feat: verify bounded simultaneous schedule execution

sdk/go/cmd/orbit-schedule-load/handler.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	orbit "git.yuntuo.hk/k2safe/orbit/sdk/go"
+	"sync"
+)
+
+// invocation 固定首次调用的任务/尝试身份，重复调用不得覆盖首条证据。
+type invocation struct {
+	index     int    // index 输入中的计划序号。
+	attemptID string // attemptID 首次调用的尝试。
+	calls     int    // calls 同一任务的调用次数。
+}
+
+// invocationLog 最多保存预期任务数个身份，异常输入不能无限增长内存。
+type invocationLog struct {
+	mu       sync.Mutex             // mu 保护多个Worker并发回调。
+	limit    int                    // limit 可存任务身份上限。
+	calls    map[string]*invocation // calls 以任务身份记录真实调用。
+	invalid  int                    // invalid 无法核验的输入次数。
+	overflow int                    // overflow 超出身份预算的调用次数。
+}
+
+func newInvocationLog(n int) *invocationLog {
+	return &invocationLog{limit: n, calls: map[string]*invocation{}}
+}
+func (l *invocationLog) handler(run context.Context, c config, runID string) orbit.WorkerHandler {
+	return orbit.WorkerHandler{Capability: orbit.WorkerCapability{Handler: handlerName(runID), HandlerVersion: "v1", PayloadVersion: "v1"}, Handle: func(ctx context.Context, e orbit.WorkerExecution) (json.RawMessage, error) {
+		payload, ok := decodePayload(e.Task.Payload)
+		if !ok || payload.Schedule < 0 || payload.Schedule >= c.Schedules || !matchesTask(e.Task, c, runID, payload.Schedule) || !validID(e.AttemptID) || e.Epoch != 1 || e.ConcurrencyToken != 0 {
+			l.mu.Lock()
+			l.invalid++
+			l.mu.Unlock()
+			return nil, &orbit.WorkerFailure{Code: "SCHEDULE_INPUT_MISMATCH"}
+		}
+		l.mu.Lock()
+		existing := l.calls[e.Task.ID]
+		if existing != nil {
+			existing.calls++
+			l.mu.Unlock()
+			return nil, &orbit.WorkerFailure{Code: "DUPLICATE_INVOCATION"}
+		}
+		if len(l.calls) >= l.limit {
+			l.overflow++
+			l.mu.Unlock()
+			return nil, &orbit.WorkerFailure{Code: "INVOCATION_LIMIT"}
+		}
+		l.calls[e.Task.ID] = &invocation{index: payload.Schedule, attemptID: e.AttemptID, calls: 1}
+		l.mu.Unlock()
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-run.Done():
+			return nil, run.Err()
+		default:
+		}
+		return e.Task.Payload, nil
+	}}
+}
+func (l *invocationLog) summarize(r *scheduleReport, o *observations) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	r.Errors["INVALID_HANDLER_INPUT"] += l.invalid
+	r.Errors["HANDLER_IDENTITY_LIMIT"] += l.overflow
+	for taskID, call := range l.calls {
+		r.HandlerCalls += call.calls
+		if call.calls > 1 {
+			r.DuplicateInvocations += call.calls - 1
+		}
+		s := o.tasks[taskID]
+		if s == nil || !s.verified || s.attemptID != call.attemptID || o.plans[s.occurrence.ScheduleID].index != call.index {
+			r.UnconfirmedInvocations += call.calls
+		}
+	}
+	for taskID, s := range o.tasks {
+		if s.verified && l.calls[taskID] == nil {
+			r.Errors["MISSING_LOCAL_INVOCATION"]++
+		}
+	}
+}