Research recommendation accepted for planning. The implementation epic is #72 with the following backlog:
- AW-01 #73 — identity, enrollment and generations;
- AW-02 #74 — protocol and capability conformance;
- AW-03 #75 — bounded outbound long polling;
- AW-04 #76 — fenced dispatch and cancellation;
- AW-05 #77 — isolated Go daemon and process supervisor;
- AW-06 #78 — enrollment/status/diagnostics UX;
- AW-07 #79 — adversarial two-owner E2E;
- AW-08 #80 — post-MVP gateway cost/latency decision.
MVP boundary is #73–#79. #80 remains post-MVP unless measured long-poll cost or latency crosses the documented threshold. The research issue remains open as the design record; implementation progress is tracked by #72.
#64 completed the Go-supervised codex exec failure contract with a conditional/negative verdict. Add #81 after #77 (daemon/supervisor) and before #79 (two-owner security E2E). Production enablement still requires #48 provider-policy authorization and #79; route/quota and exact isolation remain fail-closed unknowns.
Progress update: AW-01 #73 is merged and closed via !59 (623fcc1), with exact-SHA full CI green (run 32803309941). The identity/enrollment/generation foundation is now canonical and replay-safe.
Current critical path: #74 AW-02 protocol/conformance → #75/#76/#77 transport/dispatch/daemon → #81 Go-supervised Codex exec adapter → #78/#79 UX and two-owner E2E. AW-02 is intentionally a pure-Go wire schema/conformance slice; persistence and live transport remain in AW-03/AW-04.
AW-02 / #74 завершён и слит MR !60 (eb575d3). Pure-Go V1 protocol/conformance теперь закрывает bounded codec, authenticated/versioned envelopes, immutable capability evidence, full-duplex sequences, lease/cancel/terminal/drain/revoke state, reconnect reconciliation и exact replay/commit/discard fencing. Exact-SHA CI run 32811541953 полностью green.
Следующий критический slice: AW-03 #75 transport + presence core. Архитектурный gate остаётся явным: outbound-only worker, немедленный server wake и zero-idle serverless нельзя одновременно получить обычным HTTP polling. Без решения по broker/gateway paid-wait #75 будет реализован как safe core + feature-gated immediate/timer polling и останется открыт для cloud wake decision.
Progress update: AW-03 bounded transport/presence core landed via MR !61 at a4a4f8b; AW-01 (#73) and AW-02 (#74) were already completed. Exact-SHA CI was fully green and two independent final reviews were CLEAN.
Critical-path correction remains: #75 is only partially delivered and stays open until the wake primitive is selected. The next code slice is AW-04 (#76): durable scheduling/claim/fence/progress/terminal composition over the now-merged protocol and transport contracts. Production route mounting, reconnect, daemon packaging, and provider harness wiring remain later gates.
AW-04 durable scheduling slice landed via MR !62 (d55aee9e056110380e21bffddc67ca78ba0d1066). Exact-merge CI is fully green: https://github.com/urandon/sessionless/actions/runs/32849817499.
This advances the attachable-worker epic with owner-scoped identity/transport/protocol plus fenced dispatch, replay-safe cancellation/terminal handling, worker retirement/reuse, and no managed fallback. The epic remains open for reconnect/wake, drain/daemon lifecycle, UI/operations, and production routing/provider boundaries.
Epic status refresh after MR !62
Delivered infrastructure:
- AW-01 #73 identity/enrollment/generations — closed.
- AW-02 #74 protocol/capability/conformance — closed.
- AW-03 #75 has durable outbound HTTP exchange, presence, bootstrap and polling core, but stays open for the unresolved cloud wake/reconnect choice and production composition.
- AW-04 #76 has durable fenced scheduling/cancel/terminal/replay/retirement through MR !62, but stays open for remaining reconnect/drain/runtime composition.
Current attached-worker critical path is #77 → #78 → #79, with #75/#76 completion gates feeding #78/#79. SUB-05 #81 can be implemented feature-disabled after #77, but production enablement still requires #48 authorization and #79 two-owner security evidence.
Next active slice: AW-05 #77, starting from the existing deterministic codexsurface process-group supervisor and credential lifecycle. The implementation must add the production daemon/package boundary without weakening the unsupported-filesystem-isolation verdict or inheriting ambient host state.
Attached-worker epic checkpoint
AW-05b (#106) has landed through PR #94 at main@fa14131b037f3988c3eb664193d010879d2b1416. Exact-head CI, post-merge CI, mirror verification, independent review, and the Darwin/Colima adversarial OCI gate are green.
The active continuation is the remaining Linux rootless OCI proof for #106. This keeps the epic moving on its MVP critical path without claiming AW-05 complete before daemon packaging, durable lifecycle, and AW-03/AW-04 composition are delivered.
Attached-worker epic checkpoint
The bounded OCI isolation launcher slice #106 is complete through PRs #94/#95 at main@b50225a5af53dfb1315d4d2946e0f7bb7dc017cb. Exact-head and post-merge normal CI, Darwin/Colima evidence, and Linux rootless evidence are green; cleanup/residue ambiguity now fails closed.
The launcher is deliberately not wired into a product binary. Work continues under #77 on daemon packaging, durable lifecycle, AW-03/AW-04 composition, and recovery before the attached-worker epic can close.
Attached-worker epic checkpoint: AW-05c #107 landed via PR #96 at main@435fb59194f906c9fd10e6620950708a09e15165. Durable owner-local state, secret separation, one-process ownership, redacted lifecycle CLI, and fail-closed local recovery foundations are now present; exact-head and post-merge CI plus Linux rootless OCI evidence are green. The launcher and local-state layers remain deliberately feature-disabled. Critical-path work continues under #77 with bounded foreground composition before live AW-03/#75 and AW-04/#76 exchange wiring, then #78/#79 acceptance.
Active MVP continuation: child #108 under AW-05/#77 owns the feature-disabled foreground composition/preflight shell. It will prove one-process ownership and bounded local lifecycle without enabling network, enrollment, provider, process, or OCI work; live transport/dispatch composition remains a later explicit gate.
MVP attached-worker progress: AW-05 child #108 is complete via PR #97 and main@199e1591a2ba9fafc05ed68127fa186848a6981f.
The local worker now has a feature-disabled foreground ownership/lifecycle shell with explicit drain/shutdown and fail-closed cleanup, while all live bootstrap, transport, dispatch, provider, process, OCI, and daemon authority remains gated. With AW-05b/#106, AW-05c/#107, and AW-05d/#108 landed, the dependency-safe next path is AW-03 (#75) then AW-04 (#76), followed by live AW-05 composition and AW-07 E2E.
Started the next dependency-safe MVP slice under AW-03: #109 defines the worker-side connection-session and authenticated exchange contract over the already landed AW-01/AW-02 and local-state foundations.
This keeps the foreground product disabled while resolving bearer custody, connection-generation fencing, protocol snapshot ownership, cancellation, logout/revoke, ambiguity, and crash/restart semantics before any live long poll or AW-04 attempt execution is reachable.
Epic progress: AW-03b child #110 merged to main in PR !99 (a7d6aa3c76ce823b412499722aa7680855ca0776).
The feature-disabled path now connects authenticated AW-02 session authority to daemon invocation/result ports with exact accepted-lease materialization, local capability-pinned process authority, bounded secret-safe evidence, replay/reconciliation, and two-phase terminal retirement. Exact-head GitHub CI is green.
The next critical-path boundary is concrete AW-03 outbound transport plus AW-04 durable active-attempt ownership/cancellation before foreground activation. The two-owner gate #79 remains unchanged.
Attached-worker progress: #112 / AW-04b merged via PR #100 (054a5742b612f652ab7890b4880bf58605e4bba2). Exact active cancellation and ordered acknowledgement now exist behind the feature-disabled daemon transport boundary.
Attached-worker MVP progress: AW-03c #120 merged via PR #102 as 94ec38f90dac049da51cdfcbd951220fb2616350. Independent review is CLEAN; exact-head GitHub Actions run 34163173541 is fully green across all seven jobs.
The critical path now has bounded in-process exact replay for authenticated worker exchanges in addition to AW-01/AW-02 identity/protocol, AW-03 transport core, AW-04 durable attempt authority, AW-05 local daemon/isolation foundations, and the active-cancel watcher. The remaining AW-03 order is: durable restart/reconnect reconciliation first, then bounded production cadence plus sleep/wake/offline/cost evidence and foreground composition. No polling, reconnect, or provider execution was activated by #120.
Parent decisions
docs/research/attachable-workers.mdOutcome
Deliver an owner-scoped Go attached-worker path for user-managed hosts. The worker initiates outbound connectivity, advertises a versioned capability manifest, accepts one fenced attempt at a time, and runs pinned harness processes under a replacement environment. Sessionless remains authoritative for Session, Run, Attempt, authorization, quota, audit, and terminal commit.
The MVP supports a single owner, bounded long polling, no inbound host port, no silent cloud fallback, and no Python runtime or SDK in production. Persistent streaming/gateway, federation, multi-owner sharing, and broad tool access remain later phases.
Decomposition
Critical path
flowchart LR A1[AW-01 identity] --> A2[AW-02 protocol] A2 --> A3[AW-03 transport] A2 --> A4[AW-04 fenced execution] A2 --> A5[AW-05 Go daemon] A3 --> A6[AW-06 UX] A4 --> A7[AW-07 security E2E] A5 --> A7 A6 --> A7 A3 -. measured threshold .-> A8[AW-08 gateway decision]MVP gates
Rollout and rollback
Rollout: loopback fixture → one maintainer-owned host → opt-in single-owner canary → bounded beta. Rollback disables enrollment and new attached dispatch, drains/fences current leases, and leaves canonical state intact. It never silently reroutes a subscription-backed run.
Non-goals
Federation, provider credential cloud custody, inbound SSH, shared mutable workspaces, permanent serverless streams, general remote shell, and gateway scale optimization before measurement.