@nylorun/runtime 0.53.1-beta → 0.53.3-beta

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.53.3-beta
+
+### Patch Changes
+
+- f2ca0f1: A running computer gets the sweep's reconcile each minute its row rests, as a pod whose engine is
+  not connected does: a drain that moved it to another worker is recorded (`agent.suspended`,
+  reason `drain`) while a harness still holds its ticket, and a computer deleted outside the
+  Runtime is found lost.
+
+## 0.53.2-beta
+
+### Patch Changes
+
+- d423ecf: Computers on Kubernetes, the rest of the plan: the Helm chart signs Restate's requests to the
+  worker with an identity key it keeps (the runtime reads it from `NYLORUN_RESTATE_IDENTITY_KEY_FILE`,
+  a PEM it derives `publickeyv1_…` from), writes Restate's partition snapshots to the object store,
+  and can run the keys provider beside Substrate's egress (`keysProvider.enabled`) with the decide
+  route on the gateway. A computer resumed elsewhere by a drain records `agent.suspended` (reason
+  `drain`) on its next use, not only on its next reconcile.
+
 ## 0.53.1-beta
 
 ### Patch Changes

package/dist/host/restate-identity.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Restate's request identity key in its own format (`publickeyv1_` and the base58btc encoding of
+ * the raw 32-byte Ed25519 public key), from a PEM: Restate's PKCS#8 private key, as the Helm chart
+ * mounts it, or the SPKI public key. `nylorun start` computes the same string
+ * (cli/nylorun/src/stack/restate-identity.ts) and passes it as NYLORUN_RESTATE_IDENTITY_KEY.
+ */
+export declare function restateIdentityKeyOf(pem: string): string;
+/** Base58 with the Bitcoin alphabet; each leading zero byte becomes "1". */
+export declare function base58btc(bytes: Uint8Array): string;

package/dist/host/restate-identity.js

@@ -0,0 +1,41 @@
+import { createPrivateKey, createPublicKey } from "node:crypto";
+/**
+ * Restate's request identity key in its own format (`publickeyv1_` and the base58btc encoding of
+ * the raw 32-byte Ed25519 public key), from a PEM: Restate's PKCS#8 private key, as the Helm chart
+ * mounts it, or the SPKI public key. `nylorun start` computes the same string
+ * (cli/nylorun/src/stack/restate-identity.ts) and passes it as NYLORUN_RESTATE_IDENTITY_KEY.
+ */
+export function restateIdentityKeyOf(pem) {
+    const text = pem.trim();
+    const key = text.includes("PRIVATE KEY") ? createPublicKey(createPrivateKey(text)) : createPublicKey(text);
+    if (key.asymmetricKeyType !== "ed25519")
+        throw new Error("not an Ed25519 key");
+    const raw = Buffer.from(key.export({ format: "jwk" }).x ?? "", "base64url");
+    if (raw.length !== 32)
+        throw new Error("the public key is not 32 bytes");
+    return `publickeyv1_${base58btc(raw)}`;
+}
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+/** Base58 with the Bitcoin alphabet; each leading zero byte becomes "1". */
+export function base58btc(bytes) {
+    let zeros = 0;
+    while (zeros < bytes.length && bytes[zeros] === 0)
+        zeros += 1;
+    const digits = [];
+    for (let index = zeros; index < bytes.length; index += 1) {
+        let carry = bytes[index];
+        for (let digit = 0; digit < digits.length; digit += 1) {
+            carry += digits[digit] * 256;
+            digits[digit] = carry % 58;
+            carry = Math.floor(carry / 58);
+        }
+        while (carry > 0) {
+            digits.push(carry % 58);
+            carry = Math.floor(carry / 58);
+        }
+    }
+    let out = "1".repeat(zeros);
+    for (let digit = digits.length - 1; digit >= 0; digit -= 1)
+        out += BASE58_ALPHABET[digits[digit]];
+    return out;
+}

package/dist/host/stack-config.js

@@ -53,6 +53,8 @@ import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
 import { HOST_IDENTITY_PROVIDERS } from "../vault/host-identity.js";
+import { readFileSync } from "node:fs";
+import { restateIdentityKeyOf } from "./restate-identity.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness", "computer"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
@@ -246,14 +248,28 @@ function parseListen(env) {
     });
 }
 const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/;
+/**
+ * The keys Restate signs with: NYLORUN_RESTATE_IDENTITY_KEY (`publickeyv1_…`, comma-separated),
+ * and NYLORUN_RESTATE_IDENTITY_KEY_FILE, a PEM of the key (Restate's private key as the Helm chart
+ * mounts it, or the public key) whose `publickeyv1_…` the Runtime computes.
+ */
 function parseIdentityKeys(env) {
     const raw = read(env, "NYLORUN_RESTATE_IDENTITY_KEY");
-    if (raw === undefined)
+    const file = read(env, "NYLORUN_RESTATE_IDENTITY_KEY_FILE");
+    if (raw === undefined && file === undefined)
         return undefined;
-    const keys = raw
+    const keys = (raw ?? "")
         .split(",")
         .map((key) => key.trim())
         .filter((key) => key !== "");
+    if (file !== undefined) {
+        try {
+            keys.push(restateIdentityKeyOf(readFileSync(file, "utf8")));
+        }
+        catch (error) {
+            throw new StackConfigError(`NYLORUN_RESTATE_IDENTITY_KEY_FILE ${file} is not an Ed25519 PEM: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     for (const key of keys)
         if (!IDENTITY_KEY.test(key))
             throw new StackConfigError("NYLORUN_RESTATE_IDENTITY_KEY must be publickeyv1_<base58 Ed25519 public key>, comma-separated");

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.53.1-beta",
+    "version": "0.53.3-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.53.1-beta",
+    "version": "0.53.3-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/sandbox/computer.js

@@ -68,6 +68,10 @@ export async function computerAccess(ctx, id, signal) {
             return fail(409, `Agent ${id}'s computer failed: ${pod.reason ?? "it did not start"}.`, { code: "agent_unavailable" });
         const status = await pods.client.status(pod.k8sName, { wait: "ready", timeoutMs: 20_000 }).catch(() => undefined);
         if (status?.ready && status.podUID) {
+            // A drain the reconcile hasn't recorded yet (suspend before drain resumed it elsewhere,
+            // ready at once): the reconcile records it, once.
+            if (status.drainedAt !== undefined && status.drainedAt !== pod.drainedAt)
+                await ctx.sandboxSignal(id, { kind: "reconcile" }).catch(() => undefined);
             await firstContact(ctx, id, status.podUID);
             const expiresAt = Date.now() + computers.ttlMs;
             return {

package/dist/tenant/sweep.d.ts

@@ -1,4 +1,4 @@
-import type { PendingRequest } from "../store/types.js";
+import type { PendingRequest, SandboxPodState } from "../store/types.js";
 import type { TenantContext } from "./context.js";
 import type { OutboxRequest } from "../store/types.js";
 export declare function sweep(ctx: TenantContext): Promise<void>;
@@ -28,3 +28,21 @@ export declare function wakeOrphanedSessions(ctx: Pick<TenantContext, "store" |
     woken: string[];
     next?: string;
 }>;
+/**
+ * Whether the sweep asks for a reconcile of `row`'s pod (`reconcileStalePods`): its row has not
+ * moved for `staleMs`, and its change is unfinished, its engine is not connected, or it runs
+ * past its idle limit. A running computer (ADR-149) always qualifies: nothing else looks at it
+ * while a harness holds a ticket, so the sweep is what finds it drained to another worker
+ * (`drainedAt`, recorded once) or deleted outside the Runtime.
+ */
+export declare function podWantsReconcile(row: {
+    readonly updatedAt: string;
+    readonly createdAt: string;
+    readonly pod?: SandboxPodState;
+}, facts: {
+    now: number;
+    staleMs: number;
+    idleMs: number;
+    computer: boolean;
+    hosting: boolean;
+}): boolean;

package/dist/tenant/sweep.js

@@ -316,28 +316,41 @@ export async function wakeOrphanedSessions(ctx, now = new Date(), after, budgetM
 async function reconcileStalePods(ctx, now) {
     if (!ctx.pods)
         return;
+    const computer = ctx.pods.computer !== undefined;
     const stale = await ctx.store.tx(async (t) => {
         const config = await readSandboxConfig(t);
-        return (await t.listEnvironments()).filter((row) => {
-            const pod = row.pod;
-            if (!pod || now.getTime() - Date.parse(row.updatedAt) < hostTuning().sweep.stalePodMs)
-                return false;
-            return (pod.desired === "deleted" ||
-                pod.retiring !== undefined ||
-                pod.observed === "creating" ||
-                pod.observed === "deleting" ||
-                (pod.desired === "suspended" && pod.observed !== "suspended") ||
-                // Running, but its engine is not connected: the pod may be gone, or its volume.
-                // (A computer has no engine connection, ADR-149.)
-                (pod.desired === "running" && pod.observed === "running" && !ctx.pods?.computer && !ctx.harness.hosting(row.id)) ||
-                // Running past its idle limit: its idle timer is missing (or a turn holds it, which the
-                // reconcile leaves alone).
-                (pod.desired === "running" &&
-                    pod.observed === "running" &&
-                    now.getTime() - Date.parse(pod.lastActiveAt ?? row.createdAt) >
-                        idleMsOf(config, row) + hostTuning().sweep.stalePodMs));
-        });
+        return (await t.listEnvironments()).filter((row) => podWantsReconcile(row, {
+            now: now.getTime(),
+            staleMs: hostTuning().sweep.stalePodMs,
+            idleMs: idleMsOf(config, row),
+            computer,
+            hosting: ctx.harness.hosting(row.id),
+        }));
     });
     for (const row of stale)
         await ctx.sandboxSignal(row.id, { kind: "reconcile" });
 }
+/**
+ * Whether the sweep asks for a reconcile of `row`'s pod (`reconcileStalePods`): its row has not
+ * moved for `staleMs`, and its change is unfinished, its engine is not connected, or it runs
+ * past its idle limit. A running computer (ADR-149) always qualifies: nothing else looks at it
+ * while a harness holds a ticket, so the sweep is what finds it drained to another worker
+ * (`drainedAt`, recorded once) or deleted outside the Runtime.
+ */
+export function podWantsReconcile(row, facts) {
+    const pod = row.pod;
+    if (!pod || facts.now - Date.parse(row.updatedAt) < facts.staleMs)
+        return false;
+    const running = pod.desired === "running" && pod.observed === "running";
+    return (pod.desired === "deleted" ||
+        pod.retiring !== undefined ||
+        pod.observed === "creating" ||
+        pod.observed === "deleting" ||
+        (pod.desired === "suspended" && pod.observed !== "suspended") ||
+        // Running, but its engine is not connected: the pod may be gone, or its volume. A computer
+        // has no engine connection: look at it every time.
+        (running && (facts.computer || !facts.hosting)) ||
+        // Running past its idle limit: its idle timer is missing (or a turn holds it, which the
+        // reconcile leaves alone).
+        (running && facts.now - Date.parse(pod.lastActiveAt ?? row.createdAt) > facts.idleMs + facts.staleMs));
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.53.1-beta";
+export declare const RUNTIME_VERSION = "0.53.3-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.53.1-beta";
+export const RUNTIME_VERSION = "0.53.3-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.53.1-beta",
+  "version": "0.53.3-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",