bin/ proxies: systemd socket activation so restarts never refuse connections #1821

Activity

1. developing-today commented on Oct 28, 2026

   

   developing-todayBot

   on Oct 28, 2026 – with developing.today

   Contributor

   More actions

   CODE-752
2. github-actions

   assigned

   dezren39

   on Oct 28, 2026
3. dezren39

   added

   kind/infrastructureInfrastructure / host-portability workInfrastructure / host-portability work

   source/humanFiled directly by a humanFiled directly by a human

   status/needs-triageNot yet triaged; needs a first lookNot yet triaged; needs a first look

   priority/normalOrdinary priority (the default)Ordinary priority (the default)

   effort/sSmall: expected under 2 hours of workSmall: expected under 2 hours of work

   area/nixosNixOS modules and machine configurationNixOS modules and machine configuration

   meta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedIntake review done: acceptance criteria, links, and normalized labels added

   on Oct 28, 2026
4. dezren39 commented on Oct 28, 2026

   

   dezren39

   on Oct 28, 2026

   MemberAuthor

   More actions

   Intake review

   Fleet monitor intake pass (protocol §5), 2026-10-28.

   • Related: follow-up to Local proxy discovery: port files, sockets, or a registry instead of fixed ports? #437 (closed by Drew's 2026-10-28 decision — fixed ports + port files stand, and option (e) socket activation is approved); fleet-wide context is the audit Audit: socket activation as the default pattern for laptop services #1822.
   • Still live: Local proxy discovery: port files, sockets, or a registry instead of fixed ports? #437's closure was the design decision, not this implementation — the four bin/ proxies (clef 18742, agy 18743, codex 18744, antigravity-ls 18745) still bind their own ports.
   • Risks: socket activation changes how each proxy receives its listener (LISTEN_FDS) — a proxy that ignores the passed socket and binds anyway would double-bind; verify per proxy with a restart-under-load check (connections queue, never refused). Keep the port-file publication from Local proxy discovery: port files, sockets, or a registry instead of fixed ports? #437 intact.
   • Suggested approach: one proxy first (clef), prove restart-with-queued-connections, then roll the pattern to the other three in the same PR series.
   • Labels normalized: kind/infrastructure, source/human, status/needs-triage, priority/normal, effort/s, area/nixos, meta/enriched. Acceptance criteria were already present — no body edit.
5. dezren39 commented on Oct 31, 2026

   

   dezren39

   on Oct 31, 2026

   MemberAuthor

   More actions

   Status — owner order 2026-10-28, stalled, re-queued 2026-10-31.

   Drew approved socket activation (option (e)) for the bin/ proxies on #437 on 2026-10-28, but this issue was never queued — no task row existed.

   Remediation (2026-10-31): enqueued into repo-health-code-pilot as task 4719 (small_fix, priority 50, queued, attempts 0/3), verified by direct queue read; queue signal refreshed. Ports stay fixed per the #437 KEEP ruling.
6. dezren39

   added

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   work/assignedQueue worker lifecycle stateQueue worker lifecycle state

   status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

   and removed

   status/needs-triageNot yet triaged; needs a first lookNot yet triaged; needs a first look

   on Nov 1, 2026
7. 33 remaining items

   Load more
8. dezren39

   added

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

   and removed

   queue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queue

   queue/parkedQueue task is parked (waiting on CI, time, or an event)Queue task is parked (waiting on CI, time, or an event)

   on Nov 3, 2026
9. dezren39 commented on Nov 3, 2026

   

   dezren39

   on Nov 3, 2026

   MemberAuthor

   More actions

   🤖 Agent note · picked up

   • Agent: repo-worker-code (OpenChamber scheduled lane c29174f1-48e0-4b13-b4ff-9b73ab67e9ab)
   • Session / ID: OpenCode session ses_e5e5ca52ecdffes8V8re6F4z2i · queue task 4719
   • Found via: repo-health-code-pilot atomic claim
   • Task: Revalidated bin/ proxies: systemd socket activation so restarts never refuse connections #1821 and merged PR feat(proxies): socket-activate clef-proxy and codex-proxy (#1821) #4845 (b910a59b); no competing open PR. Host switch/restart verification remains outside task scope and is not authorized by this claim.
   • Next: Park until explicit authorization for the separate amd host switch/restart verification; then revalidate host and issue state.
   • Links: bin/ proxies: systemd socket activation so restarts never refuse connections #1821 · feat(proxies): socket-activate clef-proxy and codex-proxy (#1821) #4845
10. dezren39

    added

    queue/parkedQueue task is parked (waiting on CI, time, or an event)Queue task is parked (waiting on CI, time, or an event)

    status/parkedDeliberately paused with a recorded resume conditionDeliberately paused with a recorded resume condition

    and removed

    status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

    queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

    on Nov 3, 2026
11. dezren39 commented on Nov 3, 2026

    

    dezren39

    on Nov 3, 2026

    MemberAuthor

    More actions

    🤖 Agent note · parked

    • Agent: repo-worker-code (OpenChamber scheduled lane c29174f1-48e0-4b13-b4ff-9b73ab67e9ab)
    • Session / ID: OpenCode session ses_e5e5ca52ecdffes8V8re6F4z2i · queue task 4719
    • Task state: PR feat(proxies): socket-activate clef-proxy and codex-proxy (#1821) #4845 is merged (b910a59b); bin/ proxies: systemd socket activation so restarts never refuse connections #1821 remains OPEN for the separately authorized host verification.
    • Reason: The task packet explicitly excludes a laptop NixOS/home-manager switch or production-like restart. I did not change system configuration.
    • Resume: When explicit authorization for the separate amd host step is available, verify both sockets are listening, services activate on first connection, endpoint files republish, then recheck issue state and close bin/ proxies: systemd socket activation so restarts never refuse connections #1821 if acceptance is complete.
    • Links: feat(proxies): socket-activate clef-proxy and codex-proxy (#1821) #4845 · bin/ proxies: systemd socket activation so restarts never refuse connections #1821
12. dezren39 commented on Nov 4, 2026

    

    dezren39

    on Nov 4, 2026

    MemberAuthor

    More actions

    🤖 Agent note · parked

    • Agent: queue worker (repo-worker-code), lane code-o
    • Session / ID: task 4719
    • Found via: queue claim (execution lane: direct)
    • Task: task 4719 — socket-activate the remaining live bin/ proxies: systemd socket activation so restarts never refuse connections #1821 proxies (clef + codex)
    • Expectation: parked — implementation is done and merged; the only remaining step is the separately authorized amd host switch/restart verification, which this packet explicitly excludes.
    • Re-verified fresh 2026-11-04: PR feat(proxies): socket-activate clef-proxy and codex-proxy (#1821) #4845 MERGED (merge commit b910a59b0316257b46c8575640a0e5fba5d92e74, 2026-11-03T11:16:48Z); issue bin/ proxies: systemd socket activation so restarts never refuse connections #1821 still OPEN; issue Audit: socket activation as the default pattern for laptop services #1822 still OPEN with user/escalated (pending Drew review — no scope expansion). No competing open PR.
    • Resume condition: explicit authorization for the amd host switch/restart step; then verify the clef (:18742) and codex (:18744) sockets, activation, and endpoint files per PR feat(proxies): socket-activate clef-proxy and codex-proxy (#1821) #4845's verification steps, and close bin/ proxies: systemd socket activation so restarts never refuse connections #1821 if acceptance is complete.
13. dezren39 commented on Nov 4, 2026

    

    dezren39

    on Nov 4, 2026

    MemberAuthor

    More actions

    agent-note:v1 — task 4719 parked again (lane code-n, 2026-11-04T10:31Z).

    Fresh verification: PR #4845 is MERGED (b910a59b0316257b46c8575640a0e5fba5d92e74); issue #1821 remains OPEN. The only remaining step is the amd host switch/restart verification for the clef + codex proxies, which the task packet places behind separate explicit authorization — no such authorization has been recorded, so task 4719 is parked 6h with that resume condition (third park for this gate; prior parks 2026-11-03T21:46Z and 2026-11-04T03:48Z).
14. dezren39 commented on Nov 4, 2026

    

    dezren39

    on Nov 4, 2026

    MemberAuthor

    More actions

    Verified on amd — closing. The amd host switch landed this morning (2026-11-04, generation nixos-system-amd-26.11.20261102.f9887a8), which deployed PR #4845's socket units via home-manager. The switch alone left the sockets enabled-but-inactive (the same sd-switch limitation that left the new opencode unit unstarted), with the proxies still holding their ports directly from boot. That last step is now done and verified for both proxies:

    • clef-proxy (127.0.0.1:18742): service stopped → clef-proxy.socket started and holding the port → HTTP probe returned 200 and socket activation started the service on demand. A second probe issued during an explicit systemctl restart of the service also returned 200 — the connection was held by the socket, never refused.
    • codex-proxy (127.0.0.1:18744): same sequence — service stopped, socket armed, cold probe returned 200, service auto-started.

    All four units (both sockets, both services) are active. Restarts no longer refuse connections, as designed. Queue task 4719 is completed with this evidence; the earlier parks were only waiting on the host switch authorization, which Drew granted this morning.
15. dezren39

    closed this as completedon Nov 4, 2026
16. developing-today

    added

    status:done

    on Nov 4, 2026