Repository navigation
Agentplane: admit the Runtime proxy service role - #16360
Merged
agentydragon merged 1 commit intoNov 14, 2026
Merged
agentydragon merged 1 commit into
agentydragon merged 1 commit into
Conversation
Contributor
Visual review for
|
agentydragon-agent
force-pushed
the
agent/service-svid-runtime-role
branch
from
November 14, 2026 06:49
c98ff38 to
1f708bc
Compare
agentydragon-agent
force-pushed
the
agent/service-svid-runtime-role
branch
from
November 14, 2026 06:59
1f708bc to
76ded63
Compare
agentydragon
enabled auto-merge (squash)
November 14, 2026 07:04
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
#16341 removed the Dispatcher's readers for pre-Identity and unattributed rows after #16340 dropped them, so the transition-tolerance-removal track left the plan and the ledger re-pinned. Stage 1 now holds only the Gateway connection Lease. Since 1f3e26c, #16341, #16355, #16360, #16363, #16367 and #16369 edited 44 Go files; none were added, removed or moved and no .proto changed. The evidence's History correction no longer names the removed track. The identity-fence step names its open PR, #16373. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
…16368) This is the single open batch PR for the Agentplane organization plan. Later plan updates go here as commits until it merges. ## Commit 1: identity-fence decision The operator decided at 2026-11-14 07:20 UTC, answering the card "Choose how an Identity change is fenced against Session admission": "okay, sounds good to me, sessions can re-check". - **Cut line "Identity change against Session admission"** is now DECIDED. - There is no call between the binaries. EnvironmentService patches `spec.identity` under optimistic locking. - The Sandbox CRD already admits that change only while nothing runs. - Sessions re-check the live Identity at admission, placement and every delivery. - The retained-Session refusal goes. Session rows are never deleted, so the refusal blocked any rebind once a Session had existed. - Proposed addition, not decided: the Runtime refuses to run a retained Session whose recorded Identity differs from the Identity on its own credential. - **`environment-service-to-sandbox-controller`.** - Contract item (c) is decided. Dropping `dispatcher.Store.ChangeSandboxIdentity` and its refusal is its own behavior PR, ahead of the move. - The gate, the preserved invariants and the next-PR step change to match. - **Stale path fixed.** The automatic-wake card now says `environments/internal`. - **Evidence.** `evidence.json` records the operator's words and the checked facts: the CRD's stopped-only rule, and the Runtime's re-admission check. ## Commit 2: explicit-resume decision The operator decided at 2026-11-14 07:41 UTC, card "Choose how explicit resume is rate-bounded once EnvironmentService has no database": "No budget for explicit resume". - **Cut line "Rate bound for explicit resume"** is now DECIDED. Explicit resume reserves no wake budget; only the Sessions binary's automatic wake keeps one. - A resume acts only on a fully stopped Sandbox, and the generation token makes a stale resume return `STATE_CHANGED` (`lifecycle/SPEC.md`). So a Sandbox is resumed at most once per stop. - An Identity's `resume` grant scopes which Sandboxes it may wake. - Dropping the reservation from the explicit path is a behavior PR before EnvironmentService moves. - **`environment-service-to-sandbox-controller`.** Contract item (b) and the preserved invariants now name only automatic wake's rate limit. - **Keep-alive holds.** The proposal names Identities with a `resume` grant beside operators as explicit resumers. - **Operator questions.** The queue is empty, and the page says "None open." when it is. - **Transition tolerances.** History's empty Sandbox UID is listed as live again. A central Session may have no Sandbox, and #16356 and #16336 were closed unmerged. - **Evidence.** The operator's words are recorded. A verified fact that predated #16346 no longer says only operators may resume. ## Commit 3: burn down `transition-tolerance-removal` and re-pin at `7867f81780` - **Track landed whole.** #16341 removed the Dispatcher's readers for Sessions without an execution Identity or caller attribution, and for dispatch rows without stored attribution, after #16340 dropped those rows. The track, its next-PR entry and its ledger references are gone. Stage 1 now holds only the Gateway connection Lease. - **Ledger re-pinned.** Since `1f3e26cc58`, #16341, #16355, #16360, #16363, #16367 and #16369 edited 44 Go files. None were added, removed or moved, and no `.proto` changed. #16369 added History migration `00019_service_writer.sql`. - **Evidence.** The History correction no longer names the removed track. The identity-fence step names its open PR, #16373. - **Home page.** The reviewed-source line names the new pin. ## Checks - Structural check against the `7867f81780` inventory: PASS. All 1,275 Go files match, in 223 directories. - `prettier@3.9.10 --check`: clean. - Local Playwright: the report, the home page and the target-binaries section render at desktop and mobile, in light and dark, with no overflow and no console errors. All seven cut-line cards render, and the empty question list shows "None open.". - No source behaviour tests were run; this is a planning-only change. --- 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Admit the exact
spiffe://agentplane/runtime-proxyservice role on native Runtime control alongside the current Gateway role. Controller passive WatchState remains Controller-only, and Sessions cannot authenticate directly to Runtime. This supports moving the proxy identity with Environments while Sessions calls the proxy over its own network edge.Deliberately leaves out caller switches, deployment settings, the binary split, TokenReview removal and RBAC cleanup; receiver images must be pinned first. The focused overview and Runtime SPEC describe the optional edge.
Validation: pre-commit and commit hooks passed.
bbr test //agentplane/env/runtime/control:control_test //agentplane/env/runtime/internal/coordinator:coordinator_testpassed (https://app.buildbuddy.io/invocation/39f3ddae-18d7-464b-8f1d-88e9162e41c6). Real TLS tests exercise exact role denial and authenticated control. Deployment suitebbr test //agentplane/system_tests/suites:test_dispatcherpassed in 237.8s (https://app.buildbuddy.io/invocation/596bb764-f7c4-4ef0-bceb-1036a93d4adf).Rollback: revert the receiver commit before any caller switch. After cutover, restore compatible proxy caller images/settings first. Check Runtime control, Session dispatch and Controller passive watches after rollout.
Rebased onto
b9fe2e884aand reconciled #16345’s Controller-bound incarnation contract. The failed initial CI run had no build/test invocation: trusted-fork context rejected a conflicted merge. After rebase,bbr test //agentplane/env/runtime/control:control_test //agentplane/env/runtime/internal/coordinator:coordinator_test //agentplane/system_tests/suites:test_dispatcherpassed (https://app.buildbuddy.io/invocation/a1a0db6f-b038-4437-90bd-c6f4b6905fa2; deployment suite236.3s). No new certificate-path or allowlist manifest settings until #16359 merges and the receiver images are pinned.Questions for Claude
None.