v4.5.1

Full Changelog: v4.5.0...v4.5.1

v4.5.0 — sideload tokens, files and agent control

Sideload tokens let a LAN device drive one host's builders through the control plane and move files in both directions. The Agent path gained autonomy levels, task parking, fan-out, outward-action protection, failure classes and normalized signatures. host-runtime added a rollback journal, a local policy veto and a hash-chained audit log.

Highlights

Sideload tokens and the file channel

• A token, not an Agent. A sideload belongs to exactly one host and is stored as a SHA-256 hash plus the last four characters. Calls go device → PCS → host's root scheduler and reuse the same task, lease and fencing path as the console; the device never sees the scheduler address or its instance credentials.
• Closed permission set. tasks:read, tasks:write, builders:read, queue:read, console:run; unknown scopes are rejected rather than dropped. Shell tasks need console:run on top of tasks:write.
• Files in. POST /attachments accepts 24 MiB per file. Inputs are materialized under <workspace>/attachments/ before a command runs, for console and build tasks alike.
• Files out. requirements.console.collect walks workspace paths (32 paths / 128 files, 64 MiB each, 256 MiB total, symlinks skipped). Every collected file goes through the scheduler's artifact channel, which recomputes SHA-256; downloads return raw bytes with content-type, content-disposition and digest headers.
• Operator surface. The studio shows an "Attach sideload" strip above the root scheduler with online state, token hint and scopes. scripts/sideload-project.mjs wraps upload, task submission and verified download in one command.

Agent control

• Autonomy ladder. ask / edits / auto / full map onto Claude Code and Codex flags. Permission flags a Profile sets itself are stripped so a profile cannot widen the level the scheduler asked for; custom drivers report unmanaged instead of pretending.
• Parking on a question. NEEDS_INPUT surfaces the Agent's question in the task page; an answer resumes the attempt, and "abandon" cancels it.
• Fan-out. A running task can split into children (POST /v1/tasks/:id/split, max depth/rounds). The parent waits in WAITING_CHILDREN; children report state, outcome and verified artifacts back.
• Outward actions. git push, package publish, cloud applies, remote shells and HTTP writes are announced as they happen. A failure after an outward action is dead-lettered as interrupted_after_outward — never retried on another builder.
• Failure classes and signatures. permanent, outward, rate_limit, busy, transient decide retry vs. wait vs. dead-letter. Failures normalize into kind:sha256[:16] signatures so the same fault on many builders reads as one problem; retry-waived attempts are capped at 6.
• Tool result gate. Scheduler Agent tools return at most 8,000 characters: small output passes through, large output keeps head and tail and spills the full text to a 0600 file with a read_result handle.

Host safety rails

• Operation journal. Every mutating command runs over journal.jsonl; a failed command rolls back containers it created or started, and startup replays the journal to undo interrupted work.
• Local policy veto. /etc/osacp/host-policy.json can enforce a kill switch, allowed roles/image prefixes and a deployment cap. An untrusted file fails closed; STOP and REMOVE stay allowed so a veto cannot trap workloads.
• Hash-chained audit. audit-chain.jsonl links records by SHA-256 with secrets redacted before writing. A broken chain is reported in the heartbeat and blocks new deployments without stopping running containers.

Admin app and documentation

• Sideload cards, host detail page, live stream handling, autonomy/outcome cards, failure class and signature display, fan-out and parent/child links.
• New bilingual guides: Agent control and Sideloads.
• Architecture diagram v4.5 adds the sideload channel, file flow and three new notes; README screenshots were regenerated with stricter scrubbing of host names, IPs, paths and host ids.

Upgrade notes

• Run the migrations before starting services: scheduler 009_agent_control.sql, 010_failure_recovery.sql, 011_artifact_names.sql; PCS 014_sideloads.sql. The rebuilt deployment payloads bundle them as sql.json.
• Task states gain NEEDS_INPUT and WAITING_CHILDREN; existing tasks and schedules are unaffected.
• host-runtime creates its journal, policy and audit files on startup. Missing policy file means no local veto.
• Sideload tokens are intended for a trusted LAN. If PCS is reachable from a wider network, put it behind HTTPS and a firewall/VPN.

Verification

• Typecheck passes for scheduler, pcs-issuer, host-runtime and secret-store; admin-app production build passes.
• host-runtime DB-free suites pass (52 tests, including journal rollback, policy veto, audit chain and reconciliation).
• Scheduler and PCS suites run against PostgreSQL in CI.

v4.4.0 — dynamic scheduling

Dynamic scheduling: a host resource pool enforced by cgroups, live capability scores, weighted fair-share grants, and a pressure state machine. Static deployments keep their existing behaviour.

Highlights

Dynamic scheduling (v0.3)

• Host resource pool. Each host exposes osacp.slice/pool.slice, with one builder-<id>.scope per builder. Grants map to memory.low / cpu.weight, caps to memory.max / cpu.max, and pressure squeezes memory.high to 1.1× (PRESSURE) or 1.0× (CRITICAL) of the grant. Nothing is OOM-killed to reclaim memory.
• Split capability score. W = W_static + H_res × W_res, where only the CPU/memory half degrades with real usage. Live, dispatch (25th percentile over 15 s) and guaranteed scores are tracked per instance; committed-but-unused grants lower admission budgets, not the score.
• Weighted max-min water filling. Integer-only allocation with stable tie-breaks, independent CPU and memory fills, idle floors, and OVERCOMMITTED detection when a grant is squeezed below committed reservations.
• Per-type concurrency k(i, τ). Replaces the fixed instance limit for dynamic builders, bounded by the remaining grant, the task request and the per-type cap.
• Pressure state machine. NORMAL → BUSY → PRESSURE → CRITICAL → RECOVERING → NORMAL with separate enter and exit thresholds; new claims are refused under PRESSURE / CRITICAL instead of killing work.
• Grant lifecycle. PENDING → APPLIED / FAILED / SUPERSEDED with monotonic generations. With require_applied_before_start, a dynamic builder may not start before its quota is applied.
• Queue discipline. Claims scan up to 20 candidates, record block reasons durably, and retry with exponential backoff (1 s doubling to 60 s) instead of head-of-line blocking the queue.
• Relay. Cross-mode eligibility uses the ceiling; same-mode ordering uses the live score. The smallest sufficient child is preferred for D > 0, the idlest for D = 0.

Removal reliability

• A repeated REMOVE is now idempotent: it is re-dispatched instead of returning 409 DEPLOYMENT_REMOVED. A timed-out acknowledgement no longer strands a deployment in the UI.
• Deployment acknowledgement updates are guarded by generation, so a late acknowledgement cannot roll back a newer command.

Documentation and localization

• New bilingual scheduling-algorithm guide, wired into both READMEs, the scheduler specification and the docs index: English · 简体中文
• The admin app UI and source comments are now fully English; .zh-CN documentation remains Chinese.

Upgrade notes

• Run the schema migration scheduler/sql/008_dynamic_scheduling.sql before starting the scheduler. The deployment payload under deploy/scheduler/app/sql/ includes it.
• Static mode is unchanged. The scheduling mode is selected once on the root scheduler and inherited by node schedulers and builders.
• Dynamic mode requires cgroup v2 on the host. If the host runtime does not provide it, admission reports CGROUP_UNAVAILABLE and refuses to run rather than running without an enforced cap.

Verification

• CI green for scheduler, pcs-issuer, host-runtime, secret-store and admin-app (typecheck, full test suites against PostgreSQL, lint and build).
• Local checks: typecheck across backend packages, admin-app lint/build, DB-free suites (host-runtime 72, secret-store 6, scheduler resources 15).

v4.3.1 — documentation update

Documentation and maintenance update. Runtime behavior is unchanged from v4.3.0.

Documentation

• Every Markdown document now ships with an English default and a .zh-CN.md counterpart, including a language switcher and language-aware cross-links.
• Added Chinese editions for the root README, SECURITY, all module READMEs, and all docs/ guides.

Comments

• Source comments are now in English across scheduler, pcs-issuer, host-runtime, secret-store, admin-app, agents, scripts, and the deployment files.
• Regenerated payloads under deploy/scheduler/app/ and deploy/builder/app/ from source.

Compatibility

• No wire-protocol, database-schema, or configuration changes.
• Existing v4.3.0 deployments and container images remain compatible.

v4.3.0 — first public release

First public release of the multi-node AI agent compute & scheduling platform.

Control plane

• PCS — host registry, deployment plans, signed commands, Agent/API profiles and audit. Writes desired state only; never calls Docker.
• host-runtime — runs on every host, long-polls PCS, verifies Ed25519 commands, creates containers and reports actual state. Outbound only.

Scheduling

• Deterministic queue, admission, leases and fencing as plain rules in PostgreSQL.
• Recursive root/node schedulers, each with its own database and builders; ΣW aggregates up the subtree.
• Host federation: merge a host into another by changing one reference, detach without restarting containers.
• Cross-scheduler relay: a task with D > W is pushed down, never copied; max depth 8.

Builders and agents

• Builders are official Ubuntu images (or bare-metal hosts) with root SSH and a real toolchain.
• Claude Code, Codex, DeepSeek and custom CLI/HTTP agents through one adapter boundary.
• Profiles hold references only; secrets resolve from the Secret Store at run time.
• Chat and container terminal run through the same task pipeline, leases and fencing.

Admin app

• Live studio: recursive scheduler tree, animated task signals on every active link.
• Hosts, builders, schedulers, profiles, tasks, terminal, chat and audit logs.
• Light and dark themes, English and Chinese, zero UI framework dependencies.

Tooling

• Single-machine Compose path and multi-host control-plane deployment.
• Acceptance, load, backup, PKI and payload scripts.
• CI for all packages, MIT license.

Full Changelog: https://github.com/UnmetDecade/OSACP/commits/v4.3.0