slice 10A: activate the control envelope (Down channel) + hub-backed desired provider (v0.15.0)

The control envelope becomes live: the agent caches the hub's desired-state +
generation and re-fetches GET /hosts/{id}/desired-state only when the
generation advances. A new internal/desired Syncer maps the wire shape into a
reconcile.CachingProvider feeding the engine; benign deltas reconcile, an
explicit guest decommission is gated pending_signature (exec is 10B). Adds the
DesiredStateResponse/WireDesiredState wire types + Client.FetchDesiredState +
the loop EnvelopeObserver seam. Cross-repo golden (envelope + desired-state)
byte-identical with the hub.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This commit is contained in:

authentik Default Admin

2026-06-10 19:02:59 +02:00

parent aa4dfb75ea

commit 8ecf8929fb

19 changed files with 836 additions and 59 deletions

									
										internal/hub/testdata/control-envelope.golden.json
									
Vendored

		+7
		
												View File
												
				@@ -0,0 +1,7 @@

				{

				  "status": "ok",

				  "poll_interval_seconds": 900,

				  "blocked": false,

				  "desired_generation": 4,

				  "has_signed_ops": true

				}