coulomb/llm-connect
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Provide a private Unix listener for owner-metered Messages
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 22:20:55 +02:00
parent dc77f434a8
commit 718e6730e4
4 changed files with 143 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/LLM-WP-0009-owner-metered-messages-transport.md
View file

@ -57,7 +57,7 @@ No actual inference, provider credential or live price/FX policy is involved.
id: LLM-WP-0009-T03
status: wait
priority: high
blocking_reason: "Requires trusted owner hosting and actual lease/token delivery, provider custody and direct-route denial under HFACT T03/T04; accepted tariff/FX and G0 remain HFACT T01."
blocking_reason: "Local Unix hosting, worker lease/token lifecycle and bwrap confinement proved; requires admitted credential-to-owner bootstrap, matched protected artifact and Railiance custody/placement under HFACT T03/T04; live tariff/FX and G0 remain HFACT T01."
state_hub_task_id: "98a38d75-73ab-5f37-b710-5df9d9681e49"
```
@ -81,6 +81,35 @@ Resolve or explicitly disposition those existing checks before an owner accepts
the protected artifact/release. Evidence:
`docs/evidence/2026-09-09-request-admission-quality.json`.
### Local owner-route integration return — 2026-09-09
`MessagesOwner` now starts an owner-only Unix Messages listener after the worker
reserves its parent envelope. The initial accepted Activity Core heartbeat supplies
its exact expiry, run, worker and attempt binding. Lease loss, timeout, signals,
gateway exceptions and normal exit revoke the route. A timer also enforces the
initial lease deadline; heartbeat renewal does not extend this first route.
Only the opaque token and namespace-local base URL reach the child. Provider key,
ledger and owner socket directory remain outside the workload's mounts and PID
namespace. The sandbox refuses direct egress, alternate credential delivery,
extra host mounts, consumer mismatches and additional sandboxes for this binding.
Real local bwrap tests prove sole-route forwarding, direct host/public-IP denial,
private-state absence, revocation with no second forward, and teardown. The actual
worker/Glas/bwrap/ledger path also imports its permitted fixture commit and replays
a lost terminal close without repeating the request or authoring. Queue, provider,
credential and authoring remain deterministic fixtures; factory attempts remain 0.
Worker suite: 377 passed, including installed CLI and real namespace tests.
Sand-boxer required `make check`: lint clean, 199 tests passed. LLM suite: 264
passed; changed transport adds no lint/type diagnostics, with existing full-repo
177 Ruff/36 mypy diagnostics still requiring pre-release disposition.
This closes local source route/lease/token/confinement wiring. Remaining return:
admitted owner bootstrap that supplies the provider key to `MessagesOwner`, matched
protected runtime/CLI artifact, Railiance host/profile/consumer/custody/recovery
admission, live provider compatibility and accepted bounds/tariffs/FX, then G0 and
natural model/queue evidence. No protected runtime was installed or promoted,
no existing CCR changed, no secret read or paid execution took place.
## Repair historical source identities blocking primary synchronization
```task