activator removal: tracker

[elitegreg]

Tracker for the DoubleZero activator removal effort.

Master plan: activator-removal-plan.md (in greg's working tree; will be added to the repo if useful).

Purpose

Retire doublezero-activator. Onchain allocation (RFC-11) supersedes it. The deployed activator is frozen — no new builds, no new releases — but existing instances keep running until the supported CLI floor rises high enough that the activator-invoked instructions can be removed from the program.

Phasing overview

Phase	What ships	Repo	Gate
1	Stop deploying then stop building/releasing the activator	infra, doublezero	none
2	E2E runs onchain-allocation only; activator container removed from tests	doublezero	none
3	Delete activator/ crate	doublezero	phases 1, 2 merged
4	Treat onchain-allocation as always-on; remove flag-gated branches; deprecate the flag	doublezero	phase 3 merged
5	Status enum cleanup (rename unused variants *Deprecated)	doublezero	phase 4 merged
6	In-repo docs and comments scrub	doublezero	phase 5 merged
7a	Remove User activate/reject/closeaccount instructions	doublezero	gate ≥ 0.12.0
7b	Remove device/link/multicastgroup activate/reject/closeaccount instructions	doublezero	gate ≥ 0.14.1
8	Tear down monitoring, shut down EC2 hosts in all environments, delete Terraform module	infra	all of 1–7 merged + product OK to lose ability to support older CLIs

Child issues

Phase 1 — freeze deployment, then build and release

• PR 1.1 — infra: stop deploying activator (keep instances running) — malbeclabs/infra#1175
• PR 1.2 — doublezero: drop activator release pipeline — activator removal phase 1.2: drop activator release pipeline #3608

Phase 2 — e2e migrates to onchain-allocation only

• PR 2.1 — delete legacy BackwardCompatibility e2e shard — activator removal phase 2.1: delete legacy BackwardCompatibility e2e shard #3609
• PR 2.2 — floor BackwardCompatibility shard at CLI 0.12.0 / 0.14.1 — activator removal phase 2.2: floor BackwardCompatibility e2e shard at CLI 0.12.0 / 0.14.1 #3610
• PR 2.3 — convert remaining e2e shards to onchain-only; drop activator container — activator removal phase 2.3: convert remaining e2e shards to onchain-only; drop activator container #3611

Phase 3 — delete the activator crate

• PR 3.1 — delete activator/ crate from workspace — activator removal phase 3.1: delete activator/ crate from workspace #3612

Phase 4 — onchain-allocation always-on; deprecate the flag

• PR 4.1 — serviceability program: collapse OnChainAllocation flag branches — activator removal phase 4.1: serviceability program — collapse OnChainAllocation flag branches #3613
• PR 4.2 — Rust SDK + CLI: drop OnChainAllocation flag-gated code — activator removal phase 4.2: Rust SDK + CLI — drop OnChainAllocation flag-gated code #3614
• PR 4.3 — TS + Python SDKs: propagate OnChainAllocation rename — activator removal phase 4.3: TypeScript + Python SDKs — propagate OnChainAllocation rename #3615
• PR 4.4 — Go SDK: verify FeatureFlags consumers; doc-comment bit 0 — activator removal phase 4.4: Go SDK — verify FeatureFlags consumers; doc-comment bit 0 #3616

Phase 5 — status enum cleanup

• PR 5.1 — serviceability program: rename activator-only status variants to *Deprecated — activator removal phase 5.1: serviceability program — rename activator-only status variants to *Deprecated #3617
• PR 5.2 — Rust SDK + CLI: propagate status variant renames — activator removal phase 5.2: Rust SDK + CLI — propagate status variant renames #3618
• PR 5.3 — TS + Python SDKs: propagate status variant renames — activator removal phase 5.3: TS + Python SDKs — propagate status variant renames #3619
• PR 5.4 — Go SDK + Go consumers: propagate status variant renames — activator removal phase 5.4: Go SDK + Go consumers — propagate status variant renames #3620

Phase 6 — documentation and comment scrub

• PR 6.1 — docs and comment scrub — activator removal phase 6.1: docs and comment scrub #3621

Phase 7 — min-version-gated program cleanup ⚠️ DO NOT MERGE UNTIL GATE MET ⚠️

• PR 7.1 — remove user activate/reject/closeaccount instructions (gate ≥ 0.12.0) — activator removal phase 7.1: remove user activate/reject/closeaccount instructions [DO NOT MERGE — gated on min_compatible_version >= 0.12.0] #3622
• PR 7.2 — remove device/link/multicastgroup activate/reject/closeaccount instructions (gate ≥ 0.14.1) — activator removal phase 7.2: remove device/link/multicastgroup activate/reject/closeaccount instructions [DO NOT MERGE — gated on min_compatible_version >= 0.14.1] #3623

Phase 8 — tear down monitoring and infrastructure ⚠️ DO NOT MERGE UNTIL ALL OF 1–7 + PRODUCT SIGN-OFF ⚠️

• PR 8.1 — remove activator Grafana monitoring — malbeclabs/infra#1176
• PR 8.2 — stop and disable systemd services on all hosts — malbeclabs/infra#1177
• PR 8.3 — terminate EC2 hosts and remove infra-as-code — malbeclabs/infra#1178

Cross-cutting risks

1. Borsh discriminant stability. Phase 5 renames must not change the numeric repr(u8) discriminants of any status enum or feature flag bit.
2. Phase ordering with releases. Phases 4 and 5 change program behavior in subtle ways. They should ride a normal program release/upgrade cycle, not be bundled with the larger 7.x deletions.
3. Min-version gate enforcement. Phases 7.1 and 7.2 are land-mines if merged before the corresponding min_compatible_version bump.
4. Phase 2 visibility. After PR 2.3, no test exercises the activator. Any regression in onchain-allocation behavior surfaces in normal e2e signal instead of being absorbed by the activator.
5. Phase 8 sequencing within the phase. PR 8.2 must precede PR 8.3 — never destroy EC2 hosts that have a running activator.
6. Coverage preservation in phase 4. The test handling rule in phase 4 exists because a careless reviewer could net-delete coverage by treating every legacy-only test as obsolete.

Open items / TBDs

• Onchain min_compatible_version bump owner. Who runs the doublezero globalconfig setversion transactions and on what schedule? This is the gating action for phases 7.1 and 7.2.
• Cloudsmith package archival. Optional follow-up to phase 8.
• Contributor communication plan. Phase 7.2 removes contributor-side program instructions — announce the deprecation timeline ahead of the min-version bump.
• Status variant audit details. PR 5.1 includes an audit step for UserStatus::Deleting, PendingBan, and Updating, plus the full MulticastGroupStatus enum.
• Controller LinkStatusPending sentinel. PR 5.1 decides whether to keep LinkStatusPending unrenamed or rename it and migrate the controller to a distinct sentinel.