
Current scope: Guest
Category: 80_chain | Version: v1.0.0
Owner: DOCUMENT_CUSTODIAN | Review cycle: 60 days
Approval authority: GOVERNANCE_ADMIN, CHAIN_OFFICER
Documentation portal is read-only. Editing and mutation endpoints are disabled.
Kvary platform is originally created in Georgian. Where a Georgian version exists, Georgian is authoritative for platform UI, documentation, and legal interpretation.
Translations into other languages are provided for convenience. Some records may originate in other languages and carry their own source or legal locale for a specific flow, but where a Georgian version is available, the Georgian version prevails for platform-level wording and interpretation.
Metadata incomplete: Change Log
Document ID: GOS-80-CHAIN-NO-REWORK-CHECKLIST Version: 0.1.0 Status: DRAFT Owner Role: CHAIN_OFFICER Last Review Date: 2026-03-04 Next Review Date: 2026-04-04
Lock critical decisions now so migration from local/stage to AWS production does not require redesign.
Status legend: ⚪ TODO → 🟡 IN_PROGRESS → 🔴 BLOCKED / 🟢 DONE
| # | Workstream | Owner | Target Date | Status | |---|---|---|---|---| | 1 | Event Contract Freeze | CHAIN_OFFICER | 2026-03-04 | 🟢 DONE | | 2 | Partitioning and Ordering | LEDGER_ENGINEER | 2026-03-04 | 🟢 DONE | | 3 | Idempotency and Exactly-Once Boundaries | ORCHESTRATION_ENGINEER | 2026-03-09 | ⚪ TODO | | 4 | DLQ and Replay Discipline | SRE_LEAD | 2026-03-04 | 🟢 DONE | | 5 | Retry/Timeout Policy | ORCHESTRATION_ENGINEER | 2026-03-10 | ⚪ TODO | | 6 | Security and Secrets | SECURITY_OFFICER | 2026-03-10 | ⚪ TODO | | 7 | Observability Baseline | OBSERVABILITY_OWNER | 2026-03-11 | ⚪ TODO | | 8 | Deployment Safety | PLATFORM_ENGINEER | 2026-03-11 | ⚪ TODO | | 9 | Environment Parity | RELEASE_MANAGER | 2026-03-12 | ⚪ TODO | | 10 | Infrastructure as Code Lock-In | PLATFORM_ENGINEER | 2026-03-12 | 🔴 BLOCKED | | 11 | Governance and Change Control | GOVERNANCE_OFFICER | 2026-03-13 | ⚪ TODO | | 12 | Exit Criteria to Production | PROGRAM_OWNER | 2026-03-14 | ⚪ TODO |
Weekly update rule:
Status and Target Date every Friday.BLOCKED, add blocker note in the relevant section below.Current sprint notes:
🟢 DONE: schema compatibility sign-off is published in docs/80_chain/schemas/README.md for v1 baseline contracts.🟢 DONE: producer-path audit confirms orchestration records are emitted through intent-key enforcement helpers.🟢 DONE: controlled failure DLQ + replay evidence captured in docs/80_chain/99_audit_logs/SINGLE_OPERATOR_DLQ_REPLAY_DEV_2026-03-04.md.npm run kafka:kes-smoke and npm run kafka:kes-consumer.🔴 BLOCKED: backend plan/config files are ready, but stage validation is blocked because Terraform CLI is not installed on the current machine.
terraform init -reconfigure -backend-config=backend.stage.hcl in docs/80_chain/templates/terraform/ecs-kafka-orchestrator.Progress update (#10):
docs/80_chain/templates/terraform/ecs-kafka-orchestrator/BACKEND_SETUP.md.backend.dev.hcl, backend.stage.hcl, backend.prod.hcl.terraform command not found (CommandNotFoundException).milestone.approved, mint.requested, mint.confirmed, anchor.requested, anchor.confirmed, orchestration.dlq.schemaVersion mandatory on all events.key = intentId.Producer-path audit sign-off (2026-03-04):
packages/financial-layer/chain/orchestration/partition-key.ts via resolveIntentPartitionKey and buildKafkaRecordInput.packages/financial-layer/chain/orchestration/kafka-kafkajs.ts (publish -> helper -> producer send).packages/financial-layer/chain/orchestration/kafka-stubs.ts (send -> helper).scripts/kafkajs-producer-consumer-demo.js (bus publish without arbitrary key override).scripts/single-operator-e2e.js (stub producer send with event intent continuity).eventId, intentId, reason, failedAt, sourceTopic).KES smoke linkage (acceptance criteria):
npm run kafka:kes-smoke with API trigger path enabled (KES_ORCHESTRATOR_KAFKA_ENABLED=true).eventId, intentId, and source topic context.intentId key semantics.DLQ/replay sign-off (2026-03-04):
SINGLE_OPERATOR_FAIL_ON_TOPIC=mint.requested.tmp/outputs/single_operator_dlq.jsonl with required fields.scripts/single-operator-replay-dlq.js with intentKeyMismatches = 0.docs/80_chain/99_audit_logs/SINGLE_OPERATOR_DLQ_REPLAY_DEV_2026-03-04.md.intentId, eventId, topic, partition, offset on every consume/publish boundary.KES smoke linkage (acceptance criteria):
npm run kafka:kes-smoke, capture publish/consume traces containing intentId, eventId, topic, partition, and offset.receivedCount and event-level fields from kes.orchestrator.events.dev, stage) for regression comparison.latest).force-new-deployment and revision tracking.Stage replay drill package (prepared 2026-03-04):
docs/80_chain/99_audit_logs/SINGLE_OPERATOR_DLQ_REPLAY_STAGE_2026-03-04.md.docs/80_chain/99_audit_logs/SINGLE_OPERATOR_DLQ_REPLAY_DEV_2026-03-04.md.docs/80_chain/SINGLE_OPERATOR_MODE.mddocs/80_chain/AWS_MSK_ENV_MATRIX.mddocs/80_chain/AWS_ECS_TASK_ENV_BLOCKS.mddocs/80_chain/templates/terraform/ecs-kafka-orchestrator/docs/80_chain/SMOKE_EVIDENCE_TEMPLATE.md