feat: agent timeout classes + bounded announce publish retry — W2.6 - #48
Merged
Merged
Conversation
TimeoutPolicy now owns all four server-side deadline classes: handshake and hello plus authz (authorization refusal and final HelloAck writes, replacing the AUTHZ_REPLY_TIMEOUT constant) and shutdown (connection-task join budget, replacing SHUTDOWN_TIMEOUT). Both are configurable via timeouts.authz_secs/timeouts.shutdown_secs and --authz-timeout/ --shutdown-timeout, validated 1..=3600 like the existing classes. The announce loop no longer retries failed publishes on the healthy min(1s, ttl/6) poll — a sustained directory outage would otherwise republish forever at up to 4Hz per agent. Retryable failures now sleep RetryPolicy::delay: base x 2^(n-1) capped (defaults 1s..30s) with equal jitter inside [delay/2, delay], so minimum cadence stays provable while fleet retries decorrelate. Success or the 410 lease-renew path resets the backoff; fatal 4xx classes and issuer/disk failure surfacing are unchanged. AnnounceConfig carries the policy and refuses base > cap or zero base; rand becomes a non-optional rds-net dep (iroh/noq pull it transitively anyway). Tests: RetryPolicy::delay per-failure jitter bounds and cap saturation past overflow-scale counts; announce() rejecting an inverted policy; an e2e where a directory answering every publish with HTTP 500 sees a bounded attempt count over 3.5s while the task stays alive; settings merge/override/bounds coverage for the two new timeout fields. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
agent-configuration.md documents timeouts.authz_secs/shutdown_secs and the --authz-timeout/--shutdown-timeout flags; the timeout section now lists all four classes with defaults and names the classes still open (client dial/idle, media/progress). The W2.6 ledger row records: agent timeout classes complete, directory publish retry bounded+jittered; client dial/idle, transport retry reuse and desktop/media deadlines remain open. The W2.4 row is corrected — the managed desktop viewer channel shipped, it no longer lists viewer manager APIs as open. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
W2.6 slice: completes the server-side timeout classes and fixes the
directory publish-retry storm.
TimeoutPolicygainsauthz(authorization refusal + finalHelloAckwrite budget; was
AUTHZ_REPLY_TIMEOUT) andshutdown(connection-taskjoin budget; was
SHUTDOWN_TIMEOUT) — configurable viatimeouts.authz_secs/timeouts.shutdown_secsand--authz-timeout/--shutdown-timeout, validated 1..=3600.AnnounceConfig.retry: RetryPolicy— consecutive retryable publishfailures sleep
base × 2^(n-1)capped (default 1s→30s) with equaljitter
[delay/2, delay]instead of the fixed ~1s poll. Success andthe 410 lease-renew path reset the backoff; fatal 4xx unchanged.
randbecomes a non-optional rds-net dep (already transitive viairoh/noq).
Test plan
RetryPolicy::delayjitter-range + cap-saturation unit testsannounce()rejects inverted/zero retry policies3.5s while the announce task stays alive (vs ~14 attempts at the old
cadence)
Generated with Devin