Repository navigation
Move node transport to /api/v1 and stop forwarding it through Web - #119
Merged
Merged
Conversation
…rough Web
Sandbox node enrollment, configuration, identity and the node WebSocket move
from /core/v1/sandbox/{enroll,node/*} to /api/v1/sandbox-node/*, beside the
existing /api/v1/agent-daemon routes. Authentication is unchanged: an
enrollment token or the node credential. The old paths are removed.
The console no longer forwards node or daemon transport and returns 404 for
/v1 and /api/v1 whatever the credential; the TLS reverse proxy sends both
directly to Core. make openapi now writes /api/v1 routes to
contracts/agents-api/runtime.openapi.yaml; the public openapi.yaml is
unchanged. Docs describe the routing table and that older nodes cannot
connect to this Core, so upgrades follow the drain and re-enrollment workflow.
Address the blind review of the /api/v1 node transport move: - The upgrade steps now say to route /api/v1/*, including WebSocket upgrades, directly to Core when the release goes live; the old routing breaks every Runtime daemon connection, not only node enrollment. - The pre-specification drain needs a Core built from a commit with #114 that still serves the old node paths (for example 7b66be2); drain there, then upgrade. Re-enrollment stops the old node service and moves its identity directory aside first. - CONTRIBUTING notes the executor-credential routes that still go to Core. - The node installer reports 404 as a routing problem, 409 as maintenance or a deployment conflict and keeps the proxy hint for connection errors; the self-hosted connection check reports 404 as a routing problem. - openapi-split keeps only the security schemes each non-public document uses; the public openapi.yaml is unchanged. - Console tests cover encoded and doubled separators toward /api/v1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Move node transport out of
/coreinto the machine namespace/api/v1. The Web console stops forwarding any machine traffic.Why
This follows the approved Core/Web boundary:
/v1: applications, Project API key./core/v1: Core Web and operator scripts, Core key./api/v1: machine connections only.The TLS proxy sends
/v1and/api/v1straight to Core, and everything else to Web.Change
POST /core/v1/sandbox/enroll,GET /core/v1/sandbox/node/{configuration,identity}and WebSocket/core/v1/sandbox/node/connectmove to/api/v1/sandbox-node/{enroll,configuration,identity,connect}. Authentication is unchanged (enrollment token or node credential). There is no compatibility layer for the old paths; a node must come from the same distribution as its Core./api/v1to Core), 409 (maintenance or deployment conflict), other HTTP errors, and connection errors./v1and/api/v1, including WebSocket upgrades./node-install/*is still served.scripts/openapi-splitwrites/api/v1paths to a newcontracts/agents-api/runtime.openapi.yamland prunes the security schemes each document doesn't use. The publicopenapi.yamlis unchanged.7b66be23.Validation
cmd/server, api (PostgreSQL), core-console and openapi-split, plus 130 installer tests./api/v1node and daemon routes and for WebSocket upgrades. Evidence is in~/.parsar/acceptance/machine-transport-api/evidence/.make check(server mode) passed ondfbe7d7f. Playwright browser cases were skipped on the server (Chrome unavailable; user-approved skip).dfbe7d7f. Those were small, local fixes, verified by tests and the gate without a second review round.Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.