docs: finalize orchestrator phase 5 operations
This commit is contained in:
john
@@ -72,7 +72,7 @@ window and never changes the runtime mode. The first gate requires:
|
||||
Passing the gate means only `manual_canary_review`; it does not authorize or
|
||||
activate Canary routing.
|
||||
|
||||
Phase 3 adds the execution handoff boundary without enabling it:
|
||||
Phase 3 introduced the execution handoff boundary in a hard-disabled state:
|
||||
|
||||
- `workflow-execution-request-v1` normalizes authorization, timeout,
|
||||
cancellation, fallback, and idempotency controls;
|
||||
@@ -82,8 +82,8 @@ Phase 3 adds the execution handoff boundary without enabling it:
|
||||
events;
|
||||
- the effective engine remains Native and non-Native dispatch throws
|
||||
`WORKFLOW_EXECUTION_HANDOFF_DISABLED`;
|
||||
- the implementation capability is hard-disabled in code, so memindadm
|
||||
configuration cannot accidentally unlock execution.
|
||||
- the implementation capability was hard-disabled in code while the contracts
|
||||
and observability matured.
|
||||
|
||||
Phase 3.1 adds a Memind-owned Dry-run projection. Shadow mode continues its
|
||||
LangGraph observation while also evaluating the configured Canary allowlist and
|
||||
@@ -103,12 +103,13 @@ Phase 3.2 establishes the Executor Gateway boundary:
|
||||
operations;
|
||||
- timeout, cancellation, fallback, authorization, network, and side-effect
|
||||
controls are normalized before adapter selection;
|
||||
- Goosed, Aider, and OpenHands are registered as `contract-only` adapters;
|
||||
- Goosed, Aider, and OpenHands were initially registered as `contract-only`
|
||||
adapters;
|
||||
- the reference memory store is explicitly non-durable and used only for local
|
||||
contract tests.
|
||||
|
||||
`EXECUTOR_DISPATCH_IMPLEMENTED=false` is a code-level gate. Phase 3.2 can record
|
||||
blocked, idempotent job state but cannot invoke an adapter or launch a process.
|
||||
Phase 3.2 could record blocked, idempotent job state but could not invoke an
|
||||
adapter or launch a process.
|
||||
|
||||
Phase 3.3 makes that blocked state durable:
|
||||
|
||||
@@ -122,9 +123,8 @@ Phase 3.3 makes that blocked state durable:
|
||||
independently;
|
||||
- memory mode keeps both stores explicitly non-durable.
|
||||
|
||||
The persisted job is still a preview terminal state:
|
||||
`status=blocked`, `reason=executor_dispatch_not_implemented`, and
|
||||
`executionEnabled=false`. Phase 3.3 does not call Goosed, Aider, or OpenHands.
|
||||
The Phase 3.3 persisted job was a preview terminal state. Existing Shadow runs
|
||||
remain blocked and non-executable after later phases.
|
||||
|
||||
Phase 3.4 adds read-only Executor Job observability:
|
||||
|
||||
@@ -144,12 +144,25 @@ Phase 3.4 adds read-only Executor Job observability:
|
||||
- Canary readiness now requires both checkpoint and Executor Job storage to be
|
||||
durable.
|
||||
|
||||
These endpoints are observational only. They do not add submit, retry, claim,
|
||||
or adapter-dispatch operations.
|
||||
Phase 3.5 through Phase 5 add the opt-in execution plane:
|
||||
|
||||
The default memindadm mode remains `off`. Canary and Active routing are not
|
||||
wired to the LangGraph executor in Phase 3. Native Agent Run remains the sole
|
||||
executor in every mode.
|
||||
- `executor-worker-v1` provides atomic claim, lease fencing, heartbeat, progress,
|
||||
retry, timeout recovery, completion, cancellation, and drain semantics;
|
||||
- PostgreSQL stores worker heartbeats and exposes queue/worker metrics;
|
||||
- Goosed uses the existing session HTTP/SSE transport with abort propagation;
|
||||
- Aider and OpenHands run as separate worker processes or containers with
|
||||
workspace aliases, isolated roots, no shell, bounded environment/output, and
|
||||
artifact references;
|
||||
- LangGraph active runs queue an Executor Job, wait durably, and converge their
|
||||
terminal state from the job/event boundary;
|
||||
- admission policy enforces tenant/user/workspace allowlists, concurrency, and
|
||||
per-minute limits before a job can enter the queue;
|
||||
- memindadm, Portal environment, Orchestrator environment, adapter enablement,
|
||||
worker health, authorization, and admission are independent fail-closed gates.
|
||||
|
||||
The default memindadm switch and both environment execution gates remain off.
|
||||
Native Agent Run therefore remains the executor until an explicitly approved
|
||||
Canary satisfies every gate.
|
||||
|
||||
## Admin configuration
|
||||
|
||||
@@ -159,10 +172,11 @@ Supported modes:
|
||||
|
||||
- `off`: Native Agent Run only.
|
||||
- `shadow`: Native executes; the configured engine may observe.
|
||||
- `canary`: user allowlist and deterministic rollout percentage produce
|
||||
Dry-run candidate decisions.
|
||||
- `active`: workflow-allowlisted tasks produce Dry-run primary-engine
|
||||
decisions.
|
||||
- `canary`: user allowlist and deterministic rollout percentage select eligible
|
||||
runs; execution still requires the explicit execution switch and environment
|
||||
gates.
|
||||
- `active`: workflow-allowlisted tasks select the primary engine, subject to
|
||||
the same health, policy, worker, and kill-switch gates.
|
||||
|
||||
`MEMIND_ORCHESTRATOR_KILL_SWITCH=1` always forces Native selection.
|
||||
|
||||
@@ -200,6 +214,15 @@ the Orchestrator API:
|
||||
```text
|
||||
GET /v1/executor-jobs/:jobId
|
||||
GET /v1/executor-jobs/:jobId/events?after=<cursor>&limit=<limit>
|
||||
POST /v1/executor-jobs
|
||||
POST /v1/workers/claim
|
||||
POST /v1/workers/jobs/:jobId/start
|
||||
POST /v1/workers/jobs/:jobId/heartbeat
|
||||
POST /v1/workers/jobs/:jobId/progress
|
||||
POST /v1/workers/jobs/:jobId/complete
|
||||
POST /v1/workers/jobs/:jobId/fail
|
||||
POST /v1/workers/recover-expired
|
||||
GET /v1/workers/stats
|
||||
```
|
||||
|
||||
## Colima deployment
|
||||
@@ -247,6 +270,11 @@ requires the repository release gates and a separately approved deployment.
|
||||
| `MEMIND_ORCHESTRATOR_HOST` | HTTP bind address | `127.0.0.1` |
|
||||
| `MEMIND_ORCHESTRATOR_PORT` | HTTP port | `8093` |
|
||||
| `MEMIND_ORCHESTRATOR_SERVICE_TOKEN` | Bearer token for `/v1/*` | empty |
|
||||
| `MEMIND_ORCHESTRATOR_WORKER_TOKEN` | Additional worker-protocol token | empty |
|
||||
| `MEMIND_ORCHESTRATOR_EXECUTION_ENABLED` | Queue admission execution gate | `false` |
|
||||
| `MEMIND_ORCHESTRATOR_ENABLED_EXECUTORS` | Enabled adapter IDs | empty |
|
||||
| `MEMIND_ORCHESTRATOR_*_ALLOWLIST` | Tenant/user/workspace admission scopes | empty / workspace alias |
|
||||
| `MEMIND_ORCHESTRATOR_MAX_*` | Global, tenant, user and rate quotas | bounded safe defaults |
|
||||
| `MEMIND_ORCHESTRATOR_CHECKPOINT_MODE` | `postgres` or explicit `memory` | `postgres` |
|
||||
| `MEMIND_ORCHESTRATOR_DATABASE_URL` | Dedicated Orchestrator PostgreSQL URL | required |
|
||||
| `MEMIND_ORCHESTRATOR_DATABASE_SCHEMA` | Checkpoint and Executor Job schema | `memind_orchestrator` |
|
||||
|
||||
Reference in New Issue
Block a user