Repository navigation
Verify a deployed hosted channel with a local workspace #176
Description
Run a fresh, team-deployed hosted channel on Cloudflare while its workspace stays on a real team machine. The channel, model loop and durable pi state live in the cell; repository files, shell processes, lanes, browser and desktop tools remain on the workspace. This is the first milestone of #13, not a cloud execution environment.
Status — October 7
The initial deployed qualification passed on one physical workspace machine after reproducing and fixing #183. PR #186, reviewed head 4d534550b0a36d9c8272113018c71c0b9b199830, merged as 80c67ca on October 7 at 13:37:52 UTC after GitHub CI passed; #183 is closed. The deployed evidence remains tied to the pilot versions below. This pilot stays open for the actual second-machine, teammate directory-discovery and physical sleep/network-partition checks below.
Detailed scenario results and repeat procedure cover T1–T16, including the pre-fix failures. Real model: anthropic/claude-sonnet-5-5; files, lanes and tools stayed on the local Mac.
- Dedicated channel service, initial version
360a7bca-a1fc-4bbb-8fa5-e64b599a8273from sourcead3f7313ea18f2fd9c5f9e3fb2ca9c5b1df67861. - Dedicated directory service, version
0df59e7b-4f07-41a7-9722-33b232398e07. - Final channel-service version
b58efd2d-579e-4c70-a9aa-c326bca1e086includes the PR fix(channel): keep hosted runs resident while busy #186 fix and uses the original service entry point. The temporary pilot-onlyctx.abort()wrapper was removed, history was compared again, and shell work succeeded afterward. - The same hosted channel and history were preserved throughout. Existing non-pilot services were unchanged; the isolated pilot remains available for the next acceptance pass.
Existing foundation
The channel service, workspace connection and ace new --hosted <url> landed in 3ff0b97; 1a2e1f3 fixed the first connection. PR #85 records real model/tool validation in a local Workers/Durable Objects runtime. That evidence does not establish deployed Cloudflare behavior.
Acceptance
Checked items below are supported by the recorded deployed evidence. PR #186 has merged; the whole pilot remains incomplete until the remaining physical-machine and discovery checks pass.
- Deploy dedicated pilot channel/directory services from recorded source revisions, use an isolated project/profile and a new channel, and preserve existing services/data/credentials. Service URLs and versions are recorded above without secrets.
- Create the hosted channel with the supported CLI and complete real model/local shell and lane file read/write work. Verify actual local execution and durable transcript, tool results, metadata and usage (T1/T3).
- Redeploy the service against the same channel, compare full protocol replay and channel info including usage, reopen and continue work without resetting the store or replacing the channel (T6). A plain deployment during an active shell also completed without duplicate execution (T10), but did not measurably reset the runtime.
- Cleanly stop the workspace host with SIGTERM, retain cloud human chat, return an explicit offline tool outcome, then restart/reconnect and complete shell work (T15).
- Verify physical workspace sleep/wake and network loss/partition recovery. Clean SIGTERM is not evidence for these cases.
- Open the hosted channel through Ace on another actual team machine: verify attributed human messages, live updates/reconnect, permitted model invocation and execution remaining on its workspace. Another context or self-tailnet loopback is not a second machine.
- Verify a teammate host discovers and reaches the hosted channel through the pilot directory; exercise its offline/reconnect presentation. This was not simulated with a second host process on the same machine.
- Cause a real runtime reset during an active shell and separately after the first model-stream delta using temporary pilot-only
ctx.abort()(T13/T14). Confirm shell process cleanup, unsafe-tool interruption without replay, preserved historical prefix and model continuation. The stopped partial reply plus regenerated complete reply is recorded as observed behavior, not an established defect. Reset coverage comes from this fault injection, not plain deployment. - Verify a detached silent 75-second tool completes once after the residency fix; exercise Stop, ordinary Kill and Kill after 56 seconds with no client watching. Confirm parent/child cleanup, no completion marker after cancellation/deadline, and a usable channel afterward (T4 final/T8/T9/T11).
- Observe idle hibernation after work ends, then reopen and execute successfully while preserving the workspace socket (T7). This establishes observed residency/hibernation behavior, not long-term resource or billing guarantees.
- Publish source/deployment and scenario evidence; retain the pre-fix Hosted idle hibernation interrupts active tools while local shell keeps running #183 reproduction, distinguish passed checks from unavailable cases, and link the defect from [Meta] Run hosted channels in the cloud with local workspaces #13 and [Meta] Dogfood Ace end to end #5.
- Review and merge fix(channel): keep hosted runs resident while busy #186 so the validated Hosted idle hibernation interrupts active tools while local shell keeps running #183 fix is part of the supported source. Merged as 80c67ca; Hosted idle hibernation interrupts active tools while local shell keeps running #183 closed automatically.
Use real runtimes, models and provider credentials. Keep channel state in pi-durable and the channel package runtime-neutral. Existing channels are permanent data; any format change requires a versioned migration checked against an existing-channel backup.
App setup, general hosted backup/restore, host-independent lifecycle/discovery and outbound messaging are later focused work in #13. This pilot can expose their limits without silently broadening its scope. Execution-host handoff #49, directory push #14 and cross-gateway terminals #11 are related work, not prerequisites.
Tracked by #13; deployed-path dogfooding evidence for #5. No acceptance checkbox above is complete merely because the implementation exists or local Workers checks passed.
Activity
iamnbutler commentedon Oct 7, 2026
Historical pre-fix report. The completed initial qualification and candidate regression results supersede the in-progress status below.
Initial deployed pilot evidence on October 7, using source
ad3f7313ea18f2fd9c5f9e3fb2ca9c5b1df67861and the dedicated real Cloudflareace-channel-pilotservice:The #183 reproduction started the shell at 11:35:03 UTC, reconstructed the runtime at 11:35:38 UTC and observed the original shell's end marker at 11:36:18 UTC. A later wait was interrupted again after another recovery. The model avoided replaying the original command; this is not evidence that arbitrary side effects are safe to continue across that loss of pending-call state.
Bounded replay, process and runtime-generation artifacts are retained by the pilot operator. #183 is a child issue of this pilot and the first blocker linked from #13; it is also recorded in #5.
T5 started PID
20265(sleep child20268) at 11:37:09 UTC in generationfdc6b613:6. Pi reported interruption roughly 30 seconds later; the model finished without retrying at 11:37:38 UTC. Hosted Kill at 11:38:12 UTC returned successfully with pi already idle, but both original processes remained alive afterward. The operator retained the T5 replay, process checks, Kill timestamp and shell marker evidence.This is a demonstrated failure to cancel the call already orphaned by hibernation, not proof that ordinary Kill fails while a current active workspace call remains attached. The service busy/residency fix is being prepared. The complete evidence matrix and remaining upgrade, interruption, cancellation, idle and second-machine results will follow; no acceptance checkboxes are changed by this partial report.
iamnbutler commentedon Oct 7, 2026
October 7 deployed qualification update: the initial one-machine pilot and #183 regression checks are complete. PR #186, head
4d534550b0a36d9c8272113018c71c0b9b199830, is ready for review and unmerged. GitHub CI passed at 11:55:09 UTC;bun typesandbun run cialso passed in the Ace operator channel.The dedicated services are ace-channel-pilot and ace-directory-pilot. Initial source was
ad3f7313ea18f2fd9c5f9e3fb2ca9c5b1df67861. The service fix is the one in PR #186; the final deployment isb58efd2d-579e-4c70-a9aa-c326bca1e086, using the original service entry point with the temporary reset wrapper removed. The same hosted channel was retained throughout; existing non-pilot services were unchanged.anthropic/claude-sonnet-5-5executed shell work on the local Mac and read/wrote an actual lane file.ctx.abort()caused a real socket drop and reconnect in about one second. The old processes were gone within five seconds, no end marker appeared, and pi recorded interruption without replaying the unsafe command. Prior history stayed intact.To repeat #183's regression: dispatch a silent shell longer than the former hibernation window, close all ordinary channel clients, confirm one start/result in the same generation, then repeat with Kill after at least 56 seconds and inspect both parent/child exit and absence of an end marker after the original deadline. After the run ends, verify an idle cell can hibernate and reopen. Genuine-reset checks require the separately identified pilot fault injection; a plain deployment must not be reported as an observed reset.
Still open: review/merge #186; another actual physical client/teammate machine, including attributed collaboration and pilot-directory discovery; physical workspace sleep/wake and network partition/recovery. No second host was simulated with another context on this machine. Keep this pilot open for those checks. The isolated pilot deployment, channel and workspace connection remain available for the next acceptance pass.