Summary
Add chaos / fault-injection tests for RPC, DB, and Redis outages to verify graceful degradation and recovery.
Background & current behaviour
Several resilience features are planned/present (retries, circuit breaker #197, RPC failover #213, fail-open rate limiting, outbox #200). None are verified under real induced faults; we only assume they degrade gracefully.
Why this matters for MVP
Resilience code that isn't tested under actual faults is unproven. Chaos tests turn "should degrade gracefully" into "verified to".
Proposed implementation
- Build scenarios that kill/slow each dependency: RPC down/slow, Postgres down, Redis down — using compose (pause/stop containers) or a fault-injection proxy (toxiproxy).
- Assert expected behaviour during the fault (breaker opens, API returns 503 not hang, rate limiter fails open, cursor stays safe) and after restore (ingest resumes, no data loss/duplication, gaps closed).
- Make them runnable locally via compose and documented.
Acceptance criteria
Affected files / components
docker/ (chaos harness / toxiproxy)
- integration tests in
crates/ and services/api/
Testing & verification
Run each scenario and assert the documented degradation + recovery; wire an opt-in CI job.
Related / dependencies
Exercises #197/#200/#213/#196 (reorg) and fail-open rate limiting.
Out of scope
Production chaos engineering (game days).
Target branch
All work for this issue MUST target the dev branch. Cut your feature branch from dev and open the pull request against dev, never against main. Any PR opened against main for this issue will be closed and asked to re-target dev.
Summary
Add chaos / fault-injection tests for RPC, DB, and Redis outages to verify graceful degradation and recovery.
Background & current behaviour
Several resilience features are planned/present (retries, circuit breaker #197, RPC failover #213, fail-open rate limiting, outbox #200). None are verified under real induced faults; we only assume they degrade gracefully.
Why this matters for MVP
Resilience code that isn't tested under actual faults is unproven. Chaos tests turn "should degrade gracefully" into "verified to".
Proposed implementation
Acceptance criteria
Affected files / components
docker/(chaos harness / toxiproxy)crates/andservices/api/Testing & verification
Run each scenario and assert the documented degradation + recovery; wire an opt-in CI job.
Related / dependencies
Exercises #197/#200/#213/#196 (reorg) and fail-open rate limiting.
Out of scope
Production chaos engineering (game days).
Target branch
All work for this issue MUST target the
devbranch. Cut your feature branch fromdevand open the pull request againstdev, never againstmain. Any PR opened againstmainfor this issue will be closed and asked to re-targetdev.