Summary
Implement the reusable Atrinik control plane described by the repository seed.
The first production-shaped use case is a single Classic main deployment on a
Linux host behind home NAT. The same contract should later support
operator-approved official deployments, isolated builders, and real-hardware
GPU validation without giving any target an unrestricted command channel.
Implementation / behavior
- Run the public HTTP/WebSocket control plane as a Cloudflare Worker with
per-target Durable Object state.
- Register each host with a stable target identity, an explicit capability set,
and a per-agent key or equivalent enrollment proof.
- Accept GitHub events only after signature, repository, workflow, branch,
conclusion, commit, and delivery-idempotency validation.
- Keep desired artifact, current artifact, job state, approval state, and
offline-agent reconciliation durable.
- Deliver jobs over an agent-initiated outbound WebSocket so targets need no
static IP, public hostname, inbound webhook port, or Cloudflare Tunnel.
- Make deployment payloads declarative and allowlisted; never interpolate
network data into shell commands, paths, image names, or systemd units.
- Provide bounded retries, stale-job rejection, rapid-merge coalescing, and
operator-safe status readback.
- Keep secrets and host state outside this repository and coordinate provider
configuration through the organization governance process.
Acceptance criteria
- A disposable test agent can enroll, disconnect, reconnect, and receive the
newest desired deployment exactly once.
- Duplicate and out-of-order GitHub deliveries are harmless.
- An offline agent receives the latest desired state after reconnecting.
- The initial target policy accepts only the Classic server image and the
dedicated home-main deployment operation.
- Worker, Durable Object, protocol, and agent tests cover authentication,
authorization, replay, state transitions, and failure recovery.
- No test or documentation path requires live GitHub, Cloudflare, GHCR, game
server, or host credentials.
Non-goals
- Do not automatically deploy the official main server.
- Do not execute arbitrary PR source on a deployment agent.
- Do not move game discovery or rendezvous behavior from the metaserver Worker.
- Do not share persistent game state between Classic server generations.
Related work
Related coordination:
Summary
Implement the reusable Atrinik control plane described by the repository seed.
The first production-shaped use case is a single Classic main deployment on a
Linux host behind home NAT. The same contract should later support
operator-approved official deployments, isolated builders, and real-hardware
GPU validation without giving any target an unrestricted command channel.
Implementation / behavior
per-target Durable Object state.
and a per-agent key or equivalent enrollment proof.
conclusion, commit, and delivery-idempotency validation.
offline-agent reconciliation durable.
static IP, public hostname, inbound webhook port, or Cloudflare Tunnel.
network data into shell commands, paths, image names, or systemd units.
operator-safe status readback.
configuration through the organization governance process.
Acceptance criteria
newest desired deployment exactly once.
dedicated home-main deployment operation.
authorization, replay, state transitions, and failure recovery.
server, or host credentials.
Non-goals
Related work
Related coordination:
feat(webhook): receive verified GitHub events and persist target state #3
feat(agent): implement the NAT-friendly Classic deployment agent #4
feat(control): coordinate approved builders and hardware targets #5
feat(status): publish safe deployment and agent evidence #6
feat(release): publish immutable main images for deployment control classic#516
feat(workspace): register deploy-control as shared infrastructure atrinik#528
govern(deploy): register deploy-control and GitHub App policy github-settings#79
feat(deploy): surface agent and deployment evidence observatory#28