## Overview Define and implement the Outbound layer: outbound driver behavior (pooling, retry, circuit breaking) over platform-satisfied dependencies, composed from native per-language libraries and wired in by the chassis. Neither entrypoint generator emits outbound code. Searching for `outbound` across [`cli/src/build/go.rs`](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/cli/src/build/go.rs) and [`cli/src/build/rust.rs`](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/cli/src/build/rust.rs) returns nothing, so a declared backend produces no pool, no client, and no RED metrics. The handler opens its own connection, which is what this layer prevents. On the schema side, [`outbound.proto`](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/config/gitlab/bench/v1/outbound.proto) predates LabKit v2's outbound modules and overlaps them, so the work is reconciliation rather than completion: deciding which of bench's messages survive the comparison. ## What already exists upstream LabBench composes LabKit and never reimplements it. As of 2026-09, [`gitlab-org/labkit` `v2`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2) ships much of what this milestone was originally scoped to build: | Module | Covers | |---|---| | [`v2/postgres`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/postgres) | Instrumented client, pgxpool, `app.Component` lifecycle, per-query OpenTelemetry spans | | [`v2/secret`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/secret) | Env, file, and rotating-file providers; secrets redacted in logs and JSON | | [`v2/infrastructure`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/infrastructure) | Reads the platform's infrastructure contract from `/etc/labkit/infrastructure.yaml` | | [`v2/httpclient`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/httpclient) | Traced and logged client, `DoWithRetry` with configurable status codes | | [`v2/tls`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/tls) | Cert loading, hot reload, client verification modes | | [`v2/redis`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/redis), [`v2/objectstore`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/objectstore) | Backend types this milestone lists as out of scope | [`gitlab-org/protos`](https://gitlab.com/gitlab-org/protos) publishes `gitlab.infrastructure.v1` with `PostgreSQL`, `Redis`, and `ObjectStore` ([`proto/infrastructure/gitlab/infrastructure/v1/`](https://gitlab.com/gitlab-org/protos/-/tree/8faa4360b2889adef4086e3503e393a8adf1d770/proto/infrastructure/gitlab/infrastructure/v1)), and Fairway's manifest carries an `Infrastructure` block typed `{presence: UNUSED | OPTIONAL | REQUIRED}` per dependency ([`proto/manifest/v1/manifest.proto`](https://gitlab.com/gitlab-com/gl-infra/platform/runway/fairway/-/blob/6ad4b81f25c37fa78f66c67b6ffca1ab9eaaf8a1/proto/manifest/v1/manifest.proto)). What LabKit does **not** provide, and bench therefore owns: - **NATS**, in either direction. No module exists. - **Circuit breaking.** No module exists, and bench's `CircuitBreaker` has no upstream counterpart. - **Query-level metrics.** [`v2/postgres/tracer.go`](https://gitlab.com/gitlab-org/labkit/-/blob/df307e038980743f2e50a83cf718b1de2b50f352/v2/postgres/tracer.go) traces every query but emits no histogram, so DB observability's metrics half is an upstream ask. ## Who owns a connection Settled policy: bench declares what it needs and describes a connection only where nothing else can. The test is whether the platform provisions that kind of thing, not whether a contract happens to exist yet. | Backend | Who owns the connection | |---|---| | Postgres, Redis, object store | Platform, via `gitlab.infrastructure.v1`. LabKit reads it at runtime; bench declares only the need | | HTTP, gRPC | bench, provisionally. `base_url` and `address` are service-to-service addressing, not infrastructure. Revisit if a service-discovery contract appears | | NATS | Split. The platform names the instance, bench owns the subject and consumer config. `NATSEndpoint.instance` is already a name, so the split already shipped | | ClickHouse | Unresolved upstream. No message in `gitlab.infrastructure.v1`, no Fairway field, no runtime source, so there's nothing to defer to | Per-cell addressing isn't settled: platform-provisioned in principle, but no contract carries it yet. This rule outlives the epic, so it belongs in [`docs/decisions/`](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/main/docs/decisions/DECISIONS.md) rather than here. Writing it up as an `LB-D` record, with the number taken from the SOA Architecture Decision Index, is still to do. ## Scope Full evidence for each gap lives in the example gap tables ([artifact-registry](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/examples/artifact-registry/README.md#gaps-found), [GKG](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/examples/gkg/README.md#gaps-found)). | Deliverable | Fixture / evidence | |---|---| | Resolve "DB schema ownership" (LB-D2). The boot-time schema-landmark self-check is bench's part; deploy-time gating belongs to the Platform Binding / operator | Decision Index | | Resolve "Data access layer" (LB-D3), [bench#74](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/74). Last lean towards option 2, a co-located [DAL domain](https://docs.google.com/document/d/1Wq2yBqfp5wycwddKlL16y1b81Idq_RZWgCQSmCaAlU4) | gate-iam `iam-data-access` composite | | Delete `PostgresConfig`'s six identity fields, `password_secret_ref` included, [bench#85](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/85) | AR gap 7 | | Outbound transport config replacing the `mtls_enabled` bool: CA cert, client cert, key, `server_name` ([bench#71](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/71)), deferred out of [DM-4](https://gitlab.com/groups/gitlab-org/lab-bench/-/epics/4)'s inbound TLS work. Match the LabKit scheme selection in [gitlab-org/theseus&9](https://gitlab.com/groups/gitlab-org/theseus/-/epics/9) | AR gap 4 | | HTTP outbound connector, wiring only: [`v2/httpclient`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/httpclient) composed into a named, instrumented client ([bench#76](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/76)) | AR HTTP backends | | gRPC outbound connector, net-new with no upstream module; also settles `proto_file` against vendored stubs ([bench#77](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/77)) | AR gap 11 | | PostgreSQL outbound connector, composing [`v2/postgres`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/postgres). Carries LB-D19's query-level tracing; query-level **metrics** stay out of scope, with no upstream histogram to surface | AR + GKG backends | | NATS publish surface ([bench#72](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/72)), symmetric with [bench#66](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/66) and [bench#67](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/67). Consume side is [DM-4](https://gitlab.com/groups/gitlab-org/lab-bench/-/epics/4) | GKG gap 15, publish half | | Reconcile `PoolConfig` and `RetryPolicy` against the upstream contract. `gitlab.infrastructure.v1.PostgreSQL` carries the pool knobs and can express PgBouncer transaction pooling, which bench's cannot; `DoWithRetry` overlaps `RetryPolicy`. Likely a deletion | `outbound.proto` vs `postgresql.proto` | | Decide who owns overload policy: outbound circuit breaking and inbound load shedding, filed as one decision ([bench#78](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/78)). The one config surface with no upstream contract to reconcile against | `outbound.proto` (schema exists, unwired) | | Outbound RED metrics, zero-config and automatic. The chassis builds these, the same way inbound HTTP does in [bench#73](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/73) | `v2/httpclient/client.go`, `v2/postgres/tracer.go` | | Translate a declared `postgres: {}` into `spec.infrastructure.postgresql.presence: REQUIRED`. The FairwayManifest block exists upstream, but `bench build` never writes it, so a declared need reaches nothing | AR gap 8 | | File the upstream ClickHouse ask against [`gitlab-org/protos`](https://gitlab.com/gitlab-org/protos). GKG keeps modeling ClickHouse as an `http` backend until a contract lands | GKG gap 12 | **Cellular forcing function**: per-cell sharding and cross-cell migration tooling are out of scope for M1, but the LB-D2 and LB-D3 approach chosen here must not preclude them. This epic owns the decisions cellular hits hardest. **Out of scope**: object storage (AR gap 1) and Redis (AR gap 9), which follow once the connector pattern exists; a `clickhouse` schema variant, blocked upstream rather than deferred by choice; per-cell sharding and migration tooling; and provisioning the infrastructure itself, which the Platform Binding does. ## Definition of done - [ ] LB-D2 documented, with the boot-time schema-landmark self-check defined - [ ] LB-D3 closed, option chosen and documented ([bench#74](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/74)) - [ ] `PostgresConfig`'s identity fields deleted ([bench#85](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/85)) - [ ] `mtls_enabled` replaced by real transport config ([bench#71](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/71)) - [ ] HTTP connector working ([bench#76](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/76)) - [ ] gRPC connector working and `proto_file` settled ([bench#77](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/77)) - [ ] PostgreSQL connector working, with query tracing via `v2/postgres` - [ ] NATS publish surface landed ([bench#72](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/72)) - [ ] Duplicated pool and retry knobs removed rather than re-specified - [ ] Overload-policy ownership decided, and the behavior tested if bench keeps it ([bench#78](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/78)) - [ ] Outbound RED metrics emitted with no developer action, tagged by backend identity, named as [bench#73](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/73) settles for inbound - [ ] `bench build` maps a declared backend to `spec.infrastructure.*.presence` - [ ] Upstream ClickHouse ask filed against `gitlab-org/protos` ## Depends on Nothing external: [DM-3](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/3) (native LabKit composed by the chassis, which outbound RED metrics build on) is closed. Both remaining blockers are internal. [bench#71](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/71) holds the HTTP and gRPC connectors, since each consumes whatever replaces `mtls_enabled`; [bench#74](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/74) holds the Postgres connector. The NATS publish surface and the Fairway mapping proceed independently. ## References - [LabBench SOA Architecture](https://docs.google.com/document/d/11Zj918LuZeY3fPcU50ZPhzJtcqzvyXaO0SDamW7cDc8) - [LabBench Data Access Layer](https://docs.google.com/document/d/1Wq2yBqfp5wycwddKlL16y1b81Idq_RZWgCQSmCaAlU4) - [Phase 1 epic](https://gitlab.com/groups/gitlab-org/lab-bench/-/epics/1) (parent) - [artifact-registry example gap table](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/examples/artifact-registry/README.md#gaps-found) - [GKG example gap table](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/examples/gkg/README.md#gaps-found)