refactor: eliminate runner — all targets use direct mode#58
Merged
Conversation
The in-cluster runner Job existed because the OCP gateway was originally only reachable via cluster-internal DNS. But harness deploy already creates an OpenShift Route with external access and extracts mTLS certs, so the local CLI can talk to the gateway directly. This removes the entire runner path: the runner image, the launch command, the launcher RBAC, and the two-mode (launcher/direct) gateway config. All targets now use the same code path — deploy gateway if needed, register providers from the workstation, render payload locally, create sandbox directly via the openshell CLI. - Delete build/runner/, cmd/launch.go, gateways/ocp/addons/rbac.yaml - Delete upRemote(), defaultRunnerImage(), runnerEnv(), LauncherSection - Route --remote through upLocal with auto-deploy via deployFromConfig - Remove runner job from CI image workflow - Remove createViaRunner/profileHasCustomProviders from create.go - Extract mTLS certs for all non-local gateways (not just launcher mode) - Drop MTLS secret default (only extract when explicitly configured) -883 lines, one code path for all targets.
2 tasks
robbycochran
added a commit
that referenced
this pull request
Jun 12, 2026
* X-Smart-Branch-Parent: main * docs: update all documentation for current CLI state Audit and update all core documentation to reflect PRs #58-#61: README.md: - Add 'What harness up replaces' section showing the single command vs 8+ raw openshell commands for a 4-provider agent - Remove deleted commands (preflight, providers) - Update config files table (gateway.yaml, remove providers.toml/openshell.toml) - Add OpenCode support, --provider-refresh flag, --env injection - Add v0.0.59 prerequisite SPEC.md: - Remove deleted commands and config files - Update payload section (no more env.sh/sandbox.env) - Document three registration flows (standard, ADC, custom) - Add --provider-refresh, task -p application, empty env host lookup AGENTS.md: - Update sandbox image workaround (adds opencode-ai) - Fix test target description (bats removed) sandbox/CLAUDE.md: - Add opencode as available agent - Remove stale kubectl/deploy-kubeconfig reference - Generalize inference description demo/DEMO-SCRIPT.md: - Fix entrypoint (claude not claude --bare -p) - Replace providers.toml with profiles directory - Replace gateway.toml with gateway.yaml - Remove harness providers step * chore: remove demo script and demo agent config The demo/ directory and agents/demo.yaml were not actively used. Updated README task agent example to use a generic name. * refactor: only register providers declared in agent YAML registerProviders() now takes the agent's provider name list instead of a gateway config. Only providers listed in the agent YAML are registered — no more hardcoded list of all four providers. The agent YAML is the single source of truth for which providers a sandbox needs. If a provider isn't in the YAML, it's not registered. * docs: restructure README to show command → file → equivalent The 'What harness up replaces' section now flows: the harness command, the agent YAML it reads, then the openshell commands it replaces. Removed the duplicate Agent Configs section. * feat: add gateway field to agent config, add OCP agent example The agent YAML can now specify its deployment target via gateway: field. harness up reads it to determine local vs remote — no --local/--remote flag needed when the agent config declares it. - gateway: local (default) — Podman on your machine - gateway: ocp — OpenShift cluster - gateway: kind — local kind cluster - --local/--remote flags override the agent config Added agents/ocp.yaml as a concrete example. * docs: add OCP equivalent openshell commands to README Show the additional Helm deploy + sandbox create commands that harness up runs when gateway: ocp is set. * docs: fix OCP command order — deploy gateway first, then providers The correct OCP sequence is: namespace + CRD + SCCs + Helm + rollout + gateway register → then provider registration → then sandbox create. Previously showed providers before deploy. * refactor: wire provider config via --config on provider create, not --env Provider config values (JIRA_URL, JIRA_USERNAME, etc.) now flow through the provider system via --config on 'openshell provider create' instead of being merged into --env on sandbox create. - BuildEnvMap() returns only the agent's env: section (sandbox-level vars) - ProviderRef.ConfigList() returns config as KEY=VALUE pairs for --config - registerProviders() takes []agent.ProviderRef instead of []string, passing each provider's config to the registration call - Provider configs are managed by the gateway, not manually injected * refactor: rename providers[].config to providers[].env, inject via --env Provider non-secret vars (JIRA_URL, JIRA_USERNAME) are sandbox env vars, not gateway-managed config. Rename the field from 'config' to 'env' to make this clear. Both top-level env: and providers[].env: merge into BuildEnvMap() and are injected via --env on sandbox create. Provider env overrides top-level env on collision. The gateway only manages secrets (credentials) — non-secret vars go directly to the container. * fix: add gws to status.Cmd logging, sync builtin.yaml with default, update README commands - Add status.Cmd() call for 'gws auth export --unmasked' so it shows with --show-commands - Add gws provider to builtin.yaml (was missing vs default.yaml) - Update README 'What harness up replaces' with actual captured output from --show-commands (includes gws export, inference set order, env var alphabetical order) - Add --debug flag to test-flow.sh (passes --show-commands, shows output) * fix: fail fast on provider registration errors, slim down builtin Provider registration now returns errors instead of silently skipping. If you declare a provider in your agent YAML, you need it — missing credentials are a configuration error, not a graceful degradation. builtin.yaml slimmed to vertex-local only (inference). Users who need github/atlassian/gws create agents/default.yaml with the full list.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
[secrets] mtlsconfig (not just "launcher" mode)Test plan
go vet ./...passesgo test ./...passes (all packages)bats test/preflight.batspasses (29 tests)make test-local— local gateway integrationmake test-kind— kind cluster integrationmake test-remote— OCP integration (when cluster available)🤖 Generated with Claude Code