Repository navigation
Conversation
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
github-actions
Bot
added
enhancement
This comment has been minimized.
This comment has been minimized.
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
…tories Retry unpublished failed goldens through conditional Substrate cleanup while preserving successful snapshots on credential rotation. Keep checkout and probe deadlines below the backend RPC deadline so startup failures become observable. Negotiate Git object format with clone before fetching the selected ref. Cover credential correction, cleanup failures, snapshot retention, and both Git object formats with regression and live E2E tests. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
This comment has been minimized.
This comment has been minimized.
Measure the retry delay from Substrate's terminal failure checkpoint rather than template creation. Slow failed startups must still back off, and their failure status must remain observable before a replacement preparation starts. Cover an old template with a recent failure timestamp. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Cross-runtime snapshot lifecycle, credential isolation, and retry behavior require human review and live Substrate validation beyond the available static evidence.
1 open issue
3 files not reviewed
go/api/gen/kagent/config/v1/adk.pb.go: Generated filego/api/gen/kagent/config/v1/workspace.pb.go: Generated filego/api/v1alpha3/zz_generated.deepcopy.go: Generated file
What changed in this PR
Adds Git-backed workspaces to Agents and SandboxTemplates, preparing repository files before runtime readiness while preserving independent files across instance creation, resume, and fork.
Changes:
- Adds workspace APIs, validation, and generated Go/Python contracts.
- Integrates checkout, preparation-only credentials, snapshot selection, and failed-preparation retries across supported runtimes.
- Adds unit and end-to-end coverage, installer configuration, and architecture documentation.
| File | Description |
|---|---|
| python/packages/kagent-proto/src/kagent/config/v1/workspace_pb2.pyi | Adds workspace message typing. |
| python/packages/kagent-proto/src/kagent/config/v1/workspace_pb2.py | Adds generated workspace bindings. |
| python/packages/kagent-proto/src/kagent/config/v1/adk_pb2.pyi | Types the ADK workspace field. |
| python/packages/kagent-proto/src/kagent/config/v1/adk_pb2.py | Regenerates ADK workspace bindings. |
| python/packages/kagent-adk/tests/unittests/test_config_contract.py | Tests unsupported workspace rejection. |
| python/packages/kagent-adk/src/kagent/adk/types.py | Rejects workspaces in Python ADK. |
| proto/kagent/config/v1/workspace.proto | Defines the workspace configuration contract. |
| proto/kagent/config/v1/adk.proto | Adds workspace configuration to ADK. |
| helm/kagent-crds/templates/api.kagent.dev_sandboxtemplates.yaml | Adds generated sandbox workspace schema. |
| helm/kagent-crds/templates/api.kagent.dev_agents.yaml | Adds generated Agent workspace schema. |
| go/sandbox/guest/Dockerfile | Includes workspace build dependencies. |
| go/sandbox/guest/cmd/main.go | Initializes workspace before serving operations. |
| go/pkg/workspace/workspace.go | Implements validated checkout and durable receipts. |
| go/pkg/workspace/workspace_test.go | Tests checkout, recovery, and file preservation. |
| go/harness/codex/internal/adapter/adapter.go | Initializes Codex repository workspaces. |
| go/harness/codex/config/config.go | Accepts and validates workspace configuration. |
| go/harness/claude/internal/adapter/adapter.go | Initializes Claude repository workspaces. |
| go/harness/claude/config/config.go | Accepts and validates workspace configuration. |
| go/core/test/e2e/workspace_test.go | Exercises workspace preparation and lifecycle. |
| go/core/test/e2e/sandbox_test.go | Extends timeout for preparation recovery. |
| go/core/test/e2e/README.md | Documents workspace test prerequisites. |
| go/core/test/e2e/mocks/workspace.json | Supplies cross-runtime workspace tool responses. |
| go/core/test/e2e/interaction_test.go | Extracts reusable Agent creation helper. |
| go/core/internal/translator/workspace.go | Compiles sources and preparation-only access. |
| go/core/internal/translator/workspace_test.go | Tests source selection and credential isolation. |
| go/core/internal/translator/revision.go | Includes preparation access in revision identity. |
| go/core/internal/translator/kagent/compiler.go | Passes workspace into ADK configuration. |
| go/core/internal/translator/compiler.go | Resolves workspace inputs and rejects BYO. |
| go/core/internal/translator/codex/compiler.go | Passes workspace into Codex configuration. |
| go/core/internal/translator/claude/compiler.go | Passes workspace into Claude configuration. |
| go/core/internal/substrate/sandbox.go | Adds sandbox checkout arguments and boot access. |
| go/core/internal/substrate/sandbox_test.go | Updates template compilation tests. |
| go/core/internal/substrate/policy.go | Shares policy construction for preparation access. |
| go/core/internal/substrate/client.go | Retries failed preparation and pins golden snapshots. |
| go/core/internal/substrate/client_test.go | Tests retry safeguards and snapshot requirements. |
| go/core/internal/substrate/actor_template.go | Adds preparation policy and checkout-aware timeout. |
| go/core/internal/substrate/actor_template_test.go | Verifies preparation policy immutability. |
| go/core/internal/controller/workspace_preparation_test.go | Tests recovery after credential correction. |
| go/core/internal/controller/sandbox_reconciler.go | Retries failed sandbox workspace preparation. |
| go/core/internal/controller/sandbox_reconciler_test.go | Tests credential tracking and preparation retries. |
| go/core/internal/controller/sandbox_collections.go | Resolves sandbox workspace dependencies. |
| go/core/internal/controller/reconciler.go | Integrates Agent workspace preparation retries. |
| go/core/internal/controller/reconciler_test.go | Extends backend fake with retry support. |
| go/core/internal/controller/preparation_test.go | Adds retry delegation to test backend. |
| go/core/cli/internal/commands/install.go | Enables Substrate golden egress support. |
| go/core/cli/internal/commands/install_test.go | Checks golden egress installation setting. |
| go/api/v1alpha3/zz_generated.deepcopy.go | Regenerates workspace deep-copy support. |
| go/api/v1alpha3/workspace_types.go | Defines public workspace source types. |
| go/api/v1alpha3/workspace_cel_test.go | Tests workspace admission validation. |
| go/api/v1alpha3/sandboxtemplate_types.go | Adds SandboxTemplate workspace selection. |
| go/api/v1alpha3/configuration_crd_cel_test.go | Registers workspace validation tests. |
| go/api/v1alpha3/agent_types.go | Adds Agent workspace selection. |
| go/api/gen/kagent/config/v1/workspace.pb.go | Adds generated Go workspace bindings. |
| go/api/gen/kagent/config/v1/adk.pb.go | Regenerates Go ADK workspace bindings. |
| go/adk/cmd/main.go | Initializes workspace before ADK startup. |
| docs/architecture/workspace-sources.md | Documents workspace lifecycle and security boundaries. |
| docs/architecture/sandboxes.md | Links sandbox preparation to workspace behavior. |
Review effort: Balanced
Comment on lines
+283
to
+285
| output, err := cmd.Output() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("workspace Git command failed: %w", err) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds
spec.workspace.gittoAgentandSandboxTemplate, so a repository is available in/data/workspacebefore the first turn or sandbox operation. Agents can share an AgentTemplate while selecting different repositories.The checkout runs during golden preparation using Substrate's boot egress support. Each Session or Sandbox gets an independent writable copy, and resume/fork preserves its files without fetching again. Source credentials are injected by the egress gateway during preparation; ongoing Git access requires a separate runtime grant.
Full commit SHAs are recommended for reproducibility. Branches and tags resolve during preparation, so new instances can retain an older commit after the remote ref moves. A later preparation can pick up the newer commit.
Supports the Go ADK, Codex, Claude, and managed Sandbox guest. Python ADK and BYO runtimes reject configured sources. Standalone Sandbox tools images need Git installed. Includes the API/generated contracts, runtime integration, installer configuration, and design details.