Appendix F Companion: The Risk Lab

bash scripts/check.sh

javac --release 17 -d out UnsafeRiskScorer.java StarterProbe.java
java -cp out StarterProbe

good day            : true
confidence of 1.7   : true
service that is slow: true after 1502 ms
service that is down: false

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URI;

/**
 * The starting point of the exercise. It works on a good day. Do not copy its habits: read it and
 * list what can go wrong before you run StarterProbe.
 */
public class UnsafeRiskScorer {
    private final String serviceUrl;

    public UnsafeRiskScorer(String serviceUrl) {
        this.serviceUrl = serviceUrl;
    }

    public boolean approve(String borrowerId, String itemId) {
        try {
            HttpURLConnection connection = (HttpURLConnection)
                    URI.create(serviceUrl + "/risk?borrower=" + borrowerId + "&item=" + itemId).toURL().openConnection();
            BufferedReader in = new BufferedReader(new InputStreamReader(connection.getInputStream()));
            String line = in.readLine();
            String[] parts = line.split(" ");
            float score = Float.parseFloat(parts[1]);
            if (parts[0].equals("LOW")) {
                return score > 0.8f;
            }
            return false;
        } catch (Exception anything) {
            return false;
        }
    }
}

import com.sun.net.httpserver.HttpServer;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.nio.charset.StandardCharsets;

/** Runs UnsafeRiskScorer against a small local service and prints what it does. */
public class StarterProbe {
    public static void main(String[] args) throws Exception {
        HttpServer server = HttpServer.create(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0), 0);
        server.createContext("/risk", exchange -> {
            String query = exchange.getRequestURI().getQuery();
            String body = "LOW 0.95";
            if (query.contains("borrower=BADSCORE")) {
                body = "LOW 1.7";
            } else if (query.contains("borrower=SLOW")) {
                try {
                    Thread.sleep(1500);
                } catch (InterruptedException ignored) {
                    Thread.currentThread().interrupt();
                }
            }
            byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
            exchange.sendResponseHeaders(200, bytes.length);
            exchange.getResponseBody().write(bytes);
            exchange.close();
        });
        server.start();
        String url = "http://127.0.0.1:" + server.getAddress().getPort();
        UnsafeRiskScorer scorer = new UnsafeRiskScorer(url);

        System.out.println("good day            : " + scorer.approve("B1", "CAM1"));
        System.out.println("confidence of 1.7   : " + scorer.approve("BADSCORE", "CAM1"));
        long began = System.nanoTime();
        System.out.println("service that is slow: " + scorer.approve("SLOW", "CAM1")
                + " after " + (System.nanoTime() - began) / 1_000_000 + " ms");
        server.stop(0);
        System.out.println("service that is down: " + scorer.approve("B1", "CAM1"));
    }
}

package risk.support;

import java.time.Clock;
import java.time.Instant;
import java.time.ZoneOffset;
import risk.domain.RiskAssessment;
import risk.domain.RiskLevel;

/** Small shared test values. The clock is fixed so that no test depends on the time of day. */
public final class Fixtures {
    public static final Instant NOW = Instant.parse("2026-10-13T12:00:00Z");
    public static final Clock CLOCK = Clock.fixed(NOW, ZoneOffset.UTC);

    private Fixtures() {
    }

    public static RiskAssessment assessment(RiskLevel level, double confidence) {
        return new RiskAssessment(level, confidence, NOW);
    }
}

package risk.support;

import java.util.HashMap;
import java.util.Map;
import java.util.Objects;
import java.util.concurrent.atomic.AtomicInteger;
import risk.domain.ItemRiskAssessor;
import risk.domain.RiskAssessment;
import risk.domain.RiskAssessmentException;
import risk.domain.RiskLevel;

/** A deterministic, hand-written assessor for tests: no network, no model, and it counts its calls. */
public final class FakeItemRiskAssessor implements ItemRiskAssessor {
    private final Map<String, RiskAssessment> answers = new HashMap<>();
    private RiskAssessment defaultAnswer = Fixtures.assessment(RiskLevel.LOW, 0.95);
    private boolean failing;
    private final AtomicInteger calls = new AtomicInteger();

    public FakeItemRiskAssessor answer(String borrowerId, RiskAssessment assessment) {
        answers.put(borrowerId, Objects.requireNonNull(assessment));
        return this;
    }

    public FakeItemRiskAssessor defaultAnswer(RiskAssessment assessment) {
        this.defaultAnswer = Objects.requireNonNull(assessment);
        return this;
    }

    public FakeItemRiskAssessor failing() {
        this.failing = true;
        return this;
    }

    public int calls() {
        return calls.get();
    }

    @Override
    public RiskAssessment assessRisk(String borrowerId, String itemId) {
        calls.incrementAndGet();
        if (failing) {
            throw new RiskAssessmentException("The fake was told to fail.");
        }
        return answers.getOrDefault(borrowerId, defaultAnswer);
    }
}

package risk.support;

import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpServer;
import java.io.IOException;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.URI;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.TimeUnit;

/**
 * A controlled local risk service for tests: the JDK's own HTTP server on the loopback address and a
 * free port. Borrower LOWB answers {@code LOW 0.93}, MODB {@code MODERATE 0.70} and HIGHB
 * {@code HIGH 0.88}. BADSCORE answers a confidence of 1.7, BADLEVEL an unknown level, GARBAGE one field
 * and BROKEN status 500. SLOW sends nothing until the stub is closed, and SLOWBODY sends its headers and
 * the first byte and then holds the rest until the stub is closed. Everything else is 404. It is a
 * stand-in for a real service, not the service.
 */
public final class StubRiskService implements AutoCloseable {
    private final HttpServer server;
    private final CountDownLatch release = new CountDownLatch(1);
    private volatile String lastQuery = "";

    public StubRiskService() throws IOException {
        server = HttpServer.create(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0), 0);
        server.createContext("/risk", this::handle);
        server.start();
    }

    public URI baseUri() {
        return URI.create("http://127.0.0.1:" + server.getAddress().getPort());
    }

    /** The raw query of the last request, so a test can check what was sent. */
    public String lastQuery() {
        return lastQuery;
    }

    private void handle(HttpExchange exchange) throws IOException {
        String query = exchange.getRequestURI().getRawQuery();
        lastQuery = query == null ? "" : query;
        String borrower = "";
        for (String pair : lastQuery.split("&")) {
            if (pair.startsWith("borrower=")) {
                borrower = URLDecoder.decode(pair.substring("borrower=".length()), StandardCharsets.UTF_8);
            }
        }
        int status = 200;
        boolean stallBody = false;
        String body;
        switch (borrower) {
            case "LOWB" -> body = "LOW 0.93";
            case "MODB" -> body = "MODERATE 0.70";
            case "HIGHB" -> body = "HIGH 0.88";
            case "BADSCORE" -> body = "LOW 1.7";
            case "BADLEVEL" -> body = "EXTREME 0.50";
            case "GARBAGE" -> body = "only-one-field";
            case "BROKEN" -> { status = 500; body = "server error"; }
            case "SLOW" -> {
                awaitRelease();
                body = "LOW 0.93";
            }
            case "SLOWBODY" -> {
                stallBody = true;
                body = "LOW 0.93";
            }
            case "A B&C" -> body = "MODERATE 0.60";
            default -> { status = 404; body = "none"; }
        }
        byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
        try {
            exchange.sendResponseHeaders(status, bytes.length);
            if (stallBody) {
                exchange.getResponseBody().write(bytes, 0, 1);
                exchange.getResponseBody().flush();
                awaitRelease();
                exchange.getResponseBody().write(bytes, 1, bytes.length - 1);
            } else {
                exchange.getResponseBody().write(bytes);
            }
        } catch (IOException clientGone) {
            // the client gave up (a timeout test); nothing more to send
        } finally {
            exchange.close();
        }
    }

    private void awaitRelease() {
        try {
            release.await(30, TimeUnit.SECONDS);
        } catch (InterruptedException interrupted) {
            Thread.currentThread().interrupt();
        }
    }

    @Override
    public void close() {
        release.countDown();
        server.stop(0);
    }
}

package risk.domain;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.time.Instant;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.ValueSource;
import risk.support.Fixtures;

class RiskAssessmentTest {

    @ParameterizedTest
    @ValueSource(doubles = {-0.01, 1.01, Double.NaN, Double.POSITIVE_INFINITY})
    void confidenceOutsideZeroToOneIsRejected(double confidence) {
        assertThrows(IllegalArgumentException.class,
                () -> new RiskAssessment(RiskLevel.LOW, confidence, Fixtures.NOW));
    }

    @ParameterizedTest
    @ValueSource(doubles = {0.0, 0.5, 1.0})
    void confidenceAtTheEdgesIsAccepted(double confidence) {
        assertEquals(confidence, new RiskAssessment(RiskLevel.LOW, confidence, Fixtures.NOW).confidence());
    }

    @Test
    void aMissingLevelOrTimeIsRejected() {
        assertThrows(NullPointerException.class, () -> new RiskAssessment(null, 0.5, Fixtures.NOW));
        assertThrows(NullPointerException.class, () -> new RiskAssessment(RiskLevel.LOW, 0.5, (Instant) null));
    }

    @Test
    void automaticApprovalNeedsLowAndAtLeastTheThreshold() {
        assertTrue(Fixtures.assessment(RiskLevel.LOW, 0.80).permitsAutomaticApproval());
        assertFalse(Fixtures.assessment(RiskLevel.LOW, 0.79).permitsAutomaticApproval());
    }

    @ParameterizedTest
    @ValueSource(strings = {"MODERATE", "HIGH", "UNKNOWN"})
    void aLevelOtherThanLowNeverApprovesAutomatically(String level) {
        assertFalse(Fixtures.assessment(RiskLevel.valueOf(level), 1.0).permitsAutomaticApproval());
    }
}

package risk.domain;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;

import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.CsvSource;
import risk.support.FakeItemRiskAssessor;
import risk.support.Fixtures;

class ReservationScreenTest {

    @ParameterizedTest
    @CsvSource({
            "LOW,    0.95, AUTO_APPROVE",
            "LOW,    0.80, AUTO_APPROVE",
            "LOW,    0.79, SUPERVISOR_REVIEW",
            "MODERATE, 0.99, SUPERVISOR_REVIEW",
            "UNKNOWN, 1.00, SUPERVISOR_REVIEW",
            "HIGH,   0.10, REJECT",
            "HIGH,   0.99, REJECT"})
    void eachAssessmentIsRoutedByTheDomainsRules(String level, double confidence, String expected) {
        FakeItemRiskAssessor fake = new FakeItemRiskAssessor()
                .defaultAnswer(Fixtures.assessment(RiskLevel.valueOf(level), confidence));
        assertEquals(Route.valueOf(expected), new ReservationScreen(fake).route("B1", "CAM1"));
    }

    @Test
    void aFailedAssessmentIsNeverTurnedIntoAnApproval() {
        ReservationScreen screen = new ReservationScreen(new FakeItemRiskAssessor().failing());
        assertThrows(RiskAssessmentException.class, () -> screen.route("B1", "CAM1"));
    }

    @Test
    void eachBorrowerIsAssessedOnTheirOwn() {
        FakeItemRiskAssessor fake = new FakeItemRiskAssessor()
                .answer("RISKY", Fixtures.assessment(RiskLevel.HIGH, 0.9));
        ReservationScreen screen = new ReservationScreen(fake);
        assertEquals(Route.REJECT, screen.route("RISKY", "CAM1"));
        assertEquals(Route.AUTO_APPROVE, screen.route("B1", "CAM1"));
    }

    @Test
    void blankOrMissingIdentifiersAreRejectedBeforeAnyAssessment() {
        FakeItemRiskAssessor fake = new FakeItemRiskAssessor();
        ReservationScreen screen = new ReservationScreen(fake);
        assertThrows(IllegalArgumentException.class, () -> screen.route(" ", "CAM1"));
        assertThrows(IllegalArgumentException.class, () -> screen.route("B1", null));
        assertEquals(0, fake.calls());
    }
}

package risk.adapter;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;

import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.CsvSource;
import risk.domain.RiskAssessment;
import risk.domain.RiskAssessmentException;
import risk.domain.RiskLevel;
import risk.support.Fixtures;

class RuleBasedRiskAssessorTest {

    private static RiskAssessment assess(int violations) {
        return new RuleBasedRiskAssessor(borrower -> violations, Fixtures.CLOCK).assessRisk("B1", "CAM1");
    }

    @ParameterizedTest
    @CsvSource({"0, LOW", "1, MODERATE", "2, MODERATE", "3, HIGH", "9, HIGH"})
    void theLevelFollowsTheNumberOfViolations(int violations, String expected) {
        assertEquals(RiskLevel.valueOf(expected), assess(violations).level());
    }

    @ParameterizedTest
    @CsvSource({"0, 1", "0, 3", "1, 2", "2, 3", "0, 8", "3, 4", "2, 9"})
    void moreViolationsNeverLowerTheRisk(int fewer, int more) {
        // a metamorphic property: it does not say what the level is, only how two answers relate
        assertTrue(assess(more).level().compareTo(assess(fewer).level()) >= 0);
    }

    @ParameterizedTest
    @CsvSource({"0", "1", "5"})
    void theCautiousFallbackNeverApprovesWithoutAPerson(int violations) {
        assertFalse(assess(violations).permitsAutomaticApproval());
    }

    @Test
    void aNegativeCountIsAFailureAndNotALowRisk() {
        assertThrows(RiskAssessmentException.class, () -> assess(-1));
    }
}

package risk.adapter;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.net.URI;
import java.time.Duration;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Tag;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.Timeout;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.ValueSource;
import risk.domain.RiskAssessment;
import risk.domain.RiskAssessmentException;
import risk.domain.RiskLevel;
import risk.support.Fixtures;
import risk.support.StubRiskService;

/** The adapter against a real HTTP client and a service under our control: one test per outcome. */
@Tag("integration")
class HttpRiskPredictionAdapterContractTest {
    private static final Duration BOUND = Duration.ofMillis(300);

    private StubRiskService stub;
    private HttpRiskPredictionAdapter adapter;

    @BeforeEach
    void startStub() throws Exception {
        stub = new StubRiskService();
        adapter = new HttpRiskPredictionAdapter(stub.baseUri(), Duration.ofSeconds(1), BOUND, Fixtures.CLOCK);
    }

    @AfterEach
    void stopStub() {
        stub.close();
    }

    @Test
    void aGoodAnswerBecomesATypedAssessment() {
        RiskAssessment answer = adapter.assessRisk("LOWB", "CAM1");
        assertEquals(RiskLevel.LOW, answer.level());
        assertEquals(0.93, answer.confidence());
        assertEquals(Fixtures.NOW, answer.assessedAt());
    }

    @Test
    void theLevelAndConfidenceOfEachAnswerAreKept() {
        assertEquals(RiskLevel.MODERATE, adapter.assessRisk("MODB", "CAM1").level());
        assertEquals(RiskLevel.HIGH, adapter.assessRisk("HIGHB", "CAM1").level());
    }

    @Test
    void identifiersAreEncodedInTheRequest() {
        assertEquals(RiskLevel.MODERATE, adapter.assessRisk("A B&C", "CAM 1").level());
        assertTrue(stub.lastQuery().contains("borrower=A+B%26C"), stub.lastQuery());
        assertTrue(stub.lastQuery().contains("item=CAM+1"), stub.lastQuery());
    }

    @ParameterizedTest
    @ValueSource(strings = {"BADSCORE", "BADLEVEL", "GARBAGE", "BROKEN", "UNKNOWN-PERSON"})
    void everythingExceptAGoodAnswerIsAFailureAndNeverADefault(String borrower) {
        assertThrows(RiskAssessmentException.class, () -> adapter.assessRisk(borrower, "CAM1"));
    }

    @Test
    @Timeout(5)
    void aServiceThatSendsNothingIsGivenUpOnWithinTheBound() {
        long began = System.nanoTime();
        assertThrows(RiskAssessmentException.class, () -> adapter.assessRisk("SLOW", "CAM1"));
        assertTrue(elapsedMillis(began) < BOUND.toMillis() * 4, "waited too long");
    }

    @Test
    @Timeout(5)
    void aServiceThatStallsInTheMiddleOfTheBodyIsAlsoBounded() {
        long began = System.nanoTime();
        assertThrows(RiskAssessmentException.class, () -> adapter.assessRisk("SLOWBODY", "CAM1"));
        assertTrue(elapsedMillis(began) < BOUND.toMillis() * 4, "waited too long");
    }

    @Test
    void aServiceThatIsNotThereIsAFailure() {
        HttpRiskPredictionAdapter nobody = new HttpRiskPredictionAdapter(
                URI.create("http://127.0.0.1:1"), Duration.ofMillis(300), BOUND, Fixtures.CLOCK);
        assertThrows(RiskAssessmentException.class, () -> nobody.assessRisk("LOWB", "CAM1"));
    }

    private static long elapsedMillis(long beganNanos) {
        return (System.nanoTime() - beganNanos) / 1_000_000;
    }
}

package risk.adapter;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertSame;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.time.Duration;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.TimeUnit;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.Timeout;
import risk.domain.ItemRiskAssessor;
import risk.domain.RiskAssessment;
import risk.domain.RiskAssessmentException;
import risk.domain.RiskLevel;
import risk.support.FakeItemRiskAssessor;
import risk.support.Fixtures;

class ResilientRiskAssessorTest {
    private static final Duration LIMIT = Duration.ofMillis(200);
    private static final RiskAssessment PRIMARY = Fixtures.assessment(RiskLevel.LOW, 0.95);
    private static final RiskAssessment CAUTIOUS = Fixtures.assessment(RiskLevel.MODERATE, 0.50);

    private static ItemRiskAssessor stalled(CountDownLatch release) {
        return (borrower, item) -> {
            try {
                release.await();
            } catch (InterruptedException interrupted) {
                Thread.currentThread().interrupt();
            }
            return PRIMARY;
        };
    }

    @Test
    void aTimelyPrimaryAnswerIsUsedAndTheFallbackIsNotTouched() {
        FakeItemRiskAssessor fallback = new FakeItemRiskAssessor().defaultAnswer(CAUTIOUS);
        try (ResilientRiskAssessor assessor = new ResilientRiskAssessor(
                new FakeItemRiskAssessor().defaultAnswer(PRIMARY), fallback, LIMIT)) {
            assertSame(PRIMARY, assessor.assessRisk("B1", "CAM1"));
            assertEquals(0, fallback.calls());
            assertEquals(0, assessor.fallbackCount());
        }
    }

    @Test
    @Timeout(5)
    void aStalledPrimaryIsGivenUpOnWithinTheLimitAndTheFallbackAnswers() {
        CountDownLatch never = new CountDownLatch(1);
        try (ResilientRiskAssessor assessor = new ResilientRiskAssessor(
                stalled(never), new FakeItemRiskAssessor().defaultAnswer(CAUTIOUS), LIMIT)) {
            long began = System.nanoTime();
            RiskAssessment answer = assessor.assessRisk("B1", "CAM1");
            long millis = (System.nanoTime() - began) / 1_000_000;
            assertSame(CAUTIOUS, answer);
            assertTrue(millis < LIMIT.toMillis() * 4, "waited " + millis + " ms");
            assertEquals(1, assessor.fallbackCount());
        } finally {
            never.countDown();
        }
    }

    @Test
    @Timeout(5)
    void aStalledPrimaryIsAskedToStop() throws InterruptedException {
        CountDownLatch askedToStop = new CountDownLatch(1);
        CountDownLatch never = new CountDownLatch(1);
        ItemRiskAssessor primary = (borrower, item) -> {
            try {
                never.await();
            } catch (InterruptedException interrupted) {
                askedToStop.countDown();
            }
            return PRIMARY;
        };
        try (ResilientRiskAssessor assessor = new ResilientRiskAssessor(
                primary, new FakeItemRiskAssessor().defaultAnswer(CAUTIOUS), LIMIT)) {
            assessor.assessRisk("B1", "CAM1");
            assertTrue(askedToStop.await(2, TimeUnit.SECONDS), "the stalled call was not asked to stop");
        } finally {
            never.countDown();
        }
    }

    @Test
    void anExpectedFailureOfThePrimaryLeadsToTheFallback() {
        try (ResilientRiskAssessor assessor = new ResilientRiskAssessor(
                new FakeItemRiskAssessor().failing(), new FakeItemRiskAssessor().defaultAnswer(CAUTIOUS), LIMIT)) {
            assertSame(CAUTIOUS, assessor.assessRisk("B1", "CAM1"));
            assertEquals(1, assessor.fallbackCount());
        }
    }

    @Test
    void aProgrammingErrorInThePrimaryIsNotHiddenByTheFallback() {
        ItemRiskAssessor buggy = (borrower, item) -> {
            throw new IllegalStateException("bug");
        };
        FakeItemRiskAssessor fallback = new FakeItemRiskAssessor().defaultAnswer(CAUTIOUS);
        try (ResilientRiskAssessor assessor = new ResilientRiskAssessor(buggy, fallback, LIMIT)) {
            assertThrows(IllegalStateException.class, () -> assessor.assessRisk("B1", "CAM1"));
            assertEquals(0, fallback.calls());
        }
    }

    @Test
    void ifTheFallbackAlsoFailsTheCallerSeesTheFailureAndNotAnApproval() {
        try (ResilientRiskAssessor assessor = new ResilientRiskAssessor(
                new FakeItemRiskAssessor().failing(), new FakeItemRiskAssessor().failing(), LIMIT)) {
            assertThrows(RiskAssessmentException.class, () -> assessor.assessRisk("B1", "CAM1"));
        }
    }

    @Test
    void aPrimaryThatReturnsNullIsABugAndIsReportedAsOne() {
        ItemRiskAssessor returnsNull = (borrower, item) -> null;
        try (ResilientRiskAssessor assessor = new ResilientRiskAssessor(
                returnsNull, new FakeItemRiskAssessor().defaultAnswer(CAUTIOUS), LIMIT)) {
            assertThrows(NullPointerException.class, () -> assessor.assessRisk("B1", "CAM1"));
        }
    }

    @Test
    @Timeout(5)
    void anInterruptedCallerKeepsItsInterruptFlagAndGetsAFailure() {
        CountDownLatch never = new CountDownLatch(1);
        try (ResilientRiskAssessor assessor = new ResilientRiskAssessor(
                stalled(never), new FakeItemRiskAssessor().defaultAnswer(CAUTIOUS), Duration.ofSeconds(5))) {
            Thread.currentThread().interrupt();
            assertThrows(RiskAssessmentException.class, () -> assessor.assessRisk("B1", "CAM1"));
            assertTrue(Thread.interrupted(), "the interrupt flag must be restored");
        } finally {
            never.countDown();
        }
    }
}

package risk.rollout;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertSame;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.util.ArrayList;
import java.util.List;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.ValueSource;
import risk.domain.RiskAssessment;
import risk.domain.RiskLevel;
import risk.support.FakeItemRiskAssessor;
import risk.support.Fixtures;

class RolloutAssessorTest {
    private static final RiskAssessment BASE = Fixtures.assessment(RiskLevel.MODERATE, 0.50);
    private static final RiskAssessment MODEL = Fixtures.assessment(RiskLevel.LOW, 0.95);

    private final List<ProvenanceRecord> records = new ArrayList<>();
    private final FakeItemRiskAssessor baseline = new FakeItemRiskAssessor().defaultAnswer(BASE);
    private final FakeItemRiskAssessor model = new FakeItemRiskAssessor().defaultAnswer(MODEL);

    private RolloutAssessor assessor(RolloutMode mode, int percent) {
        return new RolloutAssessor(baseline, model, mode, percent, "model-7", records::add);
    }

    @Test
    void whenOffTheBaselineDecidesAndTheModelIsNeverCalled() {
        assertSame(BASE, assessor(RolloutMode.OFF, 100).assessRisk("B1", "CAM1"));
        assertEquals(0, model.calls());
        assertTrue(records.isEmpty());
    }

    @Test
    void inShadowTheBaselineDecidesAndTheModelsAnswerIsOnlyRecorded() {
        assertSame(BASE, assessor(RolloutMode.SHADOW, 0).assessRisk("B1", "CAM1"));
        assertEquals(1, model.calls());
        ProvenanceRecord record = records.get(0);
        assertSame(MODEL, record.modelAnswer());
        assertSame(BASE, record.decision());
        assertFalse(record.modelDecided());
        assertEquals("model-7", record.modelVersion());
    }

    @Test
    void aShadowFailureNeverChangesTheDecisionAndIsRecordedAsNoAnswer() {
        FakeItemRiskAssessor broken = new FakeItemRiskAssessor().failing();
        RolloutAssessor shadow = new RolloutAssessor(baseline, broken, RolloutMode.SHADOW, 0, "model-7", records::add);
        assertSame(BASE, shadow.assessRisk("B1", "CAM1"));
        assertNull(records.get(0).modelAnswer());
    }

    @Test
    void whenOnTheModelDecidesAndTheRecordSaysSo() {
        assertSame(MODEL, assessor(RolloutMode.ON, 0).assessRisk("B1", "CAM1"));
        assertEquals(0, baseline.calls());
        assertTrue(records.get(0).modelDecided());
        assertSame(MODEL, records.get(0).decision());
    }

    @Test
    void aCanaryUsesTheModelForTheSameBorrowersEveryTime() {
        RolloutAssessor canary = assessor(RolloutMode.CANARY, 30);
        for (int i = 0; i < 200; i++) {
            String borrower = "B" + i;
            RiskAssessment expected = canary.inCanary(borrower) ? MODEL : BASE;
            assertSame(expected, canary.assessRisk(borrower, "CAM1"));
            assertSame(expected, canary.assessRisk(borrower, "CAM1"));
        }
    }

    @Test
    void aCanaryOfThirtyPercentCoversRoughlyThirtyPercent() {
        RolloutAssessor canary = assessor(RolloutMode.CANARY, 30);
        long inside = java.util.stream.IntStream.range(0, 1000).filter(i -> canary.inCanary("B" + i)).count();
        assertTrue(inside > 230 && inside < 370, "inside = " + inside);
    }

    @Test
    void zeroPercentIsNobodyAndOneHundredPercentIsEverybody() {
        RolloutAssessor none = assessor(RolloutMode.CANARY, 0);
        RolloutAssessor all = assessor(RolloutMode.CANARY, 100);
        assertTrue(java.util.stream.IntStream.range(0, 1000).noneMatch(i -> none.inCanary("B" + i)));
        assertTrue(java.util.stream.IntStream.range(0, 1000).allMatch(i -> all.inCanary("B" + i)));
    }

    @ParameterizedTest
    @ValueSource(ints = {-1, 101})
    void aPercentageOutsideZeroToOneHundredIsRejected(int percent) {
        assertThrows(IllegalArgumentException.class, () -> assessor(RolloutMode.CANARY, percent));
    }

    @Test
    void whenTheModelDecidesAndFailsTheFailureIsNotHidden() {
        FakeItemRiskAssessor broken = new FakeItemRiskAssessor().failing();
        RolloutAssessor on = new RolloutAssessor(baseline, broken, RolloutMode.ON, 0, "model-7", records::add);
        assertThrows(risk.domain.RiskAssessmentException.class, () -> on.assessRisk("B1", "CAM1"));
        assertTrue(records.isEmpty());
    }
}

package risk.domain;

/**
 * How cautious to be about a request. UNKNOWN means that no trustworthy assessment exists; it is
 * not a level between the others and it is never a reason to approve.
 */
public enum RiskLevel {
    LOW,
    MODERATE,
    HIGH,
    UNKNOWN
}

package risk.domain;

import java.time.Instant;
import java.util.Objects;

/** One answer to the question “how risky is it to lend this item to this borrower?”. */
public record RiskAssessment(RiskLevel level, double confidence, Instant assessedAt) {

    /** The least confidence at which a LOW assessment may approve a request without a person. */
    public static final double AUTOMATIC_APPROVAL_CONFIDENCE = 0.80;

    public RiskAssessment {
        Objects.requireNonNull(level, "level");
        Objects.requireNonNull(assessedAt, "assessedAt");
        if (Double.isNaN(confidence) || confidence < 0.0 || confidence > 1.0) {
            throw new IllegalArgumentException("Confidence must be between 0.0 and 1.0: " + confidence);
        }
    }

    /** Only a LOW level held with enough confidence may skip a person. */
    public boolean permitsAutomaticApproval() {
        return level == RiskLevel.LOW && confidence >= AUTOMATIC_APPROVAL_CONFIDENCE;
    }
}