feat(orchestrator): slice 13b — consolidated registration inputs (egress policy) #370

2026-07-13T20:40:56-04:00

didericis-claude commented

2026-07-13 20:40:56 -04:00

Sub-slice of slice 13 (docker launch integration). Bridges the existing per-bottle prepare output to the consolidated registry — the first piece of "what to register."

What it does

registration_inputs(plan) turns a prepared egress plan into the backend-neutral inputs Orchestrator.launch_bottle takes:

egress_policy(plan) — the policy blob is the exact routes YAML the per-bottle egress sidecar used to read from a file (egress_render_routes). In the consolidated model the multi-tenant gateway's PolicyResolver fetches it from the registry per request (keyed by source IP) instead. Same render → a bottle's allow-list is byte-identical when it moves onto the shared gateway.
RegistrationInputs bundles policy + metadata; the metadata carries the human slug so the shared registry can map a minted bottle id back to a name (console / supervise display — the UX gap noted in slices 11/12).

Host-side glue (imports bot_bottle.egress), used by the launch path — not the lean orchestrator control-plane process. Not yet wired into launch (13c/13d), consistent with the slice-6/10 pattern of landing the primitive before the cut-over.

Key test

The policy round-trips through load_config back to the same routes + log level — proving the resolver-served policy reconstructs the per-bottle egress config exactly.

Verification

pyright 0 errors, pylint 9.83/10, unit suite green (1718 tests; the 13 test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise).

Stacked on #369.

🤖 Generated with Claude Code

Sub-slice of **slice 13 (docker launch integration)**. Bridges the existing per-bottle `prepare` output to the consolidated registry — the first piece of "what to register." ### What it does `registration_inputs(plan)` turns a prepared egress plan into the backend-neutral inputs `Orchestrator.launch_bottle` takes: - **`egress_policy(plan)`** — the policy blob is the *exact* routes YAML the per-bottle egress sidecar used to read from a file (`egress_render_routes`). In the consolidated model the multi-tenant gateway's `PolicyResolver` fetches it from the registry per request (keyed by source IP) instead. Same render → a bottle's allow-list is **byte-identical** when it moves onto the shared gateway. - **`RegistrationInputs`** bundles `policy` + `metadata`; the metadata carries the human **slug** so the shared registry can map a minted bottle id back to a name (console / supervise display — the UX gap noted in slices 11/12). Host-side glue (imports `bot_bottle.egress`), used by the launch path — *not* the lean orchestrator control-plane process. Not yet wired into launch (13c/13d), consistent with the slice-6/10 pattern of landing the primitive before the cut-over. ### Key test The policy **round-trips through `load_config`** back to the same routes + log level — proving the resolver-served policy reconstructs the per-bottle egress config exactly. ### Verification pyright **0 errors**, pylint **9.83/10**, unit suite green (1718 tests; the 13 `test_sidecar_init` `/bin/sleep` errors are pre-existing NixOS-local noise). Stacked on #369. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

didericis-claude added 1 commit 2026-07-13 20:40:57 -04:00

feat(orchestrator): slice 13b — consolidated registration inputs (egress policy)

lint / lint (push) Successful in 2m10s

Details

test / unit (pull_request) Successful in 1m12s

Details

test / integration (pull_request) Successful in 29s

Details

test / coverage (pull_request) Successful in 1m20s

Details

ea0c070cfe

Bridges the per-bottle `prepare` output to the consolidated registry:
`registration_inputs(plan)` turns a prepared egress plan into the
backend-neutral inputs `Orchestrator.launch_bottle` takes.

- egress_policy(plan): the policy blob = the exact routes YAML the
  per-bottle sidecar read from a file; the multi-tenant gateway's
  PolicyResolver now fetches it from the registry per request instead.
  Same egress_render_routes, so a bottle's allow-list is byte-identical
  moving onto the shared gateway.
- RegistrationInputs bundles policy + metadata; metadata carries the human
  slug so the shared registry can map a minted bottle id back to a name
  (console / supervise display).

Host-side glue (imports bot_bottle.egress) used by the launch path — not
the lean orchestrator control-plane process. Not yet wired into launch
(that's 13c/13d), consistent with the slice-6/10 pattern of landing the
primitive before the cut-over.

Key test: the policy round-trips through load_config back to the same
routes + log level — the resolver-served policy reconstructs the per-bottle
egress config exactly.

pyright 0 errors; pylint 9.83/10; unit suite green (1718 tests; the 13
test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

didericis force-pushed orchestrator-registration from d0b35b5506 to ea0c070cfe

2026-07-13 21:15:51 -04:00

Compare

didericis-claude referenced this pull request

2026-07-13 21:16:16 -04:00

feat(git-gate+orchestrator): slice 13c(i) — per-bottle git-gate provisioning render #371

didericis-claude commented

2026-07-14 00:57:32 -04:00