PRD: Host control server #486

Open

didericis-claude wants to merge 2 commits from prd-new-host-control-server into main

Author	SHA1	Message	Date
didericis-claude	794e4e662d	docs: defer broker replay protection to its own issue (#494 ) prd-number-check / require-numbered-prds (pull_request) Failing after 7s Details tracker-policy-pr / check-pr (pull_request) Successful in 10s Details refresh-image-locks / refresh (push) Successful in 30s Details lint / lint (push) Successful in 1m6s Details Per PR review, replay protection is too heavy for the host control server MVP. Drop it from the four-gap framing (now three gaps), remove the enforcement design section and implementation chunk, and track the iat-window + jti-cache work in #494 as an independent in-process change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 22:35:13 +00:00
didericis-claude	f2fe1f9b2d	docs: PRD for host-side control server (#468 ) Promote the in-process launch broker into a standalone host control server: the single privileged host component that brokers launches, owns orchestrator lifecycle, and is the sole writer of host-durable state. Closes the four broker gaps (transport, durable provisioned secret, replay protection, disciplined op vocabulary) and splits host state by owner and lifetime (orchestrator SQLite / host JSONL audit / gateway none). The payoff is dropping the Docker socket from the CLI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 22:35:13 +00:00

Author

SHA1

Message

Date

didericis-claude

794e4e662d

docs: defer broker replay protection to its own issue (#494 )

prd-number-check / require-numbered-prds (pull_request) Failing after 7s

Details

tracker-policy-pr / check-pr (pull_request) Successful in 10s

Details

refresh-image-locks / refresh (push) Successful in 30s

Details

lint / lint (push) Successful in 1m6s

Details

Per PR review, replay protection is too heavy for the host control
server MVP. Drop it from the four-gap framing (now three gaps), remove
the enforcement design section and implementation chunk, and track the
iat-window + jti-cache work in #494 as an independent in-process change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-26 22:35:13 +00:00

didericis-claude

f2fe1f9b2d

docs: PRD for host-side control server (#468 )

Promote the in-process launch broker into a standalone host control
server: the single privileged host component that brokers launches, owns
orchestrator lifecycle, and is the sole writer of host-durable state.

Closes the four broker gaps (transport, durable provisioned secret,
replay protection, disciplined op vocabulary) and splits host state by
owner and lifetime (orchestrator SQLite / host JSONL audit / gateway
none). The payoff is dropping the Docker socket from the CLI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-26 22:35:13 +00:00

PRD: Host control server #486

2 Commits