SILVER/NODEDC_MISSION_CORE
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor(worker): externalize runtime registries

Browse Source
This commit is contained in:
DCCONSTRUCTIONS
2026-08-31 19:47:07 +03:00
parent 104e54f4dd
commit 732cc139fd
4 changed files with 194 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent
+4 -2
View File
@@ -12,11 +12,12 @@ ENV PYTHONPATH=/opt/nodedc/mission-core/src \
WORKDIR /opt/nodedc/mission-core
COPY src/k1link ./src/k1link
COPY config ./config
COPY experiments/perception/worker/observatory_portable/worker-006-agent-build-context.json \
./release/worker-006-agent-build-context.json
RUN case "${NODEDC_SOURCE_REVISION}" in \
RUN mkdir -p /run/nodedc/registries \
&& chmod 0555 /run/nodedc /run/nodedc/registries \
&& case "${NODEDC_SOURCE_REVISION}" in \
*[!0-9a-f]* ) exit 64 ;; \
* ) ;; \
esac \
@@ -45,6 +46,7 @@ LABEL org.opencontainers.image.title="NODE.DC Observatory Worker 006 agent" \
com.nodedc.worker-contour="worker-006" \
com.nodedc.authority="observation-only" \
com.nodedc.models="external" \
com.nodedc.runtime-registries="external-read-only" \
com.nodedc.base-image.sha256="58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794" \
com.nodedc.build-context.sha256="${NODEDC_BUILD_CONTEXT_SHA256}"
experiments/perception/worker/observatory_portable/worker-006-agent-build-context.json
+22 -10
View File
@@ -27,11 +27,6 @@
"kind": "tree",
"image_path": "/opt/nodedc/mission-core/src/k1link"
},
{
"path": "config",
"kind": "tree",
"image_path": "/opt/nodedc/mission-core/config"
},
{
"path": "experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent",
"kind": "file",
@@ -43,11 +38,24 @@
"image_path": "/opt/nodedc/mission-core/release/worker-006-agent-build-context.json"
}
],
"required_configuration": [
"config/observatory-portable-run-definitions.json",
"config/observatory-worker-runtime-candidates.json",
"config/perception/m49-tgs-portable-v2.json",
"config/perception/lab-v1-eomt-ddrnet-portable-v2.json"
"embedded_configuration": [],
"external_runtime_files": [
{
"role": "portable-run-definition-registry",
"environment_variable": "MISSIONCORE_OBSERVATORY_WORKER_DEFINITIONS_FILE",
"container_path": "/run/nodedc/registries/observatory-portable-run-definitions.json",
"binding": "exact-read-only-regular-file",
"identity_owner": "post-image runtime installation",
"baked_into_image": false
},
{
"role": "portable-worker-runtime-registry",
"environment_variable": "MISSIONCORE_OBSERVATORY_WORKER_RUNTIME_REGISTRY_FILE",
"container_path": "/run/nodedc/registries/observatory-worker-runtime-candidates.json",
"binding": "exact-read-only-regular-file",
"identity_owner": "post-image runtime installation",
"baked_into_image": false
}
],
"runtime": {
"pythonpath": "/opt/nodedc/mission-core/src",
@@ -57,11 +65,15 @@
"k1link.observatory.m49_worker_container_main"
],
"composition_module": "k1link.observatory.m49_worker_service",
"configuration_baked_into_image": false,
"runtime_registries_baked_into_image": false,
"models_baked_into_image": false,
"executor_releases_baked_into_image": false
},
"forbidden_context": [
"model weights",
"run-definition registries",
"runtime-candidate registries",
"recorded K1 sessions",
"worker bearer credentials",
"executor release payloads",
experiments/perception/worker/observatory_portable/worker-006-agent-install-plan.template.json
+60 -10
View File
@@ -55,6 +55,7 @@
"com.nodedc.worker-contour": "worker-006",
"com.nodedc.authority": "observation-only",
"com.nodedc.models": "external",
"com.nodedc.runtime-registries": "external-read-only",
"com.nodedc.base-image.sha256": "58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
"com.nodedc.build-context.sha256": "<build-context-sha256>"
},
@@ -76,9 +77,41 @@
"MISSIONCORE_OBSERVATORY_WORKER_BASE_URL": "http://127.0.0.1:18080",
"MISSIONCORE_OBSERVATORY_WORKER_TOKEN_FILE": "/run/secrets/observatory-worker.token",
"MISSIONCORE_OBSERVATORY_WORKER_WORK_ROOT": "/work",
"MISSIONCORE_OBSERVATORY_WORKER_DEFINITIONS_FILE": "/opt/nodedc/mission-core/config/observatory-portable-run-definitions.json",
"MISSIONCORE_OBSERVATORY_WORKER_RUNTIME_REGISTRY_FILE": "/opt/nodedc/mission-core/config/observatory-worker-runtime-candidates.json",
"MISSIONCORE_OBSERVATORY_M49_INSTALLATION_RECEIPT_FILE": "/release/worker-installation-receipt.json"
"MISSIONCORE_OBSERVATORY_WORKER_DEFINITIONS_FILE": "/run/nodedc/registries/observatory-portable-run-definitions.json",
"MISSIONCORE_OBSERVATORY_WORKER_RUNTIME_REGISTRY_FILE": "/run/nodedc/registries/observatory-worker-runtime-candidates.json",
"MISSIONCORE_OBSERVATORY_M49_INSTALLATION_RECEIPT_FILE": "/release/worker-installation-receipt.json",
"MISSIONCORE_OBSERVATORY_LAB_V1_INSTALLATION_RECEIPT_FILE": "/release/lab-v1-worker-installation-receipt.json"
},
"runtime_registry_files": {
"binding": "individual read-only bind files",
"identity_timing": "filled and verified after coordinator image build",
"included_in_coordinator_image_or_image_receipt": false,
"required": [
{
"role": "portable-run-definition-registry",
"environment_variable": "MISSIONCORE_OBSERVATORY_WORKER_DEFINITIONS_FILE",
"host_path": null,
"container_path": "/run/nodedc/registries/observatory-portable-run-definitions.json",
"byte_length": null,
"sha256": null,
"mode": "read-only"
},
{
"role": "portable-worker-runtime-registry",
"environment_variable": "MISSIONCORE_OBSERVATORY_WORKER_RUNTIME_REGISTRY_FILE",
"host_path": null,
"container_path": "/run/nodedc/registries/observatory-worker-runtime-candidates.json",
"byte_length": null,
"sha256": null,
"mode": "read-only"
}
],
"required_preflight": [
"fill one exact absolute host path, byte length and SHA-256 for each registry after the coordinator image identity exists",
"reject missing, symbolic-link, non-regular or identity-mismatched registry files before container start",
"bind each registry as its own read-only file at the fixed container path",
"reject any registry path inside the coordinator image"
]
},
"user": {
"uid": 0,
@@ -121,9 +154,13 @@
"force-delete exact created container ID"
],
"sibling_runtime_fences": {
"exact_image_sha256s": {
"eomt": "58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
"ddrnet": "591cb382c099eeb05e7ec16e2371e0b2da54d2bb5c49ec0f4ac88dbf72b0f0cd"
"component_image_identity": {
"source": "/release/lab-v1-worker-installation-receipt.json",
"schema_version": "missioncore.observatory-portable-lab-v1-worker-installation-ready-receipt/v1",
"fields": "component_installations.<eomt-or-ddrnet>.image_sha256",
"image_kind": "derived adapter image",
"base_image_ids_are_component_ids": false,
"queued_job_override_allowed": false
},
"commands_and_entrypoints": "exact values sealed in the LAB V1 runner installation receipt; never supplied by a queued job",
"bind_sources": "only exact Worker-host asset roots sealed in the LAB V1 runner installation receipt and descendants of its exact work-root binding",
@@ -179,6 +216,16 @@
"container_path": "/run/secrets",
"mode": "read-only",
"purpose": "private bearer token file"
},
{
"container_path": "/run/nodedc/registries/observatory-portable-run-definitions.json",
"mode": "read-only",
"purpose": "exact external portable RunDefinition registry file"
},
{
"container_path": "/run/nodedc/registries/observatory-worker-runtime-candidates.json",
"mode": "read-only",
"purpose": "exact external portable runtime candidate registry file"
}
],
"external_assets": {
@@ -188,10 +235,12 @@
"queued_jobs_may_select_paths_or_commands": false
},
"lab_v1_runner_installation_input": {
"state": "loader-contract-not-yet-defined",
"environment_variable": null,
"container_path": null,
"reason": "the current local runner module defines an in-memory sealed installation receipt but no environment loader or installed receipt path"
"state": "external-installed-receipt-required",
"environment_variable": "MISSIONCORE_OBSERVATORY_LAB_V1_INSTALLATION_RECEIPT_FILE",
"container_path": "/release/lab-v1-worker-installation-receipt.json",
"mode": "read-only",
"owns_component_image_identities": true,
"queued_jobs_may_override_component_images": false
},
"protected_contours": [
"K1 connection and control",
@@ -217,6 +266,7 @@
"result": "not-run"
},
"models_baked_into_image": false,
"runtime_registries_baked_into_image": false,
"authority": {
"commands_enabled": false,
"actuation_allowed": false,