Skip to content

feat(admin): a Venues view, and the venue on hosts and runs (#712) - #724

Merged
edgehero merged 1 commit into
mainfrom
feat/console-venues-712b
Oct 21, 2026
Merged

edgehero merged 1 commit into
mainfrom
feat/console-venues-712b

Conversation

@edgehero

Copy link
Copy Markdown
Owner

Part 2 of #712. Parts 1 and 3 (#722 and #723) are merged.

What changes

  • The registry row carries the venues. Each host's row gains backends: blessed=<venues>;floor=<property:word,...>;os=<engine>:<gateway>.

    • It holds only names and fixed words, so the registry's content rule always passes.
    • The first blessed venue is the default, which is how PI_BACKENDS is already read.
    • The gateway word (local, remote or unknown) is the worker's boot read, never an address.
  • A Venues view on both surfaces. The console gets a Fleet panel; the /dispatch panel gets a VENUES view, opened with v from HOSTS. For each venue it shows:

    • which hosts bless it, the default and any floor;
    • every declared property in words, naming the observation it depends on;
    • what it serves, and its credential custody;
    • the openshell engine and gateway, as of the worker's start.

    The view builds on the hosts' published facts and the static BACKENDS table, and checks nothing live. Its sentence tables are bolted by tests.

  • The venue on hosts and runs. The hosts tables and the runs table gain a venue column; a record with no venue counts as local.

  • A backend runs filter. It accepts any venue-shaped name, so a venue that only a newer worker blesses can still be filtered.

  • Regenerated: the fleet console fixtures and docs/images/dispatch-hosts.

Specs

Amended:

  • INT-HOST-REGISTRY-CONTRACT: the field, its encoding and its content rule. Deleting host:* still changes nothing.
  • DES-OPERATOR-CONSOLE: the Venues view.
  • REQ-OPERATOR-CONSOLE-SCREENS (b, f).

Residuals

  • The gateway word is read only at boot, and every sentence about it says so.
  • /api/state's hosts projection does not carry backends. No view reads it from there.

Verification

  • Review: two adversarial rounds, all findings fixed.
  • Suites: the admin suite passes 1823 of 1823. The full suite fails only on the known macOS mcp test and on timing tests, which pass when run alone.
  • Images: a fresh render-images.mjs run is byte-identical to the committed SVGs and PNGs.
  • Checks: node admin/build.mjs, and the revision-row, test-count, temp-dir and dated-fixture checks, all pass.

Part 2 of #712.

- Each host's registry row gains `backends`, written as names and fixed
  words only: blessed=<venues>;floor=<property:word,...>;os=<engine>:<gateway>.
  The first blessed venue is the default, as PI_BACKENDS is read. The
  gateway word (local, remote or unknown) is the boot read, never an
  address. hostBackendsField and parseHostBackends are shared by the
  worker and admin, and the parser checks every element again.
- Admin hostRowOf keeps backends and caps. venuesView builds one model
  from the hosts' published facts plus the static BACKENDS table, and
  checks nothing live.
- The console's Fleet page has a Venues panel, and the /dispatch panel a
  VENUES view (`v` from HOSTS). Each venue shows:
  - the hosts that bless it, the default, and any floor;
  - every declared property in words, naming the observation it depends
    on;
  - what it serves, its credential custody, and the openshell engine and
    gateway as of the worker's start.

  Sentence tables (DECLARATION_TEXT, PROPERTY_LABEL, GATEWAY_TEXT) are
  bolted by tests.
- Venue columns on the hosts tables and the runs table (a record with no
  venue is local), and a `backend` runs filter that accepts any
  venue-shaped name, so a newer worker's venue is filterable.
- The fleet console fixtures and docs/images/dispatch-hosts are
  regenerated.

Specs: INT-HOST-REGISTRY-CONTRACT (the backends field, its encoding and
content rule), DES-OPERATOR-CONSOLE (the Venues view) and
REQ-OPERATOR-CONSOLE-SCREENS (b, f) are amended. Deleting host:* still
changes nothing.

Signed-off-by: Rob Boerman <robboerman@live.nl>
@edgehero
edgehero merged commit b657bdd into main Oct 21, 2026
8 of 9 checks passed
edgehero added a commit that referenced this pull request Oct 21, 2026
… frame (#725)

The copy-mode steering case ran with maxCostMicros 0 and a real model, so
the runner hit its cost cap within milliseconds of the first ack. The
worker ends the exec's stdin on the verified exit line, so the second
message's frame was never written, and the case failed whenever the
relay had not written it first: on the #723 rerun and on #724.

The case now runs on a zero-rated, keyless fake model served by the
stand-in (POST /v1/chat/completions, streamed):
- The first request is held until the conformance script signals, by
  touching STEER_SIGNAL_FILE, that the relay has written the second
  frame. It waits at most 30 s. It then asks for a `read` of the job's
  prompt file.
- Any request carrying a tool result answers "done".
- The reply is chosen from the request body, not a counter, so a retry of
  the first request is held again. The body is never logged, and every
  other route answers exactly as before.

The assertion stays strict: exit 0 with a verified exit line naming both
messages, both delivered, at least 2 frames written and 2 acks verified,
no cost refusal, and a cost of 0.

Rejected: a relay change that reruns a tick requested mid-pass. Nothing
in production ticks from a mark, the failure was the closed sink, and in
production it would only add back-to-back Valkey passes when Valkey is
slow.

Specs: DES-OPENSHELL-VENUE (the CI bullet, with the residual that this is
the first model stream through OpenShell 0.1.4's rest layer).
UNCHANGED, checked: DES-STEER-VIA-READONLY-INBOX-MOUNT and
INT-STEER-INBOX-CONTRACT.

Signed-off-by: Rob Boerman <robboerman@live.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant