feat(orchestrator): slice 5 — build the consolidated sidecar bundle image #360

2026-07-13T17:00:33-04:00

didericis-claude commented

2026-07-13 17:00:33 -04:00

Slice 5 of PRD 0070, stacked on #358. Answers "where do we build the consolidated sidecar" — nowhere, until now (slice 4 launched a bare placeholder image).

sidecar.py — Sidecar.ensure_built() (default no-op) + DockerSidecar now defaults its image to the real bundle (bot-bottle-sidecars) and ensure_built() builds it from Dockerfile.sidecars when docker image inspect shows it's missing (no-op when present, or when no dockerfile is configured — e.g. a pre-pulled image). Adds image_exists().
service.py — ensure_sidecar() now builds then runs.
__main__.py — --sidecar runs the consolidated bundle (build-if-missing).

Scope note (honest): this builds + launches the bundle container. Making the running instance functional across bottles still needs the per-bottle source-IP-keyed multi-tenant config + registration/reload, and routing agent bottles to it — the next slices (now in PRD 0070's roadmap). The bundle's per-bottle CA/routes/keys config is why a single shared instance isn't functional yet.

Tests: unit (docker mocked) — image_exists, ensure_built builds-when-missing / no-op-when-present / no-op-without-dockerfile / raises-on-failure; ensure_sidecar builds-then-runs; integration (gated, deliberately no heavy image build) — image_exists reflects real docker state. Full suite green (only pre-existing /bin/sleep errors).

Merge order: #352 → #356 → #357 → #358 → this.

🤖 Generated with Claude Code

Slice 5 of PRD 0070, **stacked on #358**. Answers "where do we *build* the consolidated sidecar" — nowhere, until now (slice 4 launched a bare placeholder image). - **`sidecar.py`** — `Sidecar.ensure_built()` (default no-op) + `DockerSidecar` now defaults its image to the real bundle (`bot-bottle-sidecars`) and `ensure_built()` **builds it from `Dockerfile.sidecars`** when `docker image inspect` shows it's missing (no-op when present, or when no dockerfile is configured — e.g. a pre-pulled image). Adds `image_exists()`. - **`service.py`** — `ensure_sidecar()` now **builds then runs**. - **`__main__.py`** — `--sidecar` runs the consolidated bundle (build-if-missing). **Scope note (honest):** this builds + launches the bundle *container*. Making the running instance *functional across bottles* still needs the per-bottle **source-IP-keyed multi-tenant config** + registration/reload, and routing agent bottles to it — the next slices (now in PRD 0070's roadmap). The bundle's per-bottle CA/routes/keys config is why a single shared instance isn't functional yet. **Tests:** unit (docker mocked) — image_exists, ensure_built builds-when-missing / no-op-when-present / no-op-without-dockerfile / raises-on-failure; ensure_sidecar builds-then-runs; integration (gated, deliberately **no heavy image build**) — image_exists reflects real docker state. Full suite green (only pre-existing `/bin/sleep` errors). Merge order: #352 → #356 → #357 → #358 → this. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

didericis-claude added 1 commit 2026-07-13 17:00:34 -04:00

feat(orchestrator): slice 5 — build the consolidated sidecar bundle image (#352 )

lint / lint (push) Successful in 2m7s

Details

test / unit (pull_request) Successful in 1m5s

Details

test / integration (pull_request) Successful in 20s

Details

test / coverage (pull_request) Successful in 1m12s

Details

a092d00312

Answers "where do we build the consolidated sidecar": nowhere, until now.

  * sidecar.py — `Sidecar.ensure_built()` (default no-op) + `DockerSidecar`
    now defaults its image to the real bundle (`bot-bottle-sidecars`) and
    `ensure_built()` builds it from `Dockerfile.sidecars` when
    `docker image inspect` shows it's missing (no-op when present or when no
    dockerfile is configured, e.g. a pre-pulled image). `image_exists()`
    added.
  * service.py — `ensure_sidecar()` now builds then runs.
  * __main__.py — `--sidecar` runs the consolidated bundle (build-if-missing).

Scope note: this builds + launches the bundle *container*; making the
running instance functional across bottles needs the per-bottle,
source-IP-keyed multi-tenant config + registration/reload, and routing
agent bottles to it — the next slices (added to PRD 0070's roadmap).

Tests: unit (docker mocked) — image_exists, ensure_built builds when
missing / no-op when present / no-op without a dockerfile / raises on build
failure; ensure_sidecar builds-then-runs; integration (gated, no heavy
build) — image_exists reflects real docker state. Full suite green (only
pre-existing /bin/sleep errors).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

didericis-claude referenced this pull request

2026-07-13 17:01:50 -04:00

docs(prd): 0070 per-host orchestrator service #352

didericis approved these changes 2026-07-13 17:03:10 -04:00

didericis-claude referenced this pull request

2026-07-13 17:09:48 -04:00

feat(orchestrator): slice 6 — source-IP-keyed multi-tenant policy #361

didericis-claude referenced this pull request

2026-07-13 17:21:46 -04:00

feat(orchestrator): slice 7 — sidecar-side PolicyResolver #362

didericis-claude referenced this pull request

2026-07-13 17:49:02 -04:00