c0re: keep power intent in memory, drop agent_power/kv tables and the stop snapshot
This commit is contained in:
damocles
mara
parent
fca7f669f5
commit
b77fa9edc3
1 changed files with 222 additions and 553 deletions
|
|
@ -69,7 +69,7 @@ Cheap — no build slot:
|
|||
| `DestroyContainer` | `nixos-container destroy` + un-registration (drop from the roster, clear the ephemeral runtime dir). Runs downstream of a `Stop`, so deliberately excluded from `takes_container_down` — the container is already down by the time it claims |
|
||||
| `PurgeState` | the `purge = true` half of a destroy: delete the agent's state subvolume (via hive-priv) plus its state dir. Own node because it's conditional and the irreversible step |
|
||||
| `DestroyBookkeeping` | the post-destroy tail — meta sync, drop the power intent, notify the manager, rescan, re-emit the tombstone. Same split rationale as `RebuildBookkeeping`/`Swap`. The destructive work is `PurgeState`'s |
|
||||
| `SetWanted` | write the durable power intent (`wanted = Up`/`Offline`) as the head node of a power-op DAG. Takes the agent lease even though it's a store write, so the intent write and the tail `Reconcile` are atomic per-agent — two racing power ops can't clobber each other's intent before either reconciles |
|
||||
| `SetWanted` | record the power intent (`wanted = Up`/`Offline`, in memory) as the head node of a power-op DAG. Takes the agent lease even though it writes no container state, so the intent write and the tail `Reconcile` are atomic per-agent — two racing power ops can't clobber each other's intent before either reconciles |
|
||||
| `EmitRebuilt` | tail of a rebuild — emit the agent's `Rebuilt` manager event (ok/fail per outcome, nothing on cancel). One node per agent _and_ per outcome |
|
||||
| `WriteDropin` | `set_nspawn_flags` + `set_resource_limits` + daemon-reload |
|
||||
| `KnowledgePull` | `/knowledge` pull (`knowledge::pull`): at boot (commits that landed while `hive-c0re` was down), on the swarm knowledge-changed event, and hourly as a fallback. Holds `Resource::KnowledgeTree` (capacity 1), so two pulls never overlap on the working tree; each trigger queues its own pass, which waits for the resource if one is already live. Agentless |
|
||||
|
|
@ -82,7 +82,7 @@ and `agent_set::refresh` serializes itself with its own mutex.
|
|||
|
||||
### Every operation as a DAG
|
||||
|
||||
The `stop` / `start` power ops write the durable `wanted` intent via a head
|
||||
The `stop` / `start` power ops record the in-memory `wanted` intent via a head
|
||||
`SetWanted` node (not a pre-submit side effect) — it holds the agent lease,
|
||||
so intent-write + reconcile is atomic per-agent. `restart` is the exception:
|
||||
it writes _no_ intent (no `SetWanted` head) — it bounces the container and
|
||||
|
|
@ -138,11 +138,14 @@ Notable collapses:
|
|||
|
||||
### Desired-state (spec vs status)
|
||||
|
||||
Per-agent power _intent_ — `wanted: Up | Offline` — is durable as the
|
||||
`agent_power` table in the coordinator DB (`hive-c0re/src/stores/power.rs`).
|
||||
Per-agent power _intent_ — `wanted: Up | Offline` — is what the operator last
|
||||
asked of an agent through a power op, held in memory by `PowerStore`
|
||||
(`hive-c0re/src/stores/power.rs`) until hive-c0re restarts. Nothing is durable:
|
||||
the swarm owns lasting intent, and declares each agent's state in the hive's
|
||||
wanted bucket (`workers/wanted.rs`), which outranks the local intent.
|
||||
`container_view` remains the observed _status_; `Reconcile` nodes converge the
|
||||
two. Setting `wanted` is never a queued node: the power layer
|
||||
(`job_queue/power.rs`) writes the row synchronously, then inserts the DAG
|
||||
(`job_queue/power.rs`) writes it synchronously, then inserts the DAG
|
||||
whose `Reconcile` reads the fresh value — rapid toggles are last-writer-wins.
|
||||
Every operator power surface —
|
||||
dashboard buttons, the MCP tools, and `hivectl stop/start/restart/kill` —
|
||||
|
|
@ -151,8 +154,12 @@ and crash-watch suppression can't drift per surface; the only direct starts
|
|||
left are the gateway's (no lease, no
|
||||
harness). Cancelling a still-queued power DAG reverts `wanted` to the
|
||||
observed state — a cancel means "don't do it," not "do it later." hive-c0re
|
||||
seeds agents without a row from observed state on first touch (running ⇒
|
||||
`Up`); destroy removes the row.
|
||||
seeds an agent without an intent from observed state on first touch (running ⇒
|
||||
`Up`); destroy removes it. After a restart no agent has an intent, so each one
|
||||
is seeded from what its container is doing and nothing starts or stops by
|
||||
itself; the swarm's declaration then starts the agents it declares `Up` and
|
||||
stops the ones it declares `Offline`. A broad `hivectl start` starts every
|
||||
agent in scope.
|
||||
|
||||
The admin-socket responses carry the submitted DAG ids; `hivectl` polls
|
||||
`HostRequest::QueueNodes` (~1s) and prints a progress line per DAG — roll-up
|
||||
|
|
@ -314,8 +321,8 @@ already attempted, so a closure that fails to deploy gets one try per process.
|
|||
|
||||
The boot log line records the rebuild / deferred / up-to-date counts so the
|
||||
operator sees at a glance how much work the boot triggered. `auto_update::run`
|
||||
seeds agents without an `agent_power` row from observed state during
|
||||
classification (the one-time migration; thereafter the DB is authoritative).
|
||||
seeds agents without an intent from observed state during classification, so a
|
||||
boot with no operator action in this process never finds drift of its own.
|
||||
|
||||
## Meta flake
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue