Foundations design: one Host model, runtime and event route

kayg commented

2026-10-05 05:09:08 +00:00

Owner

Design-only foundations job requested by the owner. Worktree: /mnt/hdd/infraternal/wt-lp/foundations-design; branch: detached HEAD at dev; base/head: 851d502909.

Scope: read-only source investigation and compact design of the Host aggregate, unified infraternal-agent v1 transport, authoritative events/cache, provider cutover, fault tests and independently mergeable milestones. Deliverables: /mnt/hdd/infraternal/jobs/foundations-design/design.md and questions.md. No product commits, pushes, deployment or subjobs.

Read CLAUDE.md, DECISIONS.md (especially §§31–45), DESIGN, PLAN and UI. The job's explicit no-subjobs/read-only instructions govern this investigation. Code graph is being built outside the worktree in the job directory. Current production failures and in-flight one-add-host/connect-errors/install-single-source jobs will be treated as migration inputs.

Design-only foundations job requested by the owner. Worktree: /mnt/hdd/infraternal/wt-lp/foundations-design; branch: detached HEAD at dev; base/head: 851d50290998f1328b7e5557f9084a5d7d0dff07. Scope: read-only source investigation and compact design of the Host aggregate, unified infraternal-agent v1 transport, authoritative events/cache, provider cutover, fault tests and independently mergeable milestones. Deliverables: /mnt/hdd/infraternal/jobs/foundations-design/design.md and questions.md. No product commits, pushes, deployment or subjobs. Read CLAUDE.md, DECISIONS.md (especially §§31–45), DESIGN, PLAN and UI. The job's explicit no-subjobs/read-only instructions govern this investigation. Code graph is being built outside the worktree in the job directory. Current production failures and in-flight one-add-host/connect-errors/install-single-source jobs will be treated as migration inputs.

kayg commented

2026-10-05 05:10:15 +00:00

Author

Owner

Design-only foundations job requested by the owner. Worktree: /mnt/hdd/infraternal/wt-lp/foundations-design; branch: detached HEAD at dev; base/head: 851d502909.

Scope: read-only source investigation and compact design of the Host aggregate, unified infraternal-agent v1 transport, authoritative events/cache, provider cutover, fault tests and independently mergeable milestones. Deliverables: /mnt/hdd/infraternal/jobs/foundations-design/design.md and questions.md. No product commits, pushes, deployment or subjobs.

Read CLAUDE.md, DECISIONS.md (especially §§31–45), DESIGN, PLAN and UI. The job's explicit no-subjobs/read-only instructions govern this investigation. Code graph is being built outside the worktree in the job directory. Current production failures and in-flight one-add-host/connect-errors/install-single-source jobs will be treated as migration inputs.

Design-only foundations job requested by the owner. Worktree: /mnt/hdd/infraternal/wt-lp/foundations-design; branch: detached HEAD at dev; base/head: 851d50290998f1328b7e5557f9084a5d7d0dff07. Scope: read-only source investigation and compact design of the Host aggregate, unified infraternal-agent v1 transport, authoritative events/cache, provider cutover, fault tests and independently mergeable milestones. Deliverables: /mnt/hdd/infraternal/jobs/foundations-design/design.md and questions.md. No product commits, pushes, deployment or subjobs. Read CLAUDE.md, DECISIONS.md (especially §§31–45), DESIGN, PLAN and UI. The job's explicit no-subjobs/read-only instructions govern this investigation. Code graph is being built outside the worktree in the job directory. Current production failures and in-flight one-add-host/connect-errors/install-single-source jobs will be treated as migration inputs.

kayg commented

2026-10-05 05:13:48 +00:00

Author

Owner

Current-head evidence (851d502909):

HostStatus is engine-derived online/offline (crates/proto/src/resources.rs:10–18). Host list derives remote status from tunnel presence (resources.rs:2443–2470), but detail derives it from local engines only (:2472–2489). Host identity, SSH ownership/settings and installation state therefore do not have one lifecycle owner.
SSH updates write host_ssh_settings (storage/mod.rs:832–847); install jobs own a second ssh copy (proto/install.rs:155–175), and bootstrap connects through job.ssh (server/install.rs:1258–1266). The screenshot report is consistent with these distinct sources.
Embedded RPC directly holds ProviderRuntime (host_route.rs:306–335); remote RPC decodes frames (agent/provider_rpc.rs:18–69). Embedded probe/trust bypasses the signed remote OPEN path (server/ssh_route.rs:101–146). Native operations already share the runtime; no second substrate implementation rewrite is needed.
RuntimeEvent omits summaries (provider_runtime.rs:81–90); native notices are emitted before reconciliation (:785–810). Existing latest-only snapshot publication is useful (remote.rs:528–560), but client Events target '*' maps to the local host (server/stream.rs:2020). Hosts/install/dashboard/sidebar use separate pollers, including per-job polling (hosts/+page.svelte:112–145).
Production defaults still instantiate LegacyProvider (agent/lib.rs:1320–1339). FactoryRegistry, bounded collectors, optional capability handlers and shared signing are existing migration seams to keep.

Design choices: one Host reducer with versioned connection and explicit execution-owner bindings; bootstrap records operation evidence, not editable connection truth; transport/SSH/provider health and inventory completeness remain separate from lifecycle. Embedded and mTLS paths share v1 frame actors, with only transport admission differing. Events are emitted after atomic publication; gaps and old epochs cannot revive completeness. SQLite-backed cache pages and globally bounded staging prevent 500 host-local maxima from becoming 500 allocations.

DECISIONS §§33–35 supersede the stale deployment/Postgres/polling descriptions in DESIGN/PLAN/UI. Self-install and mesh-auth work has evolved since the arch-review head; #72/#73 are not claimed newly closed by foundations. Risky transitions retain independent Sol review; ordinary/UI steps go to gates. No product gate or performance measurement has been run in this design-only job.

Current-head evidence (851d50290998f1328b7e5557f9084a5d7d0dff07): - HostStatus is engine-derived online/offline (crates/proto/src/resources.rs:10–18). Host list derives remote status from tunnel presence (resources.rs:2443–2470), but detail derives it from local engines only (:2472–2489). Host identity, SSH ownership/settings and installation state therefore do not have one lifecycle owner. - SSH updates write host_ssh_settings (storage/mod.rs:832–847); install jobs own a second ssh copy (proto/install.rs:155–175), and bootstrap connects through job.ssh (server/install.rs:1258–1266). The screenshot report is consistent with these distinct sources. - Embedded RPC directly holds ProviderRuntime (host_route.rs:306–335); remote RPC decodes frames (agent/provider_rpc.rs:18–69). Embedded probe/trust bypasses the signed remote OPEN path (server/ssh_route.rs:101–146). Native operations already share the runtime; no second substrate implementation rewrite is needed. - RuntimeEvent omits summaries (provider_runtime.rs:81–90); native notices are emitted before reconciliation (:785–810). Existing latest-only snapshot publication is useful (remote.rs:528–560), but client Events target '*' maps to the local host (server/stream.rs:2020). Hosts/install/dashboard/sidebar use separate pollers, including per-job polling (hosts/+page.svelte:112–145). - Production defaults still instantiate LegacyProvider (agent/lib.rs:1320–1339). FactoryRegistry, bounded collectors, optional capability handlers and shared signing are existing migration seams to keep. Design choices: one Host reducer with versioned connection and explicit execution-owner bindings; bootstrap records operation evidence, not editable connection truth; transport/SSH/provider health and inventory completeness remain separate from lifecycle. Embedded and mTLS paths share v1 frame actors, with only transport admission differing. Events are emitted after atomic publication; gaps and old epochs cannot revive completeness. SQLite-backed cache pages and globally bounded staging prevent 500 host-local maxima from becoming 500 allocations. DECISIONS §§33–35 supersede the stale deployment/Postgres/polling descriptions in DESIGN/PLAN/UI. Self-install and mesh-auth work has evolved since the arch-review head; #72/#73 are not claimed newly closed by foundations. Risky transitions retain independent Sol review; ordinary/UI steps go to gates. No product gate or performance measurement has been run in this design-only job.

kayg commented

2026-10-05 05:22:28 +00:00

Author

Owner

Finished foundations-design. Base/head remains 851d502909 (detached dev worktree). No source edits, commits, pushes, deployment, subjobs or product gate runs.

Deliverables:

/mnt/hdd/infraternal/jobs/foundations-design/design.md
/mnt/hdd/infraternal/jobs/foundations-design/questions.md

The compact design specifies the Host aggregate/reducer, lifecycle/action presentation, connection revision and installation/session ownership, common v1 in-memory/mTLS connection actor, committed event/cache publication, bounded fleet recovery, generic provider/resource cutover, generated bindings and fault tests. Seventeen independently mergeable 1–3-day milestones total 40 focused person-days, with dependencies, file ownership/parallelism, acceptance and issue closure conditions. Zero open owner decisions block foundations. Deferred owner topics and already-settled choices were not re-asked.

Applied emil-design-eng and better-ui/layout/typography/colors/accessibility/writing/interface: immediate frequent/keyboard feedback, existing calternal surfaces/scales, one primary action, grouped lifecycle presentation, recoverable long text, named controls/focus/status announcements and cause/remedy copy. Proposed browser/contrast/accessibility behavior is explicitly pending implementation; supplied screenshots were inspected as production evidence. No new screenshot or runtime UI proof is claimed.

The workload-specific infraternal-agent RSS budget is a proposal derived under DECISIONS §43 from audit #51, not release calibration. Other PLAN performance budgets remain. Product verification must happen in the planned implementation milestones through scripts/verify and perf-test-VM A/B.

Actual design/read-only validation output (also in verification.txt), quoted verbatim:

PASS design: 24 explicit source references resolve at recorded head
PASS design: 17 milestones, each 1–3 days, total 40 person-days
PASS design: 0 open owner decisions
PASS read-only: HEAD 851d50290998f1328b7e5557f9084a5d7d0dff07; tracked/untracked worktree clean
NOT RUN product gates: design-only external artifacts; no source change or release certification

Code graph built outside the worktree: Full build: 489 files, 7618 nodes, 110045 edges (postprocess=minimal). Source references were then checked against this job's head, rather than copied blindly from the older audits. Public technical references are cited in the design for Tokio bounded permits/watch, SQLite WAL and iproute2 network fault injection. Keep this issue open for orchestrator handoff.

Finished foundations-design. Base/head remains 851d50290998f1328b7e5557f9084a5d7d0dff07 (detached dev worktree). No source edits, commits, pushes, deployment, subjobs or product gate runs. Deliverables: - /mnt/hdd/infraternal/jobs/foundations-design/design.md - /mnt/hdd/infraternal/jobs/foundations-design/questions.md The compact design specifies the Host aggregate/reducer, lifecycle/action presentation, connection revision and installation/session ownership, common v1 in-memory/mTLS connection actor, committed event/cache publication, bounded fleet recovery, generic provider/resource cutover, generated bindings and fault tests. Seventeen independently mergeable 1–3-day milestones total 40 focused person-days, with dependencies, file ownership/parallelism, acceptance and issue closure conditions. Zero open owner decisions block foundations. Deferred owner topics and already-settled choices were not re-asked. Applied emil-design-eng and better-ui/layout/typography/colors/accessibility/writing/interface: immediate frequent/keyboard feedback, existing calternal surfaces/scales, one primary action, grouped lifecycle presentation, recoverable long text, named controls/focus/status announcements and cause/remedy copy. Proposed browser/contrast/accessibility behavior is explicitly pending implementation; supplied screenshots were inspected as production evidence. No new screenshot or runtime UI proof is claimed. The workload-specific infraternal-agent RSS budget is a proposal derived under DECISIONS §43 from audit #51, not release calibration. Other PLAN performance budgets remain. Product verification must happen in the planned implementation milestones through scripts/verify and perf-test-VM A/B. Actual design/read-only validation output (also in verification.txt), quoted verbatim: ```text PASS design: 24 explicit source references resolve at recorded head PASS design: 17 milestones, each 1–3 days, total 40 person-days PASS design: 0 open owner decisions PASS read-only: HEAD 851d50290998f1328b7e5557f9084a5d7d0dff07; tracked/untracked worktree clean NOT RUN product gates: design-only external artifacts; no source change or release certification ``` Code graph built outside the worktree: Full build: 489 files, 7618 nodes, 110045 edges (postprocess=minimal). Source references were then checked against this job's head, rather than copied blindly from the older audits. Public technical references are cited in the design for Tokio bounded permits/watch, SQLite WAL and iproute2 network fault injection. Keep this issue open for orchestrator handoff.

Rows
Columns

Foundations design: one Host model, runtime and event route #92