Data-plane posture + liveness — Slice B (amicissimo#392)

[aarontrowbridge]

What

Implements Slice B of the local-shell data plane sub-spec (spec-20260905-193000-local-shell-data-plane, rev 2) on top of Slice A's transport (#846): the honesty layer — degradation, write outcomes, liveness, rejoin — as contractual, testable behavior. Refs harmoniqs/amicissimo#392 (parent #380).

The four decisions, as shipped

• D6 — degraded entry is a named rule, and a steady state. fleet_posture.ts: a synchronous outcome-stream detector (it observes outcomes; it cannot wedge). Entry: p95 latency over the measurement window ≥ threshold → degraded (hub-up-but-slow, still routing to the hub); N consecutive no-responses (client-enforced timeouts enforced in hub_proxy.ts / the write pipeline) → standalone (hub-down: base posture + a surfaced pointer, effective mode falls back to the local engine). Hysteresis on every exit — flapping must not flap the posture. The hub-down posture means reads/writes route LOCALLY, so a session created in a hub-down window is a LOCAL session (D3's own case). Recovery re-enters fleet through the always-mounted merged projection (the recovery probe) and bumps the refetch epoch — D2's refetch-before-first-render, keyed per transition.
• D3 — the write-failure contract. fleet_writes.ts: every non-GET data-plane request resolves to delivered | failed | ambiguous-and-surfaced — never silently ambiguous. An ambiguous write retries boundedly carrying the SAME client-generated x-amicode-request-id, then resolves by re-fetching the affected thread (evidence attached). Failed outcomes echo the payload (the compose path never eats input) and record the local store's role explicitly (fleet sessions are never shadowed locally).
• D5 — the revocation handoff. A 401 on a fleet write is the read-only-with-pointer outcome: honest eviction notice + Go-Standalone, posture not degraded (revocation is honest unreachability, not degradation).
• D7 — the tunnel stamps its own config. fleet_tunnel.ts: stamped-alias inspection (the literal FLEET_SSH_ALIAS placeholder is a named unstamped state — the rejoin regression can never ship), the generation marker, and x-amicode-tunnel-generation stamped on every proxied response (SSE included), read per response — a rejoin is visible mid-session. SSE rides the proxy pipe unbuffered; a dead stream ends honestly (the client's frames-are-truth machinery reconnects + refetches).

Mid-session parity: /amicode/fleet/status carries the LIVE posture snapshot (state, pointer, transitions, refetch epoch, hub build parity with the previous version named) and the tunnel stamp — posture changes are visible through the same contract, not just at boot.

Verification

• TDD: 39 new tests in test/amicode_service_fleet_posture.test.ts (RED first — quote: Failed to load url ../src/amicode_service/fleet_posture), all green: Test Files 2 passed (2) · Tests 64 passed (64) (new file + Slice A's 25).
• pnpm run typecheck clean.
• Extension-suite clean-main baseline comparison: main = 5 pre-existing failures (terminal.test ×2 env-flaky, editable_diffs_wiring ×2, cli_gate ×1 env-dependent); this branch = the same set, zero new. (Note: clean main's pnpm -r stops earlier at packages/amico-run agent_spawn.test.ts ×1 — also pre-existing/env-dependent, untouched here.)
• The H6 legs are in the suite: hub-kill (ambiguity observed → posture flip → recovery refetch), hub-hang (client-enforced timeouts drive hub-down, never a welded degraded), hub-rejoin (generation stamp on proxied + SSE responses, restamped mid-session), plus the WAN-degradation sim (latency drives degraded entry/exit with hysteresis).

Out of scope (per the sub-spec's sequencing)

The native merged view (#393 / Slice C), production activation wiring (the fleet option's hub getter), the offline/mirror story.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}