Repository navigation
docs: managed-runtime redeploy runbook (live-tested, 61 review rounds) - #845
Merged
Merged
Conversation
…ure flag, unit coupling, restart effects, verification
…s reattach not replacement; probe soul reaped on idle timeout
…e terminal scope; unit port note; workload image surface; probe soul is not auto-reaped
…rnal docker stop trips supervisor recovery); launch-rust.sh recovery caveat on managed instances; assert readiness event values; artifact freshness check; probe workspace must not equal operator home
…request; capture pre-restart soul inventory for the comparison
…anes (Fresh/Respawn); per-surface artifact freshness; OneCLI-primary cleanup with defined token and verified_empty outcome assertion; compare container identities not uptimes
…ity before the stop; StartedAt-based survival comparison; prove running binaries via /proc exe; client build surface; fresh-agent sidecars in restart effects
…k vs strict); terminalId-tied probe identity via soul records; content-hash freshness checks scoped to changed surfaces; token path derived from unit WorkingDirectory
…(Requires is one-way); session-host content check via in-container hash; client negotiation applies to browser panes not the REST probe
…minalId re-verification before stop; readiness field assertions; execution outside the server process tree; unit-file install + daemon-reload; token via 0600 header file with OneCLI as the preferred scoped path
…assert actually halts the stop; unit-file deploy preserves site-specific settings (no blind copy); capture pipeline pipefail + non-empty baseline; private dir kept on failed stop
…ate file (never overwrite the baseline); comm-based survival comparison; empty capture is valid, only Docker failure halts
…snapshots; explicit emptiness assertion on the survival comm; nested readiness field paths; honest attribution of new containers
… (blocked recovery is per-soul, not in blockedSubsystems); browser-path check for the negotiated client route; token exception reconciled with OneCLI policy, trap scrubs header on every exit
… pointer file, same-shell contract); self-healing token header for the retry; browser-path check required on every redeploy, proven by terminalCwd match not timing
…dr still alive); unique per-run workspaces for both probes; shared pointer removed for cwd-based lost-shell recovery; labels wording fixed
…oul shell 65534:0 needs group access); run.env record + pointer with explicit set-e/lost-shell recovery via workspace timestamps
…isor control socket (Type=simple binds late); socket check in checklist; browser-probe soul fenced-stopped before its workspace is deleted
…ale socket files); same race noted on coupled bounce; pointer recovery removed for WS-based identity; browser-soul handled in any launchState; robust dotenv token extraction
…e server start; token read from the running server's /proc environ (no dotenv re-parsing); space-separated lookup output; newest-incarnation selection; BWS included in recovery prompt
… is 180s/soul at 4-way); per-soul check asserts launchState AND recoveryState; token: environ primary + dotenvy-parity .env fallback + non-empty assert
… the pre-restart capture; ~/scratch group-traversable for in-soul path traversal
…tainers + desired-running soul IDs) before the sequences; socket bound sized from desired-running inventory with container fallback; per-soul sweep over the desired-running list
… wait (config knobs make fixed bounds wrong); single combined EXIT trap scrubs both token headers; probe tree under a fresh per-run root (never chmod pre-existing dirs); post-deploy refresh of the desired-running sweep
…in recovery); dead-server-safe preliminary (MainPID=0 guarded); liveness + generous overridable stall cap with journal diagnosis on expiry
…erred to step 5 (no abort when only EnvironmentFiles hold it); stall cap sized from the captured inventory (900s/soul at 4-way, doubled, 3600s floor)
…ken post-deploy; API-less fallback limitation stated honestly; all workspace lookups assert exactly one match (one record per soul, refuse on ambiguity)
…n the newest incarnation row (inventory is per-incarnation); cap sized from effective FRESHELL_RUNTIME_STARTUP_CONCURRENCY; positive orphan check: baseline containers' souls must exist in the deployed registry
…orms, Environment= lines, supervisor 1..16 clamp); installation-scoped docker filters; orphan check matches (soul, container) pairs with surfaced inspect failures; API data-model comment corrected (collapses to latest row per soul)
…rency read (inherited env, Environment=, then EnvironmentFile which wins); DOCKER_HOST pinned to the supervisor's daemon socket; executable UI path for the browser check (coding-CLI directory step, not plain shell); after-capture installation filter actually applied
…WS/BWS against the probe layout before any stop or rm; recovery mode clears a BWS-pointing OpenCode default (original lost with the shell); BWS stop requires desiredState stopped too; curl timeouts make the browser poll actually bounded
… bash -n clean); destructive-path guard moved to the common path (validates in the normal flow too, printf -v not eval); bounded wait for the picker's unawaited settings save before the restore
…re chmod and included in the cleanup guard; picker-save poll exhaustion aborts cleanup instead of racing a still-in-flight save
…ne canonical probe root (no cross-run deletion); PROBE_ROOT realpath'd before chmod (symlinks); reset-failed for the start-rate-limit state; headers scrubbed explicitly on success
…PROBE_ROOT IS the root; WS/BWS must sit under it) and now covers D (mktemp + probe records required); guard logic executed against fixture paths, all seven cases behave
… records check (recovery runs again); D's run.env workspace cross-checked against WS (mixed-run D+WS refused); fixtures extended, all pass
…visible user files (a name pattern is not ownership); recovery confirms the matched soul record before the stop; browser poll on an elapsed-time 120s deadline; every curl carries connect and total timeouts
…stemd cgroup kill defeats it; unit KillMode caveat); probe root deleted only when it holds nothing but this run's workspaces; poll clock starts after the operator's UI step; strict build ordered after the stop; health curls bounded
…ly empty (dotfiles included; in-soul state lives in the soul volume); root-entry sweep covers ..-prefixed names; codex retention warning placed at the restart instructions as well
…unit form passes when any one is up); D pattern honors TMPDIR; run.env WS read by sourcing (unescapes %q, spaced paths tie correctly); fixtures cover both
…efore the build (units run their own paths, not the cwd); settings restore is conditional on the probe path still being current; BWS %-quoted in run.env
…values and leading zeroes (base-10 arithmetic after digit validation); picker-save wait branches instead of wedging cleanup (newer user choices are preserved, not blocking)
…y settings site; late picker saves swept after workspace deletion; header scrub moved after the sweep (it needs the token); residual no-CAS window stated honestly
…are verified (step-7 capture, recovery); sweep uses a fresh private dir (settings responses carry secrets), re-mints its token after a lost shell, and checks the final PATCH
…h sources (environ then .env) and fails closed instead of skipping; malformed sweep responses abort with manual-resolution instructions; guard pins workspace depth (case * matches slashes, nested paths refused)
…erived from the installed supervisor unit (specifiers expanded, site-specific units honored); allowed-roots fallback for the browser probe when allowedFilePaths excludes home; guard ownership keyed to the RECORDED run root (records path) with the home pattern only for recovery; four branch fixtures pass
…flag value and --flag=value forms; browser fallback uses a separate recorded BROWSER_ROOT (WS stays under PROBE_ROOT, no shared-root rule); recovery anchors by root basename (allowed-roots deployments clean up too); control socket derived from the installed unit; guard branches fixture-verified
…the probe path itself is permitted (prefix match against each entry, not a ^HOME grep); flag extraction takes the LAST match (drop-ins that reset ExecStart come after the base unit in systemctl cat)
…rver (/ boundary or exact match, ~ normalized); allowed-list read is HTTP- and shape-verified; step-7 chmod pinned to depth+basename (case * matches slashes)
…tual BWS; ~ expanded in the allowed root before quoted mktemp; sweep dir scrubbed by the EXIT trap on every exit path
…server maps WSL Windows roots itself); post-deletion sweep is a bounded poll; run.env records PROBE_ROOT and BWS is cross-checked against it; settings responses deleted immediately and the retained-records prose no longer claims they are non-secret
…d fails; recovery validates each workspace independently (no cross-root sharing); Windows-only allowed lists prompt for the Linux path of an allowed root; recorded roots canonicalized (symlinked roots compare correctly); secret-hygiene prose accurate
…all; quick-sequence baseline re-captured after the build (souls created during the build are baselined); stale-client step-7 failure gets an explicit cleanup path (BROWSER_CHECK_FAILED=1); recovery confirms the browser soul separately
…op machinery cleanly (no empty-ID requests, confirm suppressed); baseline re-capture reuses RUN in the same shell (an orphaned run dir would leak its token header)
…(pre-creation snapshot delta) and restores the OpenCode default immediately after the picker save lands (confound window shrunk to seconds); writable-root retry in the allowed fallback; CUR guarded under set -u; cleanup wait framed as belt-and-braces with its residual stated
… a NEW soul via pre-creation snapshot delta and restores the OpenCode default as soon as the picker save lands (confound window seconds, not minutes); allowed fallback retries until a writable root; CUR guarded when every settings read fails
…ndows-root manual path feeds the creation loop; strict-sequence capture sits immediately before the stop; browser-probe residual identity risk stated (no UI-exposed terminal IDs)
…in the prose; BWS matched by its canonical form (the server canonicalizes terminalCwd; symlinked allowed roots match), BWS_MATCH recorded and restored
…computes BWS_MATCH for the new workspace
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
docs/development/self-hosted-launch-runbook.md: new "Redeploy managed runtime" section — the full procedure for rebuilding and restarting the Rust server on a host with the managed runtime live: build surface (server + supervisor + session-host binaries, pinned workload image, web client,managed-runtime-v1feature flag), quick and strict restart sequences, restart effects on running sessions (durable containers survive; host-side terminals reconcile; adopted Codex sidecar retention vs systemd's default cgroup kill), an 8-step verification checklist (readiness, survival, new managed soul probe, browser negotiation check), guarded destructive cleanup, and a recovery mode.docs/development/managed-runtime.md: deploy pointer linking the runbook section.Validation
bash -n; the destructive-path guard logic was executed against fixture trees.Docs-only; no runtime code changes.