From 8e567edde4898386c7fcf77ece319f04e18f37f8 Mon Sep 17 00:00:00 2001 From: didericis Date: Mon, 13 Jul 2026 15:30:07 -0400 Subject: [PATCH] docs(prd): 0070 add the slice roadmap incl. consolidated sidecar (#352) Enumerate the implementation slices in the Sequencing section: dev-harness core, launch+broker, docker broker, consolidated per-host sidecar (new), then firecracker and macOS. Slices 1-4 implemented (#352/#356/#357/#358). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck --- docs/prds/0070-per-host-orchestrator.md | 31 ++++++++++++++++++------- 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/docs/prds/0070-per-host-orchestrator.md b/docs/prds/0070-per-host-orchestrator.md index 08b8bd5..fec1974 100644 --- a/docs/prds/0070-per-host-orchestrator.md +++ b/docs/prds/0070-per-host-orchestrator.md @@ -325,18 +325,31 @@ orchestrator becomes a VM. Decouple the two risks instead: secret handling) is proven with fast iteration — *then* wrap that exact service in the VM and solve wiring separately. -Backend order (cheapest proof → hardest → last): +### Slices -1. **Docker orchestrator** — nearly free (the sidecar bundle is already - containers; collapse N bundles into one persistent container). Proves - consolidation + the `BottleBackend` seam with the least moving parts. -2. **Firecracker orchestrator** — the real work: the shim + VM-to-VM +Built bottom-up as a stack of small PRs off this one (status: **1–4 +implemented** in #352 → #356 → #357 → #358): + +1. **Dev-harness core** ✅ — SQLite registry (runtime state) + fail-closed + attribution (source IP + identity token) + the HTTP control plane. +2. **Launch lifecycle + broker contract** ✅ — `launch_bottle` / + `teardown_bottle` + the signed, structured `LaunchBroker` request + (HS256 JWT, static ids/flags only, provenance-verified, fail-closed), + with a stub broker for the harness and registry rollback on failure. +3. **Docker launch broker** ✅ — the first real broker: `docker run` / `rm` + per bottle, built only from the request's static fields; proves the + `BottleBackend` seam on the cheapest backend. +4. **Consolidated per-host sidecar** ✅ — one persistent sidecar shared by + all bottles (idempotent singleton) instead of one per bottle — the core + consolidation win, source-IP-keyed via the attribution invariant. +5. **Firecracker broker + sidecar** — the real work: the shim + VM-to-VM routing (host forwards `bbfcN` → orchestrator TAP; the nft table grows - forward rules where today it drops all non-DNAT egress). Built against - the dev-harness so the app logic is already proven. -3. **macOS (Apple container)** — last (container-to-container networking). + forward rules where today it drops all non-DNAT egress), against the + already-proven dev-harness. +6. **macOS (Apple container)** — last (container-to-container networking). -Keep the sidecar **service one shared thing** throughout. +Backends land cheapest-first (docker → firecracker → macOS); keep the +sidecar **service one shared thing** throughout. ## Non-goals