3 Commits

Author	SHA1	Message	Date
didericis-claude	9729407430	feat(orchestrator): list_live broker op + reconcile via broker (#468) ... Chunk 3 of the host-control-server stack: grow the broker op vocabulary (PRD gap 3), starting with `list_live`, and invert `reconcile` onto it. - broker: split the closed op vocabulary into mutation (`launch`/`teardown`, carry a bottle id + static flags) and query (`list_live`, carries nothing but its op name) kinds. `verify_request` now enforces a **strict schema** (open question 1, resolved yes): unknown claim keys are rejected, a mutation must name its bottle, and a query that smuggles any id/flag is refused. - broker verb: `LaunchBroker.list_live` / `SubmitBroker.list_live` return the backend's live source IPs; a backend enumeration failure is converted to the single `BrokerUnavailableError` "live set unknown" signal. `DockerBroker` enumerates its labelled containers; `StubBroker` derives from launches (or a test override). - host controller: `POST /broker/live` verifies a signed `list_live` token and returns `{source_ips}`; `BrokerClient.list_live` is its drop-in client. - reconcile: `OrchestratorCore.reconcile()` drops the `live_source_ips` parameter and pulls the live set from the broker itself — the tell that the orchestrator couldn't see the backend goes away. **Fail-safe**: if the broker can't return an authoritative set the sweep is skipped, never run against an empty/partial set (which would reap healthy rows). The `/reconcile` HTTP contract + `OrchestratorClient.reconcile` become a bare trigger. The macOS launcher's Apple-container enumeration stays for now; it becomes the host controller's `list_live` when launch itself moves behind the broker (the pulled-forward chunk 5, next in the stack). Tests + pyright clean; pylint 10.0 on broker. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 17:52:44 +00:00
didericis-claude	1553a98275	fix(orchestrator): address review on host control server transport (#468) ... Codex review on #496: - **High — ambiguous delivery no longer orphans a launched bottle.** A timeout / dropped response from the host controller is now the ambiguous BrokerUnavailableError (distinct from the definite BrokerAuthError / BrokerClientError). OrchestratorCore.launch_bottle keeps the registry row on the ambiguous case instead of deregistering — deregistering would orphan a running container with no record (reconcile reaps rows, never containers). The row is left for reconcile to reap iff the bottle is not actually live. Definite failures still roll back, so a real failure leaves no orphan row. - **Medium — the privileged endpoint bounds request bodies.** The host server rejects an oversized Content-Length with 413 before reading it, and sets a per-request socket timeout, so a caller that can merely reach the socket (no signed token) can't exhaust memory or a handler thread. Tests: ambiguous-keep vs definite-rollback in the launch path; the BrokerUnavailableError/BrokerClientError split in BrokerClient; the 413 body cap + handler error paths (driven in-thread, since daemon request threads lose coverage) plus a deterministic real-socket check that declares an oversized Content-Length but sends a sliver (rejection on the header, no unread-body reset race); and the __main__ entrypoint broker selection. Diff-coverage 98%; pyright clean; pylint 9.8. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 09:13:36 +00:00
didericis-claude	79dd4926bb	feat(orchestrator): host control server transport (#468) ... Chunk 1 of the host-control-server stack: close the PRD's **transport** gap. Today LaunchBroker.submit(token) is an in-process method call from OrchestratorCore; this makes it a real out-of-process service reached over HTTP. - host_server.py: the host control server. A pure dispatch() (POST /broker verifies a signed token via the existing verify_request + _launch/_teardown path, GET /health) wrapped by a thin http.server adapter, mirroring orchestrator/server.py. Only the signed token crosses the wire; provenance/schema failures are fail-closed 401s that never touch the backend, a backend launch failure is a 502. - broker_client.py: BrokerClient — a drop-in submit(token) that POSTs the signed token to the host controller. A 401 re-raises as BrokerAuthError so the launch path's rollback is identical local or remote. - broker.py: SubmitBroker Protocol — the one method OrchestratorCore depends on, satisfied by both LaunchBroker and BrokerClient, so the core is unchanged (service.py annotation only). - __main__.py: wire `--broker http` behind the shared-secret env var (BOT_BOTTLE_BROKER_SECRET, hex) — a chunk-1 stopgap the durable TrustDomain key (chunk 2, #476) replaces. Tested: pure-dispatch cases, BrokerClient with HTTP mocked, and a real-socket sign -> POST -> verify -> act round-trip (incl. fail-closed forged token). pyright clean; pylint 9.86. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 07:16:56 +00:00