v4.5.0 — sideload tokens, files and agent control

Sideload tokens let a LAN device drive one host's builders through the control plane and move files in both directions. The Agent path gained autonomy levels, task parking, fan-out, outward-action protection, failure classes and normalized signatures. host-runtime added a rollback journal, a local policy veto and a hash-chained audit log.

Highlights

Sideload tokens and the file channel

• A token, not an Agent. A sideload belongs to exactly one host and is stored as a SHA-256 hash plus the last four characters. Calls go device → PCS → host's root scheduler and reuse the same task, lease and fencing path as the console; the device never sees the scheduler address or its instance credentials.
• Closed permission set. tasks:read, tasks:write, builders:read, queue:read, console:run; unknown scopes are rejected rather than dropped. Shell tasks need console:run on top of tasks:write.
• Files in. POST /attachments accepts 24 MiB per file. Inputs are materialized under <workspace>/attachments/ before a command runs, for console and build tasks alike.
• Files out. requirements.console.collect walks workspace paths (32 paths / 128 files, 64 MiB each, 256 MiB total, symlinks skipped). Every collected file goes through the scheduler's artifact channel, which recomputes SHA-256; downloads return raw bytes with content-type, content-disposition and digest headers.
• Operator surface. The studio shows an "Attach sideload" strip above the root scheduler with online state, token hint and scopes. scripts/sideload-project.mjs wraps upload, task submission and verified download in one command.

Agent control

• Autonomy ladder. ask / edits / auto / full map onto Claude Code and Codex flags. Permission flags a Profile sets itself are stripped so a profile cannot widen the level the scheduler asked for; custom drivers report unmanaged instead of pretending.
• Parking on a question. NEEDS_INPUT surfaces the Agent's question in the task page; an answer resumes the attempt, and "abandon" cancels it.
• Fan-out. A running task can split into children (POST /v1/tasks/:id/split, max depth/rounds). The parent waits in WAITING_CHILDREN; children report state, outcome and verified artifacts back.
• Outward actions. git push, package publish, cloud applies, remote shells and HTTP writes are announced as they happen. A failure after an outward action is dead-lettered as interrupted_after_outward — never retried on another builder.
• Failure classes and signatures. permanent, outward, rate_limit, busy, transient decide retry vs. wait vs. dead-letter. Failures normalize into kind:sha256[:16] signatures so the same fault on many builders reads as one problem; retry-waived attempts are capped at 6.
• Tool result gate. Scheduler Agent tools return at most 8,000 characters: small output passes through, large output keeps head and tail and spills the full text to a 0600 file with a read_result handle.

Host safety rails

• Operation journal. Every mutating command runs over journal.jsonl; a failed command rolls back containers it created or started, and startup replays the journal to undo interrupted work.
• Local policy veto. /etc/osacp/host-policy.json can enforce a kill switch, allowed roles/image prefixes and a deployment cap. An untrusted file fails closed; STOP and REMOVE stay allowed so a veto cannot trap workloads.
• Hash-chained audit. audit-chain.jsonl links records by SHA-256 with secrets redacted before writing. A broken chain is reported in the heartbeat and blocks new deployments without stopping running containers.

Admin app and documentation

• Sideload cards, host detail page, live stream handling, autonomy/outcome cards, failure class and signature display, fan-out and parent/child links.
• New bilingual guides: Agent control and Sideloads.
• Architecture diagram v4.5 adds the sideload channel, file flow and three new notes; README screenshots were regenerated with stricter scrubbing of host names, IPs, paths and host ids.

Upgrade notes

• Run the migrations before starting services: scheduler 009_agent_control.sql, 010_failure_recovery.sql, 011_artifact_names.sql; PCS 014_sideloads.sql. The rebuilt deployment payloads bundle them as sql.json.
• Task states gain NEEDS_INPUT and WAITING_CHILDREN; existing tasks and schedules are unaffected.
• host-runtime creates its journal, policy and audit files on startup. Missing policy file means no local veto.
• Sideload tokens are intended for a trusted LAN. If PCS is reachable from a wider network, put it behind HTTPS and a firewall/VPN.

Verification

• Typecheck passes for scheduler, pcs-issuer, host-runtime and secret-store; admin-app production build passes.
• host-runtime DB-free suites pass (52 tests, including journal rollback, policy veto, audit chain and reconciliation).
• Scheduler and PCS suites run against PostgreSQL in CI.