PRD: Host control server - list_live broker op + reconcile via broker (chunk 3/5) #507

Open

didericis-claude wants to merge 1 commits from host-control-server-3-list-live into host-control-server-2-secret

Author	SHA1	Message	Date
didericis-claude	76037f36a6	feat(orchestrator): list_live broker op + reconcile via broker (#468 ) lint / lint (push) Successful in 1m5s Details refresh-image-locks / refresh (push) Successful in 34s Details test / unit (pull_request) Has started running Details test / image-input-builds (pull_request) Has started running Details test / coverage (pull_request) Blocked by required conditions Details test / integration-docker (pull_request) Has been cancelled Details tracker-policy-pr / check-pr (pull_request) Successful in 7s Details Chunk 3 of the host-control-server stack: grow the broker op vocabulary (PRD gap 3), starting with `list_live`, and invert `reconcile` onto it. - broker: split the closed op vocabulary into mutation (`launch`/`teardown`, carry a bottle id + static flags) and query (`list_live`, carries nothing but its op name) kinds. `verify_request` now enforces a strict schema (open question 1, resolved yes): unknown claim keys are rejected, a mutation must name its bottle, and a query that smuggles any id/flag is refused. - broker verb: `LaunchBroker.list_live` / `SubmitBroker.list_live` return the backend's live source IPs; a backend enumeration failure is converted to the single `BrokerUnavailableError` "live set unknown" signal. `DockerBroker` enumerates its labelled containers; `StubBroker` derives from launches (or a test override). - host controller: `POST /broker/live` verifies a signed `list_live` token and returns `{source_ips}`; `BrokerClient.list_live` is its drop-in client. - reconcile: `OrchestratorCore.reconcile()` drops the `live_source_ips` parameter and pulls the live set from the broker itself — the tell that the orchestrator couldn't see the backend goes away. Fail-safe: if the broker can't return an authoritative set the sweep is skipped, never run against an empty/partial set (which would reap healthy rows). The `/reconcile` HTTP contract + `OrchestratorClient.reconcile` become a bare trigger. The macOS launcher's Apple-container enumeration stays for now; it becomes the host controller's `list_live` when launch itself moves behind the broker (the pulled-forward chunk 5, next in the stack). Tests + pyright clean; pylint 10.0 on broker. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 22:35:26 +00:00

Author

SHA1

Message

Date

didericis-claude

76037f36a6

feat(orchestrator): list_live broker op + reconcile via broker (#468 )

lint / lint (push) Successful in 1m5s

Details

refresh-image-locks / refresh (push) Successful in 34s

Details

test / unit (pull_request) Has started running

Details

test / image-input-builds (pull_request) Has started running

Details

test / coverage (pull_request) Blocked by required conditions

Details

test / integration-docker (pull_request) Has been cancelled

Details

tracker-policy-pr / check-pr (pull_request) Successful in 7s

Details

Chunk 3 of the host-control-server stack: grow the broker op vocabulary
(PRD gap 3), starting with `list_live`, and invert `reconcile` onto it.

- broker: split the closed op vocabulary into mutation (`launch`/`teardown`,
  carry a bottle id + static flags) and query (`list_live`, carries nothing
  but its op name) kinds. `verify_request` now enforces a **strict schema**
  (open question 1, resolved yes): unknown claim keys are rejected, a mutation
  must name its bottle, and a query that smuggles any id/flag is refused.
- broker verb: `LaunchBroker.list_live` / `SubmitBroker.list_live` return the
  backend's live source IPs; a backend enumeration failure is converted to the
  single `BrokerUnavailableError` "live set unknown" signal. `DockerBroker`
  enumerates its labelled containers; `StubBroker` derives from launches (or a
  test override).
- host controller: `POST /broker/live` verifies a signed `list_live` token and
  returns `{source_ips}`; `BrokerClient.list_live` is its drop-in client.
- reconcile: `OrchestratorCore.reconcile()` drops the `live_source_ips`
  parameter and pulls the live set from the broker itself — the tell that the
  orchestrator couldn't see the backend goes away. **Fail-safe**: if the broker
  can't return an authoritative set the sweep is skipped, never run against an
  empty/partial set (which would reap healthy rows). The `/reconcile` HTTP
  contract + `OrchestratorClient.reconcile` become a bare trigger.

The macOS launcher's Apple-container enumeration stays for now; it becomes the
host controller's `list_live` when launch itself moves behind the broker (the
pulled-forward chunk 5, next in the stack).

Tests + pyright clean; pylint 10.0 on broker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-26 22:35:26 +00:00

PRD: Host control server - list_live broker op + reconcile via broker (chunk 3/5) #507

1 Commits