didericis
f77023db1d
test / integration-docker (pull_request) Successful in 11s
test / unit (pull_request) Successful in 43s
lint / lint (push) Successful in 56s
test / integration-firecracker (pull_request) Successful in 3m19s
test / coverage (pull_request) Successful in 19s
test / publish-infra (pull_request) Has been skipped
tracker-policy-pr / check-pr (pull_request) Successful in 7s
Separate the gateway (data plane) from the orchestrator (control plane) at the
module level. The gateway runtime files move out of the package root — and the
backend-neutral Gateway lifecycle ABC + GATEWAY_* constants move out of
orchestrator/ — into a new bot_bottle/gateway/ package:
gateway/__init__.py (was orchestrator/gateway.py: Gateway ABC + consts
+ rotate_gateway_ca)
gateway/gateway_init.py (the PID-1 daemon supervisor)
gateway/egress_addon.py, egress_addon_core.py, egress_dlp_config.py,
dlp_detectors.py (the egress mitmproxy daemon)
gateway/git_http_backend.py (the git-http daemon)
gateway/git_gate_render.py (the git-gate pre-receive rendering)
gateway/supervise_server.py (the supervise MCP daemon)
gateway/policy_resolver.py (the data-plane control-plane RPC client)
orchestrator/ now holds only control-plane files. The shared plan/types/auth
layer (egress.py=EgressPlan, git_gate.py=GitGatePlan, supervise.py,
supervise_types.py, control_auth.py) and the launch-time git-gate provisioning
helpers stay at root, so orchestrator/ and backend/ still own them.
Because these daemons are invoked as `python3 -m bot_bottle.<name>`, loaded flat
by mitmproxy, and referenced in Dockerfile.gateway, the move updates more than
Python imports: the `-m` invocations (firecracker/macOS infra scripts), the
Dockerfile.gateway addon shim + ENTRYPOINT, gateway_init's _DAEMONS module
paths, and the git-gate CGI heredocs all now point at bot_bottle.gateway.*.
No behavior change; full unit suite green (2251).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
64 lines
2.3 KiB
Python
64 lines
2.3 KiB
Python
"""Per-host orchestrator service (PRD 0070).
|
|
|
|
A single persistent per-host service that will run the gateway functions
|
|
(egress / git-gate / supervise), coordinate with the console, and broker
|
|
agent launches. This package is being built bottom-up, starting with the
|
|
backend-neutral "consolidation core" that needs no VM packaging:
|
|
|
|
* `registry` — the SQLite runtime-state store + fail-closed
|
|
attribution (source IP + per-bottle identity token).
|
|
* `broker` — the signed, structured launch-request contract + a
|
|
`LaunchBroker` (stub for the harness) that verifies
|
|
provenance before acting.
|
|
* `gateway` — the consolidated per-host gateway: the `Gateway`
|
|
lifecycle contract (idempotent singleton). One
|
|
gateway shared by all bottles instead of one per
|
|
bottle; backend impls live under `backend/*/gateway`.
|
|
* `service` — the `Orchestrator`: owns the registry, brokers the
|
|
launch lifecycle (launch/teardown), manages the
|
|
shared gateway, attributes.
|
|
* `control_plane` — the HTTP control-plane RPC (launch / teardown /
|
|
list / attribute / gateway / health).
|
|
|
|
The actual backend-native launch (a real docker/firecracker broker) and
|
|
the egress/git/supervise data plane land in later slices once this core is
|
|
proven (see the PRD sequencing: plain-process dev-harness -> docker
|
|
orchestrator -> firecracker).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from .registry import BottleRecord, RegistryStore, new_identity_token
|
|
from .broker import (
|
|
BrokerAuthError,
|
|
LaunchBroker,
|
|
LaunchRequest,
|
|
StubBroker,
|
|
sign_request,
|
|
verify_request,
|
|
)
|
|
from .docker_broker import DockerBroker, DockerBrokerError
|
|
from ..gateway import Gateway, GatewayError
|
|
from .service import Orchestrator
|
|
from .control_plane import ControlPlaneServer, dispatch, make_server
|
|
|
|
__all__ = [
|
|
"BottleRecord",
|
|
"RegistryStore",
|
|
"new_identity_token",
|
|
"BrokerAuthError",
|
|
"LaunchBroker",
|
|
"LaunchRequest",
|
|
"StubBroker",
|
|
"DockerBroker",
|
|
"DockerBrokerError",
|
|
"Gateway",
|
|
"GatewayError",
|
|
"sign_request",
|
|
"verify_request",
|
|
"Orchestrator",
|
|
"ControlPlaneServer",
|
|
"dispatch",
|
|
"make_server",
|
|
]
|