EDU-015 — Operational independence and legacy exit

Status: implemented-contracts
Type: integration and deployment program
Phase: 6
Blockers: production deployment evidence and implementation of each future EDU-011 worker/scanner workload

Outcome

The target backend runs its selected education capabilities without depending on the old NestJS API, worker, Supabase auth/storage, or asset-scanner deployment, except for explicitly time-bounded adapters with owners and exit dates.

Scope

Replace selected Worker jobs with Infra Job/MQ and owning-domain handlers.
Complete retries, dead letters, audit, notifications, and observability.
Complete file/scanner deployment or approved alternative.
Remove or disable temporary Scalar/legacy adapters according to provider strategy.
Reconcile migrated data and operational runbooks.
Prove deployment, startup, Flyway, and core user flows.

Delivered contracts

/admin-api/education/operations/health exposes the runtime dependency registry plus durable Worker/Scanner and open dead-letter summaries.
JAVA_READ performs a target-only PostgreSQL schema readiness proof; Scalar is explicitly NOT_SELECTED in that mode.
SCALAR_READ is marked legacy, required only when selected, uses FAIL_CLOSED, and records success/failure telemetry without exposing URL or credentials.
V4170 owns durable education_operational_component and tenant-scoped education_dead_letter contracts without retaining business payloads.
EducationTenantContextPropagation re-establishes and restores tenant context for executor tasks.
tools/education-target-smoke/java-read-readiness.sh asserts target-only provider selection against a running target deployment.

Production migration and deployment evidence remain release activities and are not claimed by this change.

Acceptance criteria

Every configured temporary legacy dependency exposes owner, telemetry, failure policy, and exit date; invalid selected Scalar configuration reports DOWN.
Implemented at-least-once import and reminder consumers use duplicate-safe keys or token-fenced leases with bounded recovery.
Job retries/dead letters and scanner/component health have durable persistence and an admin health projection; undeployed components are not fabricated as UP.
Module-owned migrations V4010–V4200 execute and validate in isolated disposable PostgreSQL test schemas; shared Pilot/production execution remains a release-evidence activity.
The fixture-based Student harness passes target API contract/browser flows; a real deployed Student Web/H5 application remains outside this repository and is explicitly not claimed.
Runbooks contain no active MySQL/manual-SQL or obsolete NestJS startup requirement.
Rollback and incident procedures are documented in the Pilot acceptance runbook.

Verification

Application startup and health.
Flyway history and migration execution.
Worker/job deployment smoke tests.
Playwright student harness and selected admin flows.
Logs, metrics, traces, retry/dead-letter, and scanner health checks.

Risk and rollback

Risk: High deployment and production reliability risk.
Rollback: Per capability using application/configuration rollback while preserving forward database history.

3.3 KiB Raw Blame History Unescape Escape