fix(broker): bound identity lifecycle reconciliation

Merged
AG
1d ago
+888-107

Summary

Addresses production CLI publish gates 1-3 from #1908 without changing the DEV acceptance image:

  • return every held Fleet cleanup completion with an explicit cleanup-unconfirmed shutdown error before the broker exits
  • cap node-created identity + channel reconciliation under one 60s deadline and fail a confirmed channel-set mismatch immediately
  • cap guarded identity release requests and backoffs under one aggregate visibility budget

This deliberately leaves the smaller follow-ups in #1908 open.

Validation

  • cargo fmt --check
  • cargo test -p agent-relay-broker runtime::tests::shutdown_returns_retained_fleet_cleanup_completion -- --exact --nocapture
  • cargo test -p agent-relay-broker runtime::relaycast_events::tests::spawned_channel_reconciliation_has_one_combined_budget -- --exact --nocapture
  • cargo test -p agent-relay-broker relaycast::ws::tests::node_registered_channel_scope_ -- --nocapture
  • cargo test -p agent-relay-broker relaycast::ws::tests::owned_identity_cleanup_ -- --nocapture
  • cargo test -p agent-relay-broker runtime::tests::node_owned_identity_create_reconcile_teardown_create_again -- --exact --nocapture

[!NOTE]
Medium Risk
Changes broker shutdown, Fleet wire delivery, and Relaycast spawn/release reconciliation paths that affect production Fleet sandboxes; behavior is bounded and heavily tested but touches identity lifecycle correctness.

Overview
Fleet cleanup completions now use a dedicated unbounded node-control lane (RetainedFleetCompletion / RetainedSend) that is preferred over the bounded fleet control queue, so terminal action.result frames for owned-identity cleanup are not dropped when the queue is full or during shutdown. Identity cleanup routes Fleet completions through this lane with delivery acks; shutdown aborts in-flight cleanups and returns explicit cleanup-unconfirmed errors on held Fleet results instead of ending silently.

Lifecycle reconciliation is time-bounded: node-created spawn channel reconciliation runs under a single 60s combined deadline (reconcile_spawned_agent_channels_with_timeout), and guarded owned-identity release HTTP retries (visibility and workspace backoffs) honor one aggregate budget via release_agent_identity_guarded_with_budget. Channel-scope checks tolerate bounded read-after-write lag but still fail closed on a sustained mismatch.

CHANGELOG and tests cover shutdown with a full fleet queue, completion preemption, budget exhaustion, and channel-scope retry behavior.

Reviewed by Cursor Bugbot for commit ccfaae839daed89c84fadc8468b5802592226c58. Bugbot is set up for automated code reviews on this repo. Configure here.

Agent Relay sessions

  • codex session 01a10776 · opened via gh pr create · last active 2026-10-05
  • codex session 01a10eb9 · contributor · pushed commits · last active 2026-10-06