Procurement in the stack: compose, Enterprise edition, policy provisioning, smoke (needs gateway PR #18)

.github/workflows/e2e.yml

@@ -74,14 +74,14 @@ jobs:
       # pre-approved, still work fine) - now that workflow-approval is up, provision the real policies
       # against it and recreate just the it-change-management container with their ids: compose detects
       # the changed environment and restarts only that one service, nothing else is touched.
-      - name: Provision CAB/ECAB policies for it-change-management
+      - name: Provision CAB/ECAB policies for it-change-management and the purchase-order policy for it-procurement
         run: thinklab-platform/scripts/stack/provision-change-management.sh >> "$GITHUB_ENV"
 
-      - name: Restart it-change-management with its CAB/ECAB policy ids
+      - name: Restart it-change-management and it-procurement with their policy ids
         working-directory: thinklab-platform
-        run: docker compose up -d it-change-management
+        run: docker compose up -d it-change-management it-procurement
 
-      - name: Wait until it-change-management is ready again
+      - name: Wait until they are ready again
         run: thinklab-platform/scripts/stack/wait-ready.sh 120
 
       - name: Install newman
@@ -169,6 +169,9 @@ jobs:
       - name: Cloud inventory smoke (AWS and Azure resources, the provider's id is the identity, twenty reports of one new resource make one, a changed report replaces the snapshot, fixed lists and four tags and nothing a tool says is repeated, judged present or gone when read, a terminated resource that comes back, filters and summary, staff only, recorded on the ledger)
         run: thinklab-platform/scripts/e2e/cloud-inventory-smoke.sh
 
+      - name: Procurement smoke (a purchase order approved by the shared approval service, an approver who is not eligible refused, a rejection is final, placed and received in part, the same receipt twenty times at once is one, twenty receipts of one unit against five to arrive leave exactly five, never more than was ordered, a placed order with goods received cannot be cancelled, fixed lists and identifiers with nothing a tool says repeated, staff only, recorded on the ledger)
+        run: thinklab-platform/scripts/e2e/procurement-smoke.sh
+
       - name: Promises alerting smoke (a rule watches the patch, capacity or backup registry, a broken promise opens one alert and one incident with a fixed code, a backup that never ran opens nothing, a promise kept again resolves the alert, staff only)
         run: thinklab-platform/scripts/e2e/promises-alerting-smoke.sh
 

README.md

@@ -46,6 +46,7 @@ own repository (`micronaut-<domain>-service`); this repository ties them togethe
 | it-ipam | 8110 | `micronaut-it-ipam-service` |
 | it-cloud-cost | 8111 | `micronaut-it-cloud-cost-service` |
 | it-cloud-inventory | 8113 | `micronaut-it-cloud-inventory-service` |
+| it-procurement | 8114 | `micronaut-it-procurement-service` |
 | it-dr-registry | 8112 | `micronaut-it-dr-registry-service` |
 
 Infrastructure: MongoDB 8.0 as a single-node replica set (multi-document transactions, which the
@@ -79,9 +80,9 @@ The web app (`../thinklab-web`) is behind a compose profile so the commands abov
 |---|---|---|---|---|
 | `homelab` | 12: MongoDB, NATS, sign-in, assets, discovery, health checks, capacity, incidents, alerting, the gateway | 160 MiB | 2.1 GiB | 2560 MiB |
 | `team` | 28: also sites, maintenance windows and hardware maintenance, change management and its approvals, requests, problems, knowledge base, topology graph, type catalog, notifications, and the backup, patch, DR, vendor and licence registries | 192 MiB | 5.0 GiB | 6144 MiB |
-| `enterprise` | 37: everything the compose file starts, also the audit ledger and its anchor store, plans and subscriptions, consumables, single sign-on, the Jira and ServiceNow connector, IPAM, cloud costs and the cloud inventory | 256 MiB (the compose default) | 7.3 GiB | 9216 MiB |
+| `enterprise` | 38: everything the compose file starts, also the audit ledger and its anchor store, plans and subscriptions, consumables, single sign-on, the Jira and ServiceNow connector, IPAM, cloud costs, the cloud inventory and procurement | 256 MiB (the compose default) | 7.3 GiB | 9216 MiB |
 
-Measured on 2026-10-19 (the `enterprise` row before the cloud inventory, one more service of about the size of the cloud cost registry, was added; it has not been measured again), each edition started from nothing in its own compose project (own MongoDB 7.0, no published ports), then 90 to 150 seconds idle
+Measured on 2026-10-19 (the `enterprise` row before the cloud inventory and procurement, two more services of about the size of the cloud cost registry, were added; it has not been measured again), each edition started from nothing in its own compose project (own MongoDB 7.0, no published ports), then 90 to 150 seconds idle
 once every container was up, nothing restarting. The gateway has a 256 MiB heap in all three (it had no cap at all and started at 1.1 GiB). In `enterprise`,
 413 MiB is the `anchor-store`, a LocalStack standing in for S3 with Object Lock; against a real bucket it is not part of the stack. These are idle numbers:
 a service under load grows to its heap. Heaps are set with `THINKLAB_JAVA_OPTS` and `THINKLAB_GATEWAY_JAVA_OPTS`, the budget with
@@ -144,6 +145,7 @@ With the stack up (either way):
 | `scripts/e2e/netdata-connector-smoke.sh` (`netdata-connector-smoke.ps1`) | the Netdata connector against a test double of an agent (`mock-netdata.mjs`, started by the script): the node reaches the discovery queue once, a chart becomes a capacity sample (dimensions added up, a factor), a failing chart or an unreachable agent fails only what it must, the token is sent and never printed |
 | `scripts/e2e/dr-smoke.sh` (`dr-smoke.ps1`) | the DR registry through the gateway (DR registry ADR-030..033): a recovery plan judged when read, a walk through the runbook that counts as a pass but measures nothing, a failover and a full recovery that measure the recovery time and point, twenty reports of one exercise make one, a later pass clears a failure and a late report moves nothing, a backup-restore plan that cannot promise to lose nothing, the runbook as an identifier, a race between two people, staff only, every mutation recorded on the ledger |
 | `scripts/e2e/cloud-inventory-smoke.sh` (`cloud-inventory-smoke.ps1`) | the cloud inventory through the gateway (cloud inventory ADR-030..034): an AWS or Azure resource whose provider id is its identity, the same one again restated, a changed report that replaces the snapshot, twenty reports of one new resource that make one, fixed lists and four tags with nothing a tool says repeated, judged present or gone when read, a terminated resource that comes back, the filters and the summary, staff only, recorded on the ledger |
+| `scripts/e2e/procurement-smoke.sh` (`procurement-smoke.ps1`) | procurement through the gateway, against the REAL approval service (procurement ADR-030..034): a purchase order drafted, sent for approval and approved by an eligible approver (one who is not eligible is refused with the reason, a rejection is final), placed and received in part, the same receipt reported twenty times at once is one, twenty receipts of one unit against five to arrive leave exactly five, a delivery reference reused with another quantity and a placed order with goods received cancelled are refused, fixed lists and identifiers with nothing a tool says repeated, staff only, recorded on the ledger. Needs the purchase-order policy that `provision-change-management.sh` (or `start-local-stack.ps1`) provisions |
 | `scripts/e2e/events-smoke.sh` (`events-smoke.ps1`) | creating a user publishes `user.initiated` through the outbox and NATS, and notification-dispatch delivers the welcome notification |
 | `scripts/e2e/hardware-maintenance-smoke.sh` (`hardware-maintenance-smoke.ps1`) | starting a WorkOrder repair moves the Asset into MAINTENANCE and passing quality check moves it back to DEPLOYED, both through NATS |
 | `scripts/e2e/ledger-smoke.sh` (`ledger-smoke.ps1`) | the gateway records every mutating request on the compliance ledger and the hash chain verifies, anchoring included |

docker-compose.yml

@@ -479,6 +479,20 @@ services:
       <<: *service-env
       MONGODB_URI: mongodb://mongo:27017/thinklab_it_cloud_inventory_db?replicaSet=thinklab-rs0
 
+  # Procurement (Journey 15, sixth service): purchase orders for a vendor, approved through the shared approval service and received in part or in whole by
+  # people; what arrived and whether it is late are judged when read. THINKLAB_PO_POLICY_ID has no default (the approval policy is provisioned after the
+  # approval service is up, like the CAB/ECAB policies; without it, sending an order for approval answers 502). Staff only.
+  it-procurement:
+    <<: *service
+    build: ../micronaut-it-procurement-service
+    image: thinklab/it-procurement:local
+    ports: ["8114:8080"]
+    environment:
+      <<: *service-env
+      MONGODB_URI: mongodb://mongo:27017/thinklab_it_procurement_db?replicaSet=thinklab-rs0
+      WORKFLOW_APPROVAL_SERVICE_URL: http://workflow-approval:8080
+      THINKLAB_PO_POLICY_ID: ${THINKLAB_PO_POLICY_ID:-}
+
   # TEST DOUBLE, never part of a real deployment (profile health-test): something for the health monitor to watch, whose answer the smoke controls.
   mock-target:
     profiles: ["health-test"]
@@ -560,6 +574,7 @@ services:
       GATEWAY_IT_CLOUD_COST_URL: http://it-cloud-cost:8080
       GATEWAY_IT_DR_REGISTRY_URL: http://it-dr-registry:8080
       GATEWAY_IT_CLOUD_INVENTORY_URL: http://it-cloud-inventory:8080
+      GATEWAY_IT_PROCUREMENT_URL: http://it-procurement:8080
       # Plain-http compose stack: the refresh cookie cannot be Secure here (set true behind https). Path is as the browser sees it.
       GATEWAY_SESSION_COOKIE_SECURE: "false"
       GATEWAY_AUDIT_LEDGER_URL: http://compliance-audit-ledger:8080

scripts/e2e/Common.ps1

@@ -82,6 +82,7 @@ $script:Services = @(
     [pscustomobject]@{ Name = 'micronaut-it-cloud-cost-service';                  Port = 8111; Db = 'thinklab_it_cloud_cost_db' },
     [pscustomobject]@{ Name = 'micronaut-it-dr-registry-service';                   Port = 8112; Db = 'thinklab_it_dr_registry_db' },
     [pscustomobject]@{ Name = 'micronaut-it-cloud-inventory-service';               Port = 8113; Db = 'thinklab_it_cloud_inventory_db' },
+    [pscustomobject]@{ Name = 'micronaut-it-procurement-service';                   Port = 8114; Db = 'thinklab_it_procurement_db' },
     [pscustomobject]@{ Name = 'micronaut-ci-type-catalog-service';                 Port = 8093; Db = 'thinklab_ci_type_catalog_db' }
 )