Архив исходника Broker

Историческая копия до очистки репозитория 2026-10-16. Источник: mallexxx/execution-broker, commit ae92c15d31c8396789765cebf82f7971d6f4cb12, файл docs/support.md. Старые статусы и deployment pins ниже не заменяют актуальную personal/projects/balda/execution-broker.

Supported configurations

Execution Broker is a single-operator control plane. One authenticated principal can control its runs. Chat/topic binding prevents accidental cross-session routing; it is not tenant isolation or independent user authorization.

Runtime matrix

Configuration	Status	Boundary
Native service archives	Runtime accepted on Darwin/Linux, ARM64/AMD64	Exact archive provenance, seven binary versions, synthetic credential lifecycle, authenticated MCP/API, SQLite backup and graceful shutdown; this does not accept every provider on those hosts
Docker deterministic workflows	Integration tested	Fixed non-root image, no host mounts, read-only filesystem and restricted capabilities
Run-to-run artifact inputs	Docker integration and native transfer/restart tested	Exact session, source and SHA256 binding, transactional retention holds, resumable transfer before execution; requires the matching execution/v2 worker and gateway
Declarative project tooling	Native macOS and isolated Linux projects, real Docker handoff and deployed macOS VM accepted	Make/C, Python, Node and JVM projects, cache hit and actual Node SDK change; the tested VM verified the approved Go archive through its scoped tunnel, retained tooling evidence and passed an XCTest
Immutable repository cache	Native transfer/restart and real Docker/Callee accepted	Exact repository/commit, private checkouts, scoped capabilities and durable deadline holds; opt-in execution/v3
Environment replacement	Real Docker/Callee checkpoint, two Broker restarts and single-mutation acceptance	Operator-authored continuation, preserved raw source/base ancestry, separate approval, original deadline, bounded lineage and cancellation; matching execution/v3 workers required
Virfield v2 macOS workflows	Production macos27 reacceptance passed on 2026-10-16	Installed Virfield `8bfff9f`: native GUI/new SSH key storage and console qualification, pinned SSH bootstrap, production Story, actual reviewer write denial, independent tests, hashed artifacts, credential settlement and confirmed release
macOS Codex with persistent OAuth	Story, credential reuse and actual reviewer write denial accepted on the tested operator setup	Earlier fresh-VM/restart checks plus the current owner-approved production continuation passed; eight artifacts were independently downloaded and hashed, four tests repeated, and reviewer `os.open` returned EPERM. Provider expiration/revocation and browser reauthentication were not exercised
macOS Claude account	Accepted on the tested operator setup	Full Story, quality gate, denied-write probe and fresh-VM reuse after issuer/Broker restart passed; provider expiration/revocation and browser reauthentication were not exercised
macOS OpenCode with DeepSeek API key	Accepted on the tested operator setup	Real inference, full Story, quality gate and fresh-VM reuse after issuer/Broker restart passed; upstream revocation was not exercised; both read-only role sessions reject injected ACP writes with the native plan policy unchanged
Docker OpenCode with DeepSeek API key	Story, credential reuse and controlled invalid-key refusal accepted	Two fresh-worker Stories, re-executed quality assertions, hashed artifacts, Broker/issuer restart and checkpoint before cleanup passed. The native client rejected a never-valid API key in a separate synthetic vault; artifacts, credential settlement and cleanup passed. Actual upstream revocation was not exercised; both read-only role sessions reject injected ACP writes with the native plan policy unchanged
Docker Codex	Updated reviewer policy, production Story, cancellation, restart/reuse and controlled credential refusal accepted	The new image preserves the previously accepted runtime binaries and uses reviewer deny. Broker/gateway/worker pins and the actual image pack agree. Two production Stories passed independent four-test replays and artifact hashes; one survived Broker/gateway/issuer restart with the same run, deadline and credential owner. Cancellation during implementation retained logs and checkpointed credentials. A separate synthetic vault produced native HTTP 401/token_expired refusal with artifacts, credential settlement and cleanup. Every owned worker/container volume was removed; actual upstream revocation and browser reauthentication were not exercised
Docker Claude account	Story, credential reuse, natural access-token expiry and controlled credential refusal accepted	Two fresh-worker Stories, all six roles, independently repeated tests, hashed artifacts, Broker/issuer restart and checkpoint before cleanup passed; both read-only role sessions reject injected ACP writes. A naturally expired access token refreshed on a fresh worker, three planning roles completed, and the renewed session was checkpointed after cancellation. A separate synthetic vault produced native Authentication required and reauthentication_required with artifacts, credential settlement and cleanup. Actual upstream revocation and browser reauthentication were not exercised
Managed-host plans	Protocol and local rollback tested	Each real host still requires dedicated identity, reviewed fixed operations and deployment acceptance
Docker provider credential issuance	Code/synthetic lifecycle and live Claude/OpenCode checkpoint/reuse tested	Broker issues after durable admission, checkpoints a stopped runner, and retains the owner if worker state is lost; each provider's sandbox and credential-failure gates still apply
Remote host provider credentials	Not enabled	Fixed capability plans do not grant provider login; each host requires its own identity and deployment acceptance

On 2026-10-16 the production macos27 gate passed on installed Virfield 8bfff9f. The successful continuation reused the actual owner-approved plan. Its reviewer executed a bounded os.open probe and received EPERM; the verifier and independent checkout passed four tests. All eight retained artifacts were downloaded again with size/SHA256 verification, Prism closed the Story, the credential owner was cleared and Virfield reported no workers or jobs. The Runner package includes the macOS zombie-group settlement correction; the exact source workflow matches the deployed pack. The dated Virfield acceptance record and private operator receipts preserve the tested versions and earlier failed preparations. Those historical failures remain recorded.

The shared prism/story version changed with the reviewer policy. The Linux worker image and gateway allowlist were switched together on 2026-10-16 after explicit operator approval and a zero-active-run check. Live container config, the actual image pack and source digest agree. A production Story and fresh worker reuse across Broker/gateway/issuer restart both passed; independent checkouts repeated four tests each. Cancellation during implementation retained five hashed artifacts and settled the credential lease. Both successful runs retained seven hashed artifacts. No owned worker container or volume remained, and all three credential identities were idle and unrevoked after the cycle.

On 2026-10-16 a separate Docker Claude probe started with an access token that had expired on 2026-10-15. The native client renewed the session and completed specify, design and breakdown. The operator canceled before implementation; Broker checkpointed the renewed token with the same account and organization, released the identity and removed the worker and volume. All five artifacts passed size/SHA256 verification. This accepts natural access-token expiry and refresh on that Docker setup; upstream revocation and browser reauthentication remain separate checks.

Integration evidence is specific to the tested configuration. It does not certify arbitrary guest images, provider versions, Docker hosts or remote services. Application/device installation is owned by the calling project; the iPad workflow is a separate scenario, not a Broker release requirement.

Balda integration

The portable plugin provides the execution skill and /execute command. Broker and Prism remain external services with operator-owned MCP connections. The plugin contains no bearer tokens, does not install Docker or provision VM images, and cannot approve a managed-host plan itself.

The CI managed-plugin compatibility gate pins Balda 6621b189. It exercises the actual package through discovery, managed install, upgrade, disable/enable, removal with retained data, and recovery. Install and upgrade through Backoffice; use a new or explicitly reset session to adopt its snapshot. Repeat the gate against the exact Balda source and binary selected for deployment; the CI pin alone does not attest a different running revision.

The operator deployment separately qualified clean upstream Balda b5f7d5b4 with the managed-plugin lifecycle and native wait restart gates. Both deployed instances retained their provider sessions, locator/snapshot bindings, history, configuration and authorization; post-deploy MCP parity and Eagle Asana read-only checks passed.

Automatic observation uses the bundled balda.state and balda.session.wait tools. Persist the attempt and arm the original-session wait before Start or retry. Recover lost admission responses with execution_lookup; close abandoned attempts with the exact-payload cancellation fence. A separate TTL recovery wait survives a failed intermediate observer turn. The compatibility gate tests the native one-shot's original-session scope and restart recovery, as well as managed plugin lifecycle. A real conversational acceptance is a separate deployment gate.

Generic webhooks in this Balda revision run isolated jobs with optional literal report destinations; they cannot replace a session observer. Neither wait acceptance nor transport deduplication proves provider delivery or prevents an LLM from repeating a message. Monitor failed Balda turns and provider failures. Existing sessions retain their capability snapshots until explicitly reset.

Accepted release scope

On 2026-10-16 the operator explicitly accepted release readiness for the tested configurations and boundaries above. Production Stories, credential reuse and restart, write denial, cancellation, retained artifact checks and cleanup passed. Separate synthetic vaults exercised native provider refusals for Codex, Claude and DeepSeek on Linux; these runs retained artifacts and settled credential ownership before cleanup. Docker Claude also passed natural access-token expiry and refresh with the working account.

Working credentials for all three providers were restored on an independent physical Linux host without the original Mac or Keychain. Restored vaults passed native issue/checkpoint/release and authenticated read-only provider checks. The encrypted package, matching vault records and recovery software remain on that host with an independent protected recipient. See recovery.

The operator excluded deliberate revocation of working provider authorizations and subsequent browser login from this acceptance. Those operations remain unverified limitations; controlled invalid credentials do not prove actual upstream revocation or browser reauthentication. Linux failure checks do not establish the corresponding macOS behavior. This scoped acceptance does not publish a release or promise unattended recovery when a provider requires login. Additional configurations still require the applicable executor acceptance gates.

Operational limits

Run one Broker per database on a local reliable filesystem. SQLite over NFS and multiple writers are unsupported.
Coding roles are sequential. Parallel Stories have separate workers; per-role worktree allocation and parallel mutation are not implemented.
TTL and retry limits bound execution lifetime. They are not token or monetary budgets, and there is no automatic model-tier escalation.
Beads uses embedded Dolt inside Prism. An external shared Dolt server is outside the supplied deployment.
Coordinated backup requires a drained stack. Lost master keys, golden-image restoration and active-worker disaster recovery require separate procedures.

See security for privilege boundaries and testing for the distinction between tests, emulation and deployment acceptance.

13 KiB Executable File Raw Blame History