[agentydragon-agent]

Explicit ResumeEnvironment no longer reserves the shared wake budget, for direct Pod-bound and service-SVID operator callers and Identity resume grants. Automatic Dispatcher RequestWake alone reserves ReserveWakeAttempt; authorization, operator-stop handling, generation tokens and optimistic locking retain their existing behavior. This implements the operator’s 2026-11-14 07:41 UTC decision, “No budget for explicit resume,” recorded in plan PR #16368 at 0675c37082.

TestExplicitResumeDoesNotReserveWakeBudget exercises both caller paths with exhausted and unavailable budget backends and requires successful resume with zero reservations. TestEnvironmentServiceServiceRolesStayMethodScoped checks a real mTLS service operator resume succeeds with zero reservations; the foreign-target Identity grant test also checks zero reservations. Conflict and stale-token tests retain their coverage, with concurrent requests synchronized at the Kubernetes patch boundary rather than inside the budget fake.

Automatic wakes remain bounded: TestAutomaticWakeSharesPolicyBudgetAndReportsRetryFacts still requires rate limiting with retry facts when exhausted and refusal when the backend is unavailable; Dispatcher’s TestMixedVersionWakeWritersShareCapAndGenerationDedup and Store integration tests cover durable shared reservations. Lifecycle SPEC, README and interface comments now distinguish the two paths.

Validation:

• Changed-file pre-commit and all commit hooks passed (gofumpt applied formatting first).
• bbr test //agentplane/runner_gateway/environments/lifecycle:lifecycle_test //agentplane/runner_gateway/environments:environments_test //agentplane/runner_gateway/dispatcher:store_integration_test //agentplane/system_tests/suites:test_dispatcher --test_output=errors — all 4 passed (45ead54e); 3 executed, Dispatcher storage integration cached. The full Dispatcher system suite passed in 228.3s and covers queue, automatic wake, delivery and replica behavior. Full current-head GitHub CI pending.

Rollout: deploy/pin the Gateway behavior. No settings, manifests, schema or wire contract changes, so no image-before-config ordering applies. Independent of the identity-change fence PR #16373. Rollback: revert the Gateway image pin; explicit resume again uses the existing budget. Retain current Sandbox generations and budget rows. After Flux applies the pin, check explicit resume and automatic queued wake, including normal delivery and wake-budget retry facts.

Deliberately leaves out automatic-wake policy or limit changes, settings/manifests, storage ownership or service extraction, Runtime Identity defense, caller-authentication changes, and any new cross-component call.

Rebased onto 9a955bd3 after Gateway service SVID admission #16364, preserving its service roles and authentication behavior. Post-rebase focused validation (0fd41c23) passed lifecycle, Dispatcher storage (cached), and the full Dispatcher system suite (231.9s), but found the newly landed mTLS service-operator test still asserting an explicit budget reservation. Commit d63bccb9 changes that assertion to zero reservations while retaining its method-scoped authorization and desired-state checks. The corrected bbr test //agentplane/runner_gateway/environments:environments_test --test_output=errors executed and passed (3fcea46b). Changed-file pre-commit and commit hooks passed. Full current-head CI pending.

Latest rebase: head 9f01bc92f168218eb361383b6dd6c58b81224226 is based on a68e0de510d6ea10184705ab453a69259cb85801, including service-SVID admission and the system-test root-key renewal correction #16377. The rebase was conflict-free; range-diff showed unchanged patches, and it was published with --force-with-lease. GitHub confirms this head. Current-head pre-commit, Nix and artifact/import checks passed; Bazel and visual review are running, with no reported failures as of 2026-11-14 08:29 UTC. The focused RBE results above remain prior-base validation. Fresh origin/devel is 6e591f383864ab47d7a9370abb4bd6637f0faee3; its two additional commits change image pins and a Dispatcher documentation note, and GitHub reports this PR mergeable.

Questions for Claude

None.

[github-actions]

Visual review for 9f01bc92

Request a manual rerun from the CI run page.

Warning

1 target used the latest devel baseline (bb7c716f) because the PR base published none. Diffs there may include devel drift, not just this PR's changes.

No visual changes among the 1 affected Bazel test target. Open visual review.