feat: parity batch (App Service slots, Cloud Datastore, OCI Queue/Notifications, dashboard pages)

.github/workflows/ci.yml

@@ -60,16 +60,17 @@ jobs:
           token: ${{ env.GH_CI_TOKEN }}
           fetch-depth: 0
 
+      # Full-repo lint (go.mod/.golangci.yml changed) exhausts the default runner disk; lint needs no docker images or apt packages.
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
         with:
           tool-cache: false
           android: true
           dotnet: true
           haskell: true
-          large-packages: false
-          docker-images: false
-          swap-storage: false
+          large-packages: true
+          docker-images: true
+          swap-storage: true
 
       - name: Keep Go temp files and build cache off the /tmp tmpfs
         run: |
@@ -939,6 +940,16 @@ jobs:
           path: /tmp/gopherstack-tofu-provider-cache
           key: tofu-providers-${{ runner.os }}-aws5
 
+      - name: Cache OpenTofu provider mirror
+        id: tofu-mirror-cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: ${{ runner.temp }}/tofu-provider-mirror
+          key: tofu-mirror-${{ runner.os }}-${{ hashFiles('test/terraform/*_test.go', 'test/terraform/fixtures/**') }}
+
+      - name: Point the terraform suite at the provider mirror
+        run: echo "GOPHERSTACK_TOFU_MIRROR_DIR=$RUNNER_TEMP/tofu-provider-mirror" >> "$GITHUB_ENV"
+
       - name: Cache OpenTofu Google provider
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:

.github/workflows/routing-proof.yml

@@ -0,0 +1,75 @@
+name: Routing Proof
+
+on:
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'internal/app/routing*'
+      - 'internal/routegates/**'
+      - 'pkgs/service/router*'
+      - 'testdata/routing/**'
+      - 'services/*/route*.go'
+      - 'cmd/routingcorpus/**'
+      - '.github/workflows/routing-proof.yml'
+  schedule:
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+
+permissions: read-all
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  routing-proof:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Free Disk Space (Ubuntu)
+        uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
+        with:
+          tool-cache: false
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: false
+          docker-images: false
+          swap-storage: false
+
+      - name: Keep Go temp files and build cache off the /tmp tmpfs
+        run: |
+          if mountpoint -q /mnt; then base=/mnt; else base="$RUNNER_TEMP"; fi
+          sudo mkdir -p "$base/gotmp" "$base/gocache"
+          sudo chown -R "$(id -u):$(id -g)" "$base/gotmp" "$base/gocache"
+          {
+            echo "GOTMPDIR=$base/gotmp"
+            echo "TMPDIR=$base/gotmp"
+            echo "GOCACHE=$base/gocache"
+          } >> "$GITHUB_ENV"
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+
+      - name: Download Go modules (retry proxy stream errors)
+        run: |
+          for i in 1 2 3 4 5; do
+            go mod download && exit 0
+            sleep $((i * 15))
+          done
+          exit 1
+
+      - name: Install Task
+        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        with:
+          version: 3.54.0
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Routing proof (full, no -short)
+        run: task routing-proof

.golangci.yml

@@ -516,9 +516,15 @@ linters:
       # isolation_test.go uses unexported types and must be in the same package.
       - path: 'elasticache/isolation_test.go'
         linters: [ testpackage, paralleltest ]
+      # gremlin_ws_proxy_test.go drives the unexported front against a fake Gremlin Server (no docker).
+      - path: 'neptune/gremlin_ws_proxy_test\.go'
+        linters: [ testpackage ]
       # router_index_test.go checks the unexported index against the unexported linear scan.
       - path: 'pkgs/service/router_index_test.go'
         linters: [ testpackage ]
+      # router_alt_gate_test.go checks the unexported AltGate.admits against a lookup context.
+      - path: 'pkgs/service/router_alt_gate_test.go'
+        linters: [ testpackage ]
       # routing_test.go white-box tests unexported routing helpers and the
       # injectable RNG field, so it must live in the same package.
       - path: 'route53/routing_test.go'

AZURE.md

@@ -86,6 +86,8 @@ That said, MQTT's fixed port (`1883`) happens to fall *outside* `--port-range-st
 - **M2 (done)** — `services/azuretable`: table CRUD (Create/Delete/List Table), full entity lifecycle (Insert/Get/Query/Replace/Merge/Delete), a hand-written `$filter` lexer/parser/evaluator (eq/ne/lt/le/gt/ge, and/or/not, parentheses, every OData literal form -- string/int/Int64/float/bool/datetime/guid/binary -- against `PartitionKey`/`RowKey`/`Timestamp` and scalar properties), all eight EDM property types (String/Int32/Int64/Double/Boolean/DateTime/Guid/Binary) with `@odata.type` annotation round-tripping matching `azure-sdk-for-go/sdk/data/aztables`'s own client-side inference, and ETag-based optimistic concurrency (If-Match `*`/specific/absent -> upsert), wired into `cli.go` and bound to its own fixed port (10002, Azurite's own Table port; synchronous bind, fail-fast, no `PortAlloc` fallback -- mirrors Blob's M0 and Queue's M1 port strategy, see section 4). Batch (`$batch` multipart/mixed changesets) and continuation-token pagination are deferred -- see `services/azuretable/PARITY.md`. See `services/azuretable/README.md`/`PARITY.md` for current status and known gaps.
 - **Azure Files (done)** -- `services/azurefile` (PARITY.md is the authority): the file shares data plane (service properties, shares with snapshots/leases/ACLs/soft delete, directories, files with sparse ranges, copy and rename) on fixed port 10009 (`--azure-file-port`), account by path or `<account>.file.<host>`, `.file.` also reachable through the shared storage vhost listener, ARM `primaryEndpoints.file` advertised, share soft delete driven by ARM `fileServices/default` `shareDeleteRetentionPolicy`. Tests are driven through `azure-sdk-for-go/sdk/storage/azfile`.
 - **Azure Monitor Logs (done)** -- `services/azuremonitor` (PARITY.md is the authority): the Logs Ingestion API (`POST /dataCollectionRules/{immutableId}/streams/{stream}`, gzip, 1 MB limit, stream schema checks that drop bad records like Azure, or reject the upload with `--azure-monitor-strict-ingest`, `transformKql` through the in-tree KQL engine) and the Logs Query API (`/v1/workspaces/{id}/query`, `$batch`, resource-centric queries) on one HTTPS listener, fixed port 10013 (`--azure-monitor-port`), bearer auth (optionally JWT-shape checked). `services/azuremonitor/kql` is a KQL subset engine (tables, let, union, where, project/extend/summarize/sort/top/distinct and about 70 scalar functions); unsupported operators answer 400 SemanticError. ARM `Microsoft.OperationalInsights` (workspaces, tables, shared keys) and `Microsoft.Insights` (data collection endpoints and rules) live in `services/azurearm` over the `MonitorLogs` seam. Tests are driven through `azure-sdk-for-go/sdk/monitor/ingestion/azlogs`, `sdk/monitor/query/azlogs`, `armoperationalinsights` and `armmonitor`.
+
+- **Microsoft Graph (done)** -- `services/azuregraph` (PARITY.md is the authority): Graph v1.0/beta directory objects (applications, service principals, users, groups, app role assignments, OAuth2 permission grants, owners and members references, `directoryObjects/getByIds`, `me`, `organization`, `domains`) on one HTTPS listener, fixed port 10014 (`--azure-graph-port`). OData `$filter`/`$select`/`$top`/`@odata.nextLink`/`$orderby`/`$count`/`$search` with the `ConsistencyLevel: eventual` rules for advanced queries, alternate keys (`applications(appId='..')`), `addPassword` (secret returned once, PBKDF2 hash stored), and the Graph error envelope. ARM advertises the listener as `microsoftGraphResourceId`, so `terraform-provider-azuread` with `metadata_host` works unchanged (`test/terraform/azure/azuread_test.go`). The ARM token endpoint authenticates `client_id`/`client_secret` of applications registered here and stamps the service principal's object id as `oid`; the seeded dev service principal (the all-zero client id) accepts any secret. `--azure-arm-validate-principals` makes role assignments reject principals that are neither directory objects nor user-assigned managed identities.
 - **M3 (done)** — `services/cosmosdb`: database/container CRUD (with a single-path partition-key declaration; hierarchical/multi-path partition keys deferred), full document CRUD including upsert (`x-ms-documentdb-is-upsert`) and ETag-based optimistic concurrency (If-Match absent/specific -> upsert/conditional), and a hand-written SQL-subset query engine (tokenizer -> recursive-descent parser -> AST -> executor, directly reusing `services/azuretable/odata_filter.go`'s and `services/s3/select_sql_*.go`'s shape per this section's own M3 rationale below) supporting `SELECT *`/projections with `AS` aliasing, `FROM <alias> [<realias>]`, `WHERE` with the full comparison/boolean/`IS NULL` grammar and `@param` bindings, `ORDER BY`, `TOP`, and `OFFSET`/`LIMIT`. Auth is Cosmos's own master-key HMAC-SHA256 scheme (`services/cosmosdb/masterkey.go`, deliberately NOT `pkgs/azureauth` -- see section 3), opt-in verification via `--cosmosdb-validate-auth`, defaulting to the real Cosmos DB Local Emulator's well-known fixed master key. Bound to its own fixed port (8081, the real emulator's own published default -- NOT an Azurite-style 1000x number, since Cosmos's real emulator is a separate tool; synchronous bind, fail-fast, no `PortAlloc` fallback, and -- unlike M0/M1/M2's ports -- 8081 sits *outside* `--port-range-start`/`--port-range-end`'s own default range, mirroring `services/iot`'s MQTT precedent; see section 4). Fake `x-ms-request-charge`/`x-ms-session-token`/`x-ms-activity-id` headers on every response (real RU accounting is out of scope). Integration tests against `azure-sdk-for-go/sdk/data/azcosmos`; JS/Python SDK cross-compat smoke tests remain M4 scope. See `services/cosmosdb/README.md`/`PARITY.md` for current status and known gaps. **This completes the full 4-service Azure support plan** (Blob, Queue, Table, Cosmos); M4 (docs/polish, cross-SDK e2e) has since landed as well.
 - **M4 (done)** — Docs/polish: the four services now render under their own **Azure** heading in the root `README.md` services table with curated display names (`cmd/gendocs/categories.go`) rather than falling through to "Other" as auto-title-cased slugs; per-service guides at `docs/services/azureblob.md`/`azurequeue.md`/`azuretable.md`/`cosmosdb.md` following the established AWS guide format; a four-service docker-compose example at `examples/azure-services/` (indexed in `examples/README.md`), with `Dockerfile`/`Dockerfile.goreleaser` now exposing 10000/10001/10002/8081; and the cross-SDK smoke suite from section 7 -- `test/e2e/crosssdk/azure_smoke.mjs` (`@azure/storage-blob`, `@azure/storage-queue`, `@azure/data-tables`, `@azure/cosmos`) and `azure_smoke.py` (`azure-storage-blob`, `azure-storage-queue`, `azure-data-tables`, `azure-cosmos`), driven by `test/e2e/azure_crosssdk_test.go`, which starts gopherstack on ephemeral ports and runs both scripts in CI's `e2e-tests` job. Note: no per-service badges were added -- `.badges/` holds only repo-level aggregate badges (services/operations/parity counts), which already include the Azure services, so "badges/icons" resolved to verifying zero `cmd/gendocs` drift rather than adding new SVGs. The cross-SDK suite immediately earned its keep by catching a real wire-compatibility gap: `Get Blob` accepted only the `Range` header, but the Python/JS SDKs send `x-ms-range` exclusively, so single-range downloads were unreachable from those SDKs despite the Go SDK passing (fixed in `services/azureblob/handler.go`; see that service's `PARITY.md`).
 

Dockerfile

@@ -16,19 +16,19 @@ RUN go mod download
 # Copy the source from the current directory to the Working Directory inside the container
 COPY . .
 
-# Build dashboard2 frontend assets before embedding in Go binary
 # Build dashboard2 frontend assets before embedding in Go binary
 # If the SPA was pre-built (e.g. via `task ui-build` before `task demo`), skip the npm build
 # to avoid OOM inside the container. Fall back to building in-container if assets are absent.
-RUN if [ ! -f dashboard/static/spa/index.html ]; then \
+RUN if [ ! -f dashboard/static/spa/index.html.gz ] && [ ! -f dashboard/static/spa/index.html ]; then \
         npm --prefix ui ci --include=optional && \
         NODE_OPTIONS="--max-old-space-size=8192" npm --prefix ui run build; \
     fi
 
 # Build the Go app
-RUN go build \
+RUN CGO_ENABLED=0 go build \
     -tags 'netgo osusergo static_build' \
     -trimpath \
+    -buildvcs=false \
     -ldflags="-w -s -extldflags '-static -fno-PIC'" \
     -o gopherstack