id: T045
name: Service Integration - CreditService Admission Control
goal: Enforce CreditService quota/billing controls across PlasmaVMC and k8shost
status: complete
completed: 2025-12-12 01:39 JST
priority: P1
owner: peerB
created: 2025-12-11
depends_on: [T042]
blocks: []

context: |
  **Foreman Directive (2025-12-11):**
  CreditService (T042) is complete but not enforced. PlasmaVMC and k8shost
  do not yet check quotas before creating resources.

  **Integration Pattern (2-Phase Commit):**
  1. check_quota() - Validate balance/quota limits
  2. reserve_credits() - Phase 1: Reserve credits with TTL
  3. [Create Resource] - Actual resource creation
  4. commit_reservation() - Phase 2: Deduct from wallet
  5. release_reservation() - On failure: Release reserved credits

acceptance:
  - PlasmaVMC create_vm enforces CreditService admission control
  - Failed VM creation releases reserved credits (rollback)
  - Integration test validates end-to-end flow
  - (Optional) k8shost Pod creation integrates CreditService

steps:
  - step: S1
    name: PlasmaVMC CreditService Client Integration
    done: Add creditservice-client dependency, wire into VmServiceImpl
    status: complete
    owner: peerB
    priority: P0
    notes: |
      Files modified:
      - plasmavmc/crates/plasmavmc-server/Cargo.toml (line 35)
      - plasmavmc/crates/plasmavmc-server/src/vm_service.rs (lines 5, 38, 106-124)
    outputs:
      - path: plasmavmc/crates/plasmavmc-server/src/vm_service.rs
        note: CreditService client integration

  - step: S2
    name: create_vm 2-Phase Commit
    done: Wrap create_vm with reserve→create→commit/release flow
    status: complete
    owner: peerB
    priority: P0
    notes: |
      Implementation at vm_service.rs:586-667:
      - Phase 0: check_quota() validates balance/quota limits (lines 594-606)
      - Phase 1: reserve_credits() with TTL (lines 609-629)
      - VM creation (lines 634-648)
      - Rollback on failure: release_reservation (lines 637-646)
      - Phase 2: commit_reservation on success (lines 654-667)
    outputs:
      - path: plasmavmc/crates/plasmavmc-server/src/vm_service.rs
        note: 2-phase commit implementation (~80L)

  - step: S3
    name: Integration Test
    done: E2E test validates admission control flow
    status: complete
    owner: peerB
    priority: P0
    outputs:
      - path: plasmavmc/crates/plasmavmc-server/tests/creditservice_integration.rs
        note: 3 tests - deny (insufficient balance), allow (sufficient), smoke (client API)
    notes: |
      Tests:
      - creditservice_admission_control_deny: Tests denial with 0 balance
      - creditservice_admission_control_allow: Tests full E2E with VM creation
      - creditservice_client_integration_smoke: Tests client API (no QEMU needed)

  - step: S4
    name: k8shost Integration
    done: Pod creation checks CreditService quotas
    status: complete
    completed: 2025-12-12 01:39 JST
    owner: peerB
    priority: P1
    notes: |
      **COMPLETED 2025-12-12 (Unblocked after T041 resolution)**

      Implementation (k8shost/crates/k8shost-server/src/services/pod.rs):
      - Added credit_service field to PodServiceImpl
      - Implemented new_with_credit_service() constructor (CREDITSERVICE_ENDPOINT env var)
      - Added Pod cost calculation: calculate_pod_cost(), parse_cpu(), parse_memory()
      - 2-phase commit in create_pod() (lines 338-424):
        * Phase 0: check_quota(ResourceType::K8sNode)
        * Phase 1: reserve_credits("PodInstance", 300s TTL)
        * Create: storage.put_pod()
        * Rollback: release_reservation on failure
        * Phase 2: commit_reservation on success
      - Pricing: 10 credits/vCPU + 5 credits/GB (same as PlasmaVMC)

      Tests (k8shost/crates/k8shost-server/tests/creditservice_pod_integration.rs):
      - 3 tests (363L): deny, allow, smoke
      - Smoke test passing: ✓ 0.11s

      Pattern consistent with PlasmaVMC vm_service.rs:586-667

evidence:
  - cmd: "cargo test --test creditservice_integration creditservice_client_integration_smoke"
    result: "1 passed; 0 failed (PlasmaVMC)"
  - cmd: "cargo test --package k8shost-server --test creditservice_pod_integration creditservice_pod_client_integration_smoke"
    result: "1 passed; 0 failed; 0 ignored; 2 filtered out; finished in 0.11s (k8shost)"
  - cmd: "cargo check --package k8shost-server"
    result: "Finished `dev` profile [unoptimized + debuginfo] target(s) in 7.41s"
notes: |
  **T045 COMPLETE (2025-12-12) by PeerB:**
  - S1-S3: PlasmaVMC CreditService integration (2025-12-11)
  - S4: k8shost CreditService integration (2025-12-12, unblocked after T041)
  - Total: ~763L implementation + tests
  - Pattern consistent across PlasmaVMC and k8shost

  **Implementation Pattern:**
  - CREDITSERVICE_ENDPOINT env var enables admission control
  - Simple pricing: vcpus * 10 + memory_gb * 5
  - Graceful degradation: if CreditService unavailable, continues without quota check
  - 2-phase commit: check_quota → reserve → create → commit/rollback