SILVER/NODEDC_MISSION_CORE
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(observatory): add portable calculation profiles

Browse Source
This commit is contained in:
DCCONSTRUCTIONS
2026-08-31 15:42:56 +03:00
parent d1b75efcea
commit 9beb534108
75 changed files with 24419 additions and 348 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/runbooks/OBSERVATORY_PORTABLE_WORKER_006.md
+196
View File
@@ -0,0 +1,196 @@
# Portable Observatory Worker 006 operational boundary
## Scope and current state
This runbook covers only recorded, observation-only Observatory jobs. It does
not change K1 acquisition/control, Simulation/Gaussian, legacy LAB execution,
navigation or safety authority.
The server queue, renewable claim lease, verified source/result transport and
result publisher exist, but the production Worker API remains deliberately
disabled. All three application gates stay `False` until exact executors are
installed and a complete transport smoke has passed:
- `OBSERVATORY_WORKER_CLAIM_LEASE_READY`;
- `OBSERVATORY_WORKER_VERIFIED_RESULT_PUBLISHER_READY`;
- `OBSERVATORY_WORKER_PRODUCTION_API_ENABLED`.
The canonical central artifact store is already declared in the installed
Mission Core LaunchAgent as:
```text
MISSIONCORE_ARTIFACT_STORE_ROOT=/Volumes/docker/nodedc-mission-core/artifact-store
```
On 2026-08-31 `/Volumes/docker` was not mounted. This is a fail-closed
preflight failure, not permission to create a checkout-local substitute. The
portable Worker server composition now requires `central_status=ready` before
it can be constructed.
The installed `com.nodedc.mission-core.local` LaunchAgent was running from the
M5 Observatory feature worktree while retaining the established Mission Core
data directory in the main checkout. It declares the central artifact-store
root and cache limits, but not the two portable storage roots below. Do not
silently edit or restart this hybrid local service; carry the environment and
working-directory change through one separately reviewed, hash-gated service
transition after the code release is sealed.
Large portable inputs and in-flight results have no Mission Core data-directory
fallback. The server requires both roots through environment-only
configuration:
```text
MISSIONCORE_OBSERVATORY_WORKER_SOURCE_CAS_ROOT=/Volumes/docker/nodedc-mission-core/observatory-worker/source-cas
MISSIONCORE_OBSERVATORY_WORKER_RESULT_STAGING_ROOT=/Volumes/docker/nodedc-mission-core/observatory-worker/result-staging
```
Both directories must already exist, be canonical non-symlink directories,
remain inside `/Volumes/docker/nodedc-mission-core`, and be disjoint from each
other and from `artifact-store`. Mission Core never creates these configured
roots. If `/Volumes/docker` is absent or is only a local directory rather than
a mounted volume, composition fails closed before queue or Worker API exposure.
Provision the directories only through the reviewed server deployment after
the SMB mount preflight succeeds.
Read-only Worker evidence on the same date:
- strict-pinned `ssh -o BatchMode=yes mission-gpu` succeeds;
- Worker host identity remains `DESKTOP-OPJ8J04`;
- Windows OpenSSH `sshd` is running;
- `AllowTcpForwarding` and `GatewayPorts` use OpenSSH defaults: forwarding is
allowed and remote listeners are not exposed beyond loopback;
- Worker loopback port `18080` had no listener.
## Network shape
Mission Core remains the only backend on Mac loopback port `8000`. The Mac
owns one reverse SSH tunnel through the existing strict-pinned `mission-gpu`
alias:
```text
Worker 006 process
-> http://127.0.0.1:18080
-> encrypted SSH reverse forwarding
-> Mac http://127.0.0.1:8000
```
The exact forwarding declaration is:
```text
-R 127.0.0.1:18080:127.0.0.1:8000
```
It neither opens a LAN listener nor sends a credential in process arguments.
`ObservatoryWorkerHttpGateway` independently rejects plaintext HTTP to any
non-loopback host. `worker_tunnel_launchd.py` builds a pure, hashable launchd
plan; `scripts/plan_observatory_worker_tunnel.py` prints that plan and performs
no installation.
## Bearer credential
The server reads one credential from the fixed private data path:
```text
<MISSIONCORE_DATA_DIR>/worker-auth/observatory-worker.token
```
The installed Worker release receives the same secret through its own private,
runner-managed file and passes only its path as
`MISSIONCORE_OBSERVATORY_WORKER_TOKEN_FILE`. The token is ASCII, 32–512 bytes,
has no newline, is never stored in Git, an artifact, a plist, an environment
value, a command line or Ops plaintext, and is read with no-follow semantics.
The admitted service runtime is POSIX and requires mode `0600` or narrower;
native Windows ACL handling is intentionally not guessed.
The Worker service accepts only these non-executable settings:
```text
MISSIONCORE_OBSERVATORY_WORKER_BASE_URL=http://127.0.0.1:18080
MISSIONCORE_OBSERVATORY_WORKER_TOKEN_FILE=<absolute-private-path>
MISSIONCORE_OBSERVATORY_WORKER_WORK_ROOT=<absolute-private-D-backed-path>
MISSIONCORE_OBSERVATORY_WORKER_IDLE_POLL_SECONDS=1
MISSIONCORE_OBSERVATORY_WORKER_TRANSPORT_BACKOFF_SECONDS=5
MISSIONCORE_OBSERVATORY_WORKER_MAX_TRANSPORT_FAILURES=12
```
There is no configurable module, command, image or executable entrypoint.
## Install-time executor seam
`compose_installed_observatory_worker_service` is called only by a reviewed
Worker release. That release injects a constructed
`ObservatoryWorkerExecutorRegistry` directly in memory. Before opening the
HTTP gateway, service composition resolves the four-digest identity of every
portable RunDefinition whose executor state is `ready`:
- executor release SHA-256;
- executor image SHA-256;
- model manifest SHA-256;
- resource profile SHA-256.
No ready definitions, an empty registry, or one missing identity stops the
service before its first claim. Blocked candidates cannot be selected through
configuration and are not silently registered.
## Staged deployment and smoke sequence
No step below was applied by this implementation increment.
1. Seal each executor release and installation receipt. Change a portable
RunDefinition to `ready` only when its exact release/image identities and
local adapter admission agree.
2. Mount the existing canonical SMB artifact store. Require Mission Core
artifact status `central_status=ready`; do not initialize a local surrogate.
Through the reviewed server deployment, provision the two disjoint portable
roots above, set both environment values, and verify they resolve inside the
same mounted `/Volumes/docker/nodedc-mission-core` boundary.
3. Provision one bearer credential through the deployment-owned secret path
on both Mac and the admitted POSIX Worker service runtime. Verify file type,
no-link handling and private permissions without printing the value.
4. Generate the reverse-tunnel launchd plan, review its SHA-256 and exact
arguments, then install it through a separate hash-gated local-service
change. Accept only Worker-side `127.0.0.1:18080/api/health` reaching the
canonical Mac service; no second backend is started.
5. Install the exact Worker release. Its fixed entrypoint loads the sealed
RunDefinition registry and its in-memory executor registry, then calls
`compose_installed_observatory_worker_service`. The process must refuse a
missing token, non-loopback plaintext URL, unsafe work root, absent ready
definition or executor coverage gap.
6. Restart the canonical Mission Core process once with CAS and server token
available. Keep the Worker route disabled and verify that K1,
Simulation/Gaussian and legacy LAB surfaces are unchanged.
7. In a separate reviewed source gate, flip the claim-lease, verified-publisher
and production-API flags together. Restart only the canonical port `8000`
service. An authenticated empty claim must return `204`; missing/wrong bearer
and wrong contour identity must remain `401/403`.
8. Submit one short recorded K1 canary for each profile. Require exact source
materialization, lease heartbeat, result-package digest validation, central
artifact publication, immutable calculation-profile provenance and a
reopenable Observatory result.
9. During a bounded recorded canary, start the existing live K1 priority
transition. Require the recorded job to pause/defer and resume only after
live K1 releases the single Worker resource. This test never grants control
or navigation authority.
## Remaining blockers
- canonical SMB artifact store is currently unmounted on the Mac;
- portable source CAS and result-staging directories/environment values are not
provisioned;
- the installed Mission Core LaunchAgent has not received a sealed
working-directory/environment transition for this release;
- the shared bearer credential has not been provisioned;
- the reverse tunnel plan has not been installed or smoked;
- the Worker polling entrypoint has not been packaged into an admitted POSIX
Worker release;
- both exact executor releases/install receipts still need their own seals;
- production flags and the server route remain off by design;
- no end-to-end result has yet crossed Worker 006 -> central store ->
Observatory under this new path.
The Synology root-owned `nodedc-deploy` registry has no
`mission-core-worker` component. Older Mission Core Worker shadow artifacts
explicitly declare that they are outside that registry. Do not route a Windows
Worker install through an unrelated NAS component or weaken the deploy canon;
the durable Worker release needs its own exact reviewed installation transition
and rollback evidence.