Repository navigation
Gateway: observe and call Runtimes independently on every replica - #16361
Merged
agentydragon merged 5 commits intoNov 14, 2026
Merged
agentydragon merged 5 commits into
agentydragon merged 5 commits into
Conversation
agentydragon-agent
force-pushed
the
gateway-any-replica-receiver
branch
from
November 14, 2026 06:59
7762816 to
4575c2c
Compare
This was referenced Nov 14, 2026
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
This is the single open batch PR for the Agentplane organization plan. Further plan updates go here as commits until it merges, instead of one PR each. ## Commit 1: re-pin to devel `1f3e26cc58` and place `environmentaccess` Eight Agentplane commits landed after `02dc3c7a2e`: #16345, #16346, #16340, #16350, #16352, #16342, #16347 and #16359. They added five Go files and removed or moved none. None of them finishes a plan track. - **New package `runner_gateway/environmentaccess`.** It holds the environment rules from #16346. - It moves with EnvironmentService to `environments/access` (package `access`). - It stays outside `internal/` because the open slice #16351 makes Session admission enforce `bind_session` with it, so both binaries import it. - It is a rule parser over the shared policy reader, like `inboxaccess` and egress `policy`. - **New files in existing packages.** They take their package siblings' dispositions: - `identity/auth/service{,_test}.go` is retained. - `environments/environment_grants_test.go` moves with EnvironmentService. - **Landed steps recorded:** - `transition-tolerance-removal`: #16340 dropped the pre-Identity Dispatcher rows, and #16341 removes the branches. History's empty Sandbox UID is no longer listed as "not a leftover": #16356 refuses writers without one, ahead of the #16336 drop, which is on hold. - `gateway-connection-lease-removal`: #16345 has merged and #16361 is open. - **Cut line, explicit resume.** Since #16346 an Identity with a `resume` grant may resume, and every explicit resume reserves the Dispatcher-database wake budget. After the split, EnvironmentService has no database, so this crossing needs either its own bound or a call back to Sessions. It is queued as an operator question, after the identity fence. - **Counts and freshness.** The ledger, counts, freshness evidence and listing counts are updated: 1,275 files in 223 packages. ## Checks - Structural check against the `1f3e26cc58` inventory: PASS (42 tracks, 1,275 files, 223 packages). - `prettier@3.9.10 --check`: clean. - Local Playwright: the home page and the report render at desktop and mobile, in light and dark, with no horizontal overflow and no console errors. The binaries section still shows all seven cut-line cards. - No source behaviour tests run; this is a planning-only change. --- _Generated by [Claude Code](https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm)_ Co-authored-by: Claude <noreply@anthropic.com>
agentydragon-agent
force-pushed
the
gateway-any-replica-receiver
branch
3 times, most recently
from
November 14, 2026 07:23
db96fa1 to
d3b5f3b
Compare
agentydragon
enabled auto-merge (squash)
November 14, 2026 07:29
auto-merge was automatically disabled
November 14, 2026 07:35
Head branch was pushed to by a user without write access
agentydragon-agent
force-pushed
the
gateway-any-replica-receiver
branch
2 times, most recently
from
November 14, 2026 07:41
109db4f to
1f2d6cf
Compare
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
<!-- claude-projects-attribution: {"github_login":"agentydragon"} -->
_Requested by **Rai** · [project
thread](https://claude.ai/code/project/chan_01RbvEzrs8Yi8YhNnHoSLtMy?thread=cmsg_01RbvEzrs8Yi8YhNnHoSLtMy2SHUu9XsCD6ej526Bhqzxa)_
Doc-only update of `agentplane/plans/task_dag.md` (and one link in
`plans/environment_rules.md`) for the last day's plans and decisions.
**Added**
- **Released 2026-11-14:** each track the operator released today, with
the quoted release, its node and its PRs' state at 07:40 UTC.
- **Sandbox-free central Sessions:** orders the existing sections 5, 13
and 14 nodes for a central Session with no Sandbox attached, from the
three #15436 decisions through the zero-Environment path and its
follow-ons. New decision node `CODE_MODE_HOST_DESIGN` for whether to
keep Codex's pinned JavaScript host or own a V8 host; it is recorded as
not a prerequisite, since the host runs in the sampler Pod and needs no
executor.
- **Section 17, two binaries and the Go layout:** the agreed
Environments/Sessions split with its decided cards (automatic wake,
directories, identity re-check, no budget for explicit resume), a stage
table mapping the gh-pages Go plan onto DAG nodes, and nodes for the
stage 3 moves, keep-alive holds, stage 2 layout fixes and stage 4 local
extractions.
**Updated**
- 2026-10-30 sprint priorities marked stale; no new priorities are
stated.
- `NOTIFICATION_SERVICE_SPLIT` carries the operator's 01:11–01:12
direction (inbox service plus GitHub actor; subscription seam open).
- `SESSION_TOOL_SURFACE_CONVERGENCE_DESIGN`: direction agreed at 01:10;
interface review open.
- `DISPATCHER_PERSISTENCE_MODEL_DESIGN`: topology selected; delivery
ownership and the Dispatcher's ownership Lease remain open.
- `RUNNER_GATEWAY_RENAME`: the Environment Gateway name is dropped; the
node now covers deployed names after the split.
- `PRIVILEGED_BACKEND_AUTH_DESIGN`, `APP_AGENT_TOKEN_DECISION`,
`ENVIRONMENT_LIFECYCLE_RULES`, `ENVIRONMENT_IDENTITY_BIND_SESSION` and
`REFACTOR_COHERENCE_AUDIT` carry their merged and in-review PRs.
**Deleted as finished:** `ENVIRONMENT_RULE_TYPE_DESIGN` (selected
04:58), `ENVIRONMENT_IDENTITY_RESUME` (#16346 merged),
`TRANSPORT_PACKAGE_RENAME` (the package lives only at `net/peertls`).
**Left out on purpose**
- Section 12 is untouched: the open Lease stack (#16361, #16362, #16365)
edits it. Section 17 refers only to `RUNNER_CONNECTION_LEASE_CLEANUP`,
which exists in both versions; whichever lands second rebases.
- `plans/environment_rules.md` status line: #16351 edits it.
- No priority changes and no new dispatch.
**Checks:** a local script parsed every Mermaid block (no unknown IDs or
cycles introduced), node headings (no duplicates) and local anchors; the
remaining findings, such as links to `central_session_contract.md` from
open #15436, predate this PR. `pre-commit run --files` on both files
passes.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01AYUnw2srgM3L5WxRM4C2Kt)_
Co-authored-by: Claude <noreply@anthropic.com>
Contributor
Visual review for
|
agentydragon-agent
force-pushed
the
gateway-any-replica-receiver
branch
2 times, most recently
from
November 14, 2026 08:17
a901fd9 to
d549cfb
Compare
agentydragon-agent
force-pushed
the
gateway-any-replica-receiver
branch
from
November 14, 2026 08:31
d549cfb to
502d992
Compare
agentydragon
enabled auto-merge (squash)
November 14, 2026 08:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge only after the runner-disk image containing #16345 is pinned AND older live staging Runtimes are cycled onto that receiver.
Make every authenticated Gateway replica independently observe and call the Controller-bound Runtime. Watches and direct calls send no connection epoch; Runtime fences calls by Sandbox UID, workload Pod UID and boot ID. Local observer replacement waits for the canceled worker to exit, and delayed connection removal cannot erase a successor. Caller authorization and Dispatcher scheduling ownership are unchanged; uncertain mutations are never automatically replayed.
This is the receiver stage of the Service-routing cutover. Keep Lease/route-epoch/EndpointSlice publication solely for existing
<sandbox>-controlconsumers. A route claim or publication failure cannot block another replica's direct Runtime calls. Move callers only after this Gateway image is pinned; stop route publication only after those callers have rolled. No settings/manifests change in this PR.Rollout gates and live Runtime inventory
Fresh
origin/develat6e591f38pinsagentplane-runner-disktodevel-20261114072809-ccb9cc4; ancestry check confirms thatccb9cc4includes #16345 (d8258d6). This verifies the repository pin. Claude verified the staging deployment gate at 08:25 UTC on 2026-11-14: the remainingcodex-cleanup-tlsPod was recreated at 08:25:00 with runner-diskdevel-20261114072809-ccb9cc4(contains #16345). The Sandbox is Ready withEnvironmentRuntimeConnected. It is the only Pod staging-wide mounting a runner disk, and no KubeVirt or Firecracker Agentplane Sandboxes are running. Both the applied pin and live-process gates are met.Before merge, inventory running Sandboxes by Sandbox UID, backend, status incarnation Pod UID and workload creation time; inspect each current Pod's
spec.volumes[].image.reference, init/container image references andstatus.*ContainerStatuses[].imageID, and correlate the runner-disk tag's source commit with #16345 (git merge-base --is-ancestor d8258d69913d1e2ed800a6d2aac4670bc01ae8a8 SOURCE_COMMIT). Read the fresh pin file and Flux-applied workload/template images too. A post-pin creation time alone is insufficient evidence.For Pod backends, use the accepted incarnation's runner-disk image volume and Runtime container provenance. For KubeVirt, join Sandbox → owned VM/VMI → launcher Pod and inspect runner-disk/containerDisk references and boot provenance. For Firecracker, inspect the accepted launcher Pod's disk reference and restored Runtime provenance: suspend/resume restores RAM and the same process, so it does not upgrade an old receiver. An ambiguous or pre-#16345 process fails this gate; arrange a state-preserving supported replacement, not deletion of the Sandbox or its volume. A boot ID identifies a process, not its code version. Preserve identities, active work, History and next input when cycling.
Rollback
Before caller activation, revert this PR and restore the prior Gateway image pin; keep #16345's Runtime receiver, which accepts legacy nonzero watches/calls. Legacy route resources, permissions and settings remain available. After Flux applies it, check the Gateway rollout and route recovery, Controller
EnvironmentRuntimeConnectedand bootstrapped readiness, then retained History and a subsequent Session input, idle suspend/resume and quiesce. Reconcile any uncertain mutation by its existing command ID; do not replay it with a new ID.After stable-Service callers activate, first restore their previous
<sandbox>-controlrouting while this receiver still publishes it and verify those caller deployments rolled; then restore the old Gateway. Do not roll Runtime back underneath zero-epoch Gateway watches.Validation
The browser failures were caused by the scripted Runtime rejecting zero-epoch
WatchStaterequests. The fixture now accepts the receiver protocol and retains Sandbox/incarnation and peer authentication checks. The latest 40 indexed devel results for each browser target and the Gateway budget suite passed (rawGetTargetHistory, the query behindbbapi target history; CLI unavailable in this image); that index includes cache reuse.Focused RBE invocation
7c298eca-e3b6-4abf-8ad3-4e10ec4f7125passed//agentplane/app:test_thread_browser(all 16 shards),//agentplane/app:test_thread_window_browser,//agentplane/runner_gateway/internal/gateway:gateway_testand:queue_runner_integration_test, including the changed fixture library lint. No mutation replay, flake rerun, skipped test or timeout increase. These focused runs used the pre-rebase heads on9a955bd3. After those fixes, both browser targets and the Gateway budget suite also passed in PR CI c7d3cbe9-8641-5ff3-b523-b621c48f122e on the pre-rebase head. Full CI after rebasing onto6e591f38is pending; the range-diff confirms no patch changes.pre-commit run --from-ref origin/devel --to-ref HEADpassed after the rebase.Deterministic two-replica coverage uses two Gateway objects/public gRPC listeners against one production Runtime mTLS listener. A Controller SVID binds the incarnation; both replicas call independently, one observer restarts, and stale boot/incarnation calls are refused before backend dispatch. Legacy route ownership/publication does not gate these calls.
Required k3s suites:
//agentplane/system_tests/suites:test_pod,//agentplane/system_tests/suites:test_session_deletion,//agentplane/system_tests/suites:test_firecracker. Named scenarios cover bootstrap (test_a_preset_launches_an_initialized_editable_codex_thread), idle suspension (test_operator_resumes_an_idle_pod_without_granting_its_identity_lifecycle_control), quiesce/History/next input (test_two_harness_threads_keep_their_context_after_sandbox_suspend_resume), deletion fencing (test_session_command_cannot_cross_deletion,test_managed_cli_history_identity_uid_scope) and Firecracker (test_firecracker_preserves_live_guest). The two-replica unit/integration coverage is deterministic; these k3s suites do not claim a two-replica deployed Gateway scenario.Deliberately left out
Stable-Service caller activation; deletion of connection Lease, route epoch, per-Sandbox control Service/EndpointSlice and their RBAC; epoch proto-field removal; Dispatcher ownership Leases; EnvironmentService extraction. These follow ordered deployment gates. No Runtime-dials-Gateway mode, live-migration compatibility path, service-SVID/auth-policy migration, Identity admission, Viper, Policy error mapping or TLS-setting edits.
Questions for Claude
None. Claude verified the receiver pin and live Runtime cycle on staging at 08:25 UTC; no staging read or cycle was performed by this worker. A new launcher Pod with the same Runtime process remains unsupported.