fix(cli): foreground spawn provisions the durable backstop by default#245
Open
davidfarah2003 wants to merge 2 commits into
Open
fix(cli): foreground spawn provisions the durable backstop by default#245davidfarah2003 wants to merge 2 commits into
davidfarah2003 wants to merge 2 commits into
Conversation
A foreground `cotal spawn` hardcoded durableMembership:false, so every foreground agent silently ran live-only on durable-class channels: no read-ACL row, so the delivery daemon refused its durable joins, and any channel message posted while its connection blipped was permanently lost to auto-injection (reconnect deliberately re-opens the core-subs without re-backfill, and there is no per-member queue to catch up from). Reproduced live: a severed live-only agent lost 3/3 messages posted in the gap; the same sever against a durable-provisioned agent delivered 3/3 on its next turn via DLV redelivery. The old guard's rationale was stale: the daemon authorizes durableJoin off the ACL row and leave is agent self-service, so no managing host is required. Foreground now provisions the same footprint as --detach; a new --live-only flag restores the old behavior explicitly. A foreground exit also retires the agent's creds and broker footprint (DM/DLV durables + ACL row) — each spawn mints a fresh identity, so an exited agent's footprint was dead weight; previously every foreground exit leaked it. Mirrors the manager's despawn deprovision, including in user mode. Crash residue remains the same class a crashed manager leaves; the lifecycle-scoped retirement in the control-surface work remains the complete answer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Foreground
cotal spawnhardcodeddurableMembership: false, so every foreground agent silently ran live-only on durable-class channels: no read-ACL row → the delivery daemon refused its durable joins → no per-member DLV queue. Because a reconnect deliberately re-opens the core-subs without re-backfill, any channel message posted while the agent's connection blipped was permanently lost to auto-injection — the default config walks users straight into this.Reproduced live (released 0.11.6, isolated mesh): a foreground agent's connection was severed while 3 messages were posted; after reconnect they were absent from its context and its inbox, unrecoverable by any push. The same sever against a durable-provisioned twin delivered all 3 on its next turn via DLV redelivery.
Why the old guard was stale
Its comment claimed a durable boot membership "could be neither authorized for reader delivery nor leaved via self-service" without a managing host. Neither holds in the v3 Plane-3 design: the daemon authorizes
durableJoinoff the ACL row (commitAcl), and leave is agent self-service — no manager involvement anywhere.Change
cotal spawn(static and user-auth mode) provisions the same durable footprint as--detach, ACL row included. Join now reports "durable backstop active".--live-onlyflag restores the old behavior explicitly (no ACL row).docs/cli.mdcorrected; docs bundle regenerated; flag-inventory snapshot updated.Verification
↩ retired credson exit with the creds file gone.pnpm typecheckgreen;pnpm smoke:cigreen (incl.plane3-activation-auth, which still covers the explicit opt-out path).