didericis/bot-bottle
1
0
Fork 0
Code Issues 34 Pull Requests 11 Actions Packages Releases Wiki Activity

PRD: reprovision on gateway startup #517

Open
didericis-claude wants to merge 3 commits from prd-gateway-reprovision-on-bringup into main
pull from: prd-gateway-reprovision-on-bringup
merge into: didericis:main
Conversation 3 Commits 3 Files Changed 9
+314

3 Commits

Author SHA1 Message Date
didericis 4434752db4 docs(prd): reconcile via a backend-ABC method across all backends (0081 review)
prd-number-check / require-numbered-prds (pull_request) Successful in 11s
Details
test / image-input-builds (pull_request) Has started running
Details
test / integration-docker (pull_request) Failing after 1m13s
Details
test / unit (pull_request) Successful in 1m2s
Details
test / coverage (pull_request) Has been skipped
Details
tracker-policy-pr / check-pr (pull_request) Successful in 10s
Details 
Address review: target all backends, not firecracker-only. Make the reconcile
an @abc.abstractmethod `attach_bottled_agents_to_gateway()` on BottleBackend so
every backend implements it (cross-backend by construction) and the host calls
it on gateway bring-up. Drop the docker/macOS non-goal; add the open question of
retiring docker's now-redundant CA bind-mount.

Refs #516
 2026-07-26 19:06:00 -04:00
didericis f9d0e15f13 feat(orchestrator): update a single egress secret in place (0081)
prd-number-check / require-numbered-prds (pull_request) Successful in 8s
Details
tracker-policy-pr / check-pr (pull_request) Successful in 22s
Details
test / unit (pull_request) Successful in 58s
Details
lint / lint (push) Successful in 1m7s
Details
test / integration-docker (pull_request) Successful in 1m12s
Details
test / coverage (pull_request) Successful in 46s
Details 
Add a single-secret counterpart to reprovision_from_secret's restore-all:
update ONE egress token for a running bottle without a relaunch, for
refreshing a short-lived host credential (e.g. the Codex access token)
whose launch-time snapshot has expired.

- registry_store.store_agent_secret: per-key upsert (delete+insert of the
  one row), the counterpart of store_agent_secrets' replace-all.
- OrchestratorCore.update_agent_secret: set the in-memory token AND upsert
  the re-encrypted row under the bottle's env_var_secret, leaving other
  tokens untouched.
- POST /bottles/<id>/secret (cli-only) + client.update_agent_secret.

Refs #510, #512

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-26 18:52:11 -04:00
didericis bf6b32381d docs(prd): reprovision gateway-dependent state on gateway bring-up (0081) 
Reconcile every running bottle against a freshly-booted gateway (replace
each agent's CA, re-provision git-gate, restore egress tokens) instead of
persisting gateway state on volumes. Supersedes the abandoned CA-volume
(#511) and git-gate-volume (#513) PRs.

Refs #510, #512

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-26 18:12:03 -04:00