Orleans.Lattice.Api.Replication 9.9.0

Orleans.Lattice.Api.Replication

Optional, opt-in replication control facade add-on for Orleans.Lattice. Exposes a single transport-agnostic admin surface that drives runtime per-tree cross-cluster replication configuration through the Orleans.Lattice.Replication engine: enable replication for a tree (fixing its wire merge mode), disable it, and inspect the effective replicated-tree set (runtime and static enrollment reconciled) - from one place. Sibling packages project this facade onto a code-first gRPC surface and an MCP tool group.

Design

The facade mirrors the Orleans.Lattice.Api.Backup and Orleans.Lattice.Api.Schema control facades: the facade is the contract, transports bind over it, and it costs nothing until it is registered.

• Runtime, not redeploy. Replication membership becomes a runtime operation instead of static host config baked into every silo image.
• Converges across the estate. An enable or disable authored on one cluster converges over the already-enrolled peer set; the operator flips it once and every peer follows.
• Mode fixed at enable time. A tree's merge mode is chosen when it is first enabled and cannot be changed in place; the sanctioned path to change a mode is disable, then re-enable under the new mode (naming a bootstrap source cluster re-seeds a tree that already holds data).

Security

Enable and disable authorize fail-closed through the same Lattice access gate the data plane uses, before touching engine state, requiring the dedicated LatticeOperation.Replication capability on the target tree; the config read applies the same check per tree to filter what it reports. Once an authorization add-on supplies the access gate, anonymous callers are denied by default; with only the core no-op gate registered, every call is allowed.

• Permission-scoped discovery. GetReplicationConfigAsync reports only the trees the caller is authorized to manage, so it never reveals a tree outside the caller's grant.
• Propagation is not re-consented. The trust boundary is the existing peer enrolment, so authorization gates the authoring cluster only.
• Opt-in and absent by default. Nothing is registered unless the host calls AddLatticeReplicationApi() or AddLatticeReplicationStatusApi().
• AddLatticeReplicationApi() must be registered after AddLatticeReplication(..., enableRuntimeConfig: true). The call fails fast with an actionable message otherwise.

Peer status

AddLatticeReplicationStatusApi() adds a separate, read-only facade, ILatticeReplicationStatus. It reports each replication link - one tree, one peer region, one direction - across the whole local cluster, with its backlog, error streak, time since last contact, in-flight count, and a health derived against the LatticeReplicationStatusOptions thresholds. The report is paged and permission-scoped by the same capability as the config read. It needs only AddLatticeReplication(...) registered before it, and fails fast otherwise.

Usage

siloBuilder
    .AddLattice(/* ... */)
    .AddLatticeReplication(/* ... */, enableRuntimeConfig: true)
    .AddLatticeReplicationApi()
    .AddLatticeReplicationStatusApi(); // optional: read-only peer status

Bind a transport over the facade to drive replication configuration remotely.