Plan: Orchestrator Parallel-Dispatch and Circuit-Breaker Tests

// services/canopy-eligibility/src/orchestrator_harness.rs (new, test-only)

#[cfg(any(test, feature = "test-harness"))]
pub struct OrchestratorHarness {
    pub clients: ServiceClients,
    breaker: CircuitBreaker,
}

impl OrchestratorHarness {
    pub fn new() -> Self { /* construct with NoopProgramClient defaults */ }

    pub fn with_snap(mut self, c: impl ProgramClient + 'static) -> Self { … }
    pub fn with_tanf(mut self, c: impl ProgramClient + 'static) -> Self { … }
    pub fn with_medicaid(mut self, c: impl ProgramClient + 'static) -> Self { … }

    pub async fn determine(&self, ctx: ApplicationContext) -> CombinedResult { … }
}

struct DelayedProgramClient { latency: Duration, inner: NoopProgramClient }
struct FailingProgramClient { error_count: AtomicU32, max_errors: u32 }
struct BadSignatureProgramClient { /* returns determination with tampered signature */ }
struct DisabledProgramClient;  // simulates ADR-005 optional-service-off

#[tokio::test]
async fn dispatch_is_parallel_not_sequential() {
    let harness = OrchestratorHarness::new()
        .with_snap(DelayedProgramClient::new(Duration::from_millis(400)))
        .with_tanf(DelayedProgramClient::new(Duration::from_millis(400)))
        .with_medicaid(DelayedProgramClient::new(Duration::from_millis(400)));
    let start = Instant::now();
    let _ = harness.determine(seed_application_context()).await;
    let elapsed = start.elapsed();
    // If sequential, elapsed ≈ 1200ms. Budget in parallel: 400 + 200 overhead.
    assert!(elapsed < Duration::from_millis(700), "actual: {elapsed:?}");
}

#[tokio::test]
async fn slow_program_does_not_block_combined_result() {
    let harness = OrchestratorHarness::new()
        .with_snap(HappyProgramClient::new())
        .with_medicaid(DelayedProgramClient::new(Duration::from_secs(30)));
    let start = Instant::now();
    let result = harness.determine(seed_application_context()).await;
    let elapsed = start.elapsed();
    assert!(elapsed < Duration::from_secs(6));  // per-service timeout is 5s
    assert!(result.medicaid.is_none());
    assert!(result.snap.is_some());
}

#[tokio::test]
async fn breaker_opens_after_threshold_failures() {
    let failing = FailingProgramClient { /* always fails */ };
    let harness = OrchestratorHarness::new().with_snap(failing);
    for _ in 0..3 { let _ = harness.determine(ctx.clone()).await; }
    assert_eq!(harness.breaker_state_for("snap"), CircuitBreakerState::Open);
}

#[tokio::test]
async fn breaker_closes_after_successful_probe() {
    let recovering = RecoveringProgramClient::new(errors_before_recovery: 3);
    let harness = OrchestratorHarness::new().with_snap(recovering);
    for _ in 0..3 { let _ = harness.determine(ctx.clone()).await; }
    assert_eq!(harness.breaker_state_for("snap"), CircuitBreakerState::Open);
    tokio::time::sleep(breaker_cooldown()).await;
    let _ = harness.determine(ctx.clone()).await;  // half-open probe
    assert_eq!(harness.breaker_state_for("snap"), CircuitBreakerState::Closed);
}

#[tokio::test]
async fn bad_signature_is_rejected_and_audited() {
    let bad = BadSignatureProgramClient;
    let (audit_tx, mut audit_rx) = tokio::sync::mpsc::unbounded_channel();
    let harness = OrchestratorHarness::new()
        .with_snap(bad)
        .with_audit_sink(audit_tx);
    let result = harness.determine(seed_application_context()).await;
    assert!(result.snap.is_none());
    let event = audit_rx.try_recv().unwrap();
    assert_eq!(event.kind, "signature_verification_failed");
}

// services/canopy-eligibility/tests/optional_service_degradation_test.rs

#[tokio::test]
async fn caps_disabled_profile_skips_caps() {
    if !infrastructure_available().await { return; }
    // Requires devstack started with COMPOSE_PROFILES=snap-only
    let cfg = TestConfig::from_env();
    if !cfg.caps_url.is_empty() { return; /* caps is deployed; skip */ }
    let client = TestClient::new(&cfg.eligibility_url);
    let resp = client.post_json("/v1/eligibility/determine", &seed_ctx_json()).await;
    resp.assert_status(200);
    let body = resp.json_value();
    assert!(body["caps"].is_null());
    assert!(body["snap"].is_object());
}