vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-19 10:33:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

Classify Proxmox guest lifecycle transport

Browse source
This commit is contained in:
pulse-triage[bot] 2026-08-30 01:12:57 +01:00
parent ac2a2fe020
commit b001ad8ef1
5 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/release-control/v6/internal/subsystems/ai-runtime.md
View file

@ -7169,6 +7169,10 @@ typed `docker_container_update` operation with durable receipts and declared
backup/rollback compensation, while the model-originated
`assistant.docker.update` route and the legacy queued update transports stay
`retired_denied`.
Proxmox guest lifecycle dispatch has the same closed pairing:
`transport.agent.proxmox-guest-lifecycle` requires prior durable
`resource.proxmox.guest-lifecycle` authority, while the lifecycle result is
non-admitting evidence and cannot create dispatch authority.
Enterprise command-remediation records are readable historical imports only.
Production code contains no command or rollback execution algorithm; exported

8
docs/release-control/v6/internal/subsystems/api-contracts.md
View file

@ -9091,8 +9091,12 @@ CRUD are not claimed as customer-infrastructure mutation enumeration.
Raw command/file write/arbitrary pod exec, the legacy queued Docker
update/control transports, and enterprise command remediation are retired
compatibility surfaces. Container image updates re-entered the plane as
`resource.docker.container-update` and
compatibility surfaces. Proxmox guest lifecycle uses the paired
`resource.proxmox.guest-lifecycle` and
`transport.agent.proxmox-guest-lifecycle` authorities: the typed transport can
dispatch only after the durable non-transport lifecycle record exists, and its
result message is non-admitting evidence. Container image updates re-entered
the plane as `resource.docker.container-update` and
`transport.agent.docker-container-update`: lifecycle-dispositioned, planned
against an `update` capability that containers advertise only while an image
update is detected, and executed solely through `dockerContainerActionExecutor`

1
internal/mutationregistry/manifest.json
View file

@ -45,6 +45,7 @@
{"id":"transport.agent.docker-container-update","origin":"transport","resource_class":"customer_infrastructure","resource_kind":"app-container","capability":"update_container","entrypoint":"agentexec docker_container_update","disposition":"lifecycle","lifecycle_executor":"dockerContainerActionExecutor","approval_floor":"admin","delivery":"committed_lifecycle_before_transport","verification":"required","rollback":"task_10_truth_and_compensation","residual_owners":["task_10_truth_and_compensation"]},
{"id":"transport.agent.host-package-cache-cleanup","origin":"transport","resource_class":"customer_infrastructure","resource_kind":"agent","capability":"clean_package_cache","entrypoint":"agentexec host_storage_cleanup","disposition":"lifecycle","lifecycle_executor":"hostStorageCleanupActionExecutor","approval_floor":"policy_or_admin","delivery":"committed_lifecycle_before_transport","verification":"required","rollback":"unsupported"},
{"id":"transport.agent.host-package-update","origin":"transport","resource_class":"customer_infrastructure","resource_kind":"agent","capability":"install_os_updates","entrypoint":"agentexec host_update","disposition":"lifecycle","lifecycle_executor":"hostUpdateActionExecutor","approval_floor":"policy_or_admin","delivery":"committed_lifecycle_before_transport","verification":"required","rollback":"task_10_truth_and_compensation","residual_owners":["task_10_truth_and_compensation"]},
{"id":"transport.agent.proxmox-guest-lifecycle","origin":"transport","resource_class":"customer_infrastructure","resource_kind":"vm_or_system-container","capability":"start_shutdown_reboot_stop","entrypoint":"agentexec proxmox_guest_lifecycle","disposition":"lifecycle","lifecycle_executor":"proxmoxGuestActionExecutor","approval_floor":"admin","delivery":"committed_lifecycle_before_transport","verification":"required","rollback":"task_10_truth_and_compensation","residual_owners":["task_10_truth_and_compensation"]},
{"id":"transport.agent.raw-command","origin":"transport","resource_class":"customer_infrastructure","resource_kind":"agent-target","capability":"executor_owned_command","entrypoint":"agentexec execute_command","disposition":"lifecycle","lifecycle_executor":"dockerContainerActionExecutor/proxmoxGuestActionExecutor","approval_floor":"admin","delivery":"committed_lifecycle_before_transport","verification":"required","rollback":"task_10_truth_and_compensation","residual_owners":["task_10_truth_and_compensation"]},
{"id":"transport.agent.deploy-cancel","origin":"transport","resource_class":"pulse_administration","resource_kind":"agent-enrollment","capability":"deploy_agent","entrypoint":"agentexec deploy_cancel","disposition":"administrative_exception","approval_floor":"admin","delivery":"administrative_transaction","verification":"administrative","rollback":"unsupported","residual_owners":["task_12_final_governance"]},
{"id":"transport.agent.deploy-install","origin":"transport","resource_class":"pulse_administration","resource_kind":"agent-enrollment","capability":"deploy_agent","entrypoint":"agentexec deploy_install","disposition":"administrative_exception","approval_floor":"admin","delivery":"administrative_transaction","verification":"administrative","rollback":"unsupported","residual_owners":["task_12_final_governance"]},

1
internal/mutationregistry/registry_generated.go
View file

@ -46,6 +46,7 @@ var generatedEntries = []Entry{
{ID: "transport.agent.docker-container-update", Origin: Origin("transport"), ResourceClass: ResourceClass("customer_infrastructure"), ResourceKind: "app-container", Capability: "update_container", Entrypoint: "agentexec docker_container_update", Disposition: Disposition("lifecycle"), LifecycleExecutor: "dockerContainerActionExecutor", Approval: ApprovalFloor("admin"), Delivery: DeliveryClass("committed_lifecycle_before_transport"), Verification: VerificationClass("required"), Rollback: RollbackClass("task_10_truth_and_compensation"), ResidualOwners: []string{"task_10_truth_and_compensation"}},
{ID: "transport.agent.host-package-cache-cleanup", Origin: Origin("transport"), ResourceClass: ResourceClass("customer_infrastructure"), ResourceKind: "agent", Capability: "clean_package_cache", Entrypoint: "agentexec host_storage_cleanup", Disposition: Disposition("lifecycle"), LifecycleExecutor: "hostStorageCleanupActionExecutor", Approval: ApprovalFloor("policy_or_admin"), Delivery: DeliveryClass("committed_lifecycle_before_transport"), Verification: VerificationClass("required"), Rollback: RollbackClass("unsupported"), ResidualOwners: []string(nil)},
{ID: "transport.agent.host-package-update", Origin: Origin("transport"), ResourceClass: ResourceClass("customer_infrastructure"), ResourceKind: "agent", Capability: "install_os_updates", Entrypoint: "agentexec host_update", Disposition: Disposition("lifecycle"), LifecycleExecutor: "hostUpdateActionExecutor", Approval: ApprovalFloor("policy_or_admin"), Delivery: DeliveryClass("committed_lifecycle_before_transport"), Verification: VerificationClass("required"), Rollback: RollbackClass("task_10_truth_and_compensation"), ResidualOwners: []string{"task_10_truth_and_compensation"}},
{ID: "transport.agent.proxmox-guest-lifecycle", Origin: Origin("transport"), ResourceClass: ResourceClass("customer_infrastructure"), ResourceKind: "vm_or_system-container", Capability: "start_shutdown_reboot_stop", Entrypoint: "agentexec proxmox_guest_lifecycle", Disposition: Disposition("lifecycle"), LifecycleExecutor: "proxmoxGuestActionExecutor", Approval: ApprovalFloor("admin"), Delivery: DeliveryClass("committed_lifecycle_before_transport"), Verification: VerificationClass("required"), Rollback: RollbackClass("task_10_truth_and_compensation"), ResidualOwners: []string{"task_10_truth_and_compensation"}},
{ID: "transport.agent.raw-command", Origin: Origin("transport"), ResourceClass: ResourceClass("customer_infrastructure"), ResourceKind: "agent-target", Capability: "executor_owned_command", Entrypoint: "agentexec execute_command", Disposition: Disposition("lifecycle"), LifecycleExecutor: "dockerContainerActionExecutor/proxmoxGuestActionExecutor", Approval: ApprovalFloor("admin"), Delivery: DeliveryClass("committed_lifecycle_before_transport"), Verification: VerificationClass("required"), Rollback: RollbackClass("task_10_truth_and_compensation"), ResidualOwners: []string{"task_10_truth_and_compensation"}},
{ID: "transport.docker.runtime-stop", Origin: Origin("transport"), ResourceClass: ResourceClass("customer_infrastructure"), ResourceKind: "docker-runtime", Capability: "stop_agent", Entrypoint: "docker command stop", Disposition: Disposition("retired_denied"), LifecycleExecutor: "", Approval: ApprovalFloor("admin"), Delivery: DeliveryClass("denied_before_transport"), Verification: VerificationClass("denied"), Rollback: RollbackClass("denied"), ResidualOwners: []string{"task_07_durable_delivery", "task_10_truth_and_compensation"}},
{ID: "transport.docker.update-all", Origin: Origin("transport"), ResourceClass: ResourceClass("customer_infrastructure"), ResourceKind: "docker-host", Capability: "update_all_containers", Entrypoint: "docker command update_all", Disposition: Disposition("retired_denied"), LifecycleExecutor: "", Approval: ApprovalFloor("admin"), Delivery: DeliveryClass("denied_before_transport"), Verification: VerificationClass("denied"), Rollback: RollbackClass("denied"), ResidualOwners: []string{"task_07_durable_delivery", "task_10_truth_and_compensation"}},

2
internal/mutationregistry/runtime_surface_audit_test.go
View file

@ -165,6 +165,7 @@ func TestTransportCommandCatalogsResolveToRegistry(t *testing.T) {
"MsgTypeDockerContainerLifecycleResult": {Role: TransportRoleOperationResult},
"MsgTypeDockerContainerUpdateResult": {Role: TransportRoleOperationResult},
"MsgTypeDockerContainerObserveResult": {Role: TransportRoleOperationResult},
"MsgTypeProxmoxGuestLifecycleResult": {Role: TransportRoleOperationResult},
"MsgTypeOperationQueryResult": {Role: TransportRoleOperationReceipt},
"MsgTypeRegistered": {Role: TransportRoleProtocol}, "MsgTypePong": {Role: TransportRoleProtocol},
"MsgTypeExecuteCmd": {Role: TransportRoleMutationRequest, MutationID: "transport.agent.raw-command", DurableAuthorityID: "assistant.resource-action"},
@ -172,6 +173,7 @@ func TestTransportCommandCatalogsResolveToRegistry(t *testing.T) {
"MsgTypeReadFile": {Role: TransportRoleProtocol},
"MsgTypeCancelCmd": {Role: TransportRoleProtocol},
"MsgTypeHostUpdate": {Role: TransportRoleMutationRequest, MutationID: "transport.agent.host-package-update", DurableAuthorityID: "resource.host.package-update"},
"MsgTypeProxmoxGuestLifecycle": {Role: TransportRoleMutationRequest, MutationID: "transport.agent.proxmox-guest-lifecycle", DurableAuthorityID: "resource.proxmox.guest-lifecycle"},
"MsgTypeDockerContainerLifecycle": {Role: TransportRoleMutationRequest, MutationID: "transport.agent.docker-container-lifecycle", DurableAuthorityID: "resource.docker.container-lifecycle"},
"MsgTypeDockerContainerUpdate": {Role: TransportRoleMutationRequest, MutationID: "transport.agent.docker-container-update", DurableAuthorityID: "resource.docker.container-update"},
"MsgTypeDockerContainerObserve": {Role: TransportRoleOperationQuery},