# camel-dryrun — the executable mock dry-run harness

The **external anchor** for xMesh's codegen-first enterprise-integration capability. xMesh's
own design (`MeshWork/camel-capability-design.md`) is emphatic: a route's verdict must be
grounded in the route *actually running*, not in a model's opinion of it — otherwise the
learning signal is text-judging-text (`gap:selfscore`) and the "mesh learns integrations"
claim collapses. This harness is that anchor: it runs a Camel route, bounded, in a throwaway
sandbox, and gates on real execution.

Proven behaviour (`examples/`): a valid route (`ok-normalize`) passes with the transform
output verified; a plausible-but-wrong route (`broken-bad-component`, a made-up component)
**fails** — real Camel cannot resolve the endpoint. Confident-wrong Camel does not survive.

## Use

```bash
skills/camel-dryrun/dryrun.sh <route.yaml> [expect-substring] [max-messages] [timeout-s]
# → JSON on stdout; exit 0 = pass, 1 = fail, 2 = usage/setup error
```

Prereq (once): a JDK + camel-jbang — `brew install openjdk jbang` then
`jbang trust add https://github.com/apache/camel/ && jbang app install camel@apache/camel`.
The harness emits a clear error if `camel` is missing.

## What it proves — and what it must NOT be trusted for

- **Proves:** the route is valid Camel, its endpoints resolve, it starts, and the transform
  under test actually produced the expected output. This is real, not simulated.
- **Does NOT prove:** idempotency, message ordering, exactly-once, transactional consistency
  under partial failure — mocks cannot exercise these, and they are exactly what fails
  *silently in production*. A verdict-CMB **must** declare them unproven; overclaiming a green
  dry-run as "validated" is how a route causes an incident.

## Secretless by construction

Routes under dry-run use `timer` / `direct` / `mock` / `log` / `stub` / localhost mock
endpoints only — never real credentials or systems. xMesh holds no secrets, touches no
production system, and never deploys. Deploy is a human step, outside the mesh.

## Where it sits in the mission loop (Slice 1)

1. **doer** emits a route-CMB (Camel YAML in the payload) + the expected mock output.
2. **critic** (a decorrelated model) runs THIS harness, *owns* the pass/fail result and a
   secrets scan, and emits a verdict-CMB — down-ranking its confidence on the unproven
   properties above.
3. **supervisor** drives the mission to complete (green) or pause for a human.
4. **operator** validates → the human verdict signs the grounding → the route pattern becomes
   reusable Canon, and the (mesh-predicted-pass, human-verdict) pair feeds the learning
   calibration (`a > 1/2`).

The harness is step 2's anchor. Without a real dry-run, the loop is `gap:selfscore` and Slice
1 has "only produced a route," not proven the capability.